Question : Problem: Need to configure Guest Internet Access w/ Cisco Aironet 1130AG Access Point.

I installed a Cisco ASA 5505 on my network, the later installed and configured a Cisco Aironet 1130AG AP for wireless access to the network, works great.  Now my company would like to add guest internet access without exposing the network.  I know the 1130AG can be setup for a separate VLAN, but it only has the one interface.  I assume that subinterfaces need to be setup so I can have to separate VLANs one for Guest and one for employees.  How do I configure subinterfaces on the 1130AG?  Won't it also require that the switchport on the ASA that it is connected to be a Trunk port to accommodate both VLANs?  Is this possible?  Will I need to setup an access list on the ASA to funnel the Guest traffic to the Internet w/o accessing the other info?  I need some serious answers, because I am really lost.

Answer : Problem: Need to configure Guest Internet Access w/ Cisco Aironet 1130AG Access Point.

The safest way to do this would be to set up a VPN group on the ASA, put the Aironet in a DMZ and have actual users VPN into the ASA which would put them on the network while making it nice and safe from hackers in their cars outside.