Port security on a trunk port

interface FastEthernet0/1

 switchport trunk native vlan 20

 switchport mode trunk

 switchport port-security maximum 2

 switchport port-security

 switchport port-security violation restrict

 switchport port-security mac-address sticky

 switchport port-security maximum 1 vlan 20,30

VRF-Lite guest VLAN for Wireless

ip vrf GUEST_WIFI

 description Guest vlan

interface Vlan66

 description Guest WiFi

 ip vrf forwarding GUEST_WIFI

 ip address 10.10.10.250 255.255.255.0

 ip nat inside

 ip virtual-reassembly

ip access-list extended nonat0_GUEST_WIFI

 deny   ip 10.10.10.0 0.0.0.255 10.10.10.0 0.0.0.255

 permit ip 10.10.10.0 0.0.0.255 any

ip nat inside source list nonat0_GUEST_WIFI interface FastEthernet1 vrf GUEST_WIFI overload

ip route vrf GUEST_WIFI 0.0.0.0 0.0.0.0 FastEthernet1 192.168.0.1 global

ip dhcp pool GUEST_WIFI

   vrf GUEST_WIFI

   network 10.10.10.0 255.255.255.0

   default-router 10.10.10.250 

   dns-server 8.8.8.8  

   domain-name guest

   lease 2

OSPF redistribute static routers

access-list 10 permit 10.10.10.10

access-list 10 permit 10.10.20.0 0.0.0.255

route-map STATIC-OSPF permit 10

 match ip address 10

router ospf 100

 redistribute static metric 100 subnets route-map STATIC-OSPF

delay for wireless client for deploy GPO MSI software

Add this key for boot delay 60 sec for wireless client for deploy GPO and install MSI software.

Usualy 60 sec is enough but you can increase it if need. I use GPO for set this key. 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"GpNetworkStartTimeoutPolicyValue"=dword:0000003c