BYOD inter client communication

[plexer]

If you are running a vlan'ed byod guest network do you allow client to client communication?

 

Ben

Edited May 7, 2014 by plexer

[Boredguy]

Depends how you configure it.

Our current BYoD has client separation enabled and I've not decided if I will keep that when we get a new WiFi installed over the summer (hopefully)

[plexer]

Depends how you configure it.

Our current BYoD has client separation enabled and I've not decided if I will keep that when we get a new WiFi installed over the summer (hopefully)

 

Ok thanks I've rephrased my question as I know that it's possible to restrict inter client communication what I wanted to know is if people do actually configure it that way.

 

Thanks

 

Ben

[roadhouse1387]

Hi Ben,

 

its hobsons choice really and all down to acceptable risk, but there is some mileage in preventing users connecting with uncontrolled devices from being able to see each other on wireless networks. The main reason is that you have no knowledge of what malicious tool sets may be on those devices and so you would want to prevent folk from targeting others on your network. on the whole though, securing BYOD and Public networks from private or corporate ones can really only be done properly by using layer 3 separation technologies such as VRF. Relying on VLANs alone isn't all that secure.

 

Cheers

Shaun

[Eric]

... securing BYOD and Public networks from private or corporate ones can really only be done properly by using layer 3 separation technologies such as VRF. Relying on VLANs alone isn't all that secure.

 

Hi Shaun,

 

That's an interesting idea. Please can you describe the insecurities when using VLANs to separate network security groups? I think I know what I'm doing here, and I'm not sure what you believe the risks are ...

 

BTW, a long time ago it was possible to get packets to skip between VLANs, but those bugs were fixed.

 

Andrew

[SYNACK]

No we don't allow the DLNA advertisement of little Johnny's extra-curricular human biology homework to all the other devices on the subnet.

 

 

VLAN hopping should not be a concern unless you have trunked interfaces offered out in the wild where tagged frames will actually be accepted. A guest VLAN should be native for the whole segment after it hits the WAP/Controller - depending on the system used.

Edited May 26, 2014 by SYNACK

[FN-GM]

We do not allow the clients to communicate with each other. There is no need. If we had it on the kids would only use it to share resources using something like bonjour (there they can share music on itunes) or air drop etc.