BYOD - Ruckus, Lightspeed (schoolsbroadband) Are vlans needed? If so how?

[tj2419]

Hi

 

Right i am setting up a BYOD network for us and now have it working (in a test environment) whereby users link to 'byod-provisioning' SSID they get redirected to our ruckus authentication page.

 

They log in with their AD credentials and then get forwarded onto either 'BYOD-Staff' or 'BYOD-Student' depending on their AD role. (Staff or student).

 

All works well. They are given an IP address in the same range as all our curriculum machines.

 

We currently have no vlans.

 

What i want to know is:

• Is it imperative to VLAN the BYOD traffic off to be secure?
  
• Is there a way using the Zone Director 3000 or our lightspeed filter to assign different IP addresses? Basically have all the BYOD traffic on a different range.
  

 

We use HP switches if that makes any difference.

 

Basically a complete novice when it comes to switch configuration so any advice would be greatly appreciated.

 

Thanks

[rrrrr]

I have just recently done this with ruckus myself.

Vlans dont make it secure on their own, you need to apply acls to the vlan to secure them.

 

Splitting your network up into different vlans makes your network more efficient by reducing network noise. Also it helps contain any packet storms created by loops and makes the network better to manage.

 

Acls are then applied to the vlans to control inter vlan traffic.

 

It is important to isolate your byod users as you have limited control over what state their device is in (could be virus ridden) and the intent of the user.

 

Just a point. I originally setup acls on my ruckus controllers ssids but for some unknown reason android and ios could not get an ip address when applied. Even if i applied an empty, total allow acl.

I then moved the acl to the core switch and all was resolved

[synaesthesia]

As above, this shouldn't be too difficult. Our guest and standard wifi ssid's are on separate VLANS and IP ranges which makes for easy filtering with Lightspeed. Handily, @SchoolsBroadband know what they're doing with that sort of setup and didn't bat an eyelid at it.

[tj2419]

As above, this shouldn't be too difficult. Our guest and standard wifi ssid's are on separate VLANS and IP ranges which makes for easy filtering with Lightspeed. Handily, @SchoolsBroadband know what they're doing with that sort of setup and didn't bat an eyelid at it.

 

Did schools broadband help in the setup in any way? Thanks

[IrritableTech]

Did schools broadband help in the setup in any way? Thanks

 

They'll help set it up at their end - creating new scopes if required and setting global filtering on your BYOD devices. They may have a suggestion or two on how to setup your internal network, but it wouldn't be right for them to be doing that bit.

 

The only issue (which I believe is still the case @SchoolsBroadband - David?) is that you can't get your Radius server talking to the lightspeed radius. Which means you need to somehow internally log which IP gets assigned to which device for monitoring purposes. Not difficult to do, but does add a few extra steps if you need to investigate.

[tj2419]

Ok, as for ACL's what type of things do you need to add in there? IP's of servers etc?

 

Thanks

[SchoolsBroadband]

We so support radius to am extent I think.

 

I'll get one of my engineers to reply shortly.

 

Thanks for the mention

 

Dave

[DanJackson]

Hi All,

 

All the Lightspeed does is accept accounting information from your radius server.

 

You just need the PSK from our Support and get them to ensure that radius ports are allowed outbound through your firewall/vdom.

 

The accounting packet sent from your Radius server will contain info like User, IP, Location in the domain etc depending on how your radius server is set up.

 

The Lightspeed can then process that information and filter that user according to the current rules in place.

 

As for internal network setup and access control lists. Up to you. :-) We leave the DHCP to you, but if you need a new VLAN and create a new subnet internally, we will need to assign the address block to you as all customer TIERs must have unique address blocks.

 

Dan

[IrritableTech]

Thanks for the update @SchoolsBroadband / @DanJackson - I'll add this to my list and get around to calling and configuring soon.

[tj2419]

What things do you need to block with ACL's? Can anyone give me some examples?

 

Thanks

[tj2419]

As above, this shouldn't be too difficult. Our guest and standard wifi ssid's are on separate VLANS and IP ranges which makes for easy filtering with Lightspeed. Handily, @SchoolsBroadband know what they're doing with that sort of setup and didn't bat an eyelid at it.

 

Did you just set up new ranges in your DHCP. Let SB know. How do you get a particular range to only be used on one vlan?

 

Cheers

[tj2419]

Hi

Right after speaking to schoolsbroadband they have advised me to use some of our current IP range.

 

Anyone have any tips how i can exclude a part of our range from being distributed to our school devices but have it distribute to our BYOD devices? I can see how to add the exclusion in but how would i get it to allocate to our BYOD devices?

 

Thanks

[SchoolsBroadband]

Have you thought about putting in a separate wireless network / vlan for your BYOD devices?

[timbo343]

+ 1 for sticking BYOD devices on a VLAN, keep the traffic away from your main network.

[Julian]

I agree about a separate vlan, for devices over which you have no control.

[IrritableTech]

@tj2419 What switch gear have you got? VLANs aren't too difficult as long as you've got the equipment to handle them. Each switch where APs connect will need to support vlan tagging, but you might get away with not having smart switches on the majority of your kit.

 

There's loads of threads on setting up VLANs with Ruckus, and DHCP. Have a search then ask some more questions specific to your environment, I'm sure one of us will help.

[pantscat]

What things do you need to block with ACL's? Can anyone give me some examples?

 

Thanks

 

Sure - so you can use ACLs to tell your network what type of traffic is allowed to go where. So, for example, you could:

 

- Block all traffic apart from ports 80 and 443 from your BYOD devices

- Block any traffic from the BYOD VLAN from hitting anything other than their default gateway (so that they'll have no access to anything else internally) (note that you'll probably want exceptions for internal DHCP and DNS)

 

That sort of thing. I think I read that you've got an HP procurve network, so setting up ACLs and VLANs is fairly straight-forward once you get your head around it.