Prevent users accessing an IP address

[Chuckster]

How do you prevent users from accessing your switches, UTM et al?

 

If they type the IP address in to the browser I want them redirected to, say, the school homepage or something.

 

Is there a way of achieving this?

[Geoff]

For switches we have an out of band (where possible) Management VLAN. This means the switches aren't addressable on the 'production' VLAN(s). It also means you can mess up a remote switch config and still access it.

 

We also segmented our network. So we have 'workstation' VLANs and 'Servers' VLANs. There is a firewall (pfSense VM) sitting between these VLANs that only allows the traffic through we deem acceptable.

[Chuckster]

I have created VLANS that have been segmented to Workstation, Server, VoIP, CCTV, Printers etc

 

VLAN 5 is the management VLAN. It has our UTM, switches and our APs on that.

 

So not really sure how to now do the prevention.

[Geoff]

You can use ACLs if your switches support them. However my environment is complex so we used a firewall for performance and manageability reasons.

[ITGURU]

My switches allow you to add client management IPs into it. However I use RADIUS switch authentication using Microsoft NPS to use AD credentials to login, and only those part of a security group will allow login.

[ITGURU]

For switches we have an out of band (where possible) Management VLAN. This means the switches aren't addressable on the 'production' VLAN(s). It also means you can mess up a remote switch config and still access it.

 

We also segmented our network. So we have 'workstation' VLANs and 'Servers' VLANs. There is a firewall (pfSense VM) sitting between these VLANs that only allows the traffic through we deem acceptable.

 

Do your switches have a dedicated MGMT Port? Does your Management VLAN still go over the same uplink to the switch though so if you mess or lose the uplink to the switch you would be unable to access the MGMT vlan to access the switch?

[Geoff]

Do your switches have a dedicated MGMT Port? Does your Management VLAN still go over the same uplink to the switch though so if you mess or lose the uplink to the switch you would be unable to access the MGMT vlan to access the switch?

 

Dedicated Ethernet port which goes into the local network stack. Serial Port is also plugged into an Serial KVM with a port on the Management Net. Core network stack is a HA pair of switches with dual uplinks to each edge switch. Uplinks from site <-> site is via MPLS with a backup IP VPN link.

 

So yes, fully isolated and redundant connectivity. It's impossible to lock yourself out of a switch remotely.

[mavhc]

I have created VLANS that have been segmented to Workstation, Server, VoIP, CCTV, Printers etc

 

VLAN 5 is the management VLAN. It has our UTM, switches and our APs on that.

 

So not really sure how to now do the prevention.

 

 

So you have rules that allow/deny access from one vlan to another? Or are you just letting anyone access anything on any vlan?

 

You could put your IT Support machines in their own VLAN, with access to all others, while your workstation vlan only has access to the server and printer vlans

[ITGURU]

Dedicated Ethernet port which goes into the local network stack. Serial Port is also plugged into an Serial KVM with a port on the Management Net. Core network stack is a HA pair of switches with dual uplinks to each edge switch. Uplinks from site <-> site is via MPLS with a backup IP VPN link.

 

So yes, fully isolated and redundant connectivity. It's impossible to lock yourself out of a switch remotely.

 

So essentially you need double the number of uplink ports at the core to the edge switches? Are they over the same fibre cable run and then at the switch you have 2 ports connected, one for management and one for everything else? For the edge switches does the management port connect into the same switch on a port assigned to the management VLAN?

[Geoff]

We have double uplink ports anyway for speed and resilience. VLAN 1 is tagged over the main uplinks and untagged via the OOB port. The OOB port and the Serial KVM connect to a separate switch to the core.

[IanT]

Create an ACL on your layer 3 core

[Chuckster]

Anyone have examples of their ACLs?