Guest Wi-Fi - What do I need to know...?

[mavhc]

So, this could work in the most simple terms (because I haven't finished my coffee yet) on a managed system with old Cisco Switches and WLCs (already with VLANs), by asking them to set up what exactly?

 

Divide up an already existing VLAN on the switches (say VoIP as we don't use that), get the WLC to broadcast the guest SSID, have DHCP on the switches give out a set of IPs (possibly utilise an ACL) and pass data to directly to the router (making sure it can't speak to the rest of the network)?

 

the trouble I'm going to have is that the switches are managed (but really only on a break-fix support contract) and everything else is chargeable. So no way to mess about if I need to change the ACL or the SSID password every month...

 

Don't even need VLANS as the WLC does the ACL, so only packets destined for the gateway are allowed.

 

 

 

Why are you paying for useless management of your network? They're getting money for doing nothing, and more money for doing exactly what you tell them to do, and apparently can't do simple things like add a guest wifi.

 

What's your filtering system?

 

On WLC create an ACL. Permit DNS udp to your DNS server. Permit HTTP to your wpad server if you have one. Permit access to the gateway/router on whichever ports you want, all, or only http(s).

 

Create an ssid, under advanced specify the dhcp server as the WLC and set up a dhcp scope.

 

Set dhcp assignment to required. Set Override ACL to guyes ACL, set p2p blocking to drop.

 

Then login to guest wifi and test, if it fails turn off ACL, check it work, edit ACL and enable again.

[Koldov]

Thanks, getting there slowly (TGIF)!

 

Then on your access points you tell them to authenticate against your NPS/radius server.

 

So, this part is confusing me though...

 

Is this configured on the WLC?

 

We don't have anyway to do this that I know of (pretty sure that would be chargeable configuration change from our 3rd party support)!

[PyROm]

 

Is this configured on the WLC?

 

We don't have anyway to do this that I know of (pretty sure that would be chargeable configuration change from our 3rd party support)!

 

Yep, on the WLC controller, where you would normally specify a Pre-Shared key (password), you will have the option to use radius instead and a box to put in a shared password (to secure(ish) the comms between wlc and radius) and the ip address of your radius server.

[Koldov]

Why are you paying for useless management of your network? They're getting money for doing nothing, and more money for doing exactly what you tell them to do, and apparently can't do simple things like add a guest wifi.

 

We are not paying for a full 'support' package as such, more of a break/fix (so insurance basically) and any configuration changes are a chargeable 'scope of works'.

 

I haven't actually asked them to do anything yet, just came on here for a bit of friendly advice on what I need to ask them to do and anything I should look out for, based on our current system. I just needed the simplest/easiest way to do it safely and keep the Head happy and me in a job (not make things really complicated and start reconfiguring the whole network and server functions), just to let the Govenors and visiting LEA staff access the internet, but it's turned into a bit of a monster...

 

What's your filtering system?

 

All of our filtering/firewall is done offsite by LgFL.

[Koldov]

Yep, on the WLC controller, where you would normally specify a Pre-Shared key (password), you will have the option to use radius instead and a box to put in a shared password (to secure(ish) the comms between wlc and radius) and the ip address of your radius server.

 

I see... so... 'just install RADIUS' eh...?

[mavhc]

We are not paying for a full 'support' package as such, more of a break/fix (so insurance basically) and any configuration changes are a chargeable 'scope of works'.

 

I haven't actually asked them to do anything yet, just came on here for a bit of friendly advice on what I need to ask them to do and anything I should look out for, based on our current system. I just needed the simplest/easiest way to do it safely and keep the Head happy and me in a job (not make things really complicated and start reconfiguring the whole network and server functions), just to let the Govenors and visiting LEA staff access the internet, but it's turned into a bit of a monster...

 

 

 

All of our filtering/firewall is done offsite by LgFL.

 

Do you require a proxy? mitm CA cert? Does it filter per person?

[Davit2005]

I just needed the simplest/easiest way to do it safely and keep the Head happy and me in a job (not make things really complicated and start reconfiguring the whole network and server functions), just to let the Govenors and visiting LEA staff access the internet, but it's turned into a bit of a monster....

 

You still need to keep it isolated, protect your internal network, the users/data inside of it and put restrictions in place so students cannot use it to circumvent your networks filtering unless you are going to filter/intercept guest traffic as well. I don't think there should be any question about resistance to rushing through a system that exposes the risks for the ability of the odd guest or governor to access WiFi no matter how much the push.

Edited October 23, 2020 by Davit2005

[Primus]

You still need to keep it isolated, protect your internal network, the users/data inside of it and put restrictions in place so students cannot use it to circumvent your networks filtering unless you are going to filter/intercept guest traffic as well. I don't think there should be any question about resistance to rushing through a system that exposes the risks for the ability of the odd guest or governor to access WiFi no matter how much the push.

 

Yes it needs to be on a separate vLAN so that you can keep your trusted network safe and secure.

 

Best practice is to filter and SSL decrypt all guest traffic and log it against particular users in case of any issues.

[Koldov]

Do you require a proxy? mitm CA cert? Does it filter per person?

 

No proxies, no certs and filters by IP of device within a range (depending on VLAN).

[mavhc]

No proxies, no certs and filters by IP of device within a range (depending on VLAN).

 

My ACL method will work great then, assign a new set of IPs using the DHCP server in the WLC, shouldn't need to alter the switches at all

[FN-GM]

The other option might be better.

 

The Access Control List isn’t too big of a deal. For this purpose it will be quite small and simple.

 

I will post up an example for people to look at tomorrow.

 

 

As promised this is a basic ACL to permit internet access only. This works providing your internal devices are on the private IP range. Lines 10 & 20 are for DHCP. You can add your own DHCP server in here. I used public DNS servers so I haven't added my internal DNS here.

 

ip access-list extended INTERNET-ONLY
10 permit udp any host 10.115.0.1 eq bootpc
20 permit udp any host 10.115.0.2 eq bootpc
150 deny   ip any 10.0.0.0 0.255.255.255
160 deny   ip any 172.16.0.0 0.15.255.255
170 deny   ip any 192.168.0.0 0.0.255.255
180 permit ip any any

 

 

You need to apply this ACL to the VLAN interface. This example the ACL is applied to VLAN 521.

 

interface Vlan521
ip access-group INTERNET-ONLY in

[FN-GM]

Best practice is to filter and SSL decrypt all guest traffic and log it against particular users in case of any issues.

 

It isn't required though. I never did this as it isn't worth the hassle.

[Primus]

It isn't required though. I never did this as it isn't worth the hassle.

 

To effectively filter and report in 2020 you need to both filter and SSL intercept, the majority of the web is now HTTPS.

 

Not following best practice because it's a "hassle" is why IT gets such a bad reputation.

[elsiegee40]

 

This thread is drifted way off the original topic

 

 

 

Posts have been removed

Edited October 24, 2020 by elsiegee40

[FN-GM]

To effectively filter and report in 2020 you need to both filter and SSL intercept, the majority of the web is now HTTPS.

 

Not following best practice because it's a "hassle" is why IT gets such a bad reputation.

 

But monitoring guest traffic is not a requirement. Staff and students yes. Guest no.

[Davit2005]

In the past (about 5 years ago) I dumped a cert on a web server the users could get to and then put a link on a captive portal page to the cert. A bit of a faff but It seemed to work OK, worked better on iOS devices as in easier as it just installed the cert. Edited October 28, 2020 by Davit2005

[mavhc]

Except now you have to go to another part of iOS settings to activate said cert. If they make it easy people will be tricked into hacking themselves, OS makers will always make it harder to install a CA cert than needed, because people will be tricked into hacking themselves otherwise.

[Zammo]

Except now you have to go to another part of iOS settings to activate said cert. If they make it easy people will be tricked into hacking themselves, OS makers will always make it harder to install a CA cert than needed, because people will be tricked into hacking themselves otherwise.

 

This.

 

The number of networks you join with SSL filtering is small compared the massive attack vector allowing easy certificate install would open up

 

It's annoying but I cant see it getting any easier

[Primus]

But monitoring guest traffic is not a requirement. Staff and students yes. Guest no.

 

Any adult on the premises is requires filtering, you cannot provide a school Internet connection to a guest and not filter it appropriately.

[Zammo]

Any adult on the premises is requires filtering, you cannot provide a school Internet connection to a guest and not filter it appropriately.

You don't need to provide SSL filtering on the guest network.

[FN-GM]

Any adult on the premises is requires filtering, you cannot provide a school Internet connection to a guest and not filter it appropriately.

 

I said monitoring not filtering. 2 Different things.

[robyholmes]

To add my thoughts to this which hopefully sit in the middle. We decrypt and inspect all staff, students and guest whether on school devices or school BYOD. However we have a lettings guest network with only basic filtering and monitoring

 

Our reason for this is we believe all school guests are invited in to our school environment. It's our duty to protect those students. A good percentage of our guests will work with students. So why shouldn't they be monitored the same as staff or the student themselves.

 

Lettings however are not in our school environment. They simply use our buildings and thus its up to them to protect there users. Even if that's with our own students.

 

Ultimately, it's down to each school to measure the risk and put in place what they see fit. Personally I don't want to be asked 'What did guest A do while onsite today' and not be able to answer. However it comes at a cost of management time and supporting guests in connecting (At which point they agree to being monitored)

Edited October 28, 2020 by robyholmes

[Primus]

I said monitoring not filtering. 2 Different things.

 

Filtering and monitoring go hand in hand, you have to do both for any adult on site.

[Koldov]

Filtering and monitoring go hand in hand, you have to do both for any adult on site.

 

My bold...

 

Is this in some legislation you can link me to please?

[Primus]

My bold...

 

Is this in some legislation you can link me to please?

 

The legislation is Keeping children safe in education.

 

It references the UK Safer Internet Centre's guidance.

 

It also references the "Prevent Duty" - aka Protecting children from radicalisation: the prevent duty.

 

It does leave some questions down to individual schools and their risk assessments and it does discuss "over blocking". But the requirement is clear, you are expected to filter and monitor your school Internet connection.