ACL approach for BYOD

[FragglePete]

Hi all,

 

Just re-thinking my ACL list on our Core Switch while upgrading our Wi-Fi network to Cambium.

 

I have two SSID's setup for BYOD (Staff and Students), one SSID for Guest and then another for School Owned devices. School Owned is Pre-Shared Key, whereas the BYOD are utilisiing 802.1x with RADIUS - this is working well.

 

Currently for all these 'untrusted' devices the DHCP server is giving out the DNS address of our ISP - not our internal ones. The ACLs currently block access to all other VLANs so relatively simple as they don't really need to touch anything on the main network.

 

Best approach? Or should I tweak the ACLs to allow DNS lookups from our local DNS Server(s) which makes the ACLs a bit more complicated.

 

Pete

[speakercon]

I'd leave it with external DNS, that's what I do.

 

Is there much to be gained with the devices using your DNS servers?

[Davit2005]

If you don't need to resolve any internal DNS queries then yes jus point to external DNS servers i.e. quad9 or Cloudflare.

[FragglePete]

Appreciate the responses.

 

Thought as much. The only small fly in the ointment is our IPCS App for telephones as some staff have the App on the phone so they can access their desktop on their mobile. Do have external (and internal) DNS setup for those, but firewall is blocked for the Port(s) going out - so might be easier to make a firewall change than mess about. Calls will go out and then back in, but is that so much an issue?

 

Again, appreciate the feedback.

 

Pete

[dmj]

There's some advantages to having access to internal DNS, other than for resolving internal services. For example it's a good idea to force safe-search on youtube to restrict.youtube.com I'm sure there's other examples where this is useful.

You don't need a fully fledged DNS server either, put a lightweight cache on the network with forwarding to your main DNS. DNSMasq, unbound etc would work for this.