Securing a New Wireless Setup!!!

[Athlona]

Hello

 

I have just purchased a HP ProCurve Access Point 10ag WW J9141A. I ran the setup fine its all working great, but I just want the Staff & Students to be able to use the Internet through the wireless setup. The problem is they can see the whole network even the servers!!! They still need to enter a user name and password to get in, but Is there any way to hide the network side of things from them all??? I have had a good look at all the setting within the Access Point couldn't see anything to do that job!!!

The laptops that are going to use the wireless connection are not part of the domain at all!!!

 

Any Ideas please???

 

Thanks

[FN-GM]

You would need to put the AP on its own V-lan.

 

You can do this with managed switches if you have them

[plexer]

Using a vlan possibly.

 

Ben

[spc-rocket]

Hello

 

I have just purchased a HP ProCurve Access Point 10ag WW J9141A. I ran the setup fine its all working great, but I just want the Staff & Students to be able to use the Internet through the wireless setup. The problem is they can see the whole network even the servers!!! They still need to enter a user name and password to get in, but Is there any way to hide the network side of things from them all??? I have had a good look at all the setting within the Access Point couldn't see anything to do that job!!!

The laptops that are going to use the wireless connection are not part of the domain at all!!!

 

Any Ideas please???

 

Thanks

 

Hi,

 

You should be able to do this using radius and as others have said placing this network into its own vlan.

 

If you access point supports vlan you can also have different ssids on different vlans to allow corporate access as well as guest access using the same APs.

 

Ash.

[Athlona]

I have a full HP ProCurve network and they are all managed switches:) Downloading the manuals for them now...

Never setup a VLAN before any TIPS:)

 

Thanks

[Athlona]

Been reading up on VLANs most of today still can't understand how I can hide the network doing this method!!! Please can someone kindly explain it to poor me???

 

Thanks

 

Paul

[FN-GM]

Been reading up on VLANs most of today still can't understand how I can hide the network doing this method!!! Please can someone kindly explain it to poor me???

 

Thanks

 

Paul

 

Well they would be two seperate networks so they wont be able to be able to see each other.

[yabbadabba]

You can use a vlan as already suggested.

 

Use a router and put the WAP on its own network.

 

Depending on the kit you have in house you could create a subnet and use this for the WAP and use a "router on a stick config".

 

WAPS often have options such as "see other devices", disable this and nothing using the WAP will be able to see anything else on the same network.

[Athlona]

I have successfully setup a 2nd VLAN on my HP ProCurve 5406zl, I can't get the port that I have tagged with VLAN2 to work on the internet at all!!! I have even just plugged in a laptop straight into that port and still no internet!!! I have checked all the correct proxy information has been entered into the laptop fine!!! Any Idea's please? As If I can't get the laptop thats into that vlan port a access point has no change!!! I think I am missing something here!!!

 

Thanks

[keithu]

You need to define an IP subnet on your new vlan and make sure there is a route defined for clients to access your proxy server and for the proxy to send replies back. Also, don't forget that while you're testing with a laptop its port will have to be an untagged access port.

[Domino]

If your vlan has no access to your normal lan, it won't be able to use your proxy.

[Athlona]

Domino thanks for this info as I also didn't think setting up a second vlan would work, but all the peps I have phoned have said it would!!! So what defines a proxy to vlan1 ONLY? Is there any way to set it up so vlans2 see the proxy?

 

All this stress has driven me to drink!!!

 

Thanks

[keithu]

If you post your config file from the 5406 (cut and paste from the web interface) and some details of your current network (proxy IP in particular) we could probably get it going.

[Domino]

what proxy are you using? do you have an ISA server?

 

Its possible to get it working, but we need details, just setting up the vlan isn't enough

[Athlona]

The`Local Authority`supply our schools broadband by the mean of a netpilot and a cachepilot for caching websites!!!If a PC or Laptop is on the Domain group policy has the redirect to the cachepilots IP address to that is forwarded to the netpilot... But these laptops are not part of any Domain they are all standalone units...

 

What other information have I missed out that you would like to know? Please ask away?

[Domino]

so what you'll need is a static route from the VLAN to the netpilots address. I'm not familiar with the particular hardware so can't really tell you exactly how to do it

[keithu]

Athlona - we're running HP Procurves here and I'm happy to help you out, but you'll have to give more information about your current setup. Switch config and IP addresses at least.

[Athlona]

Hi

 

HP ProCurve 5406:-

 

Netpilot:-

 

Hope this is enough:)?

[keithu]

That's good, but we also need the actual running config. If you click on the 'Diagnostics' tab on that first screen, then on the 'Configuration' button you should see it.

[Athlona]

Hi keithu

 

Please could you tell me which area of configuration you would like a screen grab off???

 

[keithu]

In that screenshot you're on the 'Configuration' tab (top of the screen). You need to click on the 'Diagnostics' tab, which is two tabs to the right. On the screen that comes up press the 'Configuration Report' button. The text which appears in the window is what we want, but it might be a bit long for a screenshot so you may have to copy and paste it.

 

It looks like this:

 

Running configuration:

 

; J4819A Configuration Editor; Created on release #E.10.02

 

hostname "Server Room - ProCurve 5308xl"

snmp-server location "A55"

max-vlans 40

connection-rate-filter sensitivity aggressive

mirror-port E14

module 1 type J4878B

module 4 type J4907A

module 2 type J4907A

module 3 type J4878B

module 5 type J4907A

module 7 type J4878B

blah, blah, blah.....

[Athlona]

Here it is:

 

Running configuration:

 

; J8697A Configuration Editor; Created on release #K.11.63

 

hostname "ProCurve Switch 5406zl"

snmp-server location "CORE Switch"

module 1 type J8702A

module 2 type J8702A

module 3 type J8705A

trunk C21-C22 Trk30 LACP

ip default-gateway 10.45.224.2

snmp-server community "public" Unrestricted

snmp-server host 10.45.224.231 "public"

vlan 1

name "DEFAULT_VLAN"

untagged A1-A24,B1-B24,C1-C20,C23-C24,Trk30

ip address 10.45.224.41 255.255.240.0

exit

vlan 50

name "VLAN50"

ip address 10.45.250.1 255.255.240.0

tagged A12

exit

spanning-tree Trk30 priority 4

password operator

[keithu]

That looks okay, but a couple of things jump out at me:

 

In VLAN50 you've defined the gateway address as 10.45.250.1 which is in the middle of the subnet. I would put it at 10.45.240.1 which is the first address. VLAN1 is similar too, but you may have your own reasons for that. It will still work as it is of course.

 

If you're testing with a laptop plugged into port A12 you'll probably want to set that port as untagged for now.

 

It looks like your main problem is defining a route between the laptop/access point and your proxy. On the laptop you need to make sure that its IP address is within the VLAN50 address range and its gateway address is 10.45.250.1 (or 10.45.240.1 if you change it). On the proxy you need to define a route to the VLAN50 subnet. Unfortunately I don't know anything about this proxy. Does it run on windows? Have you got admin access?

[Athlona]

Hi keithu many thanks for all your help, I have phoned our LA how are going to setup that static route to the proxy - vlan50...

 

Thanks Again:hand:

[keithu]

You're welcome

 

One thing you haven't mentioned is dhcp. If you want clients on vlan50 to use an existing dhcp server on vlan1 you'll have to define an 'ip helper'. To do that you log in to your switch and type the following at the command prompt:

 

config

vlan 50

ip helper-address

exit

wr mem

 

 

You'll then have to define a new dhcp scope for the vlan50 subnet on your existing dhcp server and add a static route from the dhcp server to vlan50.

Edited October 30, 2008 by keithu
more info