Help - Wireless key issue

[bodminman]

Hi there,

 

I am new at a school (1 week) that has an ad-hoc wireless setup using NetGear AP and WEP encryption.

 

Only the teachers laptops have access to the wireless system and we enter the WEP key's when the laptops are built/repaired.

 

However, the kids have got hold of the key (maybe before I started) and are basically going straight out onto the web etc etc.

 

So I now have to sort this out and fast.

 

The APs are setup individually with static IPs, and all share the same SSID and WEP key. However the strange thing is that the APs have the Gateway IP installed basically allowing non domain traffic straight out onto the web. What would be the scenario if I removed the gateway IP from the APs?

 

I was also thinking of setting up a Radius server to enable fast changing of keys etc.

 

I've only had a little experince of wireless so any help will be greatly appreciated.

 

Thanks

[llawwehttam]

Would It be possible to use mac address filtering on this system or would it be on too large a scale.

That would be my first option.

[bodminman]

Too large I think as we have approx 140 staff laptops.

[Edu-IT]

How about changing the key and making sure that staff don't share it? There are also managed systems you could considor which will offer additional security measures but obviously there are associated costs.

 

I'd probably suggest changing the key. It's a pain because with the systems you can only have one key and once it's out, you have to change it.

 

What would be the scenario if I removed the gateway IP from the APs?

Ours do. Do you have a proxy server of any sort? Could perhaps use some sort of authentication on that.

[bodminman]

Funny you should mention proxy server as I started setting one up on wednesday. I'm itching to get the school moving away from using the ever so unreliable RM Smartcache 2 box.

 

If I remove the Gateway IP am I correct in saying that the Gateway IP will just be delivered to the rogue workstations because of DHCP server!?!

[Edu-IT]

Funny you should mention proxy server as I started setting one up on wednesday. I'm itching to get the school moving away from using the ever so unreliable RM Smartcache 2 box.

 

If I remove the Gateway IP am I correct in saying that the Gateway IP will just be delivered to the rogue workstations because of DHCP server!?!

If you have the SM2 then can you not setup authentication and deny their access somehow?

[bodminman]

There isn't any authentication what so ever to get out to the internet which is the reason why I'm setting up an ISA server. If you have the WEP key then you're out on the web.

 

All the APs gateway setting point to the crappy netgear router/firewall and that's it! That's why I mentioned setting up radius or removing the Gateway IP from the APs.