Guest Wireless Security Rant

Started by deanwebb, April 13, 2015, 12:51:53 PM

Previous topic - Next topic
Print
Go Down Pages1 2
User actions

deanwebb

April 13, 2015, 12:51:53 PM
We don't want our guest network to be totally wide open, so we will implement some security. Guests will have to authenticate to get on.

So, I get to find the solution...

Having the authenticator on the internal network created a problem because we can't have use our internal DNS domain on the Internet.

So, I build an authenticating box in the DMZ and set it to be managed by an internal system... which proceeds to place it automatically into the internal DNS domain.

I could make it a standalone box, which solves that problem... but the IP address that I was told to put on it by one group is unacceptable to the group in charge of the external DNS. I need to change that IP. Which is fine, except for the fact that the license I just put on it IS BOUND TO THE IP ADDRESS.

:wall:

This won't just be starting over. This will be starting over in deep and profound ways.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

SimonV

#1
April 13, 2015, 02:13:12 PM
Doesn't your solution do DNS intercept? That way you could hand out public DNS servers but still redirect the first requests to your auth page

deanwebb

#2
April 13, 2015, 02:22:01 PM
It does do a DNS intercept, the trick is getting it to *be* in the right place for our network.

For security, we don't allow external DNS to resolve internal hosts and vice-versa. That makes this solution a non-slam-dunk.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

deanwebb

#3
April 14, 2015, 10:02:58 AM
Troubleshooting procedure:

1. Google
2. Click all over the GUI
3. Type in a lot of ? in the CLI
4. Have my manager yell at the vendor
:developers:
5. Vendor uses Google
6. Vendor shows me the goofy spot in the GUI where DNS and domain settings are managed... Under "Mail"...  :angry:


Now it works like a top.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

Nerm

#4
April 14, 2015, 11:57:54 AM
 :lol:

deanwebb

#5
April 14, 2015, 12:20:55 PM
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

dlots

#6
April 16, 2015, 02:55:34 PM
Can you make it a stand alone box, and NAT it to the IP address they want it to use, and use the IP address it has for the actual IP address?

deanwebb

#7
April 16, 2015, 05:25:44 PM
How's this... it was an interim situation, anyway, and the hardware that's SUPPOSED to go into the DMZ just arrived. Thankfully, I know who to ask about getting the right IP address...
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

wintermute000

#8
April 21, 2015, 06:49:05 AM
(puts on router guy hat)

run a separate DNS in your external zone - possibly even from a humble router as a dns forward proxy, then create host entries for your internal / RFC1918 destinations

e.g. use 1.1.1.1 for your authenticator, and have a router in your external zone do DNS for guest, this router has a static entry for 'authenticator.deanwebbs.com' = 1.1.1.1, WLC dishes out authenticator.deanwebb.com as the landing page


bonus points, use the same R&S infrastructure except with guest VRF


my VAR deploys this design quite often

deanwebb

#9
April 28, 2015, 10:50:44 AM
To save time and $$$, we're going to re-do policy to permit this one feature. Nothing like having accounting be the ultimate network architect team.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

icecream-guy

#10
April 28, 2015, 12:41:09 PM
Quote from: deanwebb on April 28, 2015, 10:50:44 AM
To save time and $$$, we're going to re-do policy to permit this one feature. Nothing like having accounting be the ultimate network architect team.


..and here I thought it was the lawyers that yielded the ultimate network architecture powers..
:professorcat:

My Moral Fibers have been cut.

deanwebb

#11
April 28, 2015, 01:30:11 PM
Them too. But respect the power of accounting! They took a hardware-only solution and turned it into a nearly VM-only solution, among other things.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

icecream-guy

#12
April 28, 2015, 02:35:58 PM
Quote from: deanwebb on April 28, 2015, 01:30:11 PM
Them too. But respect the power of accounting! They took a hardware-only solution and turned it into a nearly VM-only solution, among other things.

so they didn't have to buy hardware???  LOL.  virtualized it all.... what a cost savings...
:professorcat:

My Moral Fibers have been cut.

deanwebb

#13
April 28, 2015, 03:17:29 PM
HUGE cost savings. Time savings, too, since software has an expedited approval process relative to hardware.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

wintermute000

#14
April 29, 2015, 02:46:45 AM
Just make sure your VM guys spec their environment appropriately including storage performance/redundancy.
Print
Go Up Pages1 2
User actions