topic Re: Guest Vlan - Best Practise Implementation in Network Security

Guest Vlan - Best Practise Implementation

anthony.dyne — Mon, 11 Mar 2019 19:31:40 GMT

Hello

How to allow guest vlan traffic for http procotol only and limit bandwidth usage, looking for best practise implementation.Blocking peer-to-peer appliction too.

In short our ASA is placed as

Internet-rtr______ASA________3560_____LAN

On ASA we allow SMTP / HTTP / HTTPS from outside to inside

ACL is applied on ASA inside interface to have control on traffic, users on the LAN access internet through Microsoft ISA Server.

thanks

Anthony

Re: Guest Vlan - Best Practise Implementation

Kureli Sankar — Fri, 07 Jan 2011 15:10:59 GMT

1. Police that vlan traffic either on the inside switch or on the ASA.

QoS on ASA : https://supportforums.cisco.com/docs/DOC-1230

2. Use websense for content scanning/filtering or use the CSC module on the ASA for http scanning/URL filtering.

http://www.cisco.com/en/US/docs/security/csc/csc6.1.1569.0/administration/guide/csc4.html

-KS

Re: Guest Vlan - Best Practise Implementation

anthony.dyne — Fri, 07 Jan 2011 20:41:00 GMT

Thank You KS for your input.

Based on your experience do you advice to Police the traffic on the switch or on the ASA as both options are available.

Thanks

Anthony

Re: Guest Vlan - Best Practise Implementation

Kureli Sankar — Sat, 08 Jan 2011 13:20:35 GMT

I'd suggest to do it on the switch. This way you can control what comes into the inside interface of the firewall.

-KS