topic Re: Guest Access Secure Enough? in Wireless

Guest Access Secure Enough?

toddgermana — Sat, 03 Jul 2021 23:31:28 GMT

Equipment: 2106 controller, 1131AG, WCS 5.1.151

Internal users: Connect to 192.168.x.x network as normal wired users would. Authenticate through a radius server connected to AD. WPA2 used. Vlan1

Guest Users: Connect to controller through web-auth, DHCP on controller, Vlan2

ACL Guest rules (In sequence):

1. Permit SourceIP 0.0.0.0 / 0.0.0.0 Destination IP 192.168.1.5/255.255.255.255 (firewall)

2. Deny SourceIP 0.0.0.0 / 0.0.0.0 Destination IP 192.168.0.0/255.255.0.0

3. Permit SourceIP 0.0.0.0 / 0.0.0.0 Destination IP 0.0.0.0 / 0.0.0.0

I understand that the suggested method for the guest Wlan is to be in the DMZ on a separate controller. As each location has its own firewall/internet connection I find this solution expensive, an administrative nightmare, and probably overkill. My question is: Is my guest access secure enough with web-auth, separate vlan, and the access control list?

Re: Guest Access Secure Enough?

Scott Fella — Wed, 24 Sep 2008 00:39:09 GMT

I personally don't like to use the ACL feature on the wlc. Why not create acl's on the L3 interface of vlan 2 to deny guest network to internal network. If you have a different internet connection for guest, you can use one of the available ports for the guest traffic. This is specifed in the interface you create for guest. If you have one internet connection, then create acl's on the l3 switch.

Re: Guest Access Secure Enough?

toddgermana — Wed, 24 Sep 2008 13:56:09 GMT

Why/What don't you like on WCS ACL? Is adding the ACL to the vlan as a secondary precaution create enough security (plus the web-auth)? Also, I don't have another internet connection.

Re: Guest Access Secure Enough?

Scott Fella — Wed, 24 Sep 2008 18:55:20 GMT

The reason why using like setting up acl's on the wlc is because it really doesn't work as well depending on your rules. ACL's are better managed on the L3 interface.

Re: Guest Access Secure Enough?

toddgermana — Thu, 25 Sep 2008 12:04:31 GMT

I had to double check with one of Cisco's engineers and he came up with the some solution. Thanks for your help!

Re: Guest Access Secure Enough?

steve.gordon — Wed, 26 Nov 2008 17:34:03 GMT

If you have a guest internet dmz in place, you can simply connect one of the physical distribution ports to the dmz, and have the guest wlan pointing to that interface.