topic Re: Guest access control in Wireless

Guest access control

tiago.molinos — Sat, 03 Jul 2021 23:14:30 GMT

Hy there,

I've set up a gest SSID using WLC 4400. Everything works as expected, but my costumer requested to block access to this SSID to corporate laptops.

I guess it could only be done by MAC Address filtering, but this is not a very good solution because:

- WLC works with a permit MAC policy (can one create a deny MAC policy so I can list and deny all the corporate MACs under the Guest SSID?);

- If I apply a MAC list to the Guest SSID the only the allowed MAC will be able to see the Web Authentication page (that has been set up with instructions to call our Service Desk for the creation of a valid account).

Are there any other solutions? I also thought that maybe if there is an Active Directory rule to block an SSID, but I haven't checked it out yet. I guess this should only work if every corporate computer uses the Windows Wireless Services but I'm not sure.

Any other ideas?

Regards,

Tiago Molinos

Re: Guest access control

Scott Fella — Fri, 01 Aug 2008 12:08:31 GMT

How are your guest accessing the guest network? Is it just open and that is why internal users can just add the ssid and hop on the guest network? You can always use GPO to define the wireless profiles on a domain computer.

Re: Guest access control

tiago.molinos — Fri, 01 Aug 2008 12:38:17 GMT

Hy!

Guests access the network via Web authentication. In my point of view with use of time limited guest accounts its fairly secured, but the costumer just asked for this feature.

I'll try to propose AD Group Policies to them.

Thanks,

Tiago Molinos

Re: Guest access control

Scott Fella — Fri, 01 Aug 2008 12:49:55 GMT

You don't want to create guest users on AD. Keep the accounst on the WLC. What you can do is create dummy radius servers and add that to the wlan ssid list. The WLC checks the local db then the radius servers and that is why internal users can use their ad credentials to access the guest. So you will need to add 3 dummy radius servers and add all three to the radius list on the wlan. It is a workaround, but that is they only way so far you can limit the webauth to guest users.

Re: Guest access control

olivier.nicolas — Mon, 04 Aug 2008 20:11:25 GMT

It's possible to deploy a GPO to deny access to some SSID

http://technet.microsoft.com/en-us/magazine/cc162468.aspx

With a deny list, you can specify by name the set of wireless networks to which the wireless client is not allowed to connect.

Re: Guest access control

tiago.molinos — Tue, 05 Aug 2008 07:43:09 GMT

Hi!

I think this good solution will only work with Windows Vista clients right? If so it's not a good one for me as almost 90% of clients are XP based...

Regards,

Tiago Molinos

Re: Guest access control

olivier.nicolas — Tue, 05 Aug 2008 07:54:48 GMT

The policy can be applied to XP clients but the AD must be running on Windows 2003

Re: Guest access control

tiago.molinos — Tue, 05 Aug 2008 08:14:53 GMT

That's great news! Do you have a link for a guide on how to get this to work?

Re: Guest access control

tiago.molinos — Wed, 17 Sep 2008 09:17:08 GMT

I've been looking everywhere to find a way to make this work in Windows XP, but I can't seem to find anything. Anyway the customer still has lots of wireless clients using Win2K... So this is not the solution... Any sugestions? I've read something in respect to NAC and a client for improving security that as to be installed in every laptop that could work... Any experience with this type of solution?

Re: Guest access control

grzegorz.ciolek — Wed, 17 Sep 2008 12:51:18 GMT

Maybe try CSA:

http://www.cisco.com/application/pdf/en/us/guest/netsol/ns386/c649/ccmigration_09186a00808753b3.pdf

You can define plenty rules

Cheers

Greg