topic Re: Pen Test Results in Wireless

Pen Test Results

sonny.herriott — Thu, 24 Oct 2019 14:51:06 GMT

Hi All,

We had a pen test on our Meraki networks and they came back with a high risk point being that the login to the Access Point (MR series) are using http and that you can't login to them with an encrypted connection. So I need to know if we can make this an SSL connection or not. I understand what could be done to lower the risk by changing the default password which I believe to be a device serial number.

We just need someone professional to say yes or no this is not possible and then either act on the answer if yes or sign the point off if low as accepted risk.

Thanks

Re: Pen Test Results

Nolan H. — Thu, 24 Oct 2019 14:52:55 GMT

Assuming your talking about the local status page

Go to your general settings

You can edit the login credentials for the local status page

In addition, you can disable the local status page and that way nobody can access it.

Re: Pen Test Results

Nolan H. — Thu, 24 Oct 2019 14:54:12 GMT

Also, your access points should be on their own VLAN, not the same one your wireless clients are using. This would also help to isolate risks as well.

Re: Pen Test Results

ww^ — Thu, 24 Oct 2019 16:55:27 GMT

and what happens when someone logs in?

you can also remove the ap and connect to the cable...

Re: Pen Test Results

Philip D'Ath — Thu, 24 Oct 2019 21:03:48 GMT

I'm with @Nolan Herring , just disable the local status page and make the issue go away.

https://documentation.meraki.com/zGeneral_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page#Disabling_the_Local_Status_Page

Re: Pen Test Results

pjc — Fri, 25 Oct 2019 13:04:11 GMT

I find the local status page (my.meraki.com) a handy tool for clients to check what connected AP, signal strength and throughput ('run speed test') if experiencing any issues.

If you, like me, find it handy, just make the local admin password something impossibly long and complex, you do this in one place, in the dashboard, Network-Wide>General

Re: Pen Test Results

Brons2 — Fri, 25 Oct 2019 21:05:39 GMT

I disabled my local status pages. Because auditors.