Block Guest SSH to 1.1.1.1

[Eugen Serban]

Hello,


I just found out that when connecting to a guest network I can ssh to 1.1.1.1. If I have the username and password, I can log in and wreck havoc in the network.

Of course, an attacker will find the 1.1.1.1 address (or whatever) and try to exploit it: it's in the web portal or shown as the dhcp server when doing an ipconfig.

My idea was to create a CPU acl that blocks ssh and telnet to 1.1.1.1, but would this be enough? Will I break other stuff?

Any ideas are greatly appreciated.

Btw, is there a guide regarding hardening the guest network?

Regards,
Eugen

[Rasika Nayanajith]

I just found out that when connecting to a guest network I can ssh to 1.1.1.1. 

Did you able to log onto your WLC using this IP ?

Rasika

[Eugen Serban]

Hello,

Yes, when connected to the guest network, I am able to ping 1.1.1.1 and ssh to it. As I have the credentials for the WLC, I was able to log in.

[Andrew MacTaggart]

you should be using an RFC5737 address for your virtual interface.

[M. Wisely · Accepted solution]

Do you have 'Management Via Wireless' enabled? We don't and we cannot access the controller via the virtual address.

[Eugen Serban]

On the anchor, we do, yes. On the remote sites we don't.

This is indeed a proper solution. Thanks!

[Eugen Serban]

I applied the change and now it's behaving like it should :)

Thanks again!

Eugen