New Wi-Fi install

purplemonkey · 09-28-2004

Hi all,

Sorry to be a complete Newb to this, but then we all got to start somewhere right? Ok onto the real brain teaser question.

We have a LAN-WAN setup at our offices, this LAN-WAN has worldwide reach. We have a VPN dial in solution for all remote workers.
I have been asked to setup a wireless install for external visitors, and internal visitors. At the moment, we provide LAN cables which people can use to access out LAN. Any external visitors have to report to IT to have their laptop scanned before using, although there is no control over this!

I'm thinking of setting up an ADSL connection with wireless access points around the meeting rooms. To make it easy to use I'm not going to use any security, no WEP keys, no MAC address registering etc.

I would like to know if people have done this before, what problems did you encounter? We are a central London office, and I'm a bit worried about people out side the building using this Wi-Fi lan for there own ends. I don't want to use WEP due to the overheads in setting every visitor up with the key etc..

All being well with this ADSL seperate LAN install, I would like to setup a Wi-Fi hotspot in this office on the main LAN, but tied down with security, the thought being this would be for people here who are not visiting but are mobile.

Look forward to your thoughts.
Tim.

Madhadder · 09-28-2004

The only way (Correct way) to do this is with some enterprise class gear
such as the Cisco Aironet family.

1. Setup Wifi on your switchs/routers in it's own VLAN, seperate from your
internal Office stuff.
2. Setup an Aironet accesspoint and turn on WEP/LEAP etc. on the AP
3. Buy some Aironet Client PCMCIA cards for the IT Dept to hand out.
4. Lock access to the net to ONLY those cards that are authroized.

This way all "Visitors" must go to the IT Dept. to get the lappy scanned
and the PCMCIA cards/client installed...

Thorn · 09-28-2004

Quote:

Originally Posted by purplemonkey

Hi all,

Sorry to be a complete Newb to this, but then we all got to start somewhere right? Ok onto the real brain teaser question.

We have a LAN-WAN setup at our offices, this LAN-WAN has worldwide reach. We have a VPN dial in solution for all remote workers.
I have been asked to setup a wireless install for external visitors, and internal visitors. At the moment, we provide LAN cables which people can use to access out LAN. Any external visitors have to report to IT to have their laptop scanned before using, although there is no control over this!

I'm thinking of setting up an ADSL connection with wireless access points around the meeting rooms. To make it easy to use I'm not going to use any security, no WEP keys, no MAC address registering etc.

I would like to know if people have done this before, what problems did you encounter? We are a central London office, and I'm a bit worried about people out side the building using this Wi-Fi lan for there own ends. I don't want to use WEP due to the overheads in setting every visitor up with the key etc..

All being well with this ADSL seperate LAN install, I would like to setup a Wi-Fi hotspot in this office on the main LAN, but tied down with security, the thought being this would be for people here who are not visiting but are mobile.

Look forward to your thoughts.
Tim.

Using a ASDL line for the visitor WLAN would be a very good idea. That keeps the system completely seperate, and there is no more chance of an attack to the main LAN than any other external attack. To prevent unauthorized people using it, you can do things such as a simple logon using a product like NoCat (nocat.net), and use correct AP placement and RF design to minimize the RF footprint outside the premises. Having some generic guest accounts on the authorization server would be easy, and could be changed as needed or on a rotating basis such as weekly, monthly, etc.

As far as the internal WLAN, you should NEVER place it on the same net as the LAN. It should be a separate network in and of itself. Mobile workers within the office should access the wired LAN via VPN as if they are external. The reason fo this is security. MAC filtering is trival to defeat (less than 1 minute) and WEP can de overcome with relative ease (depending on the WLAN's traffic levels). You should also consider using a product that will has a better encryption such as Funk Odyssey.

09-28-2004	#1 (permalink)
purplemonkey Registered Member Join Date: Sep 2004 Posts: 1	New Wi-Fi install Hi all, Sorry to be a complete Newb to this, but then we all got to start somewhere right? Ok onto the real brain teaser question. We have a LAN-WAN setup at our offices, this LAN-WAN has worldwide reach. We have a VPN dial in solution for all remote workers. I have been asked to setup a wireless install for external visitors, and internal visitors. At the moment, we provide LAN cables which people can use to access out LAN. Any external visitors have to report to IT to have their laptop scanned before using, although there is no control over this! I'm thinking of setting up an ADSL connection with wireless access points around the meeting rooms. To make it easy to use I'm not going to use any security, no WEP keys, no MAC address registering etc. I would like to know if people have done this before, what problems did you encounter? We are a central London office, and I'm a bit worried about people out side the building using this Wi-Fi lan for there own ends. I don't want to use WEP due to the overheads in setting every visitor up with the key etc.. All being well with this ADSL seperate LAN install, I would like to setup a Wi-Fi hotspot in this office on the main LAN, but tied down with security, the thought being this would be for people here who are not visiting but are mobile. Look forward to your thoughts. Tim.

09-28-2004	#2 (permalink)
Madhadder General "Noob Basher" Join Date: Apr 2002 Location: Munich, Germany Posts: 1,620	The only way (Correct way) to do this is with some enterprise class gear such as the Cisco Aironet family. 1. Setup Wifi on your switchs/routers in it's own VLAN, seperate from your internal Office stuff. 2. Setup an Aironet accesspoint and turn on WEP/LEAP etc. on the AP 3. Buy some Aironet Client PCMCIA cards for the IT Dept to hand out. 4. Lock access to the net to ONLY those cards that are authroized. This way all "Visitors" must go to the IT Dept. to get the lappy scanned and the PCMCIA cards/client installed... __________________ Legends may sleep, but they never die!!!!

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode