Network Engineering Stack Exchange is a question and answer site for network engineers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Cisco WLC and we want an open SSID for guests. We have a sign in form so they see our terms but this isn't a real liability protection. How can we block illegal activities on the open wireless connection via WLC or other technologies?

I was thinking squid + WCCP on our ASA but I'm not sure this is the best method for liability protection of the company. Are there other options that would supersede this? If this is the best option is there a best practice? Do companies normally rotate a guest account instead with 802.1x?

We have Cisco firewalls, switches and wireless infrastructure.

EDIT: specifically we would like to block torrents, site categories (guns, gambling, terrorism, etc) and VPN/proxies which would circumvent our limits.

share|improve this question
This is a legal issue rather than a technical issue. you first need to decide what you will allow your guests to do and what you won't. Then you can apply the appropriate controls. But get the legal/business decisions down first. – Ron Trunk Jul 5 '14 at 1:56
This is a question on how to implement the limitations not on what they should be. – some_guy_long_gone Jul 5 '14 at 1:58
So what actions do you want to limit? – Ron Trunk Jul 5 '14 at 2:02
Question updated with block specifics. – some_guy_long_gone Jul 5 '14 at 2:09
up vote 4 down vote accepted

From a security perspective I've found the WLCs pretty bare on their own. You can do basic ACLs but not much more. I don't think you're going to find an answer on those alone.

You can use an external web filter in association with the ASA -

It requires either Websense or N2H2 (now McAfee SmartFilter, I guess?), but if you happen to already have either of those products it makes doing category blocking really simple.

Home brewing a solution based on Squid or some other caching/protection software could work, but if you're talking about legal liability you've got to be awfully certain of that solution's capabilities for Legal to sign off on it.

Outside of these options you could look at something like a Palo Alto firewall that will wrap your application and URL blocking into a single package that you can just put between the wireless clients and the internet.

share|improve this answer
We're going with turnkey over a custom solution with squid. Namely ASA CX WSE. Thanks for the info! – some_guy_long_gone Jul 16 '14 at 0:47

Have the open guest network separated from the corporate network by having different vlans or DSL line for guest network. Have user role based firewall policies on the Cisco WLC allowing only http/https access. You should be able to block proxy server access as well. There should also be an option to revoke websites. Contacting Cisco TAC would be a very helpful in this case.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.