0

I manage a network meant for specific people, who in turn illegally share the Wifi SSID logins with friends (and so repeated changing of passwords isn't a good option).

How do I configure the border router to block all client IP addresses except static the IP's I choose to assign them?

To block 192.168.xxx.abd for example, I have tried:

ip access-list standard BLOCK 192.168.xxx.abd
  • You need security well beyond a simple ACL. – Ricky Beam Mar 5 at 17:45
  • How do I go about that? – Masssly Mar 5 at 17:47
  • 3
    Sounds like you need a few things. 1. Talk to your manager about reprimanding those employees for violation of the company policy and jeopardizing the network security by allowing outsiders to access the infrastructure. 2. Maybe set up 802.1x so you can have the users authenticate against LDAP or another form of central account management, so there isn't a shared PSK. – Jesse P. Mar 5 at 18:03
  • 3
    Home network? That's off-topic. Business network? Use RADIUS. – Zac67 Mar 5 at 18:08
  • Just noticed I had said "shared PSK". Oops. Obviously it's shared, since that's the S in PSK. – Jesse P. Mar 5 at 18:49
4

You need to set up 802.1X, that way you can guarantee that users are strongly authenticated before accessing the company Wifi. Use RADIUS or if it's a small network you can get by with the built-in authentication methods that are available in most enterprise grade Wifi-controllers. Also look into limiting access for the Wifi network only to resources that are necessary, not the whole company network.

  • Also, use a single ("static") address per user, so any duplicate logins will break existing connections. (your own connection failing is a good motivator to stop sharing) Set the wireless controller to only allow the assigned address per connection -- this is a bit harder to do. – Ricky Beam Mar 6 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.