5

We have a Cisco WLC and we want an open SSID for guests. We have a sign in form so they see our terms but this isn't a real liability protection. How can we block illegal activities on the open wireless connection via WLC or other technologies?

I was thinking squid + WCCP on our ASA but I'm not sure this is the best method for liability protection of the company. Are there other options that would supersede this? If this is the best option is there a best practice? Do companies normally rotate a guest account instead with 802.1x?

We have Cisco firewalls, switches and wireless infrastructure.

EDIT: specifically we would like to block torrents, site categories (guns, gambling, terrorism, etc) and VPN/proxies which would circumvent our limits.

Improve this question
4
  • This is a legal issue rather than a technical issue. you first need to decide what you will allow your guests to do and what you won't. Then you can apply the appropriate controls. But get the legal/business decisions down first.
    – Ron Trunk
    Commented Jul 5, 2014 at 1:56
  • 1
    This is a question on how to implement the limitations not on what they should be.
    – some_guy_long_gone
    Commented Jul 5, 2014 at 1:58
  • So what actions do you want to limit?
    – Ron Trunk
    Commented Jul 5, 2014 at 2:02
  • Question updated with block specifics.
    – some_guy_long_gone
    Commented Jul 5, 2014 at 2:09

2 Answers 2

Reset to default
5

From a security perspective I've found the WLCs pretty bare on their own. You can do basic ACLs but not much more. I don't think you're going to find an answer on those alone.

You can use an external web filter in association with the ASA - http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/97277-pix-asa-url-filtering.html

It requires either Websense or N2H2 (now McAfee SmartFilter, I guess?), but if you happen to already have either of those products it makes doing category blocking really simple.

Home brewing a solution based on Squid or some other caching/protection software could work, but if you're talking about legal liability you've got to be awfully certain of that solution's capabilities for Legal to sign off on it.

Outside of these options you could look at something like a Palo Alto firewall that will wrap your application and URL blocking into a single package that you can just put between the wireless clients and the internet.

Improve this answer
1
  • We're going with turnkey over a custom solution with squid. Namely ASA CX WSE. Thanks for the info!
    – some_guy_long_gone
    Commented Jul 16, 2014 at 0:47
0

Have the open guest network separated from the corporate network by having different vlans or DSL line for guest network. Have user role based firewall policies on the Cisco WLC allowing only http/https access. You should be able to block proxy server access as well. There should also be an option to revoke websites. Contacting Cisco TAC would be a very helpful in this case.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.