7

If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the physical access point where both sets of wireless data propagate through?

5
  • If i understood your question..it depends, if you set a diferent network segment for each wireless network, users wont be able to comunicate with each other across those networks. Commented Dec 27, 2011 at 14:16
  • I presume you could DoS the router, which would affect the other network?
    – Ian
    Commented Dec 27, 2011 at 14:45
  • and when you say "communicate" do you mean it'd be physically impossible even if you spoofed parts of packet headers?
    – Ian
    Commented Dec 27, 2011 at 15:08
  • I'm curious, what AP are you using?
    – mikeazo
    Commented Dec 28, 2011 at 13:16
  • @Ian - we encourage questioners to accept the question they feel best answers their question (click on the tick next to the answer) - this encourages people to answer by providing them with reputation points, and you get a rep reward as well.
    – Rory Alsop
    Commented Jan 26, 2012 at 16:04

3 Answers 3

7

Quite a lot of "enterprise" type access points offer functionality to allow multiple SSIDs on a single AP, and it's a pretty common configuration from what I've seen.

From a logical perspective the networks should be isolated (using VLANs or similar type of segregation). You should also be able to specify different authentication mechanisms, encryption types etc.

If correctly configured and patched, this shouldn't pose a major risk, however it does increase the complexity of the environment which always poses security risk (ie, one logical misconfiguration can cause a serious issue)

In terms of the Denial of Service risk, wireless networks can effectively always be DoS'd if an attacker wants to as a powerful enough radio source can cause denial of service on the signal and things like Deauth floods are pretty hard to stop too, from what I've seen.

4
  • Hi, thanks for replying. My emphasis is that by giving a relatively unsecure network to visitors, could this compromise the secure network because they're both using the same physical AP? Or are you saying that someone wouldnt even need to be on either network to cause a DoS to the secure network?
    – Ian
    Commented Dec 27, 2011 at 17:01
  • If you route the "insecure" network straight out to the Internet (presuming you don't need to provide internal resources to visitors) then at an IP level it shouldn't interact with the "secure" network, so there should be no risk of compromise from that point of view (although see the point in my main answer about complexity). DoSing any wireless network can be done on the radio side, whether it's "secure" or "insecure" doesn't matter, as the attacker doesn't need to connect to it to carry out the attack Commented Dec 27, 2011 at 17:19
  • If you have to ask, you probably want to hire someone who really knows their stuff to setup your stuff. It's somewhat easy to muck up if you've never dealt with vLAN specific SSIDs and such before. But yes it's possible and common as Rory says.
    – Chris S
    Commented Dec 27, 2011 at 19:19
  • Thanks Chris, I will definitely get someone else to implement! Thanks Rory
    – Ian
    Commented Dec 27, 2011 at 20:37
2

Right! Your AP becomes a single point of failure and the key to the castle, if someone happens to get a privileged access to your public network by compromising your access point, your secured network isn't anymore!

1
  • Hi, could you just elaborate on "privileged access", do you mean a higher-type of access than a normal visitor would have on the visitor network?
    – Ian
    Commented Dec 27, 2011 at 17:02
0

As both Serge and Rory mentioned, it would require an exploit in the firmware of the Access Point, so if you can access the Access Point and configure it, your more secure network would be compromised. As for VLAN security, there is some best practices, Check this link on Cisco VLAN Best Practices

All in all, I would not recommend you to have two segmented wireless network, unless it is really needed I would skip the high-consequence network (the one with access to workstations, servers, domain controllers etc) and only have a guest network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .