5

What are some common problems for companies who offer internet access to "guests" (people employed by a different company) on their premises?

My guess would be easy to use downloads like from bittorrent, if that isn't filtered by the firewall.

What are some other things a network administrator has to keep in check?

1

If the network is in a different VLAN and router/switch has a secure password, you have no worries.

Don't mind if bittorrent port is open. First, firewall must worry about others things, if you close all ports, this is a limiting freedom to use this net, perhaps someone is using this port for a VPN connection. I think the worst problem is that if you do not use a key to cipher channel, all messages could send in plaintext.

  • 1
    right, i thought about the idea to rent a completely different internet connection for the guests from a ISP. so that even if send spam or do something that is not legal, mailservers wont ban the companys ip...just some guest access – James Baker Jul 26 '16 at 15:36
  • your other points are valid as well. what do you mean by: I think maybe the worst problem is that if you use not a key to cipher channel, all messages could send in plaintext. – James Baker Jul 26 '16 at 15:37
  • you should have a minimum security, for example use user and password to enter to guest net or a key, monitoring logs for detect bad behaviours, etc. I have supposed people connect it through WiFi connection. Second part, you can understand here en.wikipedia.org/wiki/Wired_Equivalent_Privacy. But nowadays it not good use WEP. If your Wi-Fi connection is Open you have not a key to cipher messages. – jdmorei Jul 26 '16 at 15:58
1

The following points need attention:

  • Network Segregation: Prevent visitor to access your network. Examples: VLANs or even separate Internet line as your visitors will care only about Internet.
  • Legal Usage: Disclaimer to not use the Internet for bad and illegal activities. Example: Registration page, accept terms and policy with SMS activation.
  • Employee Usage: Some organizations will not like if employees use the guest WiFi to access social websites and avoid company policy. It's hard to prevent but some solutions suggest to make the visitor access valid for 1 or 2 hours then visitor needs to register again.
1

I agree with MOST of what jdmorei said with the exception of bittorrent. Some ISPs will send you cease and desist letters, which depending on whether you care or not, could be a problem. You can take care of that with a decent low-powered application-level firewall that stops Bittorrent as an application.

Host isolation: Sometimes a guest will be infected with something and start spewing traffic to other guests. If you care about that, you'll want a router/firewall that will enforce isolation. This will prevent any guests from talking directly with each other on the local network.

Speaking of which, if someone on that guest network happens to use your network for nefarious purposes (i.e. hacking into another network), this could get you involved in any ensuing investigation. Be sure your firewall has great logging and that it prevents intrusions with both ingress and egress traffic.

0

A few off the top of my head, and countermeasures.

1Torrent clients. if you have a security appliance to recognize and block torrent protocol traffic, use it. Torrent clients often use random ports. Running torrent clients automatically upload, which is detected by the ISP.

2 Illegal use. Someone could for example connect from outside and use the network for fraudulent activity. Use a password, temporary if possible. have good traffic monitoring in place and keep an eye on the DHCP logs.

3 Hackers. The router/modem can have vulnerabilities or weak passwords. If the network is not separated properly, guests could have access to sensitive devices. Update infrastructure regularly. Use a separate line / port on modem or strong VLAN and run something like Snort.

4 Denial of service. IPv6 RA flood will kill a lot of devices. If the VLANning is done by one device, it could be overloaded by another network. Again, monitoring or IDS will help this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.