How do I restrict network access to LAN for visitors

Question

How do I restrict network access to LAN for visitors?

In my organization's premises any outside visitor can come and connect to the LAN ports in our meeting rooms. We have seen that they are able to ping internal systems. How can I prevent this issue?

score 3 · Answer 1 · answered Jan 14 '14 at 17:18

The solution really depends on what your environment is, and what you're willing to put into place. There are a few solutions that come into mind, including the ones mentioned in other answers here:

Separate VLANs for public meeting spaces, and internal workstations. The downside of this is that a smart attacker can perform a VLAN hop (depending on the implementation), and end up in your workstation VLAN.
802.1X, which requires you to implement a RADIUS server, and a fair bit of management on user workstations to ensure that they have the right authentication profiles and certificates to talk to your network.
Network Access Control (or in Cisco language, Network Admission Control) which lets you authenticate users using LDAP, based on MAC address, or other mechanisms depending on your NAC implementation.

Of these three, VLAN is probably the cheapest in terms of effort on your part in configuring the environment - you don't have to do anything on user workstations, and you just have to ensure a proper segmentation of the network. 802.1x is more expensive in terms of effort and adoption, but still cheaper than a NAC solution. The NAC solution is probably going to be the most effective, and most expensive of the three, especially if you get a solution that doesn't need to deploy an agent on the workstations. It will still require some user training depending on how you implement it, but it is much harder to bypass a NAC control than it is to bypass VLAN restrictions.

What if isolated visitors try to connect to ports located at user workstation instead of meeting rooms. Will VLAN be able to restrict access. — Pentester23, Jan 15 '14 at 12:26
No, VLANs won't restrict access. A user workstation port will be connected to the work station VLAN - VLANs have nothing to do with the computer itself, but the port on which the computer is connecting. However, NAC/802.1X can help you isolate visitors in this scenario. — Karthik Rangarajan, Jan 15 '14 at 18:12

score 2 · Answer 2 · edited Mar 17 '17 at 13:14

2

The simplest solution is VLAN a virtual or logical LAN. With VLANs you can segregates your physical LAN network into different logical LAN segments i.e. Department based, based on users or application based. With the help of VLAN you can operate as build as many Virtual LANs as per your switch permits and these VLAN will be virtually isolated from each other. So what I suggest is to place your meeting rooms ports on a seperate vlan this will isolate visitors from accessing any of the internal workstations.

Edit:

VLAN are generally Subject to VLAN hopping attack i.e. switch spoofing and double tagging attacks. These reason behind these attacks is mainly due to misconfigured switch i.e. switch access port being configured as trunk port. You can review good assessment of the security of vlan from this question i.e

Why do people tell me not to use VLANs for security?

edited Mar 17 '17 at 13:14

Community

1

answered Jan 14 '14 at 14:11

Ali Ahmad

4,814
8
35
61

A necessary condition: router supports VLANs :) – boleslaw.smialy Jan 14 '14 at 14:35
I agree but with unmanaged switch you can do nothing though cost effective. – Ali Ahmad Jan 14 '14 at 15:22
Sometimes commercial routers has some out-of-the-box security features. But it fact: without router's name we can say nothing. – boleslaw.smialy Jan 14 '14 at 15:33
1

If a router supports this, this could definitely work...except that most advanced users can just do a VLAN hop and get to the workstation VLAN. – Karthik Rangarajan Jan 14 '14 at 17:11
@KarthikRangarajan how practical is vlan hopping attack if switch is properly configured i.e. guidelines provider by the vendor – Ali Ahmad Jan 14 '14 at 18:34
1

@AliAhmad Not super practical, but I've been to too many places where the switch is improperly configured and/or double tagging bypasses the restrictions that are configured. – Karthik Rangarajan Jan 14 '14 at 20:16

score 0 · Answer 3 · answered Jan 14 '14 at 13:00

0

Implement Port Security (802.1X), this is various techniques for placing access control on network ports.

answered Jan 14 '14 at 13:00

RQ'

76
6

Sorry, bad link. Should have been more careful. – RQ' Jan 14 '14 at 13:03
please provide proper link, I will edit the post. – boleslaw.smialy Jan 14 '14 at 14:41

How do I restrict network access to LAN for visitors

3 Answers3