I'm gonna give you WiFi."Is it for you?"But..."I don't know what to say about security after we use it."The guest is an outsider of the company, and if the visitor network and the office intranet are not isolated, the visitor may touch the data and systems within the enterprise once he or she has access to them.
Why quarantine: visitors are uncontrollable network risks
Visitors come from outside the company, their equipment, their network environment companies are completely unknown, may carry a virus or be used in bad faith. If the WiFi and the enterprise’s office network are connected to the same web, visitors can access Intranet resources, scan internal Internet hosts, and even launch attacks on internal systems."It's online."But..."We can't get enough of the inside."Isolation is the basis of the security of visitors WiFi, and it's not good for isolation, but for certification.
VLAN Separating: Logically separating the network
The most common means of isolation is VLAN. Separate VLAN for visitors WiFi, which is assigned to the visitor VLAN after certification has been passed and is completely separated from the office VLAN, the server VLAN. After VLAN, the terminal can only communicate within the visitor VLAN and cannot access resources directly in the network section. VLAN is carefully divided so that visitors VLAN, offices VLAN, servers VLAN are not connected to each other, but only controlled communication through firewalls where needed. VLAN isolation is a first step towards safe separation of corporate visitors WiFi certification sites and the most important one.
ACL and firewall: control what visitors can access
VLAN alone is not enough, and access to visitors is also blocked by ACL and firewalls. The ACL controls the targets that visitors can access at the exchange level, defaulting to release only Internet exports and necessary authentication servers, with all remaining bans; the firewall is further controlled at the exit, limiting the operational ports and protocols visited by visitors, and prohibiting visitors from accessing inner-net segments. Through ACL and firewalls, the visitor network is restricted to:"You can only get online. You can't touch the net."Even if a visitor ' s equipment was broken, it would not be possible to access the enterprise network horizontally.
Control of Internet access: preventing the misuse of visitor networks
Isolation is not just a matter of control."Can you access the Internet?"And I'm still in charge."How do you get online?"The network of visitors needs basic controls on access: limit bandwidth to avoid the heavy use of network resources by individual visitors; restrict P2P downloads, large traffic applications to prevent the network from being used as a download channel; filter out malicious sites and illegal content. These controls protect the network itself from becoming an entrance to irregularities.
Multinet Isolation and Wireless Configuration
On the wireless side, the visitor network is usually available through an independent SSID, for example by name"Guest-WiFi"The wireless controllers map the visitor SSID to VLAN and send the authentication strategy, isolation strategy to AP."Connect to WiFi."From that moment on, the fence was in place and the secure border was clear from the very beginning.
The company visitor WiFi certified secure isolation."VLAN cut, ACL and firewall dead, Internet behavior control, wireless multiSSID isolation". The purpose of isolation is to allow visitors"We have a network, we don't have an intranet."The visitors’ network is blocked. They are isolated and secure, so that the visitors WiFi certification can be truly assured of their use without fear of safety on the Intranet.