russellhltn wrote:Routers only handle traffic leaving the local subnet.
Fortunately in our case the Cisco 800 series are more than just a basic router. For example, to prevent any wireless client from being able to communication with any other wireless client enter in the command
dot11 {ssid | guest-ssid} [guest-SSID-number] SSID-name
Followed by
isolate-clients
russellhltn wrote:Nor do they get involved with Ethernet traffic on a segment. So even if they were in a different subnet, they could still be attacked at the Ethernet/MAC address level if they were on the same physical subnet.
Hence my suggestion of "put trusted, hardwired devices on port 0 and wireless devices go on port 1. Isolate port 0 from port 1 and you're done".
russellhltn wrote:Now, a managed switch could probably do that. I've never been lucky enough to play with them.
The
881W IS a managed switch. As described, the 881W includes "Four 10/100 Mbps Fast Ethernet-managed switch ports". This whole deal with making sure the FHC is on port 2 and port 3 is reserved for FMG use is to provide the isolation between network segments.
Now when a building has the Cat 6 pulled it
should be terminated at a patch panel along the lines of this:
http://www.amazon.com/Intellinet-12-Por ... atch+panel. 12 ports, $18. If you have only two connections to make (or three if you don't have an FHC to worry about) then you're golden. If you need more than that then you would have to get a switch anyway so tie in some Netgear GS108s and you're good to go. Connect the admin computer(s) to port 0, put all public drops and WiFi on port 1 and program the managed switch that is the 881W to provide your security at a level higher by several orders of magnitude. Net additional cost is essentially zero because as just stated you would have had to buy the switch(es) anyway.
russellhltn wrote:Can it be done? Yes, with time and money. Is it worth it? Apparently those in charge of the widow's mite think otherwise.
Correct - they don't want to do this. The security risks have been deemed to be acceptable and no further action was taken.