Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have been championed to install a router that supports multiple SSIDs and being relatively new to the world of networking, would I be able to limit the spread of viruses and the like if I have users connecting to different wireless connections?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

SSIDs are not security boundaries, they are simply convenient wireless connection points. There is nothing inherently "secure" (or for that matter, "insecure") about SSIDs, so the question is what do you do with them.

If each SSID connects to a separate network/VLAN and there is no routing between the separate networks then this would perhaps isolate the wireless machines from each other but would probably leave you with a network that was awfully complicated without actually being very useful.

edit - toally should have added this to the question originally, sorry.

One place where using separate SSIDs connecting to separate networks is very useful is for guest wireless access. You should have a separate network/VLAN and SSID for guest network access that routes directly out via your Internet connection and doesn't allow direct guest access to your LAN. This sort of separation of different types of user is pretty much standard practice in a lot of wireless implementations I've seen these days, provides immediate isolation of a source of threats that might otherwise be difficult to deal with, and should not be difficult to implement.

You might want to investigate stuff like Network Access Control (NAC) as a method for ensuring that devices connecting to the network meet a certain standard level of security. This still isn't a security panacea, but it may be helpful.

share|improve this answer
    
@Robert Moir - Thanks. I am new to the world of networking so my knowledge of separating networks is minute and I have no idea of what a VLAN is. In terms of Network Access Control, what levels of security would I be able to achieve? –  PeanutsMonkey May 30 '11 at 6:59
    
A VLAN can be thought of as a virtual switch created by partitioning up a portion of your physical switches. It is often used with layer 3 routing functions on a swtitch to create separate, reasonably isolated TCP/IP networks with routing between them at the physical switches. (for more info see the wikipedia article en.wikipedia.org/wiki/Virtual_LAN) –  RobM May 30 '11 at 7:06
    
Network Access Control - the exact things you can achieve depend on the particular NAC product you use, but it allows you to set connection policies and isolate devices that do not meet these policies (e.g. don't allow devices without up to date patches and AV to connect to the main network, just to update servers where they can install patches and AV updates, until they do meet your connection policy). –  RobM May 30 '11 at 7:08
    
@Robert Moir - Thanks. Will have a read about it. I am however keen to understand what you meant by the levels of security that can be achieved Network Access Control. –  PeanutsMonkey May 30 '11 at 7:09
    
@Robert Moir - Sorry I just saw your post so am deleting my previous comment. Do all routers/modems have Network Access Control? –  PeanutsMonkey May 30 '11 at 7:16

To the extent that some worms spread by probing random IP addresses within a local subnet, and that separate SSIDs imply separate subnets, yes it may help. However, it is most likely not worth the added complexity and there are better solutions.

share|improve this answer
    
I'm sorry but how does having multiple SSIDs actually help in the scenario you describe? –  RobM May 30 '11 at 6:59
    
@Robert Assuming that each SSID is associated with a different subnet. –  Tom Shaw May 30 '11 at 6:59
1  
Tom, that's a big assumption to make. I'm also far from convinced it will help with modern network worms. –  RobM May 30 '11 at 7:02
    
@Robert Updated to make it clear. Also you'll note I agree with your overall assessment. Out of curiosity, what's the use-case for a single router with multiple SSID's all on the same subnet? –  Tom Shaw May 30 '11 at 7:07
    
Tom - no use for them on the same subnet that I can see - you're absolutely right as far as that goes. I'm just saying that it makes sense to create multiple SSIDs to support/expose multiple VLANs, not to create multiple VLANs to support multiple SSIDs, if you see what i mean, which feels like the tail wagging the dog to me. +1 on the q, with the edit btw –  RobM May 30 '11 at 7:11

While having multiple SSIDs may provide some isolation between your clients, if your reason for doing this is to reduce the spread of viruses then you're going about it the wrong way. Start with proper anti-virus software as a means of reducing the spread of malware.

share|improve this answer
    
Thanks. The client already has the appropriate antivirus installed however would like to segment staff that generally come in from other branches, etc as well as visitors wanting to use their wireless network. –  PeanutsMonkey May 30 '11 at 7:00
3  
@PeanutsMonkey - In that case, for visitors/clients, you absolutely should have a separate wifi segment, but make sure its not a separate SSID, but also a completely separate network subnet with a firewall between it and the rest of you LAN. –  barryj May 30 '11 at 7:55
    
your comment about visitor WLANs reminded me that I should have mentioned that in my answer, this is what we do where I work. –  RobM May 30 '11 at 9:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.