2

I have been championed to install a router that supports multiple SSIDs and being relatively new to the world of networking, would I be able to limit the spread of viruses and the like if I have users connecting to different wireless connections?

Improve this question

3 Answers 3

Reset to default
8

SSIDs are not security boundaries, they are simply convenient wireless connection points. There is nothing inherently "secure" (or for that matter, "insecure") about SSIDs, so the question is what do you do with them.

If each SSID connects to a separate network/VLAN and there is no routing between the separate networks then this would perhaps isolate the wireless machines from each other but would probably leave you with a network that was awfully complicated without actually being very useful.

edit - toally should have added this to the question originally, sorry.

One place where using separate SSIDs connecting to separate networks is very useful is for guest wireless access. You should have a separate network/VLAN and SSID for guest network access that routes directly out via your Internet connection and doesn't allow direct guest access to your LAN. This sort of separation of different types of user is pretty much standard practice in a lot of wireless implementations I've seen these days, provides immediate isolation of a source of threats that might otherwise be difficult to deal with, and should not be difficult to implement.

You might want to investigate stuff like Network Access Control (NAC) as a method for ensuring that devices connecting to the network meet a certain standard level of security. This still isn't a security panacea, but it may be helpful.

Improve this answer
8
  • @Robert Moir - Thanks. I am new to the world of networking so my knowledge of separating networks is minute and I have no idea of what a VLAN is. In terms of Network Access Control, what levels of security would I be able to achieve?
    – PeanutsMonkey
    May 30, 2011 at 6:59
  • A VLAN can be thought of as a virtual switch created by partitioning up a portion of your physical switches. It is often used with layer 3 routing functions on a swtitch to create separate, reasonably isolated TCP/IP networks with routing between them at the physical switches. (for more info see the wikipedia article en.wikipedia.org/wiki/Virtual_LAN)
    – Rob Moir
    May 30, 2011 at 7:06
  • Network Access Control - the exact things you can achieve depend on the particular NAC product you use, but it allows you to set connection policies and isolate devices that do not meet these policies (e.g. don't allow devices without up to date patches and AV to connect to the main network, just to update servers where they can install patches and AV updates, until they do meet your connection policy).
    – Rob Moir
    May 30, 2011 at 7:08
  • @Robert Moir - Thanks. Will have a read about it. I am however keen to understand what you meant by the levels of security that can be achieved Network Access Control.
    – PeanutsMonkey
    May 30, 2011 at 7:09
  • @Robert Moir - Sorry I just saw your post so am deleting my previous comment. Do all routers/modems have Network Access Control?
    – PeanutsMonkey
    May 30, 2011 at 7:16
5

To the extent that some worms spread by probing random IP addresses within a local subnet, and that separate SSIDs imply separate subnets, yes it may help. However, it is most likely not worth the added complexity and there are better solutions.

Improve this answer
6
  • I'm sorry but how does having multiple SSIDs actually help in the scenario you describe?
    – Rob Moir
    May 30, 2011 at 6:59
  • @Robert Assuming that each SSID is associated with a different subnet.
    – Tom Shaw
    May 30, 2011 at 6:59
  • 1
    Tom, that's a big assumption to make. I'm also far from convinced it will help with modern network worms.
    – Rob Moir
    May 30, 2011 at 7:02
  • @Robert Updated to make it clear. Also you'll note I agree with your overall assessment. Out of curiosity, what's the use-case for a single router with multiple SSID's all on the same subnet?
    – Tom Shaw
    May 30, 2011 at 7:07
  • Tom - no use for them on the same subnet that I can see - you're absolutely right as far as that goes. I'm just saying that it makes sense to create multiple SSIDs to support/expose multiple VLANs, not to create multiple VLANs to support multiple SSIDs, if you see what i mean, which feels like the tail wagging the dog to me. +1 on the q, with the edit btw
    – Rob Moir
    May 30, 2011 at 7:11
3

While having multiple SSIDs may provide some isolation between your clients, if your reason for doing this is to reduce the spread of viruses then you're going about it the wrong way. Start with proper anti-virus software as a means of reducing the spread of malware.

Improve this answer
3
  • Thanks. The client already has the appropriate antivirus installed however would like to segment staff that generally come in from other branches, etc as well as visitors wanting to use their wireless network.
    – PeanutsMonkey
    May 30, 2011 at 7:00
  • 3
    @PeanutsMonkey - In that case, for visitors/clients, you absolutely should have a separate wifi segment, but make sure its not a separate SSID, but also a completely separate network subnet with a firewall between it and the rest of you LAN.
    – barryj
    May 30, 2011 at 7:55
  • your comment about visitor WLANs reminded me that I should have mentioned that in my answer, this is what we do where I work.
    – Rob Moir
    May 30, 2011 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .