Meraki Z1: protection of corporate devices from personal devices

Question

My company employees about 600-700 remote employees, each of whom is issued a corporate IP phone an a thin client compute endpoint.

In our current deployment, both devices are configured (defaults settings, vpn, etc) at our corporate office and shipped to the end users.

We have a couple issues with this current deployment, chief of among these that our support team has almost no visibility into our employees home network when they need support (making it difficult to determine if the issue is on our side or with the employees ISP.

We are considering swapping over our standard infrastructure deployment to include a managed access point (likely the Cisco Meraki z1) for better visibility into our employees home network experience. One proposal for this roll out includes us asking the employees to connect as many of their home devices to through their Meraki as possible (to better enable us to provide QOS guarantees to their work devices).

This change makes me uneasy in two ways:

1) Currently, both devices issued to our employees manage their own vpn settings, with all other ports of communication locked down, so we feel very confident through our audits that the devices only talk through encrypted channels. The suggested deployment with the Meraki includes a new network link not managed by the VPN (the Meraki itself would be connected over VPN, the devices will not be)

2) Perhaps there is not anything significantly different between connecting the devices to the Meraki AP vs the current deployment where employees have their devices connected to their home routers directly, but I find myself wishing I better understood the stateful firewall settings on the Meraki z1 to seperate the home devices from the corporate devices.

Are there any experienced Meraki users or network security professionals out there who can comment on either of these concerns?

Answer 1

With the Z1 you could create two VLANs - one connected to the VPN and the other not. You would then create SSIDs that connect devices to each of these LANS. You could designate certain ports VPN ports, and others not, and instruct employees to connect company devices to the company SSID or ports, and their own devices to to the other SSID and ports.

Unfortunately the Z1 doesn't currently support enforcing this through MAC addresses or their new Systems Manager Sentry, both of which would be quite simple. You could potentially use RADIUS authentication to permit wired and wireless access to the company VLAN/SSID - but the RADIUS server will be the other side of an internet connection. I think that's your best bet.