0

We have LAN outlets in conference rooms. They should be used by users from our company.

Obviously from time to time there are also visitors in those conference rooms. And they could be alone in those rooms.

Those users could try to use our network but the servers are password protected so normally they wouldn't get far.

But how about malicious people? What would happen if someone connects a device to such a LAN port and gives it i.e. the IP address of one of our servers? Or someone takes a teaser and zaps the LAN with 10,000V?

How to protect against possible problems like that? A physical lock is obviously one option. A firewall another. What is a good protection?

5
  • 1
    My two first choices would be RADIUS / 802.1x authentication, and/or a VLAN that has access to no internal resources (plus you need to mitigate VLAN attack vectors) and is throttled so it can't consume an inordinate amount of bandwidth. This is relevant - networkengineering.stackexchange.com/questions/35750/… Jul 25 '18 at 4:31
  • 1
    zaps the LAN with 10,000V? - Not much you could do about that other then having a separate switch for the lower security rooms, or just don't used wired connections and just go wireless. Authentication, plus proper encryption would make that relatively safe.
    – Zoredache
    Jul 25 '18 at 5:05
  • +1 for @RobPearson comment, which should be an answer. 802.1x, you can have a default vlan that is the guest vlan with outbound port 80/443 access to the internet for vendors to reach their resources. Everyone else can have a vlan that fits the needs of their internal org.
    – Aaron
    Jul 25 '18 at 15:37
  • I'll move it to an answer, then. Thank you Aaron. Jul 25 '18 at 16:39
  • 1
    See this question and answers.
    – Ron Maupin
    Jul 25 '18 at 16:51
1

My two first choices would be RADIUS / 802.1x authentication, and/or a VLAN that has access to no internal resources (plus you need to mitigate VLAN attack vectors) and is throttled so it can't consume an inordinate amount of bandwidth. This is relevant - https://networkengineering.stackexchange.com/questions/35750/whats-the-difference-between-radius-and-802-1x-port-based-authentication

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.