How locked down is the Guest WLAN setting (default-guestservice)?

[zack_brantley]

We have a guest SSID and it works well. We are using the isolation feature and everything seems to be blocked. My only concern is I don't know for a fact that everything is blocked. For example, we have no rules to allow DHCP requests go through, yet guest clients are getting a valid DHCP address. Secondly, we don't have an ACL to allow DNS requests to our internal DNS server, yet guest clients are querying our internal DNS servers successfully. Lastly, we have an ACL rule to deny 10.0.0.0/8 access from the guest SSID, which I would think would deny DHCP, DNS, etc. since our DHCP and DNS servers reside in that network.

In a nutshell, can someone tell me what access is allowed by default for the guest profile and why does our 10.0.0.0/8 deny rule not block everything for guests?

Thanks!

[rahul_koul]

Hi Zack,

Guest Access is a Web-based authentication (Captive Portal) in which by default DHCP and DNS traffic is allowed. Hence, when anyone connects to a Guest access WLAN they will get a DHCP and a DNS address even before they authenticate.

Infact this holds true for all forms of Captive portal authentication like Hotspot with external Web server and Web based authentication with ZD acting as the Web Server.

Hope this answers your question.

Cheers,
Rahul

[michael_brado]

Clients that use these web based authentication methods are allowed to send
ARP, DNS, and DHCP on the VLAN assigned to the WLAN, until successfully
authenticated.  Then they are granted rest of network access, possibly on a
re-assigned VLAN, etc.

Isolating guests to their own VLAN, where you can apply higher level ACLs, helps
provide a higher level of security.

[zack_brantley]

Just to make sure I am understanding everything correctly, all access is blocked except for DHCP, DNS, ARP, and Internet on the guest network. Who is doing the blocking? The AP or the Zone Director? All traffic (even in remote sites across the WAN) is NOT sending its traffic through the ZoneDirector, correct?

Are you suggesting assigning the guest SSID to a separate VLAN from the other SSIDs and then use an ACL on the router to block access to other parts of our network? If so, are you suggesting this because the access point doesn't stop traffic well enough and should be considered a security risk?

I appreciate all of the help as I just want to make sure we are fully locked down.

Thanks,
Zack

[rahul_koul]

You are right Zack. Even the traffic from remote sites is not passed except DHCP and DNS until those clients authenticate. 

Yes you can have Guest SSID on a separate VLAN but you do not need to necessarily configure ACLs on your router to block access to other devices on your network as you can configure Client isolation that can be found on Configure :: WLANs :: Edit :: Client isolation.

Does this answer your question?

-Rahul