How locked down is the Guest WLAN setting (default-guestservice)?

  • 2
  • Question
  • Updated 3 years ago
We have a guest SSID and it works well. We are using the isolation feature and everything seems to be blocked. My only concern is I don't know for a fact that everything is blocked. For example, we have no rules to allow DHCP requests go through, yet guest clients are getting a valid DHCP address. Secondly, we don't have an ACL to allow DNS requests to our internal DNS server, yet guest clients are querying our internal DNS servers successfully. Lastly, we have an ACL rule to deny 10.0.0.0/8 access from the guest SSID, which I would think would deny DHCP, DNS, etc. since our DHCP and DNS servers reside in that network.

In a nutshell, can someone tell me what access is allowed by default for the guest profile and why does our 10.0.0.0/8 deny rule not block everything for guests?

Thanks!
Photo of Zack Brantley

Zack Brantley

  • 5 Posts
  • 0 Reply Likes

Posted 3 years ago

  • 2
Photo of Rahul Koul

Rahul Koul, Employee

  • 76 Posts
  • 13 Reply Likes
Hi Zack,

Guest Access is a Web-based authentication (Captive Portal) in which by default DHCP and DNS traffic is allowed. Hence, when anyone connects to a Guest access WLAN they will get a DHCP and a DNS address even before they authenticate.

Infact this holds true for all forms of Captive portal authentication like Hotspot with external Web server and Web based authentication with ZD acting as the Web Server.

Hope this answers your question.

Cheers,
Rahul
Photo of Michael Brado

Michael Brado, Official Rep

  • 2180 Posts
  • 300 Reply Likes
Clients that use these web based authentication methods are allowed to send
ARP, DNS, and DHCP on the VLAN assigned to the WLAN, until successfully
authenticated.  Then they are granted rest of network access, possibly on a
re-assigned VLAN, etc.

Isolating guests to their own VLAN, where you can apply higher level ACLs, helps
provide a higher level of security.
Photo of Zack Brantley

Zack Brantley

  • 5 Posts
  • 0 Reply Likes
Just to make sure I am understanding everything correctly, all access is blocked except for DHCP, DNS, ARP, and Internet on the guest network. Who is doing the blocking? The AP or the Zone Director? All traffic (even in remote sites across the WAN) is NOT sending its traffic through the ZoneDirector, correct?

Are you suggesting assigning the guest SSID to a separate VLAN from the other SSIDs and then use an ACL on the router to block access to other parts of our network? If so, are you suggesting this because the access point doesn't stop traffic well enough and should be considered a security risk?

I appreciate all of the help as I just want to make sure we are fully locked down.

Thanks,
Zack
Photo of Rahul Koul

Rahul Koul, Employee

  • 76 Posts
  • 13 Reply Likes
You are right Zack. Even the traffic from remote sites is not passed except DHCP and DNS until those clients authenticate. 

Yes you can have Guest SSID on a separate VLAN but you do not need to necessarily configure ACLs on your router to block access to other devices on your network as you can configure Client isolation that can be found on Configure :: WLANs :: Edit :: Client isolation.

Does this answer your question?

-Rahul
Photo of Zack Brantley

Zack Brantley

  • 5 Posts
  • 0 Reply Likes
Ok, so it sounds like the access points are the "firewall" in this case, blocking access to other parts of our network when on the Guest SSID. I have a deny in place on the guest SSID for 10.0.0.0/8, so that nothing can go to other parts of our network. With that said, it sounds like ARP, DHCP, and DNS will ignore that rule. Are there any other protocols that ignore the deny rules?
Photo of Michael Brado

Michael Brado, Official Rep

  • 2180 Posts
  • 300 Reply Likes
No, just specifically and only those three.