Wireless Network, Security Fun :) 1

[tek777]

I was wondering if anyone could provide suggestions on where to start with my wireless network.

I just started with a new company, and they have 3 access points with no security. The Access points are on the same IP address as the servers. Basically we are broadcasting everything that happens on our network in the air around our building. I don't think that is a good thing.

There is no documentation for the access points, and they all look like different brands. Where would you suggest I start to fix this, as in emergency fix? Limit by Mac address? All the PCs have different Wireless cards, so setting up WEP could be a nighmare.

I was also thinking about using a router, making a new network just with internet access. Then have the users use our current VPN software to gain access to the network.

Any pointers would be appreciated, I guess limiting the MACs would be a starting point. I would have to do that on each of the 3 access points though. THanks!

 

[skotman]

Can you moves these guys to their own subnet, say a 10.x.x.x subnet? This will help things, also, dont run DHCP on that subnet, its like giving an address to your favorite black hat...not a good idea...so where is this place? can I go sniff? ;-) j/k

 

[paradox17]

1. Well first you can start by closing your SSID. All AP's accept the SSID "ANY" If the AP's have the option stop them from beaconing your "network name" avoiding passive scan. Your AP's will not respond to probe request unless the station has the right SSID. Also change the SSID from anything obvious.

2. Depending on your network size you can filter by MAC as you said

3. Packet fowarding- All traffic can be fowarded to a network authentication server (RADIUS).

4. You can try using static WEP but this can be a pain if you have a large network.

5. you can reduce your cell size by decreasing your output power thus decreasing your exposer to the "outside" the coverage area will still be the same because any good AP will increase the power to hold the client while decreasing data rate depending on SNR