Outbound VLAN 200
permit udp host <router> host 255.255.255.255 eq bootpc permit udp Router <vlanx> eq bootpc permit udp host <cnr> <vlanx> eq dns permit udp host <vpn_c> <vlanx> eq isakmp permit esp host <vpn_c> <vlanx>
permit udp <aps> host <admin> eq snmp3
permit tcp host <admin> <aps> eq http permit tcp host <admin> <aps> eq telnet deny ip any any log
1. Only if SNMP Management is required
2. NTP might also be required to ensure accurate time stamping of messages
3. Only if SNMP Management is required
The filters on the Core Router (Fred) are summarized in Table 2-8. Table 2-8 Filters on the Core Router (Fred)
Outbound VLANY
permit udp <vlanx> host <cnr> eq bootps permit udp <vlanx> host <cnr> eq dns permit udp <vlanx> host <vpn_c> eq isakmp permit esp <vlanx> host <vpn_c> deny ip any any log
Inbound VLANY
permit udp <cnr> <vlanx> eq bootpc permit udp host <cnr> <vlanx> eq dns permit udp host <vpn_c> <vlanx> eq isakmp permit esp host <vpn_c> <vlanx> deny ip any any log
IPSec VPN Client Configuration Notes
The configuration of a WLAN client beyond the scope of this solution reference network design guide. Please refer to related AP and client configuration documents at http://www.cisco.com.
Personal firewall or intrusion detection software should also be a consideration on the client devices, because they are open to attack while connected to the WLAN (or other untrusted networks such as the internet).
Additional IPSec VPN AP Security Considerations
The Aironet Publicly Secure Packet Forwarding (PSPF) feature can be used in the IPSec VPN configuration to prevent inter-client communication through an AP—providing additional protection from attacks on client devices. It is arguable whether this is needed with filters on the air interface of the AP already limiting traffic to DHCP, ARP, and IPSec. This feature is more likely to be used in public WLAN networks.
It is possible to use static WEP in the IPSec VPN solution; however, this is not recommended as it introduces the key management issues associated with static WEP.
IPSec VPN Switch Security Filter Considerations
It is mandatory that the APs be on a dedicated VLAN segment, and security policy might even require separate switches for the WLAN network.
The switch should filter access to its own administrative interface to prevent administrative access from WLAN addresses.
Figure 2-20 shows the router (Barney) connecting to the access switches through three VLANs: the administrative VLAN (VLAN 1) allowing management of the switches; the VLAN (VLAN 200) connecting to the WLAN; and the VLAN connecting to the wired LAN (VLAN 300).
Figure 2-20 Switch Configuration — Connecting Barney to VLANs
Barney
Figure 2-20 Switch Configuration — Connecting Barney to VLANs
Barney
The administrative access filter on the switch would be as follows, where <admin> is a host or subnet performing management functions.
Set ip permit <admin> Set ip permit enable
IP SEC Additional Switch Security Configuration Considerations
Private VLANs could be applied to prevent inter-AP client communications extending the restriction on inter-client communication implemented with PSPF on the AP. This is discouraged, because it can interfere with intra-subnet roaming, and other AP management functions. As with PSPF, the filtering applied on the APs should provide sufficient protection for WLAN clients without having to prevent inter-client communications.
IPSec VPN Management and Additional Security
The filters applied as part of the IPSec solution have a number of benefits in the secure management of the APs. Without the filters applied on the air-interface of the APs, there is no mechanism to prevent brute force attacks on the AP management interfaces. These management interfaces use static passwords and have no logging of failed attempts, or shut-out after n failed attempts. Therefore a process needs to be in place to regularly audit the configuration of the APs and associated access routers, ensuring that the filters have been correctly implemented. Configuration of Cisco IOS Intrusion detection features might be required on the access routers to detect such a failure.
IPSec WLAN LAN Extension Equipment Requirements
The client and AP choices are the same for this solution as for the EAP solution.
The VPN concentrator used in these designs is the Cisco 3005; the actual concentrator selection and architecture is described in the VPN Solution Design Guide.
Continue reading here: EAP Considerations for High Availability ACS Architecture
Was this article helpful?