Guest access to our wireless network

I have changed our network over to WPA with PEAP. One the questions that has come up is, how can guest still have access to this wireless access point to access the internet, but not have access to our internal network. Any info would be great.

I set up two ssids on our network. These map to two different VLANs. One VLAN attaches to the internal network. The other connects to a second firewall with Internet access. This also allows me to test VPN accounts by attaching to the secondary ssid and going out one firewall and back in to the other. Sometimes vendors want to demo something which needs Internet access, and I would rather put them on the secondary firewall which has open access rather than poke a hole in my main firewall. Normal users are not supposed to be on the Internet only ssid. Also you can make the security on your internal network ssid high and the Internet only ssid low.

Similar Messages

Could malware spread across our wireless network?

Hello, I need a bit of help. A scammer posing as a Norton employee got access to our MacBook Pro via LogMeIn Rescue for a few minutes before one of our family members forced shutdown. He had ample time to install a bouquet of malware, but Sophos isn't detecting any. Just to be safe, it seems like the best bet for this computer is to reinstall OSX after backing up any necessary files.
What I want to know is, could malware from this attack have spread across our wireless network to our other devices? Our laptops, desktops, phones, etc... On the targetted computer, System Preferences > Sharing shows only Printer Sharing enabled, not Web Sharing, Remote Login, Internet Sharing, or anything else. Is that a good sign? Or could an attacker have leapt from our wireless printer to another computer?
I am more than happy to provide you with any other details--just let me know. Thank you for your help.

Most of the anti-malware packages for the Mac do not detect anything. All that would be needed is to add an account or launchd .plist to run some software that gives them future access.
You cannot trust that system any longer.
So yes save essential files, erase, and install from scratch, including all applications. Only restore data files.
Unless that Mac had administrator access to the other Macs without needing to authenticate, it is unlikely they could have spread anything to other Apple devices in your home. Which is one of the reasons anti-malware packages do not find a lot of malware on Macs. They tend not to get any via the network.
Social Engineering, such as what happened to you, or getting someone to download and install something with an admin password, is the more common way bad stuff gets into a Mac.
So I would not worry about the other Macs in the house, but do a wipe of the attacked Mac.
Sorry for your loss.

Our iPhones can't find our wireless network, but our MBPs can?

Using AirPort Express. Me and my friend's MBP can connect to the wireless just fine, and we can see the wireless network name on our MBPs.
But when we use our iPhones, our wireless network is nowhere to be found, tried resetting to factory settings and restarting modem etc. Same problem happens to other devices i.e. other laptops, other phones, even Apple products, ONLY our MBPs can connect for some odd reason.
Any ideas on solving this? Thanks...

Done! I looked through some other threads and someone suggested resetting the entire AirPort with the reset button on the actual device instead of in AirPort Utility. Try that! Works completely fine now! Good luck

Suddenly our windows 7 clients can't connect to our wireless network due to a cert error?

Our company uses a Ruckus setup for our wireless network. The laptops have to have a certificate on them issued from our CA and be a member of AD group. Yesterday we noticed that nobody could connect to the internal wireless network. In
the security logs for the computers there is a this error:
A request was made to authenticate to a wireless network.
Subject:
   Security ID:        host/xxx-xxxxxxx
   Account Name:       -
   Account Domain:       -
   Logon ID:       0x0
Network Information:
   Name (SSID):       Forest River Internal
   Interface GUID:       {53b8a5f4-e910-4e3e-ab88-eb4f46356e1f}
   Local MAC Address:   68:94:23:00:26:1F
   Peer MAC Address:   C4:01:7C:4A:88:58
Additional Information:
   Reason Code:       Explicit Eap failure received (0x50005)
   Error Code:       0x80420202
   EAP Reason Code:   0x80420202
   EAP Root Cause String:   The authentication failed because certificate required for this network has expired on the server computer
   EAP Error Code:       0x80420202
this cert was is supposed to be good for another year, is there anyway that I can get the CA server to renew this cert or do I need to issue a new one and distribute it? The other issue I'm running into is I can't seem to get my CA to issue a new computer
cert. All the servers are 08 R2 boxes.

Hi,
Do you have any progresses on this issue by now?
Here is a related KB article below:
Windows 7 does not connect to an IEEE 802.1X-authenticated network if an invalid certificate is installed
http://support.microsoft.com/kb/2494172
Best Regards,
Amy Wang

Trying to connect our exercise bike to our wireless network. It sees the network, but once pass phrase is put in, it won't connect. Any suggestions? We have an Airport Extreme.

I am trying to connect our exercise bike to our wireless network. It sees the network, but once pass phrase is put in, it won't connect. Their tech support said the problem is with the router and we may need to open ports 80, 443 and 4348. We have an AirPort Extreme and I scanned for open ports and found 80 already open but the others are not. Tried using Port Mapping, putting the port number 443 in both the Public UDP and TCP fields and the Private UDP and TCP fields also. The Private IP address defaulted to 10.0.1.201 which is right outside of the DHCP range. Will this be the IP of the bike or should I change it to something else? Are the values I put in the fields totally wrong? Bike is still not connecting. Thanks for any help!

Here's an update:
Now the light is not blinking. It's a solid, consistant green. I don't know if it helps to narrow it down or anything, but I just figured I'd mention it.

When I try to get my email and I am outside our wireless network I get a "lost connection to server" message. I am trying to connect to Outlook.

When I try to get my email and I am outside our wireless network I get a "lost connection to server " message

Outlook is a mail client for PCs and Macs. Who is your mail provider? If you're talking about a business mail system, it may not be accessible from outside the company network. You will need to check with your IT department.

My husband has a Mac mini, vintage 2009, running Snow Leopard. All other computers and devices in the house are able to connect to our wireless network, but since I upgraded his computer to Snow Leaopard it won't connect. What is the problem?

What am I missing here. I'm sure it is some kind of sitting that is not right.
Thanks Pat

Sounds familiar:
lllaassJan 6, 2015 2:12 PM Re: My husband has a Mac mini, vintage 2009, running Snow Leopard. All other computers and devices in the house are able to connect to our wireless network, but since I upgraded his computer to Snow Leaopard it won't connect. What is the problem?
Re: My husband has a Mac mini, vintage 2009, running Snow Leopard. All other computers and devices in the house are able to connect to our wireless network, but since I upgraded his computer to Snow Leaopard it won't connect. What is the problem?in response to Patricia Isaac1
Power off and then back on the router
What happens when you enter the network's PW?
Try forgetting/deleting the network if necessary. To do that go to System Preferences>Network>wifi>Advanced and select the network and click on the minus sign
Csound1 wrote:
Turn off the modem and the router, wait 60 seconds. Turn on the modem, wait 60 seconds, turn on the router.

Why does one of our iPhone5's revert to the guest account on our wireless router?

My wife and I have identical iPhone5's. At home we connect wirelessly to our Ethernet network through a Cisco E2000 wirelous gigabit router.
We set the default in Settings/Wi-Fi to the main (secure) path into our router, which also offers a guest path requring password entry.
My phone remains in that mode. Hers "loses" that info and defaults to the guest path. We can still re-select the main path manually but it is a PITA to have to do this all the time.
How do I get the main path to remain the default?
NI6T

The iPhone wouldn't be reverting to the Guest network if the iPhone had not previously joined the Guest network at some point, which had to be done manually. Has your iPhone been manually connected to the Guest network in the past?
If reverting from one to the other, connection with the primary is being lost at some point by the iPhone. A restore is probably not required. Try resetting network settings on the iPhone which will erase all saved wi-fi networks and settings from the iPhone and require re-joining every wi-fi network the iPhone has access to when returning within range of such a network. Join the main network with the iPhone and don't manually select the Guest network to join so the iPhone can't revert to the Guest network.

I am trying to link our xbox and PC into our wireless network. I am using an apple airport express and it is asking me for a WEP Key. Where can I find my wep key?

I am tyrying to link our xbox and PC int oour wireless network. I am using an apple airport express and it is asking for my WEP Key. Where do I find it?

You should be able to setup WPA / WPA2 access, rather than WEP - which is old an less secure. (Unless your devices are too old for WPA??)
Try this link: http://spotlight.getnetwise.org/wireless/wifitips/apple/apple-wpa.php
**Edit
Airport does support the WEP protocol.
Apple Docs: http://docs.info.apple.com/article.html?path=Airport/5.0/en/ap2084.html

Limited access icon on wireless network

Hi all, I'm having trouble using the Internet on a laptop (HP 15-g094sa) that I bought last year. Because of my old laptop getting older, I decided to purchase a new laptop which I'm yet to use the Internet on. At the start of the year, soon after a Windows update, I encountered a problem of a flashing desktop screen. I was advised that it was potentially to do with the compatability (or lack of) with Norton Security. To solve the problem, I was advised to do something on the log-in screen before entering my password to log in. I think it was potentially something to do with the ease of access in the bottom left-hand corner. By doing something with that, it solved the problem of the flashing screen but did something to Norton and my wireless network meaning that I couldn't access either. I double-click on the Norton icon on my desktop now and nothing happens. Does anyone know what I could do to solve the problem? I know that I have a working wireless Internet because I'm using it on my old laptop now. Any help would be much appreciated .

Sorry to hear about the problem. Since you are unable to open Norton program now, I would recommend to try the steps from our KB article first:https://support.norton.com/sp/en/in/home/current/solutions/v64233471_EndUserProfile_en_us Check the wireless network connectivity when you completely uninstall Norton when you follow the instructions from the above link. Let me know the results. HarryNorton Support

How do I use Airport Extreme to create wired access point on wireless network?

Bit of an odd situation. I just went from cable to DSL at home and the modem moved from right by my computer to upstairs.
Trouble is, there's no real easy way to get a cable from the modem upstairs to my X-box (sans wireless connector) downstairs.
I could buy the wireless adaptor for the X-Box, but I was hoping I wouldn't have to spend any more money.
I have my airport extreme, and I was hoping I could use it to create a wired access point on the network, recieving the signal from the wireless modem upstairs and allowing me to plug in the X-Box.
Is this possible? If so, how? I've been through the config panel about a dozen times, but can't figure out what combination to set up.
Thanks.

Will it work if I use the express to create the network?
Yes, providing that you have an 802.11n version of the AirPort Express and the Express has been configured to "Allow this network to be extended".
Then, the AirPort Extreme can be configured to "extend" the Express network. When you do this, the AirPort Extreme will provide more wireless coverage and the LAN Ethernet ports are enabled, so you can connect an Ethernet device.
This will not be a "normal" Ethernet connection. It will only work as well as the wireless "hop" between the Express and Extreme allow.
For best results and performance, a wired connection through the hole in the wall is always best. If you decide to do this, you will need the "new" AirPort Express with both a WAN and LAN port on the device. But, you could try wireless first to see if it will meet your goals before you reach for the tools.

How do you know if someone else is attempting access to your wireless network? (WRT54G)

I searched adn tried the Linksys FAQ to no avail to get an answer to the subject question.
Is there any way to verify who is actually using or trying to attempt use of your wireless network, if so, where do I locate and view this information?
I just set up a wireless system so my wife could get access from her wireless equipped laptop, but I really see no area to verify who is actually using the wireless network or if some other outside source/person is attempting to get access.
Any info on where, how and what to do to view this type of info would be greatly appreciated and if it can't be, shouldn't there be something added to the system that would allow one to view all users accessing their wireless system?
Thank you,
Clay Fugitte

Tracking down who is using your wireless system is usually difficult or impossible. The router only knows the MAC address of the connecting computer. MAC addresses can be faked. Even if you knew the MAC address of the person connecting, what can you do with that info? Go around the neighborhood asking people "Is this your MAC address?"
Instead of worrying about who is connecting to your wireless, you should simply set up wireless security. This will keep intruders off your wireless network. Then you don't need to worry about who is connecting.
It sounds like you are running an unsecured wireless router. When you run an unsecured wireless router, anyone within range can login and use your Internet connection. At a minumum, this means that they will be using your bandwidth. At worst, they could be uploading copyrighted music, sending spam email, distributing viruses, or downloading child pornography --- all from an account with your name on it! So my advice is --- secure your wireless network.
To set up wireless security, do the following:
First of all, to setup wireless security, you must use a computer that is wired to the router.
Where to find the router settings: The router's login password is usually on one of the "Administration" pages. The other settings are all found in the "Wireless" section of the router's setup pages, located at 192.168.1.1
First, give your router a unique SSID. Don't use "linksys".
Make sure "SSID Broadcast" is set to "enabled".
Next, leave the router at its default settings (except for the unique SSID), and then use your pc to connect wirelessly to the router. Test your wireless Internet connection and make sure it is working correctly. You must have a properly working wireless connection before setting up wireless security.
To implement wireless security, you need to do one step at a time, then verify that you can still connect your wireless computer to the router.
Next, encrypt your wireless system using the highest level of encryption that all of your wireless devices will support. Common encryption methods are:
WEP - poor (see note below)
WPA (sometimes called PSK, or WPA with TKIP) - good
WPA2 (sometimes called PSK2, or WPA with AES) - best
WPA and WPA2 sometimes come in versions of "personal" and "enterprise". Most home users should use "personal". Also, if you have a choice between AES and TKIP, and your wireless equipment is capable of both, choose AES. With any encryption method, you will need to supply a key (sometimes called a "password" ).
The wireless devices (computers, printers, etc.) that you have will need to be set up with the SSID, encryption method, and key that matches what you entered in the router.
Retest your system and verify that your wireless Internet connection is still working correctly.
And don't forget to give your router a new login password.
Picking Passwords (keys): You should never use a dictionary word as a password. If you use a dictionary word as a password, even WPA2 can be cracked in a few minutes. When you pick your login password and encryption key (or password or passphrase) you should use a random combination of capital letters, small letters, and numbers, but no spaces. A login password, should be 12 characters or more. WPA and WPA2 passwords should be at least 24 characters. Note: Your key, password, or passphrase must not have any spaces in it.
Most home users should have their routers set so that "remote management" of the router is disabled. If you must have this option enabled, then your login password must be increased to a minumum of 24 random characters.
One additional issue is that Windows XP requires a patch to run WPA2. Go to Microsoft Knowledge base, article ID=893357 and it will direct you to the patch.
Sadly, the patch is not part of the automatic Windows XP updates, so lots of people are missing the patch.
Note:
WEP is no longer recommended. The FBI has demonstrated that WEP can be cracked in just a few minutes using software tools that are readily available over the Internet. Even a long random character password will not protect you with WEP. You should be using WPA or preferably WPA2 encryption.

Adding clients to our wireless network

We just added airport express as our wireless router and need help adding our windows xp laptops to the network. I do not see "add wireless clients from the base station menu" and our laptops do not recognize any apple wireless devices. Any help would be greatly appreciated.

boeeandme wrote:
I have selected 802.11b/g compatible. The network does not come up in when searching for available networks.
The advice I gave you applied to SP2 (at least) of Windows XP. I'll guess that those laptops are at least up to SP2 if not SP3. The only other issue would be whether you've configured AirPort's "Wireless Options" panel to "Create a closed network". That would prevent the AirPort unit from broadcasting its "SSID" and would require that you enter the name of the network when trying to connect. I can't tell you how to reach a screen on XP where you'd do that, but it shouldn't be hard to try that approach.
One other thought: What encryption option have you declared? If you're trying to use WPA2 and those laptops are sufficiently old, it may be that they don't support WPA2. Try turning off encryption temporarily to see if the laptops can connect.
Do I need to install airport express on the laptops?
No. I wouldn't expect that to help.
I do appreciate your help.
You'd probably be more appreciative if I could give you advice that helped!

Unable to block Non-Corprate machine access to CORP wireless network

Hello everyone
I am facing this problem right now , I created rule 1 for host authentication and rule 2 for user authentication ,but seems I am unable to block non-corprate machine * IPAD or smart phone* to access CORP wireless network if people put vaild domain user name and password.
Here is deatils and please help.
Rule 1 --Host AUTH---
External Groupls : AD1
Protocol: Radius
Was Machine Authenticated: -ANY-
System name : start with host/
Results : Permit Access
Rule 2 --User AUTH---
External Groupls : AD1
Protocol: Radius
Was Machine Authenticated: -true-
System name : -ANY-
Results : Permit Access
Default : Deny Access
Now , If I connect personal smart phone with windows username and password , ACS is able to blocked , screenshot as follow
But ,If I connect same personal phone with "domain\username" and password , the phone is able to connact , and here is screenshot.
Question is why matched "host AUTH" rule when I use "domain\username " on personal phone ? However, I do check the system name in "host AUTH" and permit access until system name start with "host/ " , so how come , this person is able to passed the rule .

We don't have BYOD at this moment , so we don't want employee access CORP wireless network with their personal devices.
Back to question, I was able to authenticate the laptop by machine name and seems work if I only type the username without domain .
But if I type "domain\username " into phone, I am able to connect it , I don't know why this can be happened and how to fix.
Please show off your kind help , thanks all

Our wireless network always disconnect clients

Hello,
I'm newbie on Cisco wireless network, please give me some help on our Cisco WLC 2500, for example how to check and configure channel ?
Thanks

Hi Leo,
After read your link, which file I need to upgrade of the following items ?
•Early Deployment (ED)—These software releases provide new features and new hardware platform support as well as bug fixes.
•Maintenance Deployment (MD)—These software releases provide bug fixes and ongoing software maintenance.
•Deferred (DF)—These software releases have been deferred. We recommend that you migrate to an upgraded release.
And how to upgrade existing APs from WLC ?
Thanks

Guest access to our wireless network

Similar Messages

Maybe you are looking for