Sample secure home network

Dear,
I'm looking for a sample architecture and configuration sample for a small home network.
I have 2 x WAP321, SMB-SG 300 switch and ISA firewall.
Thanks.
Joris

Joris,
Thank you for clarifying that the firewall is an ASA not an ISA.  A couple of suggestions to get started.
Install ASDM
If you haven't already, plug in the ASA and connect your PC to it.  Your PC should get an IP via DHCP.  Browse to the default gateway and on the homepage will be a link to download ASDM.  Download and install it.  Use ASDM to connect to your ASA going forward.  It's a pretty nice UI that will make configuring the ASA much easier than CLI, unless your very comfortable with CLI.
Ensure you need outside access to Home Control
Since your connection is PPPoE, I'm also assuming you don't have a static IP from your provider meaning that your public IP may change from time to time.  The reason this is important is because if you are needing the ability to browse to your Home Network from outside your home, then you would either need a static IP that never changes (preferred) or utilize something like DDNS (less reliable).  All that said, there is a distinct possibility that you wouldn't need to worry about any of that.  Most, if not all, of the Home Control providers make this part easy by acting as a bridge between your outside access to your Home Control and your internal Home Control system.  What that means is that your Home Control system is checking into their system on a regular basis and their system leverages that regular checkin to control it.  You browse to their website to gain access to your Home Control system.  This generally doesn't require a static IP or any special configuration on your end.  It just requires that your Home Contol system has access to the internet and that certain ports are open.
I'd recommend contacting your Home Control system provider and ask them if you need a Static IP at your house to control your system.  Odds are the answer will be no.  I'd also ask them what ports need to be open from your Home Control system to their system for everything to function correctly.  They should provide you with a list of ports (i.e. TCP 80, TCP 443, UDP xxx, etc.)
Not only do you need this information to determine how to configure your firewall and if you have everything necessary from your ISP, but also to determine if you really need another SSID for your Home Control or if it can also be on your Home Network.  Some people may still prefer to put it on it's own SSID, for security reasons, but this also makes setting up and managing the network more complex for it to truly be secure.  For it to truly be secure, we would not only put it on its own SSID, but we would ensure that nothing else has access to the SSID.  So to directly connect to it internally, you would have to disconnect from your Home Network SSID and attach to the Home Control Network SSID.  If you're not going to make it secure, there's really no point to putting it on its own SSID.
Shawn Eftink
CCNA/CCDA
Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.

Similar Messages

  • HP Officejet Pro 8600 won't recognize secure home network

    Hi, just got an HP Officejet Pro. Setup went great, except for a snafu with our home network: it won't recognize it, even when I manually enter the name and password. It will however recognize our unsecured guest network. I temporarily set it up on that, but I'd rather be using the secured home network. I've run the wizard several times, reset to factory settings, all with the same result. Help? 

    Hi,
    The issue could be due to the the Encryption level used in the router. You can try the solution available here
    http://h10025.www1.hp.com/ewfrf/wc/document?docname=c02920684&cc=ad&dlc=en&lc=en
    Happy Printing
    Click on the "Thumbs up"button on the left to say "Thanks"
    Please mark the post that solves your problem as "Accepted Solution"
    (Although I am employed by HP, I am speaking for myself and not for HP)

  • Most Secure Home Network Configuration

    I have already working properly a Wireless Home Network with the following configuration.
    Cable modem wired to Linksys E1000 router
    Linksys router wired to PC Desktop, also conected wireless to a laptop and a printer.
    Everything is working fine, but my question is...what is the most secure combination?? This one or if the Cable modem is wired directly to the PC desktop and this wired to the router, from it wirelessly to the laptop and printer??? Any other?
    Maybe this helps...The PC desktop has Windows XP, the laptop has Windows 7. 
    Thank you,
    Solved!
    Go to Solution.

    The way you have it is the best. The other combination won't actually work unless you configure your PC for internet sharing and have it online at all times you need internet on any of your computers.

  • My iphone joins home network, wife's will not

    My wife and I recently bought new iPhone 3gs. Mine connects automatically to our secured home network (after I put the name and password into my iPhone).
    Set my wife's up the same, but her's will not connect to our home network. Under Settings-->Wi-Fi it shows she is connected to our home network, but it still shows 3G at the top of the phone.
    Under the network's info, her IP Address and Subnet Mask are totally different from mine. She has nothing listed for Router or DNS. I do.
    Not sure what is going on. We have two iPhones and two laptops and everything connects fine to the router except for her phone.
    She thinks she has connected to other networks, but is not sure.
    Anyone have any advice? Thanks.

    It's possible it could be this problem (if you are running firmware 2.2), which Apple seems to be completely ignoring:
    http://discussions.apple.com/thread.jspa?threadID=1680864&tstart=0
    Does your wife's phone occasionally look as if it has a connection, which then drops really quickly. Can it sometimes not even see your home network? And are there times when it just says "unable to connect to {network name}"?

  • Just got a new IPOD Touch and it wont connect to our Wifi home network with a Belken N Router. Our router uses WEP 64 bit security, but had a "blank" password field, which the IPOD did not like. Changing to a 6 char numeric PW didnt help either.

    OS is whatever OS ships with current IPOD Touch
    I cannot understand why the APPLE engineers have designed this product so that it has SO MANY WIFI problems.  This is supposed to be an easy-to-use product.  We've had no problems connecting our new laptop, our ROKU box, etc, but it seems impossible to get the IPOD touch to work.  NOTHING LIKE SPENDING XMAS MORNING DOING APPLE TECH SUPPORT TROUBLESHOOTING TO LEAVE YOU IN THE CHRISTMAS SPIRIT!!!  Argh!
    In fact, the only way we have been able to get this expensive brand new IPOD to work on our home network is to DISABLE SECURITY in the router settings.  THIS IS ANYTHING BUT A GOOD IDEA.
    DON"T KNOW WHY BUT MANY OTHER USERS ARE REPORTING THE SAME KIND OF PROBLEM SO APPLE ENGINEERING NEEDS TO GET BUSY AND FIX THIS PROBLEM SO THAT NEW USERS CAN CONNECT TO THE INTERNET WITHOUT HAVING TO BE TRAINED ROUTER ENGINEERS TO DO IT!!!!
    Ok, sorry for the rant, but surely those of you who are experiencing this share my frustration.  This is not why I bought an APPLE product.
    IS THERE ANY POSSIBILITY THAT APPLE WILL NOT ALLOW A WIFI PASSWORD with more than one identical alphanumeric character?  Any ideas?  We also tried eliminating the 40 MHZ setting under Bandwidth settings in the router settings for our router, but it made no difference.  The router has the latest firmware, too.  Running out of ideas, and am ready to box this unit up and send it back!

    Thanks, Bob!  You are correct.  And, we learned this as we spoke with APPLE TECH SUPPORT by phone on Christmas day (800-APL-CARE).  One of their reps spent the time to help us troubleshoot this, but the boiled down conclusion is your answer, and to repeat for the benefit of others, here is what worked:
    1. With our Belkin router set to "out-of-the-box" WEP 64 bit security, we could not get wireless access of any kind.  Only with the Security Mode set to DISABLED, could we gain access.
    2. Changing the router's security mode setting to "WPA/WPA-2...." and entering a new min. 8 char passphrase, and then entering that same passphrase into the IPOD Touch, and restarting the router, did the trick!
    Based on this, and some info found in another posting, I can only conclude that the IPODs and IPHONES do not support WEP security mode in many generic routers used by thousands of consumers.  Hopefully, those same consumers can figure out how to change their wireless router setttings to WPA/WPA-2 security mode and ALSO get all their other wireless devices (PCs, laptops, WII boxes, ROKU boxes) all reconfigured to WPA mode, too.
    I THINK THE BOTTOM LINE HERE IS THAT THERE IS AN ISSUE THAT APPLE NEEDS TO ADDRESS WITH WEP COMPATIBILITY and it may also be the case that MOST CONSUMERS ARE USING WEP 64 BIT security on their home wireless routers?
    In any case, it's working now, so anyone who is having problems should try changing to WPA mode and post back here if it worked for them!

  • Safari Home Page On Secure Wifi Network Login

    My employer has a very secure guest network. Sometimes when I log in and connect, my Ipad goes directly to Apple.com. This causes a problem because if I hit the Home key so I can open Safari, my Ipad disconnects from the WiFi network and I get a "not connected" message. How can I set my Ipad to go directly to a web page in Safari after logging in?

    King Penguin, thanks for your reply. Unfortunately, the issue is still there. When I open Safari, I don't get the secure login website to get into the wi-fi network. If I click on the network in Settings, sometimes the login page pops up, but my IPad goes directly to Apple.com, and it's not in Safari, so I can't access another website, and if I close Apple.com and open Safari, the wi-fi connection is lost.

  • Safari cannot make a secure connection to Google or Youtube--but only on my home network

    Recently, when I am on my home network, I cannot connect to Google or Youtube.  When I try to, I get an error message that says that Safari can't make a secure connection to the site.  (I can connect to these sites with Firefox at home though)  However, when I am at work, both Google and Youtube load just fine on Safari.  Any idea what could be causing this?  I suspect that it's the repeater that my landlord installed in my apartment, but I really have no idea.
    I am running Mavericks (10.9.4) on a 15-inch, late 2011 MacBook Pro.

    Hello Punxsutawney Phyllis,
    Thanks for using Apple Support Communities.
    See the article below to troubleshoot this error message you are receiving.
    Mac OS: "Unable to establish a secure connection" or "can't verify identity" messages in Web browsers
    http://support.apple.com/kb/TA20405
    Take care,
    Alex H.

  • I used part of my name in my home network.  Now I understand this was stupid security error.  How can i change the name of my home wifi network, airport express?  Thanks.

    I used part of my name in my home network.  Now I understand this was stupid security error.  How can i change the name of my home wifi network, airport express?  Thanks.

    Open Macintosh HD > Applications > Utilities > AirPort Utility
    Click on the picture of the AirPort Express
    Click Edit in the smaller window that appears
    Click the Wireless tab at the top of the next window
    Edit the Wireless Network Name
    Keep it short.....maximum 10-12 characters or so. No blank spaces or punctuation marks in the name
    Click Update at the lower right of the window to save the new setting and wait a full minute for the AirPort to restart

  • Why does the security code for my home network not work with my hp6500?

    I have a HPOfficejet 6500A Plus and am running windows 7 on a Dell desktop.  I've tried to get my printer to connect to a home network and every time I type in the password it won't connect...it fails the security.   I've always used the direct printer cable to connect one of my desktops to the computer and am trying to get the wireless featur to work...it won't. 

    Hi,
    Please refer the link below and download HP Print and Scan Dr utility which will be able to help in installing printer and checking for correct security key.
    http://h10025.www1.hp.com/ewfrf/wc/document?docname=c02271484&tmp_task=useCategory&cc=us&dlc=en&lc=e...
    Although I am an HP employee, I am speaking for myself and not for HP.
    --Say "Thanks" by clicking the Kudos Star in the post that helped you.
    --Please mark the post that solves your problem as "Accepted Solution"

  • Unable to connect Photosmart C4795 to secure wireless home network

    I recently purchased a Photosmart C4795 for use on a secure home wireless network that only has two laptops on it.  I am using a Belkin G Wireless Router and Windows XP as an operating system.  The network uses WEP privacy, and I have I know I have to do something with the passphrase and the printer...but I just can't figure out where or how.  This is how my problem goes:
    I followed the setup wizard, and press the WPS button on the router when prompted.  The printer's blue light turns on, and I proceed to  choose the "Wireless network connection (802.11)" option to connect the device.  I then select "No (or not sure), my printer is connected to my network.  Help me to setup the wireless network connection for my printer"
    From there, I connect my laptop to the printer via USB as prompted, and the wizard begins installing several components (x/9) but always gets stuck on step 6 for a few minutes, and then says "Printer Setup has failed to complete."  After retrying this a couple times, my only choice is to check "Continue the installation without connecting to the printer now, I will connect later" and click Next.  The wizard ends, saying I'll have to add the device later, so when I go that option I once again choose "Wireless network connection"  From there, it gives me a blank printer list.  No printers, let alone the one I want, show up after Refreshing.  So when I click "my printer is not listed" I'm then back at square one where I am prompted to USB connect the printer and it just loops over the same errors. 
    Does anyone please have some advice or opinions?  I've tried calling customer support and I've browsed the forums, but I haven't found the solution and I'm just pretty confused.  Any help at all would be greatly appreciated.

    Let's add the printer manually. 
    Verify that you can browse to the printer's internal web page by its IP address into a browser.  (The IP address is on the Network Config Page that you can print from the printer's front panel).
    1. Click "Start" button --> Printers and Faxes.
    2. Under Printer Tasks, click "Add Printer".
    3. Click "Next" button on the Add Printer Wizard window.
    4. Select "Local printer attached to this computer". Deselect "Automatically detect and install My Plug and play printer". Click "Next".
    5. Under Select a Printer Port option, select "Create a new port" and select "Standard TCP/IP Port" and click "Next" button.
    6. In the "Welcome to the Add Standard TCP/IP printer port wizard" make sure that the printer is turned on and connected to same network that your computer is connected to. Click "Next" button.
    7. Under "Add Standard TCP/IP Printer Port" enter the printer's IP address. Click "Next" then click "Finish".
    8. Now, select HP from the list of manufacturers, select your printer from the list of Printer models and click 'Next' button.
    9. If you can't find your printer, you'll need to find the install CD and use the "Have Disk" option to select one of the hp*.ini files. Alternatively, you can select another HP printer model that is a similar type (series).
    10. Add the print spooler name and click "Next".
    11. Click "Next"
    12. Click "Next" and then "Finish"
    Say thanks by clicking "Kudos" "thumbs up" in the post that helped you.
    I am employed by HP

  • Unable to Access My "secure" home wireless network

    Airport works fine when finding unsecure networks requiring no password to log on, such as in public areas. But it won't work thru my secured wireless network. I use a D Link wireless router. Air port "sees" the network, but it requires a log on to gain access for the first time. I'm positive I have the right password. I've spent a lot of time with the ISP here in Kuwait, and granted, MAC isn't their strong suit, but they keep pointng back to the problem being with the computer. I can plug into the router with a cable and everything is fine and I can access my neighbors unsecure network thru his router...thanks neighbor. Any suggestions?
    Mac Book Pro 17"   Mac OS X (10.4.10)  

    I was having similar problems few things.
    1. Check to make sure drivers are up to date for Dlink. I would double check your settings for your router.
    2. This is more of a question. Do you have a lot of people that come over to your place and use your appartment? I was having problems with my Linksys Router and I decided to setup a Mac filter instead.
    3. Hard reset the router.
    4. Check D-links website see if the have any information regarding router problem.

  • I want to enter the password for a secure WIFI network on several iphones.  If I do this, can the end users somehow extract the ip address and password for the wifi network from the iphone and use it from a pc (at home, for example)?

    I want to enter the password for a secured wifi network on several iphones.  If I do this, is it possible for the end users to somehow extract the ip address and password information and use it from a pc/laptop/other mobile device.  For security reasons, I don't want them to be able to to this.
    Please advise,
    Thanks.

    If you look at the top left of your screen you will either see a 3G (or 4G if you have AT&T) or you will see the wi-fi symbol.  If you don't see the wi-fi symbol you are connecting to Gmail through your cellular data plan, not via wi-fi.
    To answer your question, it doesn't happen often but when it does the steps I mentioned above will normally resolve it.  Hopefully you won't have any further problem with this.

  • I want to be able to totally block the FaceTime functionality in my home network.  I would like to do this at the router level.  Does anyone know the hostname or IP address that the FaceTime application uses? Or which port it connects to?

    I want to be able to totally block the FaceTime functionality in my home network so my 4 kids aren't using the Facetime feature- It was easy for Skype just had to enter the work Skype on my Router Security list- and it denies access. I would like to do this at the router level for FaceTime? Only site I find in init.ess.apple.com - is this the startup site for Facetime?   Does anyone know a site I can block, hostname or IP address that the FaceTime application uses? Or which port it connects to?

    I would presume so, but it might be worth your while to experiment and play around with different combinations to see if you can block FaceTime while keeping Game Center open.  Good luck!

  • How do I use my wireless Led TV as a second monitor using my home network without any cables? Both of them are connected to home network

    How do I use my wireless Led TV as a second monitor to my mac book pro using my home network without any cables? Both of them are connected to home network

    Having a gateway there is not going to be a problem. We just need to configure the Time Capsule correctly to work with the 2Wire.
    You will need one ethernet cable to connect the 2Wire to the Time Capsule and a second ethernet cable to temporarily connect your computer to the Time Capsule so that it can be configured.
    The 2Wire you have now should already be broadcasting a wireless network, so once you have the Time Capsule setup, you will actually have two wireless networks there.
    Here's how to configure the Time Capsule to work with the 2Wire:
    Connect an ethernet cable from one of the LAN <-> ports on the 2Wire to the WAN (circle icon) port on the Time Capsule.
    Connect another ethernet cable temporarily from your computer to one of the LAN <-> ports on the Time Capsule
    Open Hard Drive > Applications > Utilities > AirPort Utility
    Click Manual Setup
    Click the Base Station tab below the row of icons to assign a name for the Time Capsule, a device password (write this down) and adjust time zone settings
    Click the Wireless tab below the row of icons
    Wireless Mode....Create a wireless network
    Wireless Network Name....Your choice
    Radio Mode....Automatic
    Channel...Automatic
    Wireless Security...WPA/WPA2 Personal
    Wireless Password....Your choice (write this down)
    Check mark next to....Remember password in keychain
    Click the Internet icon
    At the bottom, change the setting for Connection Sharing to "Off (Bridge Mode)"
    Click Update at the lower right and the Time Capsule will restart after 20-25 seconds and you should get the green light.
    You should now be able to connect to your Time Capsule wireless network.
    I'm not clear on whether you have tried to setup the Time Capsule to backup your computer. Post back if you need some info on that. We may need to start another thread for that as that will be a different subject.

  • Set up a Foscam wireless webcam through BaseStation 7.71 inside and outside of my home network.

    I bought a X10 wireless Security Camera last year and it took me months to figure out how to set it up to access the video both inside my home and through my iPhone remotely, even on my Mac at my office.  I thought I would provide my process of getting this done to help those trying something similar.  Yes the X10 camera works as a Foscam Camera.  I am very happy with the result.  The biggest  challenge was Port Forwarding the Apple Basestation but now that I figured it out, it is easy.
    "How I set up a Foscam wireless webcam through Apple Hardware and software to work inside and outside of my home network seemlessly."
    What you need:
    -Foscam or compatible camera, (iPad or iPhone or Mac or better all three)!
    -Service Provider Router.
    -Apple Base Station, Extreme or Express. 7.71
    -'ip scanner' (software for Mac, app for iPad/iPhone.
    -CCTV Camera pros port scanner app for iPhone.
    First REMOTE ACCESS
    Go to www.dyndns.org and set up an account. For about $20/yr you can have 30 host websites.  Write down the user name and password as you will need it later.
    You need  this service to have a stable website to see your camera outside your network later as 'ip' addresses can change but this site will remain stable.
    Then after you log back in, create a 'host website' from the menu.  When you are creating the host site, dyndns will give you lots of web address choices or you can create your own. Just pick one. Also, you will need the 'ip' of the server where the camera will be. Luckily the dyndns website tells you this, just select it. Write down the web address, click create and you are done this part.
    Next you need to set up the camera.
    CAMERA SET UP
    Using an Ethernet cable, connect your Apple Base Station to your web cam.
    You will need to run 'ip scanner' to see the 'ip' address for the web cam. Write down the 'ip'. Select it, then select "open device in".  Pick browser.
    A web page will be launched and you are given 3 choices. I picked the middle, 'push browser'.  You are then asked for the user name and password for the camera. By default the user is 'administrator' and there is no password. Just click log in. You now will see a menu along the left, at the bottom it should say 'device management'. Select that. Another page will show and there are several important things to do here.
    1. Alias - give a name to the camera.
    2. Set the time from a server.
    3. Users - set a user and password. Write this down as you will need it.
    4. Basic network. Either check to 'Obtain IP from DHCP Server' or specify an IP you want to stay the same. You need the subnet and main DNS server and the Gateway (same thing like 192.168.0.?or 10.0.0.? or 172.16.0.?)
    Decide on a port you want use. Write this down. The camera will reboot, you will need to log in. In the browser enter IP then : the port#.  Like 192.168.0.?:80 you will need the camera user name and password.
    5. Wireless-scan for the nearby network list. Pick your network, enter your password, click submit. It will reboot.
    6. UPnP-check to use.
    7. DDNS Service (this allows remote viewing) pick DynDns.org
    Enter your DynDns user name and password.
    Enter the long DynDns Host website you wrote down. Click Submit. It will reboot. 
    APPLE Basestation set up
    Run Airport Utility on Mac or iPad or iPhone.
    Tap basestation, tap edit, tap advanced, tap Port Settings, tap 'new entry', in description enter a name, enter HTTP port number you picked when setting up the camera in all 4 spots: public and private UDP and TCP. Enter the IP address you picked in the camera setup. Click done and again until the Basestation updates.
    Run the CCTV app, pick 'tools', pick 'Port forwarding Checker'. Enter the port you selected to see if it shows open then you are good. If not go back through the steps.
    Set up Foscam App on the iPad and iPhone.
    Run App, tap Add Camera,
    Label- enter a name
    User- Camera user name
    Password- Camera
    Local camera address-the IP address eg 192.168.0.?
    Port- the one you specified.
    If it connects you will see the chain turn green.
    Remote address- the long one from DynDns.
    Port- the one you specified.
    If it connects you will see the chain turn green.
    Tap done.
    If everything is entered correctly it will all work.
    Trouble shooting, make sure the IP address for the camera is listed correctly in the Apple Router.  If it changes on the network, just go into the Airport Utility and update that.  Also make sure the dyndns address is correctly listed in the Camera set up.
    If questions, just let me know.

    Ok.. you have to work out the way you are going to access the TC..
    There are basically three methods..
    1. Direct access using AFP.. you need a static public IP and the TC as the main internet router.. then you need to turn on internet access and password the hard disk. The college has to have port 548 open.
    If you do not have a static public IP then you can use ddns service but there is no client in the TC.. so you will have to figure out a way to update the service.
    2. Use BTMM with icloud. This is the Apple method. It actually uses vpn..(the vpn is locked to apple use only but it is not available to end user).. The requirements are 7.6.1 firmware and lion or ML on a Mac computer. I am not sure of the ports because the link to the Apple cloud is separate from the vpn to your home system.
    3. VPN.. that means you need to bridge the TC and use a decent quality vpn modem / router or combo thereof.
    VPN are not for the faint of heart.. it can take a lot of work to get running but offers the best security.. you will need to change the network equipment in your house more than likely.. using a pc / mac as a vpn server is possible.. but messy.
    There are also easy ways to at least access the home computer.. teamviewer for example. This is likely blocked by the college though.
    Double NAT is where you put a router on a private IP behind another router on a private IP.. that makes port forwarding close to impossible.

Maybe you are looking for