davidelang
commented
1 month ago Owen DeLong wrote:
Description
Currently, we have applied a workaround for IoT (and other trainings) which require wired devices on the same broadcast domain as wireless devices by dedicating 8 ports on each of the cfRoom switches as untagged cfSCALE-FAST.
This is a security risk as well as an improper use of this global WiFi VLAN.
I propose instead, that we add the cfInstall VLAN as an additional "SCALE-TRAINING" SSID on the 2.4Ghz radios only.
ideally this would only be in the room that's doing the training. (first use case for our netmap parameter? although I think it only does wired currently)
This would give us the ability to impose additional limitations on that VLAN (e.g. not allowing it to communicate with other conference VLANs, limitations on its internet access, etc.
yes, we need to do more of this sort of thing
I'd also like to see us use semi-smart tabletop switches for all of the training labs that would use these ports. In this way, the ports could be tagged on the cfRoom switches and converted to untagged by the tabletop switches. This would prevent casual use of the ports in non-training rooms by conference attendees.
sounds good, there are a lot of pretty cheap 8 and 16 port switches out there that are low power and small (much better for the tables than using enterprise grade switches, even if the price delta isn't that much)
David Lang
These are a couple of possible solutions. I'm open to additional suggestions or better ideas.
Acceptance Criteria
No further untagged ports open on switches in public accessible areas Better security audit and control of the Install VLAN Implementation of the above across all cfRoom switches.
owendelong
Description
Currently, we have applied a workaround for IoT (and other trainings) which require wired devices on the same broadcast domain as wireless devices by dedicating 8 ports on each of the cfRoom switches as untagged cfSCALE-FAST.
This is a security risk as well as an improper use of this global WiFi VLAN.
I propose instead, that we add the cfInstall VLAN as an additional "SCALE-TRAINING" SSID on the 2.4Ghz radios only.
This would give us the ability to impose additional limitations on that VLAN (e.g. not allowing it to communicate with other conference VLANs, limitations on its internet access, etc.
I'd also like to see us use semi-smart tabletop switches for all of the training labs that would use these ports. In this way, the ports could be tagged on the cfRoom switches and converted to untagged by the tabletop switches. This would prevent casual use of the ports in non-training rooms by conference attendees.
These are a couple of possible solutions. I'm open to additional suggestions or better ideas.
Acceptance Criteria
No further untagged ports open on switches in public accessible areas Better security audit and control of the Install VLAN Implementation of the above across all cfRoom switches.