Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cisco 877W Dual SSID/VLAN Security Issue

Hi All

 

I have an issue with my 877W that is as fascinating as it is frustrating. I have two SSIDs/VLANs, one for trusted LAN users (PRIVATE), and one for guests (GUEST).  The PRIVATE network is secured from the GUEST nework by zone based firewall. Everything works fine, guest devices cannot access private devices, except for one thing - the BVI interface on the PRIVATE network is always accessible to guest devices, and all services open to attack eg telnet/ssh/http/dns etc. I've tried everything to secure this interface from the guest network, including putting deny any any on physical, BVI and VLAN interfaces

Am I missing something obvious, or some fundamental architecture of the 877 that would stop this interface being secured? Any help aprreciated!

P.S config has been pared down to basics below

 

version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ROUTER
!
boot-start-marker
boot-end-marker
!
logging buffered 4096
enable secret 5 $1$BdpF$r/mAhQGYs8LBlqEpANmke0
!
no aaa new-model
!
dot11 syslog
!
dot11 ssid PRIVATE@123
 vlan 100
 authentication open
 authentication key-management wpa
 wpa-psk ascii 7 046B0A535A15441D2D0C11141A5A5F
!
dot11 ssid VISITOR@123
 vlan 200
 authentication open
 authentication key-management wpa
 mbssid guest-mode
 wpa-psk ascii 7 03374C0A08392040420C00
!
ip source-route
!
no ip dhcp conflict logging
ip dhcp excluded-address 172.16.1.1 172.16.1.10
ip dhcp excluded-address 192.168.0.1 192.168.0.10
!        
ip dhcp pool GUEST
 utilization mark low 70 log
 network 172.16.1.0 255.255.255.0
 dns-server 192.168.0.1 61.9.242.33 61.9.226.33
 default-router 172.16.1.1
!
ip dhcp pool PRIVATE
 utilization mark low 70 log
 network 192.168.0.0 255.255.255.0
 dns-server 192.168.0.1 61.9.242.33 61.9.226.33
 default-router 192.168.0.1
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
username cisco privilege 15 password 7 073F205F5D1E491713
!        
policy-map type inspect PM-DENYGUEST
 class class-default
  drop
!
zone security GUEST
zone security PRIVATE
zone-pair security GUEST-TO-PRIVATE source GUEST destination PRIVATE
 service-policy type inspect PM-DENYGUEST
!
bridge irb
!
interface ATM0
 no ip address
 shutdown
 no atm ilmi-keepalive
!        
interface FastEthernet0
 no ip address
!
interface FastEthernet1
 switchport access vlan 100
 no ip address
!
interface FastEthernet2
 switchport access vlan 100
 no ip address
!
interface FastEthernet3
 no ip address
!
interface Dot11Radio0
 no ip address
 encryption vlan 100 mode ciphers aes-ccm
 encryption vlan 200 mode ciphers aes-ccm
 broadcast-key vlan 100 change 30
 broadcast-key vlan 200 change 30
 ssid PRIVATE@123
 ssid VISITOR@123
 mbssid
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 station-role root
!
interface Dot11Radio0.100
 encapsulation dot1Q 100 native
 zone-member security PRIVATE
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.200
 encapsulation dot1Q 200
 zone-member security GUEST
 bridge-group 2
 bridge-group 2 subscriber-loop-control
 bridge-group 2 spanning-disabled
 bridge-group 2 block-unknown-source
 no bridge-group 2 source-learning
 no bridge-group 2 unicast-flooding
!
interface Vlan1
 no ip address
!
interface Vlan100
 no ip address
 bridge-group 1
!
interface Vlan200
 no ip address
 bridge-group 2
!
interface Dialer0
 ip address negotiated
 ip access-group 101 out
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ppp authentication chap callin
 ppp chap hostname podfive@bigpond.com
 ppp chap password 7 10580A4F1C4005005B
!
interface BVI1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 zone-member security PRIVATE
!
interface BVI2
 ip address 172.16.1.1 255.255.0.0
 ip nat inside
 ip virtual-reassembly in
 zone-member security GUEST
!
ip forward-protocol nd
ip http server
ip http access-class 2
ip http authentication local
ip http secure-server
!
ip nat inside source list 1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
!
logging trap debugging
logging 192.168.0.11
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
bridge 2 protocol ieee
bridge 2 route ip
!
line con 0
 exec-timeout 5 0
 no modem enable
 transport output all
line aux 0
 exec-timeout 0 1
 no exec
 transport output none
line vty 0 4
 exec-timeout 5 0
 login local
 transport input telnet ssh
 transport output none
!
end

Everyone's tags (4)
1 REPLY
New Member

Ignore that. self zone got me

Ignore that. self zone got me. Argh! phew!

78
Views
0
Helpful
1
Replies