How to add WIFI to my office painlessly? - Page 2

cool_chick · 01-02-2007, 01:42 PM

Quote:

Originally posted by svandamme
i'm sure it is, but it's not more secure then not having a physical link between the two... furthermore, i'm sure your work has a larger budget for these things, and somebody to look after the setup and the users in it.... this is a docters office of some kind, with patients... 802.1x with a backend to sort out the traffic , isn't really a KIS solution...

It's pretty secure, dude. There's no worries with regard to that....

And oh we have a hell of a budget alright....one of the reasons I love the job!

Personally, if I were him, I'd put a stand-alone PC. I agree, most of us don't take our laptops to the doctor. If I needed anything, I'd have my blackberry. It's a nice offering, but I wonder how utilized it will be. However, he could be setting the trend for the future....I dunno.....you can get a lot done waiting what seems like forever for your appointment.....

For him, yes, separate network, separate DSL line, etc. There's no need to have production on the WIFI unless the office workers have laptops. The advice contained herein is all accurate.

nostatic · nostatic's Garage

you guys are all paranoid. Then again, i guess you're running windoze...

At my last two places I have *insisted* on having open wireless (albeit with limited port capabilities). I run my home network wide open as well. If someone wants my bandwidth, have fun...I don't pay by the bit. And I have yet to see a homeless person outside stealing signal or trying to hack govt computers from my bushes.

All this draconian stuff is an IT manager's wet dream, and a nightmare for someone who actually needs ubiquitous network access...

mikester · 01-02-2007, 09:35 PM

regarding 802.1x - it is fairly secure but still breakable - though I don't know how to do it and I consider myself pretty high up there in the network security no-how arena. Cool; don't get too full of yourself - the fall when your network is compromised even by accident will be a hard one.

802.1x the protocol is actually very secure but still relies on stupid humans to implement it. So, you have 802.1x implemented - how many client certs are there? 1 for all or 1 for each individual computer? If it is 1 for all then I can bet with confidence that your network is already compromised. If it is 1 for each client then I will still bet that certs are not being revoked properly at termination and thus still useable. All of these things equal insecure.

Next question; how secure is the radius server doing your 802.1x authentication?

How secure is your port management on your switches? Are all workstation ports set with port fast and bpdu guard enabled? If not; I'll bring over my cheap switch and figure out your VTP domain name, set mine the same with a higher revision number and figure out your authentication and then erase all of your vlans for you. :-)

Just for kicks.

Still, this guy's not looking for this indepth of a solution. He can do what he wants to do very easily with a second DSL connection and an off the shelf wireless router that supports WPA2. Really, he could leave it wide open but if someone were to do something bad on his network he would open himself up to some liability. If he didn't get releases from his patients and they did something bad with the access he would still be open to some liability. The key here is that if he's in the US he needs to comply with HIPAA and the easiest way to do that is to ensure that these two networks are separate.

89911 · 01-03-2007, 04:21 AM

A stand alone computer seems to be the trick. I've got plenty of outdated ones that I rotated as workstations until they can't handle the next software upgrade. I actually have an extra dsl modem from my home that I have since upgraded to cable. I'm using the same dsl provider in my office. Could a split the phone line thats coming into for the dsl to operated two modems? Then run them separately after this? Thanks again. Geez, this is better then talking to Dell in India!

svandamme · svandamme's Garage

i'de avoid a standalone pc like the plague

for one thing it still needs to connect to "something"
and you cannot run it with "internet sharing" one of the existing pc's

it's a liability for more reasons then one
and will require managing the box, and continious checking if the lock down has not been comprimised... all in all, not a good solution
you do not want to be bothered keeping the pc running, with patient and their kids screwing up the box all the time... unless you are a masochist pc hobbyist

trust me on this one, you do not want to maintain a public accessible pc
they will screw it up if it has anything more then a touch screen with menu options...

having wifi enabled from a second dsl line, and then having patients connect with their own laptop or pda's is fine, if they cannot figure out how to connect their own gear to your patient wifi net with the wifi hotspot info posted, then train your people to shrug shoulders and say "i'm not the network geek around here, sorry it works for most people"

89911 · 01-03-2007, 04:46 AM

I think you misunderstood me. I am going to have one computer away from patients that is controlling a wireless router. Thats it. The computer will be a marginal one at best, at least good enough to configure a router

If I can spit off the modem to seperate, I'm looking at not increasing any monthly fees.

masraum · 01-03-2007, 08:17 AM

It is usually possible to use a wireless router as an access point or a router if the router has a few wired switch ports as well as wireless.

89911 · 01-03-2007, 08:42 AM

Quote:

Originally posted by masraum
It is usually possible to use a wireless router as an access point or a router if the router has a few wired switch ports as well as wireless.

Understood. I'm trying to leave my present set up out ot the loop, since I have the wireless router configured for multiple remote hosting on several workstations Not saying I can't do it, but I'm not looking to change something that is functioning fine.

masraum · 01-03-2007, 11:18 AM

Well, technically you can even hook the new wireless router up as a router and just have it assign it's own IP's and NAT/PAT them just as it would any place else.

I've read and re-read your initial post. I guess I just don't understand what you are looking for. I'm betting that there's a 99% chance that you can do whatever you want, but I just don't understand what you want.