For the security of our lab, we need to isolate untrusted network segments as is required according to the communication rules described in Chapter 3, Configuring Networking Lab Components. Let's quickly recall them:

First, we need to block all the incoming traffic from the external network and isolate the guest WLAN. Log in to the router console, start the configuration mode, and create an ACL for that purpose called wan with the following commands:

ip access-list extended wan
remark deny access from wan
deny ip 192.168.0.0 0.0.255.255 any log
deny icmp 192.168.0.0 0.0.255.255 any
exit
ip access-list extended guest
remark deny access to guest wlan
deny ip any 192.168.0.0 0.0.255.255
deny icmp any 192.168.0.0 0.0.255.255

Let's quickly explain what we have just done:

Now, we need to apply the ACL to the router subinterface, serving communications with an external network (in our case it is fa0/0.5). Exit the ACL configuration mode and get into the interface configuration mode (if you have defined sub-interfaces other than the ones we have done, just substitute fa0/0.5 with the one corresponding to your subinterface connected to a SOHO router):

interface fa0/0.5

Now, assign the ACL called wan to be applied on network traffic coming to the subinterface from outside:

access-group wan-in in

Next, assign the ACL called guest to be applied on network traffic coming to the subinterface from inside:

access-group guest-out out

The following ACL for the rest of the router subinterfaces can be created and applied in a similar manner. Therefore, we will put them in a table for convenience:

We are going to install FreeRADIUS on a Debian-based virtual Linux server and put it into the server subnet on IP address 10.0.0.6. The installation process is very similar to the Ubuntu Server installation process:

wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.9.tar.gz
tar zxfv freeradius-server-3.0.9.tar.gz
cd freeradius-server-3.0.9
./configure
make
make install

Every authorized user in our lab will have a personal certificate for the trusted WLAN connections, and it is logical to prepare certificates before we start to put their paths into the server's configuration.

You can use the lab certificate authority installed in Chapter 4, Designing Application Lab Components, to create all the necessary certificates. We already have a CA certificate created, so we only need to create server and client certificates and sign them with the CA:

You can create multiple client certificates for as many users as you would like to allow access to your lab via the trusted WLAN. Copy the server and CA certificates into the /etc/freeradius/certs/lab directory on the FreeRADIUS server.

Now, it is time to configure FreeRADIUS for our needs. The configuration files can be found in the /etc/freeradius directory.

We are interested in the following configuration files now:

client 172.16.1.2 {
        secret = YourSecret
        shortname = TrustedWLAN
}

default_eap_type = tls
tls {
     certdir = ${confdir}/certs/lab
     cadir = ${confdir}/certs/lab
     private_key_password = YourServerKeyPassword
     private_key_file = ${certdir}/radius.key
     certificate_file = ${certdir}/radius.pem
     CA_file = ${cadir}/rootCA.crt
     dh_file = ${certdir}/../dh
     random_file = /dev/urandom
}

We have already configured the Ethernet interface of the access point in Chapter 3, Configuring Networking Lab Components, but we have omitted the wireless interface configuration because it is highly dependent on a RADIUS server which we didn't have before the current chapter. Now it is time to fill this gap:

As a closing step, we need to test our newly created WLAN by connecting a client machine to it. Let's do it on a Windows 8.1 machine:

Now, you are connected to the trusted WLAN and can penetrate our vulnerable servers. So far, we have reliably secured our trusted WLAN and the whole lab network from an unauthorized network access. We have almost reached the main goal of the book: building a lab with wireless access protected from attacks from outside.

Cisco devices have a feature called Switched Port Analyzer (SPAN), which basically mirrors network traffic from selected source ports to a selected destination port. We need this feature to copy network traffic coming through the server VLAN to our network-based IDS for further analysis.

We are going to monitor the whole server traffic (ports fa0/7-fa0/10) on the fa0/11 port, so let's configure SPAN on our core switch with the following commands:

enable
config t
interface fa0/11
port monitor fa0/7
port monitor fa0/8
port monitor fa0/9
port monitor fa0/10
end
copy running-config startup-config

Snort is a free, open source network Intrusion Detection System (IDS) capable of performing packet logging and real-time traffic analysis in IP-based networks.

This IDS identifies the following:

Taking into account the following points, we have a system with powerful features for security monitoring:

Snort can be executed on various operating systems: Windows and Unix-like. In our case, we are using Ubuntu Server 14 and we will consider the Linux distribution.

apt-get install snort

service snort start

cp -R ./rules/ /etc/snort/
cp -R ./so_rules/ /etc/snort/
cp -R ./preproc_rules/ /etc/snort/

service snort restart

service snort restart

snort -D -dev -c /etc/snort.conf

ifconfig -a