Wireless Security Management

What it is

Wireless security management is the set of controls that keep a wireless network safe after the encryption is set up.

Encryption protects the traffic. Management controls decide which clients may join, what they can reach, and how the devices themselves are protected.

Good management also includes watching for rogue devices and keeping the access points up to date.

How it works

Several small controls work together, and none of them is enough on its own.

Access list and connect list

On the legacy wireless package, the access list is applied on an access point and decides which clients may join. The connect list is applied on a client and decides which access points it may join.

/interface wireless access-list add mac-address=AA:BB:CC:DD:EE:FF interface=wlan1 authentication=yes forwarding=yes
/interface wireless set wlan1 default-authentication=yes default-forwarding=yes

• mac-address identifies the client.
• authentication says whether the client may join.
• forwarding says whether the client may talk to other clients on the same access point.
• default-authentication and default-forwarding apply to clients that match no rule.

An entry can also have a signal range or its own key. The CAPsMAN chapter shows the matching access list features.

MAC filtering

Allowing only listed MAC addresses is a weak control. MAC addresses are visible in the air and can be copied.

Use it to organise clients or to add a second check. Do not use it as the main protection.

Client isolation

Setting forwarding to no stops one wireless client from talking to another on the same access point. This is called client isolation.

It is useful on guest networks. Each guest can reach the internet but not the other guests. On the wifi driver, client isolation is a setting in the datapath.

Hidden SSID

Hiding the SSID stops it appearing in a simple scan. It is not security, because the name still appears in client requests and can be found by anyone who listens. It can even make clients probe for the name in every place they go.

WPS and other weak features

WPS lets a device join with a short code or button. Its design has flaws that make it a risk, so turn it off where it is not needed.

Rogue access points

A rogue access point is one that the network owner did not approve. It may be an employee's own router or an attacker's fake.

You can look for rogues with the scan and snooper tools, and compare the SSIDs and MAC addresses to your own list. Enterprise authentication with server certificate checks also protects clients from fake access points.

RADIUS and per client control

An access point can ask a RADIUS server to decide on a client by its MAC address. This lets one central server manage many access points. A client can also have its own pre shared key, so you can revoke one device without changing the key for all.

Protecting the devices

A wireless device is a router as well.

• Use strong passwords and remove default access.
• Limit which services run and which networks can reach them.
• Disable discovery and management services on the wireless side if they are not needed.
• Keep RouterOS and the firmware up to date.

/ip service print
/tool mac-server print

• /ip service print lists the management services and the address each one accepts.
• /tool mac-server print shows the layer 2 management access that you may wish to limit.

Separating networks

Put guests, staff and devices on different SSIDs and VLANs. Isolation keeps a problem in one group from reaching the others.