Fr Robert, tell us about your home network I heard you say once that every person device gets ...

[G+_Ian Treleaven]

Fr. Robert, tell us about your home network. I heard you say once that every person/device gets their own VLAN. What's your preferred setup for a home network?

[G+_Travis Hershberger]

Considering that he lives in a dorm, he's probably got an enterprise class network at home!  A different VLAN for each room actually makes a kind of sense, but not for every single device.  I wouldn't want to maintain it at least.

[G+_Fr. Robert Ballecer, SJ]

1. I don't live in a dorm -- I live in a community of Jesuit brothers. -- Dorms have a lot more noise and booze... while we have a lot more antacids and coffee.

 

2. I run an Enterasys D2 Enterprise switch (12-port Gigabit with PoE + 2 SFPs for the fiber uplink to the campus network.) All my policy is baked into the switch, so it manages all the VLANs in real-time.

 

Connected to the D2 are several HP Intellijacks (Managed 4-port PoE Gigabit switches)

 

As new devices are connected they are put on an untrusted VLAN that has Internet access, but that's it.. If they successfully authenticate 802.1x they get their own trusted VLAN so that they can see my network resources, but not the other devices on the network. 

 

As devices request other devices on the network, and if they are authorized to do so, the switch generates another VLAN tagged to the ports those devices are on.

 

This keeps devices from scanning the network (unless I allow it) and ensures that any rogue devices on the network that start looking for other devices to infect will see nothing on the network but the default gateway. Since "connected" VLANS are generated on the fly between ONLY the devices that are communicating with one another, it also greatly mitigates the possibility of MITM attack by a compromised, trusted device. 

 

I use Xirrus arrays for my WiFi, so the VLAN policy extends even to wireless devices on my network.

 

Peace,

Padre

[G+_Fr. Robert Ballecer, SJ]

BTW... I would NOT suggest that for a home network...

 

Unless you've got a few thousand dollars of Enterprise gear hanging around. :)

[G+_Mikael Eidsvaag]

you can try a hp 1810-8g with pfsense, but beware that you are creating a nat nat problem.