VLAN Configuration

Right now the Meraki Router/Firewall and Access Points are all controlled by church headquarters. However there is no documentation or instruction about configuring the devices for security purposes such as adding separate VLANs, DHCP guard, layer 2 filtering, etc.

Right now I have big security concerns with all of my buildings simply due to lack of documentation and all of the computers and wireless access points on the same broadcast domain using dumb (non-managed) layer 2 switches to network everything together.

With the new program replacing MLS and ward leaders wishing to print from their office (ex: temporary recommends), wireless printers are being requested and approved for purchase. Granted, wireless connectivity will have to be disabled for security purposes, but scanning will be a thing that all ward and stake clerk's will need access. Since the church will not be purchasing scanners for wards that will need them for the new program, wards are going to be purchasing their own multifunction printers. I found out Xerox scanners do not transmit scans over USB directly to the computer , so that is another thing I have to be wary about.

Lastly, as I know that not every tech-savvy person knows how VLANs work and are configured, I cannot simply replace dumb switches with managed switches and leave. I can leave documentation and hope someone knows what to do , but also the church and FM group do not supply managed switches

1) Is there ready documentation explaining all the rules in place on the firewall/routers? (Yes I know about the dumbed down version)
2) Is there ready documentation explaining all the rules in place on the access points?
3) Is there a way to put individual LANs/broadcast domains on each router port (get the church to configure it)? That way I could put one broadcast domain on one port and another broadcast domain on another port and have everything run through the firewall, separating wireless and wired devices.
4) Would it be possible to put all ward offices on their own VLAN?
5) Is there a reason why the church purchases routers and access points for each building but not managed switches?

AnthonyBowers wrote:Right now the Meraki Router/Firewall and Access Points are all controlled by church headquarters. However there is no documentation or instruction about configuring the devices for security purposes such as adding separate VLANs, DHCP guard, layer 2 filtering, etc.

I'm sure there's documentation, they just don't share it with the STS.

AnthonyBowers wrote:Right now I have big security concerns with all of my buildings simply due to lack of documentation and all of the computers and wireless access points on the same broadcast domain using dumb (non-managed) layer 2 switches to network everything together.

I share the concern - especially if for some reason the administrative share on the computer gets turned on. That's easy to do unintentionally trying to make some feature work. I have all mine disabled off.

AnthonyBowers wrote:With the new program replacing MLS and ward leaders wishing to print from their office (ex: temporary recommends), wireless printers are being requested and approved for purchase.

I'll refer you to the Meetinghouse Technology Policy

5.1.3 Local Unit Provided Equipment: Local unit budgets should not be used to purchase any printers, copiers, and multifunction devices. The costs for repairing, upgrading, and replacing any equipment not provided as part of new building construction or by the FM group are the responsibility of the local unit.

I'd also reference Handbook 1: 14.7.2.2 which prohibits units from using funds to buy computers. (In the context, it raises question of it includes pritners as well)

AnthonyBowers wrote:scanning will be a thing that all ward and stake clerk's will need access. Since the church will not be purchasing scanners for wards that will need them for the new program, wards are going to be purchasing their own multifunction printers.

No doubt, some people are going to go "whole hog" on the electronic thing, but as someone who's day job is building document scanning systems, scanning is more work than filing. Given the points above, it might be best to wait and see what the church comes up with.

AnthonyBowers wrote:1) Is there ready documentation explaining all the rules in place on the firewall/routers? (Yes I know about the dumbed down version)

None that I've ever seen - at least made available to an STS.

AnthonyBowers wrote:2) Is there ready documentation explaining all the rules in place on the access points?

Sames as #1.

AnthonyBowers wrote:3) Is there a way to put individual LANs/broadcast domains on each router port (get the church to configure it)? That way I could put one broadcast domain on one port and another broadcast domain on another port and have everything run through the firewall, separating wireless and wired devices.

You might call support and ask if they can enable the Special Purpose (SP) zone for your buildings. Typically it's used for a FHC, but that's probably about as close as you're going to get for what you want. Everyone in the SP zone is assigned a unique church-wide 10.x.x.x IP separate from the 192.168.x.x of the "unwashed masses" (User zone). Port 2 will become the SP port. However, I don't think it's a good idea to put any APs on this zone.

AnthonyBowers wrote:4) Would it be possible to put all ward offices on their own VLAN?

See #3

AnthonyBowers wrote:5) Is there a reason why the church purchases routers and access points for each building but not managed switches?

Probably cost. I notice that TM seems to support "switches", so I assume managed switches are supplied for some situations. I'd guess it's to get multiple zones at a remote spot without having to run separate cabling for each zone.

Wild guess here. The church uses managed switches in office buildings and other non-meetinghouse locations where you don't want random people attaching random computers to the network. Security first.

Right, but meeting houses are transmitting sensitive information back and forth between Salt Lake. Are they expecting security through obscurity to work? For the most part it does, but you need something at least at Stake Centers. I mean, the entirety of the building network is built on an unmanaged switch and basically open to the public (protected by a password known to pretty much every member).

While I know that the policy for technology purchases is there, the last our stake has heard from Salt Lake about getting scanners for the new program (I don't remember what it is called) replacing MLS was that Salt Lake and the FM Group will not be supplying printers with scanners.

My understanding is that the database files and transmission is encrypted. I wouldn't call it security though obscurity.

By policy, confidential information shouldn't be stored on the computer but in removable storage locked away.

Dispite my exalted title, I'm just another STS. You need to bend the ear of either support or your presiding authority to take up with their presiding authority.

AnthonyBowers wrote:Salt Lake and the FM Group will not be supplying printers with scanners.

Because clerks can use either cell phone cameras or the multi-function printer in the library to scan receipts?
I believe our new Xerox B405 copier allows us to scan directly to a flash drive.

Because clerks can use either cell phone cameras or the multi-function printer in the library to scan receipts?

Yes, however if you have ever seen elderly clerks fumble with cellular devices, you would question why that is an acceptable answer. I'm sure if President Nelson were to try doing it, he would also be asking for a bigger screen.

I believe our new Xerox B405 copier allows us to scan directly to a flash drive.

Yes you can transfer scans over a USB flash drive. Now what happens if that flash drive were to end up in someone else's hands and did a file recovery? All those deleted (if deleted) are now available. Xerox MFPs need replaced with something that will transmit over USB cable straight to the computer.

My understanding is that the database files and transmission is encrypted. I wouldn't call it security though obscurity.

How many of you trust Windows firewall to protect your computer from the Internet?

Dispite my exalted title, I'm just another STS. You need to bend the ear of either support or your presiding authority to take up with their presiding authority.

My hope isn't to get some immediate action. I have aired my opinions towards the local stake leaders who vocalize their 2nd handed recount to the area leaders so on and so on. I am hoping to bring to attention many security flaws that no one has answers to. I also hope that others will do the same.

Interesting points. When I was stake clerk, back when multiple members used the admin computer to enter data into MLS using a single Windows account, I cautioned all the ward clerks to always save confidential documents to a flash drive, never onto the hard drive, and to always store the flash drive in a locked cabinet. My counsel was very rarely followed.

These days, the only folks who use the admin computer are the bishopric, clerks, and maybe the exec sec. So physical security and account security have improved. I'm not really concerned about network security, although our use of a Pre-Shared Key for the Wi-Fi is a clear and present danger.

I don't know, but I wonder if Sophos Firewall is much superior to Windows Firewall. Let's hope so, given the higher license costs of Sophos. But this goes back to your point of local control. Does anyone at the local level have control, training, or experience configuring Sophos and locking it down?

I'm not really concerned about network security, although our use of a Pre-Shared Key for the Wi-Fi is a clear and present danger.

Look up layer 2 attacks and you will see there are a variety of attacks that are easy to use.

I don't know, but I wonder if Sophos Firewall is much superior to Windows Firewall. Let's hope so, given the higher license costs of Sophos.

Again, if you feel your Windows computer would be completely safe exposed to the Internet by itself, please do so. I accidentally left my management laptop exposed for 1 day and it got hacked, with a reputable Antivirus and Anti-Malware service. I put it back on my network and it took my entire network down. Didn't even try to fix it, just re-installed Windows it to keep it off the network and prevent additional devices (such as flash drives) from getting exposed. It would be a fun experiment to try with Sophos

AnthonyBowers wrote:Again, if you feel your Windows computer would be completely safe exposed to the Internet by itself, please do so.

The admin computers are not exposed to the internet. To everyone on the WiFi in the same meetinghouse, yes. But that's not quite the same.

The admin computers are not exposed to the internet. To everyone on the WiFi in the same meetinghouse, yes. But that's not quite the same.

What about open and active network ports in the newer buildings? Or someone planting a device? A cellular device has access to the Internet. There are multiple vectors to attack from. I am not even close to listing all of the possible attacks public buildings present. Even my original question does not account for all possible attacks, just simple ones anyone who knows how to use Google can do.

I hear your concerns and wonder why so much concerns on security of what is basically a home network. Even if you put a VLAN on the router it stills knows about all the VLANs on it. It knows how to route between them. The one thing it wouldn't allow is a broadcast to the other VLANS. Even manage switches would do the same.

One thought that just crossed my mind is to have the wireless access based on user accounts, so that only a member of the church can gain access to the WIFI. This would cut down on people outside of the church to get onto the network.

Now I'm going to change from security to bandwidth through the firewall. A few weeks ago, I tested the connection speed and I was only getting a 4 megabits/second download when I know that the Internet connection was 30 megabits per second. I checked it directly against the modem and I get 30 megs down.

I called the GSC and was told that there is a policy in place that states that there is VLAN rate limit applied. I'm like really? If that is true, then it is a lousy policy because each VLAN doesn't need to have a rate limit. We should be able to use the full bandwidth that we are paying for.

I would like to understand why this policy is in place and how can I (we) be able to get it changed so that we can use the bandwidth. Dont tell me that it could saturate the link to the service provider, because it could, but with rate limit, it is already being done. Could rate limit help the FHC, sure it could, but they are open generally during the week and not when the general church members are there.

AnthonyBowers wrote:What about open and active network ports in the newer buildings?

The only open RJ-45 in my meetinghouse is on the podium, but I agree that many meetinghouses have open RJ-45 jacks in the library and in other public areas. In the absence of a managed switch, we could simply unplug all unused connections from the unmanaged switch. Granted, that would not prevent someone from unplugging, say, the library copier, and using that port for their own devices.

harddrive wrote: One thought that just crossed my mind is to have the wireless access based on user accounts, so that only a member of the church can gain access to the WIFI. This would cut down on people outside of the church to get onto the network.

A few years back, this was a proposal looked at. At the time I believe it was discarded because it was rather complicated to set up. Things of course have changed since then and I suppose it might be revisited. However, I wouldn't hold my breath.

Biggles wrote:

harddrive wrote: One thought that just crossed my mind is to have the wireless access based on user accounts, so that only a member of the church can gain access to the WIFI. This would cut down on people outside of the church to get onto the network.

A few years back, this was a proposal looked at. At the time I believe it was discarded because it was rather complicated to set up.

As I recall, it would have required installing a certificate on each user's device. An impractical workload for the local STS.

AnthonyBowers wrote:What about open and active network ports in the newer buildings? Or someone planting a device? A cellular device has access to the Internet.

Why would someone go to that level of effort? What are they hoping to gain? For someone who does't know the church, that's a lot of effort for an unknown payoff.

If they are targeting something of the church, it seems like a phishing email to a bishop or clerk to hijack their Church Account credentials would be far more rewarding. Such an attack could be launched by anyone from anywhere in the world, unlike an attack that would require them to be at least within WiFi range.

harddrive wrote:I hear your concerns and wonder why so much concerns on security of what is basically a home network. Even if you put a VLAN on the router it stills knows about all the VLANs on it. It knows how to route between them. The one thing it wouldn't allow is a broadcast to the other VLANS. Even manage switches would do the same.

Well the first mistake is considering a church building a home network. It is a small business network. It should be equivalent to the network of a chain restaurant. The point of a VLAN is to separate broadcast domains. Broadcast domains are all the possible IP addresses that can be assigned on a subnet (192.168.0.0/24= 192.168.0.0-192.168.0.255; 192.168.0.0/18= 192.168.0.0-192.168.63.255). It would be like yelling in your home to see who is there. VLANs large networks into smaller networks while using the same network equipment causing all inter-network traffic to go to the router/firewall where access rules are set.

harddrive wrote:One thought that just crossed my mind is to have the wireless access based on user accounts, so that only a member of the church can gain access to the WIFI. This would cut down on people outside of the church to get onto the network.

Easier option is to add a guest or second network with a password (client isolation for public use) and on a separate VLAN and set a really long password for the main wireless network that ward and stake leaders have.

harddrive wrote:I called the GSC and was told that there is a policy in place that states that there is VLAN rate limit applied.

They probably have it in place for QoS reasons (bad implementation).

russellhltn wrote:

AnthonyBowers wrote:What about open and active network ports in the newer buildings? Or someone planting a device? A cellular device has access to the Internet.

Why would someone go to that level of effort? What are they hoping to gain? For someone who does't know the church, that's a lot of effort for an unknown payoff.

Why would someone sniff wireless traffic in a cafe or restaurant? Credit card information, general browsing data, emails, passwords, etc. It is all potentially valuable information.

I know what a VLAN is and what it's function is. I misspoke that a church network is like a home network, however the VPN that is on the firewall is only for management and no other traffic, except for a FHC or the facility network goes across it. Everything goes directly to the Internet.

In my book by adding extra VLANs is actually complicating things. You would need a separate switch for each VLAN just like I had to do for my FHC that run through the same firewall. You would have to know which switch goes to switch subnet and then if someone comes in to troubleshoot the issue and dont know the set up then they could do something to bring down the entire network. Also unless you want to be in the calling of Stake Technology specialist for the rest of your life, then the next person will need to know the setup. Also the church has dumb down the system that I feel like I'm a tier 1 dummy instead of a tier 4 engineer professionally. So basically reboot and it comes up great, if not call GSC to see what is going on.

Also the only reason that I can see for VLAN rate limit is so that each VLAN gets equal share. In my large organization that I work for, there is no VLAN rate limit. So if it isn't done in a large organization then why do it in a small environment.

The principal of KISS is what is needed. It makes life so much better.

harddrive wrote:I know what a VLAN is and what it's function is.

harddrive wrote:In my book by adding extra VLANs is actually complicating things. You would need a separate switch for each VLAN just like I had to do for my FHC that run through the same firewall. You would have to know which switch goes to switch subnet and then if someone comes in to troubleshoot the issue and dont know the set up then they could do something to bring down the entire network.

Router on a stick was the topology I was thinking. 1 router, (at least) 1 switch, and (at least) 1 wireless access point. The router controls all of the subnets. The beauty of VLAN trunking from the router to the switch is that it is 1 cable capable of supplying 1000+ subnets. You then use the switch to control which port gets which VLAN (ex: 100 = public {192.168.100.1/20}, 200 = clerk ward 1 {192.168.200.0/24}, 205 = clerk ward 2 {192.168.205.0/24}) and then you can use unmanaged switches past that switch in each clerk office if you need more ports or have another need. This model is very simple. If you have the router in a clerk's office, you can utilize one or all of the remaining router ports. How many devices are in your clerk offices? The point of this model is to have most if not all traffic run through the firewall.
I can make it even simpler, 1 VLAN for public traffic, 1 VLAN for church devices and management.

harddrive wrote:Also the church has dumb down the system that I feel like I'm a tier 1 dummy instead of a tier 4 engineer professionally.

What is the difference between the church configuring 2+ network devices vs 3+? You only add 1 additional page of instruction of what plugs into which port (BTW: same documentation as router for its different ports). The church can set it up however they want, they are controlling all of the devices anyway.

harddrive wrote:The principal of KISS is what is needed. It makes life so much better.

And that is why there are zero locks on people's homes.

AnthonyBowers wrote:Why would someone sniff wireless traffic in a cafe or restaurant? Credit card information, general browsing data, emails, passwords, etc. It is all potentially valuable information.

Seems like a church would be comparatively poor place to sniff. But now you're moving away from threats to the admin computers.

But it seems the underlying issue is cost. As best as I can find, the church has 15,174 wards in North America alone. Even if we assume that there's an average of 3 wards per building, that still over 5,000 buildings. It quickly adds up to a pretty penny.