Restrict Roaming Users Access

Where I work, we have users who work on the internal network and
roaming users who work out on site, but reguarly visit the office. The
users working on the internal network have their internet access
restricted so they cannot access anything malicious. However, the
roaming users internet access is not restricted. My boss is keen for
the roaming users to be able to come in the office, and have wireless
access to certain files/folders on the file server and printers on the
internal network. However, he is keen that they do not have full
access to the network as they could have malicious files on their
laptops that could infect the whole network. What is the best way to
go about doing this? The only solution I've been offered so far is to
have a completely separate network with a file server that reguarly
synchronizes with the internal network and to have seperate printers
as well. Has anyone got any better ideas?

On Oct 1, 1:07 pm, addyg...@hotmail.com wrote:
> Where I work, we have users who work on the internal network and
> roaming users who work out on site, but reguarly visit the office. The
> users working on the internal network have their internet access
> restricted so they cannot access anything malicious. However, the
> roaming users internet access is not restricted. My boss is keen for
> the roaming users to be able to come in the office, and have wireless
> access to certain files/folders on the file server and printers on the
> internal network. However, he is keen that they do not have full
> access to the network as they could have malicious files on their
> laptops that could infect the whole network. What is the best way to
> go about doing this? The only solution I've been offered so far is to
> have a completely separate network with a file server that reguarly
> synchronizes with the internal network and to have seperate printers
> as well. Has anyone got any better ideas?

Help me out a little here... What type of wireless gear are you using?

If it's commercial grade gear I recommend the creation of a second
wireless network which would match the network that the users have at
their remote sites. Then put an access list on that SSID only (this is
why it's important to have commercial gear, it can do this.) With an
ACL in place on the second SSID, you can prevent certain protocols
from accessing the network.

Chris
NetSteady
866-678-WIFI

On 2 Oct, 19:26, NetSteady <cmhu...@gmail.com> wrote:
> On Oct 1, 1:07 pm, addyg...@hotmail.com wrote:
>
> > Where I work, we have users who work on the internal network and
> > roaming users who work out on site, but reguarly visit the office. The
> > users working on the internal network have their internet access
> > restricted so they cannot access anything malicious. However, the
> > roaming users internet access is not restricted. My boss is keen for
> > the roaming users to be able to come in the office, and have wireless
> > access to certain files/folders on the file server and printers on the
> > internal network. However, he is keen that they do not have full
> > access to the network as they could have malicious files on their
> > laptops that could infect the whole network. What is the best way to
> > go about doing this? The only solution I've been offered so far is to
> > have a completely separate network with a file server that reguarly
> > synchronizes with the internal network and to have seperate printers
> > as well. Has anyone got any better ideas?
>
> Help me out a little here... What type of wireless gear are you using?
>
> If it's commercial grade gear I recommend the creation of a second
> wireless network which would match the network that the users have at
> their remote sites. Then put an access list on that SSID only (this is
> why it's important to have commercial gear, it can do this.) With an
> ACL in place on the second SSID, you can prevent certain protocols
> from accessing the network.
>
> Chris
> NetSteady
> 866-678-WIFI

Thanks for your reply. At the moment, we haven't bought any wireless
gear at all. We're willing to buy whatever's necessary though. What
commercial gear would you recommend? Also, what protocols would you
block?