Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 38 replies
  • Subscribers 1 subscriber
  • Views 28081 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to disconnect wireless user

Breakingcustom
Is there a way from the web interface to kill someone's wireless connection or does it have to be done via SSH?


This thread was automatically locked due to age.
  • 0
    If you are on 9.1xx, you can create a MAC address list of clients to be blocked, and apply that as a blacklist to the affected wireless networks.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Sophos Platinum Partner

    --------------------------------------

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

  • 0
    I am on 9.1.  I'm not wanting to permanently block the person.  Basically for some reason clients are getting the wrong DHCP IP from a SSID.  I restarted the firewall last night to see if it would clear the IPv4 table, but it didn't.  There are two entries for that MAC address in it for two different networks.
  • 0
    I haven't heard this complaint before, but I'm not sure what you mean by the wrong IP.  Do you mean they get an IP from an SSID that they can't/shouldn't access?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Basically there are 3 SSIDs.  Two of them are Bridged to VLAN.

    SSID1 = Bridged to VLAN40 (10.40.1.0/24)
    SSID2 = Bridged to VLAN41 (10.41.1.0/24)

    Someone connected to SSID2 has a 10.40.1.x address.  Looking at the IPv4 Lease Table there are two entries for the MAC address one for the 10.40 and one for the 10.41.

    Doesn't seem like there is an easy way to clear the DHCP table so I just changed the lease time to just a few hours instead of the default.
  • 0
    All that says to me is that the device at that MAC address has been used to access both SSIDs.  It shouldn't cause any problems that I can think of.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    The thing is, those two networks shouldn't talk to each other.  So if for some reason they are still using SSID's IP DHCP range and actually on another network I don't want them to be able to access the resources.
  • 0
    It doesn't work like that.  The client only can connect to a single SSID at a time.  The UTM's DHCP server "remembers" associated MACs and IPs, but that doesn't mean they're active simultaneously. You can leave the lease time at one day without any fear of security violations. 

    Cheers - Bob

    Sorry for any short responses.  Posted from my iPhone.
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    They are connecting to just one SSID, but when looking at Wireless Protection that individual is showing the wrong IP range for the SSID they are connected to.
  • 0
    I haven't heard this complaint elsewhere, so I don't think it's a bug...  It must be either a configuration issue or miscommunication.  Can you get a picture from the user showing the SSID they're on and the IP they're connected to?  Please show pictures from WebAdmin that led you to conclude that there's a problem.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    I'll have to do some screenshots on Monday when they are open.  I had some, but I think I might of already deleted them.

    Basically a person on SSID2 was showing an IP they should've gotten from SSID1.  When I would click on Wireless Networks it would show it.  

    I'll get some screenshots on Monday.
Unfiltered HTML