How to block or secure Wireless when connected to wired LAN?

[Hurricane Andrew]

My company, like so many, has several laptop users who have a need for internet connectivity while travelling. Wireless makes this very easy, but is also a security risk. From a usability standpoint, we can't disable the wireless. But, when they are connected to our wired LAN, we would like to "close" the wireless hole without shrouding all of our locations in heavy lead shields.

Our concern is that if they are connected to our LAN, and also connected to a wireless network, it could pose a security risk. Is some sort of Network Access Control able to "turn off" wireless connections before allowing connectivity, or perhaps a firewall of some sort could "isolate" the two networks providing a similar protection?

Any thoughts would be greatly appreciated!

 

[Fardringle]

Do the users connect their laptops to docking stations while on the wired network in the office? If so, the easiest solution would be to set up hardware profiles so that the wireless adapter is disabled when the laptop is in the docking station, and enabled when it is not in the dock.

 

[spyordie007]

The other option would be to use a software supplicant (i.e. Cisco's Secure Services Client, although that's a bit much for just this).

 

[Hurricane Andrew]

Originally posted by: Fardringle
Do the users connect their laptops to docking stations while on the wired network in the office? If so, the easiest solution would be to set up hardware profiles so that the wireless adapter is disabled when the laptop is in the docking station, and enabled when it is not in the dock.

They don't right now, but that sounds like it might certainly be a viable solution. We've had a few users inquire about docking stations for other reasons, so we would even come off looking like the good guys.

 

[911paramedic]

I was going to post an easy solution, but it relied on the end user doing something simple, which nullified it.

 

[Hurricane Andrew]

Originally posted by: 911paramedic
I was going to post an easy solution, but it relied on the end user doing something simple, which nullified it.

:laugh: How true!

It does appear that hardware profiles will take care of 99% of our issue, though again, it too involves the user making a choice at boot time, which means the help desk will still get calls...