<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Just a quick update on what needs doing:</p>
<ul>
<li>Adding UCC-IoT to UniSFA AP `coromandel`<br>
</li>
</ul>
<p>The changing of the UniSFA AP from `sharpchin` to `coromandel`
was recorded in <a class="moz-txt-link-freetext" href="https://wiki.ucc.asn.au/ChangeLog">https://wiki.ucc.asn.au/ChangeLog</a> but not on
<a class="moz-txt-link-freetext" href="https://wiki.ucc.asn.au/Wifi">https://wiki.ucc.asn.au/Wifi</a>, which is why I couldn't find it.
VLAN 7 needs to be trunked to the UniSFA port and the SSID added
on the AP. The wifi docs also need to be updated further to
reflect the new situation.<br>
</p>
<ul>
<li>Firewalling the IoT subnet<br>
</li>
</ul>
Right now, traffic from the IoT subnet is not NATed and can't escape
UCC, but it can freely communicate with other parts of the UCC
network. Both of those need to be fixed, ideally, with outbound
traffic from the IoT VLAN restricted.<br>
<p>If nothing more happens on that front, that'll be my project on
Monday night. Anyone else who's interested in the IoT network is
welcome to help out.</p>
<p>Cheers,</p>
<p>James [MPT]<br>
</p>
<div class="moz-cite-prefix">On 3/12/19 1:37 am, James Arcus wrote:<br>
</div>
<blockquote type="cite"
cite="mid:47f553d3-44f3-9c45-d13c-68562892eb55@ucc.asn.au">
<pre class="moz-quote-pre" wrap="">Hi all,
I'd talked about doing it in person a few times, but tonight I finally
got around to creating the start of our "IoT network".
So far, this has involved trunking a new VLAN 7, provisioning a new
subnet 192.168.22.0/24 with DHCP, and creating a pair of WPA2-PSK WLANs
(UCC-IoT and UCC-IoT-5), broadcast from both the clubroom AP (smallwing)
and the UWAnime AP (abe). At the moment, the VLAN is trunked to all the
switches, the APs and Murasoi, nowhere else.
At current, you can join the wifi network with the key and get both an
IPv4 and a v6 address, but it doesn't route anywhere. The intention will
be to keep access in and out fairly limited to what's needed. Wired
ports can also be added to access VLAN 7 in their relevant switch configs.
At the moment, DHCP is given freely out to anyone who joins. It's not
final, merely what was easiest to set up and use for testing the new
network. I'm imagining the next steps will be to finalise a DHCP and
firewalling policy, and migrating the webcams across?
As usual, the wifi passphrase in in uccpass, under UCC/other/IoT-wifi.
Cheers,
Jimbo [MPT]
_______________________________________________
List Archives: <a class="moz-txt-link-freetext" href="http://lists.ucc.asn.au/pipermail/tech">http://lists.ucc.asn.au/pipermail/tech</a>
Unsubscribe here: <a class="moz-txt-link-freetext" href="https://lists.ucc.gu.uwa.edu.au/mailman/options/tech/jimbo%40ucc.asn.au">https://lists.ucc.gu.uwa.edu.au/mailman/options/tech/jimbo%40ucc.asn.au</a>
</pre>
</blockquote>
</body>
</html>