UTM / Network Advice For Bar-Restaurant

[purdybread]

Any help or thoughts with this greatly appreciated.

I had a local bar / restaurant business contact me to look at and improve their network security. There is new legislation due to come into force in Europe at the end of May regarding data protection (GDPR). If you haven't heard about it across the pond the fines for non compliance can be pretty hefty.

After a quick look at the network my first thoughts were I would get to do my first Untangle deployment.

There is various workstations, a "Server" running accounting software, some loyalty card machines, tills, a NAS and a clocking in machine for staff.

I had a look at NG Firewall Complete 25 user. The price was acceptable. I was ready to order when I realised I had completely forgot to include their WiFi network!! This would include a lot of users on the Guest network

Current network consists of a Draytek firewall/router with a Netgear unmanaged switch for the business network, and a USG (via the Draytek, not the Netgear) to a Unifi 24 port POE switch and then access points.

On occasion there can at times be several hundred people in between the bar, restaurant. Its clear the 25 user license Untangle solution isnt gonna work, and the price for the required coverage is just too much.

I have considered a Unifi stack for the whole operation instead of Untangle, removing the Draytek altogether, and upgrading the USG to a USG Pro and the Unifi switch to a 48 port model, however any research I have done has suggested that the USG devices are not looked on favourably as edge devices, and certainly cant be considered UTM devices. The customer will be willing to spend money on this, but I really doubt they will spend $3200 plus for a untangled device.

Has anyone had experience of similar hospitality jobs? How would you handle it and what are the alternatives?

If I have missed any important info out I apoligise.

Again thanks in advance for any thoughts

 

[Slaters Kustum Machines]

I'm curious why there is the Draytek and the USG. What you could do is USG->Untangle(transparent bridge mode)-Switch->Rest of the network. The way Untangle works is that once you have reached the license limit it bypasses any other connections meaning it doesn't scan them. Ideally it's best to have enough licenses to scan all traffic. Obviously the guest network should be isolated from the rest of the network which is easy with the Unifi equipment, but I'm not sure what the requirements are for the GDPR stuff.

 

[tek9]

You can just bypass the guest network entirely so it doesn't count against the license limits. You probably only need the UTM features for the secure network anyhow.

 

[purdybread]

I'm curious why there is the Draytek and the USG.

I believe the USG / Unifi Switch / access points were added at a later date, by a different company that set up the original network. That company is now out of business.

I had wondered if would be possible to isolate the wifi from the business network via untangle, removing it from scanning, however that sort of defeats the purpose of having Untangle maybe?

Yes the current guest wifi is isolated from the main network.

As for requirements for GDPR no one really knows yet, its all very vague, there is a stipulation that your IT systems have to be secure, and the fines for data breach can be severe, up to €20 million or 4% of annual turnover, whichever is higher. From reading guidelines, it appears that in event of data loss the company would have to show they made best effort in setting up security and having procedures in place.

I have no experience with UTM devices, and have been trying to read as much info as possible this last few days, but feel like my head is spinning.
As I said earlier I had thought about removing the Draytek and the USG, and replacing with a USG Pro, and possibly upgrading the Unifi switch to the 48 port model and removing the netgear switch.

Perhaps use a DNS service for filtering and blocking?

However when I read online it is suggested that the USG is anything but a secuirty gateway as the name implies and no substitute for the real thing. Any Ubiquiti experts have any input on this?

 

[Slaters Kustum Machines]

I had wondered if would be possible to isolate the wifi from the business network via untangle, removing it from scanning, however that sort of defeats the purpose of having Untangle maybe?

I would say it doesn't defeat the purpose because really you want to protect and monitor the main business network. Which would be the case. With the guest network isolated from the main network there isn't as big of a risk or need to monitor it with a UTM. Currently the USG/USG Pro are not UTM's. They have added IDS/IPS, but it's not ready for production use yet. That is why I would use Untangle behind the USG/USG pro in bridged mode to handle the UTM features. What you get with a USG/Unifi network is easy management and a single pane of glass for monitoring. I would remove the Netgear and run a Unifi switch if it were my client.

 

[YeOldeStonecat]

The USG wouldn't have enough power for a high amount of users, I only use USGs in small networks <25 users. Above that...USG Pro. Above that and the USG XG.

Anyways....we have a lot of hybrid networks..when I say "hybrid"..that means I'll have like Unifi switches and APs or EdgeSwitches and Unifi APs (earlier years before Unifi switches matured) behind Untangle firewalls.

Get an appliance like a NexGen NG-500 and stick on your Untangle Complete for 25 ...and set your VLAN'ing to dump guest traffic out a dedicated port on the switch to a whole separate Eth interface. Bypassing that whole interface from the UTM gauntlet...or even creating a policy and putting on a rack of just freebie modules..and it won't count against the licensing on your paid modules on the default rack. Having full bypass for the guest traffic could probably get away with just an NG-100 since it's not UTM'ing on the high load of the guest interface ..just passing packets.

You want the UTM to protect the business computers, you don't have to care for guests. They're separated, whole different VLAN and IP network...no reason to protect guests, they're just a support nightmare, just give 'em internet.

So I'd do an:
NG-500
Untangle subscription Complete for 25 (or a few more for elbow room of your clients office and devices..you know the count!)
Unifi switch
A few Unifi Pro or even HD APs (dunno the spread of this place....size/area to cover)
Cloud Key