Skip to main content

Separate your outbound NAT to prevent issues with guest wireless traffic

Mark Glinski
  • Updated

In this article:

    If your organization provides guest wireless network service, issues related to guest traffic may appear on your Scorecard, even though you have no control over guest devices. You can keep those issues off your Scorecard by separating out your outbound network address translation (NAT) IP address.

    Deploy a separate guest NAT IP address

    A wireless network NAT IP address that is separate and unique from the NAT IP address on your office network routes guest traffic directly out to the internet with a unique digital footprint. Guest traffic never flows on your internal office wireless network, so any potential risk introduced by those unknown devices is neutralized, even if they contain vulnerabilities or have been compromised.

    In the following diagram, the NAT IP address for the guest network has a unique address, 11.2.3.100. The regular corporate network traffic uses the NAT IP address 11.2.3.4. You can register the guest wireless network IP address 11.2.3.100 with SecurityScorecard to avoid having issues and findings attributed to your scorecard that are not within your domain of control as they are not your devices.

    discrete-nat-egress.png

    Tell Security Scorecard about the discrete NAT address

    After you deploy a separate NAT IP address for your guest wireless network, tell SecurityScorecard about it and provide the unique IP address:

    • On your Scorecard, refute any findings related to guest NAT address, indicating that it is separate from your office network.
    • Submit a Support request to remove findings related to traffic on the guest NAT address.

      zd-ticket-discrete-outbound-NAT.png

    We will remove from your Scorecard any issues detected or associated with your guest NAT IP address..

    Related articles