Depending on the purpose of the wireless net-
work, users may require the same access on the wireless network that is afforded on
the wired LAN. In favor of exposing the wireless network to the complete wired LAN
a VPN solution may be used. This architecture would allow wireless network access
to the Internet, just the VPN gateway, or other basic internal assets (such as an intranet
site), which force the use of a VPN gateway for any other resources.
An additional strength provided by a VPN on top of wireless authentication is
defense in depth. To gain internal LAN access from a wireless network, an attacker
must compromise and gain access to the VPN in addition to any layer 2 wireless
authentication/access control mechanisms. An attacker who gains access to the wireless
medium would likely never suspect the use of a VPN and assume the state of limited
internal access or mistake the current state for the complete LAN.
An assessment should be performed to understand the business case where wireless
assets need complete access to the corporate LAN, and explicitly allow access on an
IP/port basis. Fine-grain segmentation can be obtained by levering SSID-based VLAN
assignments, explained in detail in the following sections, to assign restrictions on a
per-VLAN basis with supporting ACLs at higher points within the network.
This is from ** Computer Security Handbook **