13 ms·

Really, Google? (Or Why We Can’t Have Nice Wireless Networks)

52 points by Varcht 8y ago

amaccuish 8y ago
Reminds me of trying to get Active Directory to work across firewalls. MSRPC makes it a total nightmare with moving, randomly assigned ports.
- g45y45 8y ago
  Yes, but this is MUCH easier today. Next Gen firewalls support Deep Packet Inspection for MSRPC traffic, you can even whitelist specific RPC calls, auto/temp allow the ephemeral ports, etc
jeffrallen 8y ago
Wtf dude, you're a network admin, administer your network. Perhaps you should read up on the end to end principle, instead of blaming the apps.
- Spivak 8y ago
  I think the point is that admins are administering their network. Disallowing wireless clients from communicating with one another is SOP.
  - crankylinuxuser 8y ago
    No, they aren't. Making a one-size-fits-badly policy is how you get large amounts of shadow IT and assets on non-controlled machines. The security policy has to balance with what the users are tasked with, and what's expected. And when IT won't budge, you get really weird stuff happening. I've seen professors running a linksys natted network on a uni lan, precisely because he needed control and lookup of IPs for his robotics setup. And Uni IT did their knuckle-dragging usual of nothing (blame the user). His solution was "insecure" but that went to his real task of robotics prof.
    - zelon88 8y ago
      This sounds to me like the prof tried to tell IT what to do instead of explaining to IT what he wanted to accomplish. If you came up to me and said "Hey I want to plug in my own router in my office so I can have my own little WiFi network for my projects" I'd tell them no, it's against policy, against SOP, against best everything, and it would be an unmanaged, insecure, non-company asset (probably with default credentials and unpatched firmware). I would then just nod my head at his hemming and hawing and invite him to go over my head. Now... If you came up to me and said "Hey I've got a ton of wireless devices in my office that are related to my work. What would be the best way for me to network them all together and isolate them from the rest of the network?" I'd gladly draw up a plan to get the task done, order the assets that I want in my shop (with company money), configure it the way I want, and then roll it out and keep tabs on it. Just doing whatever you want on the network because IT won't let you is asking for trouble, and could/should get you fired.
      - dingaling 8y ago
        But if the prof doesn't have a budget or billable cost-centre you're just going to shrug and he's back to 'do it myself' That's the most common problem users have with IT.
        crankylinuxuser 8y ago
        Yep, and since he was one of the senior faculty teaching engineering (that the uni started the new program for within the last 4 years), he's immune to these kinds of "we'll fire you if you do X it thing". He needed not wpa2 enterprise wireless. WPA2 personal would have sufficed for his robotics... but "Policies". When he asked how to proceed, IT-Networks responded with "We dont tell people how to do their networking. We enforce policy." He had contacts in IT (my director), and put me to make it work. So I helped configure a better router, made sure DHCP and other protos wasn't leaking out the WAN, set a stupid long PSK. Took me .5h to get a good environment set up. And sure, it violated policy, but it was secure and enabled the prof to continue his swarming robotics experiments.
mikestew 8y ago
"IT admin being a dick and won't turn on peer-to-peer networking on the corpnet? Plug a router you bought off the internet into the corpnet tap, or better yet, run a hotspot from some random phone!" I don't think the title fully encapsulates how astounded I am that this made it through the multiple layers of the Google corporate machine without someone in the chain, someone, saying, "umm..." Next time someone asks you to review those user docs, really read them this time in case you have to be the one raising your hand. ('cuz I know I've been guilty of kind of skimming them.)
- WrtCdEvrydy 8y ago
  But those IT guys just plug things in, I can do it just as well! /s
- detaro 8y ago
  According to the description above that section, it doesn't even need an internet connection in that mode, so a quick dumb hotspot for just this purpose seems like a fairly reasonable solution. If IT isn't flexible enough to provide that on request, someone else setting it up at least doesn't hurt that much. (a server-based fallback would have some value, but I bet people would find something to complain about that too. To slow, unnecessarily sending data back to Google, ...)
  - mikestew 8y ago
    so a quick dumb hotspot for just this purpose seems like a fairly reasonable solution. I believe the issue at hand is the question of who the user is going to call when that doesn't work. The phone vendor? The phone OS vendor? The telecom? Hmm, somehow I feel that those three options will not be first on the list, but rather who is closest and has technical knowledge of any kind.
    - detaro 8y ago
      Who either has "making such things work" in their job description and thus is the right address, or says "not a school-owned device, not my responsibility, please go through the process next time". If it truly works without connection to the internet (and you thus can ignore a lot of the security etc concerns), providing an unconnected AP with a flat network shouldn't be a big issue for most sysadmins. (And yes, I know what first-level support for random non-technical users is like). Yes, they'd prefer if it just worked in whatever environment, but I don't think it's that out of order that it doesn't, especially without knowing the tradeoffs involved in the design. I agree with the article on "they should specify what they need exactly" though, for those orgs that want to explicitly allow it in their main infrastructure instead of providing a workaround.
hannob 8y ago
tl;dr "I run a network with some wonky Enterprise stuff that does weird things I don't understand and it's Google's fault."
- g45y45 8y ago
  Yeah, this was a lame rant. Just create a single purpose SSID on your enterprise wireless controller that supports peer-to-peer (client to client connectivity). Bind the educational hardware to that, everything is fine. Really I dont see Google doing anything wrong here...
  - amaccuish 8y ago
    > Just create a single purpose SSID... He tried that
  - elcritch 8y ago
    True that sounds tenable, but dealing with multicast can be a pain. There's no such thing as "enable p2p", there's enable multicast and open specific ports between clients, etc. Does Google give the IP and netmask for the multicast, or the requirements for TTL, or even just the multi-cast ports used, etc? Are they even using multicast? It's all basic info which could readily be listed allowing a configuration to meet the user's needs. Having a single "wide open on all ports" (e.g. consumer grade) SSID on a network could be a significant vulnerability vector.
    - g45y45 8y ago
      There is enable p2p, its called disabling client isolation mode. This isn't even specifically about multicast. Its just the peers (clients) cannot make unicast connections to each other.
      - Spivak 8y ago
        The peers can't discover each other without multicast.
reaperducer 8y ago
Bigcorp gets all the positive PR for bringing new technology to schools and "disrupting" the classroom paradigm, while the IT department gets all the blame because Bigcorp doesn't field test. Sounds like Google to me.
kbirkeland 8y ago
While the rant is valid, I feel like the amount of effort venting about this was equal to or more than actually attempting to get this to work. The author claims that there is "a fair amount of multicast in play which could be part of the issue," but there are no inherent issues with multicast over wifi. My suspicion is that it uses mDNS or some other _link-local_ multicast protocol for discovery. This isn't really news though; any network operator that supports Apple TVs, Chromecasts, etc on their network has had to deal with this (and most vendors have solutions for proxying mDNS).
- Spivak 8y ago
  Proxying mDNS is such a pain if your vendor doesn't have something built-in. Like when you have to start creating VXLANs to accommodate devices that assume L2 adjacency or installing L7 proxies I think it's fair to say there's some fault with the application vendor.
jon889 8y ago
How come multicast, bonjour etc doesn't work on enterprise networks? I've always wondered this because it would've been helpful several times.
- g45y45 8y ago
  because peer to peer -- ie client to client comms is blocked by the AP for security. Smarter wireless controllers allow selective protocol to pass, so you might be able to allow just mDNS (bonjour). Now this is just for wireless peers, it will allow mDNS to work with other wired clients not using that AP. Its a setting that can be modified.
- tjohns 8y ago
  I don't work in IT, and I'm a bit biased on this topic, but my understanding is that these protocols are chatty and can flood the network on large deployments (e.g. an entire campus that shares the same subnet). They also tie up WiFi airtime. So they're usually explicitly blocked, along with anything else multicast related. Also, Enterprise IT is often averse to anything that's not centrally managed, and Bonjour is the anthesis of centralization (it's all peer-to-peer). Some networks turn on client isolation so that peers can't talk to each other at all, often in the name of security. That said, there are ways to get this stuff to work right in an enterprise setting. It requires careful network design to keep broadcast domains small, ideally with an mDNS Reflector running somewhere. All the major WLAN vendors have custom options for supporting it, with varying levels of customizability: - Cisco: https://www.cisco.com/c/en/us/support/docs/wireless/aironet-1100-series-access-point/113443-cuwn-apple-bonjour-dg-00.html https://www.cisco.com/c/en/us/support/docs/wireless/aironet-... - Aruba: https://www.arubanetworks.com/techdocs/Instant_41_Mobile/Advanced/Content/UG_files/Services/AirGroup/AirGroup%20Configuration.htm https://www.arubanetworks.com/techdocs/Instant_41_Mobile/Adv... - Ubiquiti: https://help.ubnt.com/hc/en-us/articles/360001004034-UniFi-Best-Practices-for-Managing-Chromecast-Google-Home-on-UniFi-Network https://help.ubnt.com/hc/en-us/articles/360001004034-UniFi-B... Admittedly, it's hard to get right, the apps that need it are not usually business critical, and there's not many apps to test with... so most IT shops just turn it off and avoid the additional headache. Which is unfortunate, because it effectively kills off any peer-to-peer functionality on the LAN. Disclaimer: I work at Google, but not on any of the teams mentioned in the article. I am a big fan of mDNS, but that's my personal opinion.
jbb67 8y ago
I expect to read next that they blocked port 80 too because "security" and it's Google's fault they can't get to web sites now.
viraptor 8y ago
I'm curious what's the suggested alternative. If you have a self-setup device with no physical interface, which can be accessible from any place on the network - how would you do that? Is there some kind of interval version of upnp? Nmb is theoretically possible, not wouldn't work outside of specific environments.

52 points by Varcht 8y ago

Reminds me of trying to get Active Directory to work across firewalls. MSRPC makes it a total nightmare with moving, randomly assigned ports.

g45y45 8y ago
Yes, but this is MUCH easier today. Next Gen firewalls support Deep Packet Inspection for MSRPC traffic, you can even whitelist specific RPC calls, auto/temp allow the ephemeral ports, etc

jeffrallen 8y ago

Wtf dude, you're a network admin, administer your network. Perhaps you should read up on the end to end principle, instead of blaming the apps.

Spivak 8y ago
I think the point is that admins are administering their network. Disallowing wireless clients from communicating with one another is SOP.
- crankylinuxuser 8y ago
  No, they aren't. Making a one-size-fits-badly policy is how you get large amounts of shadow IT and assets on non-controlled machines. The security policy has to balance with what the users are tasked with, and what's expected. And when IT won't budge, you get really weird stuff happening. I've seen professors running a linksys natted network on a uni lan, precisely because he needed control and lookup of IPs for his robotics setup. And Uni IT did their knuckle-dragging usual of nothing (blame the user). His solution was "insecure" but that went to his real task of robotics prof.
  - zelon88 8y ago
    This sounds to me like the prof tried to tell IT what to do instead of explaining to IT what he wanted to accomplish. If you came up to me and said "Hey I want to plug in my own router in my office so I can have my own little WiFi network for my projects" I'd tell them no, it's against policy, against SOP, against best everything, and it would be an unmanaged, insecure, non-company asset (probably with default credentials and unpatched firmware). I would then just nod my head at his hemming and hawing and invite him to go over my head. Now... If you came up to me and said "Hey I've got a ton of wireless devices in my office that are related to my work. What would be the best way for me to network them all together and isolate them from the rest of the network?" I'd gladly draw up a plan to get the task done, order the assets that I want in my shop (with company money), configure it the way I want, and then roll it out and keep tabs on it. Just doing whatever you want on the network because IT won't let you is asking for trouble, and could/should get you fired.
    - dingaling 8y ago
      But if the prof doesn't have a budget or billable cost-centre you're just going to shrug and he's back to 'do it myself' That's the most common problem users have with IT.
      - crankylinuxuser 8y ago
        Yep, and since he was one of the senior faculty teaching engineering (that the uni started the new program for within the last 4 years), he's immune to these kinds of "we'll fire you if you do X it thing". He needed not wpa2 enterprise wireless. WPA2 personal would have sufficed for his robotics... but "Policies". When he asked how to proceed, IT-Networks responded with "We dont tell people how to do their networking. We enforce policy." He had contacts in IT (my director), and put me to make it work. So I helped configure a better router, made sure DHCP and other protos wasn't leaking out the WAN, set a stupid long PSK. Took me .5h to get a good environment set up. And sure, it violated policy, but it was secure and enabled the prof to continue his swarming robotics experiments.

mikestew 8y ago

"IT admin being a dick and won't turn on peer-to-peer networking on the corpnet? Plug a router you bought off the internet into the corpnet tap, or better yet, run a hotspot from some random phone!" I don't think the title fully encapsulates how astounded I am that this made it through the multiple layers of the Google corporate machine without someone in the chain, someone, saying, "umm..." Next time someone asks you to review those user docs, really read them this time in case you have to be the one raising your hand. ('cuz I know I've been guilty of kind of skimming them.)

WrtCdEvrydy 8y ago
But those IT guys just plug things in, I can do it just as well! /s
detaro 8y ago
According to the description above that section, it doesn't even need an internet connection in that mode, so a quick dumb hotspot for just this purpose seems like a fairly reasonable solution. If IT isn't flexible enough to provide that on request, someone else setting it up at least doesn't hurt that much. (a server-based fallback would have some value, but I bet people would find something to complain about that too. To slow, unnecessarily sending data back to Google, ...)
- mikestew 8y ago
  so a quick dumb hotspot for just this purpose seems like a fairly reasonable solution. I believe the issue at hand is the question of who the user is going to call when that doesn't work. The phone vendor? The phone OS vendor? The telecom? Hmm, somehow I feel that those three options will not be first on the list, but rather who is closest and has technical knowledge of any kind.
  - detaro 8y ago
    Who either has "making such things work" in their job description and thus is the right address, or says "not a school-owned device, not my responsibility, please go through the process next time". If it truly works without connection to the internet (and you thus can ignore a lot of the security etc concerns), providing an unconnected AP with a flat network shouldn't be a big issue for most sysadmins. (And yes, I know what first-level support for random non-technical users is like). Yes, they'd prefer if it just worked in whatever environment, but I don't think it's that out of order that it doesn't, especially without knowing the tradeoffs involved in the design. I agree with the article on "they should specify what they need exactly" though, for those orgs that want to explicitly allow it in their main infrastructure instead of providing a workaround.

hannob 8y ago

tl;dr "I run a network with some wonky Enterprise stuff that does weird things I don't understand and it's Google's fault."

g45y45 8y ago
Yeah, this was a lame rant. Just create a single purpose SSID on your enterprise wireless controller that supports peer-to-peer (client to client connectivity). Bind the educational hardware to that, everything is fine. Really I dont see Google doing anything wrong here...
- amaccuish 8y ago
  > Just create a single purpose SSID... He tried that
- elcritch 8y ago
  True that sounds tenable, but dealing with multicast can be a pain. There's no such thing as "enable p2p", there's enable multicast and open specific ports between clients, etc. Does Google give the IP and netmask for the multicast, or the requirements for TTL, or even just the multi-cast ports used, etc? Are they even using multicast? It's all basic info which could readily be listed allowing a configuration to meet the user's needs. Having a single "wide open on all ports" (e.g. consumer grade) SSID on a network could be a significant vulnerability vector.
  - g45y45 8y ago
    There is enable p2p, its called disabling client isolation mode. This isn't even specifically about multicast. Its just the peers (clients) cannot make unicast connections to each other.
    - Spivak 8y ago
      The peers can't discover each other without multicast.

reaperducer 8y ago

Bigcorp gets all the positive PR for bringing new technology to schools and "disrupting" the classroom paradigm, while the IT department gets all the blame because Bigcorp doesn't field test. Sounds like Google to me.

kbirkeland 8y ago

While the rant is valid, I feel like the amount of effort venting about this was equal to or more than actually attempting to get this to work. The author claims that there is "a fair amount of multicast in play which could be part of the issue," but there are no inherent issues with multicast over wifi. My suspicion is that it uses mDNS or some other _link-local_ multicast protocol for discovery. This isn't really news though; any network operator that supports Apple TVs, Chromecasts, etc on their network has had to deal with this (and most vendors have solutions for proxying mDNS).

Spivak 8y ago
Proxying mDNS is such a pain if your vendor doesn't have something built-in. Like when you have to start creating VXLANs to accommodate devices that assume L2 adjacency or installing L7 proxies I think it's fair to say there's some fault with the application vendor.

jon889 8y ago

How come multicast, bonjour etc doesn't work on enterprise networks? I've always wondered this because it would've been helpful several times.

g45y45 8y ago
because peer to peer -- ie client to client comms is blocked by the AP for security. Smarter wireless controllers allow selective protocol to pass, so you might be able to allow just mDNS (bonjour). Now this is just for wireless peers, it will allow mDNS to work with other wired clients not using that AP. Its a setting that can be modified.
tjohns 8y ago
I don't work in IT, and I'm a bit biased on this topic, but my understanding is that these protocols are chatty and can flood the network on large deployments (e.g. an entire campus that shares the same subnet). They also tie up WiFi airtime. So they're usually explicitly blocked, along with anything else multicast related. Also, Enterprise IT is often averse to anything that's not centrally managed, and Bonjour is the anthesis of centralization (it's all peer-to-peer). Some networks turn on client isolation so that peers can't talk to each other at all, often in the name of security. That said, there are ways to get this stuff to work right in an enterprise setting. It requires careful network design to keep broadcast domains small, ideally with an mDNS Reflector running somewhere. All the major WLAN vendors have custom options for supporting it, with varying levels of customizability: - Cisco: https://www.cisco.com/c/en/us/support/docs/wireless/aironet-1100-series-access-point/113443-cuwn-apple-bonjour-dg-00.html https://www.cisco.com/c/en/us/support/docs/wireless/aironet-... - Aruba: https://www.arubanetworks.com/techdocs/Instant_41_Mobile/Advanced/Content/UG_files/Services/AirGroup/AirGroup%20Configuration.htm https://www.arubanetworks.com/techdocs/Instant_41_Mobile/Adv... - Ubiquiti: https://help.ubnt.com/hc/en-us/articles/360001004034-UniFi-Best-Practices-for-Managing-Chromecast-Google-Home-on-UniFi-Network https://help.ubnt.com/hc/en-us/articles/360001004034-UniFi-B... Admittedly, it's hard to get right, the apps that need it are not usually business critical, and there's not many apps to test with... so most IT shops just turn it off and avoid the additional headache. Which is unfortunate, because it effectively kills off any peer-to-peer functionality on the LAN. Disclaimer: I work at Google, but not on any of the teams mentioned in the article. I am a big fan of mDNS, but that's my personal opinion.

jbb67 8y ago

I expect to read next that they blocked port 80 too because "security" and it's Google's fault they can't get to web sites now.

viraptor 8y ago

I'm curious what's the suggested alternative. If you have a self-setup device with no physical interface, which can be accessible from any place on the network - how would you do that? Is there some kind of interval version of upnp? Nmb is theoretically possible, not wouldn't work outside of specific environments.