3
\$\begingroup\$

(EDIT): forest for the trees

This is why I love StackExchange! I have several great ideas to try, none of which were my original.

I asked here based on an assumption I probably shouldn't make: my cheap network gear cannot help in a more standard way. I've been seeing them as dumb switches--one still hasn't arrived, so can't yet be certain.

Points I should've added (sorry) but didn't because the question was already getting too long:

  • Most of the building's network is VLAN-segregated on PoE Juniper gear.
  • I wired the patch panel and wall ports four years ago--they're already standard.
  • The rack has no switch, so I got a couple cheapies--one for connectivity and one for PoE to a handful of phones (for tenants, in the office where intranet is required.
  • We can't afford a Juniper at this location, would resolve all concerns.
  • I pulled three runs from another closet on this floor, patching to the Juniper there. All three cables are spoken for, even though two days ago I only needed one (things change around here).
  • There's a ton of furniture/equipment in the way now, but I suppose I could pull a fourth, dedicated to the port I'm trying to protect.
  • I didn't think of pulling another run, because my "cheap gear" assumption had me thinking the dongle thing would be simpler. I was probably wrong twice.

I'll assess the PoE switch when it arrives today, and if it's too dumb to help I'll either pull more cable or insert a small router/firewall.


original question


nutshell

I want to make a scrambled Ethernet dongle (or cable) that must be inserted before a network drop can bring data. My question primarily stems from

  • how safe PoE is for devices connected with a "bad" cable and
  • if anyone has one pinout recommended over another because of PoE.

why

I'm wiring a room for rented dinners and conferencing, with several network drops to be made available as guest Internet. In the same building as our business network.

The room has a VOIP phone †† on a non-guest network, with access to the internal LAN. Clearly, giving guests this access is undesirable. I hope no one would unplug the phone to connect their laptop...but I'm planning for that contingency.

the idea

If I intentionally mis-wire a cable (e.g. not T568B), A patch cable at the rack can reverse the "error," giving a valid connection. The phone works--but if someone unplugs and connects their laptop †† the port will not help them.

At a job back in 2001, the senior network engineer had little dongles we'd issue to conference room visitors. He wired the wall ports wrong, and the dongle reversed it. Joe's a smart guy.

Since my VOIP phone is always in this room, that dongle would be of little use, since anyone could swap their laptop into it. ††

device safety

But that was before PoE.

Naturally a fried laptop is not the result we want; if Power over Ethernet didn't exist, I'd simply make a couple cables--probably a simple shift cipher. From what I read on the Wikipedia page on PoE, the switch should refrain from providing power...but I'd prefer to not experiment with expensive hardware. And that brings me to StackExchange. :,)

babysitting/security-through-obscurity

I'm often tasked with setup, but I'll rarely be present at these events, so I won't be there to keep an eye on people. The wait staff is busy and uninterested in security, so I'd prefer to remove infosec discipline from the equation.

I realize that anyone knowing the secret can simply unplug the cable from the phone and use that...but the conspicuous nature of wrestling with the phone base †† is at least more a deterrent than simply unplugging a cable from the wall. My hope is that anyone who wants wired network will have their own cable--or will use one we've already provided.

summary

If I'm worrying too much (and PoE devices are highly reliable at detecting a connection they shouldn't provide power for), then lemmeno--I'll just build something and be done with it.

I'll post here if requested. The switch is a TP-Link TL-SG108PE

Previously asked at Networking.StackExchange, ruled off-topic. It's admittedly a grey area, I suppose.

†† The phone is a Polycom and uses PoE. The cables are annoyingly cumbersome to unplug--making it far more likely someone will disconnect at the wall. I also can't plan for someone bringing an axe to penetrate the server room--but I can still lock the door.

\$\endgroup\$
15
  • 7
    \$\begingroup\$ I feel like this is entirely the wrong approach to this problem, though I don't know enough about networking to know what the correct one is. \$\endgroup\$ – Hearth Jan 15 at 5:31
  • 2
    \$\begingroup\$ I wonder if some routers might let you disable auto-MDIX? That might make it so that just using a crossover cable would work.... \$\endgroup\$ – Hearth Jan 15 at 5:43
  • 4
    \$\begingroup\$ You are overthinking this. Standard PoE will detect if a device can use it, but some PoE solutions are passive and just force power out and depending on what device it is it may allow it or it goes up in smoke. Use standard wiring in the building and standard PoE, configure the network so that only the Voip phone can work at the one socket and no other device can. Configure the LAN as separate LAN to your router. This is a network engineering issue, not an electrical engineering issue. \$\endgroup\$ – Justme Jan 15 at 5:51
  • 3
    \$\begingroup\$ @zedmelon I can't offer any help. You are already more informed than I am. But I +1 your question. It's well-written and I appreciate that. You even added a very clear statement of your motivation. That makes a world of difference! \$\endgroup\$ – jonk Jan 15 at 6:02
  • 1
    \$\begingroup\$ There is just a couple of issues here. Wires have to be kept in pairs. There are just 24 permutations of 4 pairs and if you are worried about PoE it could limit the safe amount. Also Gigabit Ethernet needs all 4 pairs and it can autonegotiate even if pairs are all mixed up or have their polarity swapped. Even 100M Ethernet which uses only 2 of the pairs can work with polarity swapped, and most devices like laptops use auto-MDI/MDIX to work even if cable swaps TX/RX pairs. \$\endgroup\$ – Justme Jan 15 at 8:46
2
\$\begingroup\$

If I'm worrying too much (and PoE devices are highly reliable at detecting a connection they shouldn't provide power for)

They are reliable at that; at least standards-compliant ones, and my guess is that if your switch and your phones are from different manufacturers, they are compatible because they stick to the POE(+) standards, which requires detection before power.

The room has a VOIP phone †† on a non-guest network, with access to the internal LAN.

Put all the phone-dedicated ports on a VLAN. Managed switches can do that, and the overlap of "cheap managed switch" and "affordable PoE injecting switch" is relatively large, so check whether your switch can already do that.

That VLAN doesn't get access to arbitrary internal services; instead, a firewall rule on the single computer (or server, or router) that you also assign to that VLAN says "if the VLAN tag is set, drop all packets but these that are going to the VoIP servers"; done.

This all might be free.

I'd simply make a couple cables--probably a simple shift cipher.

Your trust in being able to modify ethernet at wire speed is admirable, but I think you'll find that you can't just change arbitrary things about your packet without breaking its transportability through ethernet. So, if you wanted to encrypt your traffic, you'd need to wrap it in a valid ethernet frame afterwards.

And for that there's already a million solutions – from IPsec to OpenVPN to Wireguard… really really no reason to invest in hardware development (my gosh you're underestimating this) of a one-shot security-by-obscurity system...

\$\endgroup\$
6
  • 4
    \$\begingroup\$ While I agree 100% with your answer, I believe you have misunderstood the OP’s comment about “shift cypher”. I think he is simply talking about switching the wire pairs in the cable around, not applying a cypher to the data. \$\endgroup\$ – DoxyLover Jan 15 at 8:17
  • \$\begingroup\$ @DoxyLover ah! yeah that's easier, but probably not wise. \$\endgroup\$ – Marcus Müller Jan 15 at 8:24
  • \$\begingroup\$ @DoxyLover: correct. [@]MarcusMuller: also correct. I said that because if PoE had never existed it's what I'd do--which was likely extraneous to the question and didn't help much (sorry). ...and no way I'm smart enough to do that. :,) \$\endgroup\$ – zedmelon Jan 15 at 19:24
  • \$\begingroup\$ @MarcusMuller: [[overlap of cheap managed and cheap PoE]] thanks, I'll check that out. \$\endgroup\$ – zedmelon Jan 15 at 19:24
  • \$\begingroup\$ @zedmelon it'd still be a bad idea without PoE ;) The right approach to avoid confusion and unauthorized access to your network is network isolation and if necessary cryptography, never such hacks. \$\endgroup\$ – Marcus Müller Jan 15 at 19:25
1
\$\begingroup\$

(1) Cut the locking tabs on the plugs on the patch cables so they can't easily be removed from either end

(2) Use a locking device eg

http://www.rjlockdown.com/patchcordpage.html

https://cpc.farnell.com/tuk/kpj2nt/t-lok-tamperproof-faceplate/dp/CS31332

https://patchsavesolutions.com/236-rj45-patch-cable-locks

(3) Run a script on your VoIP server that if the conference room phone is unplugged, staff are warned immediately so they can go and replug it. Ideally an automated announcement over the conference room PA system.

\$\endgroup\$
2
  • 1
    \$\begingroup\$ I'd +1 this for suggestion 2 but surely cutting the locking tab off the cable would make it fall out if you so much as breathed on it. \$\endgroup\$ – Alex Hajnal Feb 6 at 18:16
  • 1
    \$\begingroup\$ Depends how you cut it. You cut it so there's enough tab to locate in the jack, but not enough for it to be pressed by a finger. You can still get it out with a small screwdriver etc. \$\endgroup\$ – Owain Feb 8 at 8:55
1
\$\begingroup\$

You can shuffle conductors but:

  • if you swap pair-for-pair, MDI-X auto-negotiation might unswap them on the fly. Someone will connect their laptop and it'll "just work".
  • if you mix conductors between pairs and then run it over normally wired segment, you'll get crazy crosstalk that will probably kill the communication, receive lots of interference and cause even more. Balanced pair is the core concept of Ethernet, unpairing them will cause havoc in and out of your system.

We can't afford a Juniper at this location, would resolve all concerns.

This is your answer: you can't afford secure endpoint at this location, thus you cannot install anything other than guest network there. This is it.

What you're doing is you're trying to substitute obscurity for security and in every book it is HELL NO. Seriously, you're not securing anything, you're only lying to your superiors that something is secure when it isn't. You'll rightfully take all the blame when your scheme get breached.

\$\endgroup\$
3
  • \$\begingroup\$ You're absolutely correct. FWIW company is small (I'm the only I.T. person), and no one would even think to ask whether this is a thing. My best guess is that Joe's dongles were simply crossover adapters in a time before MDI-X. Wish I could find him to ask, but it's been 19y. \$\endgroup\$ – zedmelon Feb 10 at 16:59
  • 1
    \$\begingroup\$ @zedmelon about 15-20 years ago, back in 100Mbit times, I piggybacked another connection over extra pairs. Those pairs were completely unused, and all equipment just shorted them. You could run anything you wanted and noone would see it. SInce 1000Mb it's no longer an option. \$\endgroup\$ – Agent_L Feb 11 at 15:07
  • 1
    \$\begingroup\$ hahah yeah I did the same thing several times, connecting two PCs when only one cable was pulled to a location. Felt like cheating the system, sticking it to the man! \$\endgroup\$ – zedmelon Feb 12 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.