Service engineers, auditors, lecturers and contractors come on board for a few days and need the crew or business network. Adding their laptop or phone is easy. Remembering to remove it is not. A year later the firewall holds hundreds of devices nobody can name, and some of them belong to people who left months ago.
How device access usually works on a SonicWall
A common setup on ships is a MAC Address Object per device, placed in an Address Group, and access rules and bandwidth limits that reference the group. Removing a device from the group removes its access. The problem is that address objects in SonicOS have no expiry date. Nothing happens on the day the contractor signs off.
A simple manual method
- Name the object so it explains itself: person, device type, company, for example
J.Smith [Laptop] Contractor. - Put the end date in the object's comment or in a shared list, in the same format every time (YYYY-MM-DD sorts correctly).
- Keep contractors in their own Address Group, with its own access rule and Bandwidth Object, never in the crew group.
- Once a week, and on every port day, remove the objects whose date has passed. Commit once, and check the group membership afterwards.
It works as long as the same person does it every week. At handover it is usually the first thing to be forgotten.
Watch out for random MAC addresses
Modern phones and laptops use a different, random MAC address for each Wi-Fi network, and some change it periodically. A device registered with one address may appear tomorrow with another and lose access, or the old object stays behind unused. Ask the guest to turn off the private or random address for the ship's network only:
- iPhone: Settings > Wi-Fi > (i) next to the network > Private Wi-Fi Address: Off.
- Android: Wi-Fi > network settings > Privacy > Use device MAC (on Samsung: MAC address type > Phone MAC).
- Windows: Settings > Network & internet > Wi-Fi > the network > Random hardware addresses: Off.
A MAC address whose second hexadecimal digit is 2, 6, A or E is a locally administered (usually random) address; register it only after the guest has turned the feature off.
Review before every audit
Cyber security audits increasingly ask who has network access and why. Export the contractor group before the audit, check every name against the crew and visitor lists, and remove what you cannot explain.
Doing it with Device Manager for SonicWall
Device Manager for SonicWall adds each device with an expiry date, names it from your own template, and lists the expired devices so they can be removed from their groups or deleted in one session with a single commit. The Android app scans the MAC address with the phone's camera and warns when it looks random. Both apps work through the SonicOS API, without the web interface.
All shipboard IT guides · Razvan Malciu, shipboard IT officer