BYOD and wifi network conundrum

Not sure with forum to stick this in as it has a bit of everything, not even sure how I'll write it up but here goes.

Current situation is this :-

Wifi is split into two vlans, one domain and one guest. The guest is transparent with no authentication, the domain has authentication via two smoothwalls.

Everything works great except I've now got two problems, well three if you count I've got no budget ;p

We have 45 staff Ipads, which connect to the guest wifi without a problem, they are managed via a mac mini server with profile manager.

So far so good.

Except I've been asked if I can get them on the same IP Range as the domain so they can start using applications like airserver / displaynote etc.

Okay I can do this, I can set up IDs / passwords for each Ipad and join them to the domain via a profile manager payload (PITA but doable).

Now this is the kicker, SLT have authorised students to bring their own I devices to lessons to participate in group application activities, however they will of course be on the wrong IP range.

How can I fix this without any cost or routing (I'd like to keep the vlans separate - they are vlans for a reason!)? can I send a payload to a guest device without end user interaction?

This suggestion depends a lot on how your vlans are set up and what version of Windows (I sure Windows 7 can do this) you are running, and there may be other security implications (local firewall on the Windows PC's), but here's one possible solution:

On the PC's running AirServer/Displaynote set up a virtual NIC, give it an IP or dhcp on your guest VLAN.

Now the iDevices should see those AirServers as being on the same network without having to join your domain VLAN.

That would mean tagging every port, its a possibility, plus forgot to mention all the machines are still on XP... (so airserver is moot afaik) I am going to recommend all the machines are upgraded to 7 during the summer.

How many student devices are you expecting to have? We manually set proxy on all of our student devices, works out about 250'odd a year between the two of us.

On BYOD ? I've no idea of numbers yet - won't be a whole heap - seems a lot of work doing it that way, though I suppose once they are done they are done (although entering the network key would be interesting (how do you do that?)). The other issue with this would be lack of authentication on their devices - not a huge problem they would just have to be told to enter their domain username and password. Just trying to make this as transparent as possible!

What about suggesting SLT buy some AppleTV's for the guest lan rather than allowing unsecure devices on to the domain lan?

We have some appletvs on the guest network at present, but if they were on domain they'd be a bit more flexible with displaynote / airserver (cheaper too) and similar apps, plus I'm not a huge fan of them (dropouts, picture size etc.)

Damn you! I'm going to come with a creative solution that'll work even if it's the last thing I ever do... ;)

How about...

Putting the PC's running airserver/displaynote on the guest network then setting up VPN's to your domain vlan for access to the secure stuff?

Quote:

---

Originally Posted by tmcd35

Damn you! I'm going to come with a creative solution that'll work even if it's the last thing I ever do... ;)

How about...

Putting the PC's running airserver/displaynote on the guest network then setting up VPN's to your domain vlan for access to the secure stuff?

---

Domain trusted computers on an untrusted networks, ummmmmm, eeep.

Quote:

---

Originally Posted by SYNACK

Domain trusted computers on an untrusted networks, ummmmmm, eeep.

---

Surely the devil is in the detail (aka, I can't come up with any better - can you?). I'm sure you can say the same about just about any VPN connection. The questions would be who as physical access/uses the machine(s) with the VPN connection(s), how does the VPN initiate and what does it have access to once it's connected.

The other answer so far is to put BYOD devices on the domain...

Surely the answer is.......Rasberry Pi????

No?

Ok then.

Ben

You can see the conundrum I'm having, I don't think there is a single answer to it. It has to be one thing or another, can't think of one easy free solution :(

I'm thinking raspberry pi, but rather not have a full distro of xbmc on there (plus I think it only mirrors video and audio correct me if I'm wrong)
I looked around to see if some bright spark came up with just an airplay mirroring distro - not sure if one's been done yet.

Got the raspberry pi working on lan via vlan no problem, but this still isn't going to help with PC apps (which is moot until they decide I can upgrade everything to windows 7)

Hating apple one day at a time..... :)

And now I've just had a brand new (cr)appletv taken fresh out of the box that will not connect to the wifi, no signal strength, nothing GRRRRRRRRRRRRRRRRRR

with apple TV's found it easier to activate them at home.......... (i didnt thank god)

Staff IPads on the Domain IP range. Fine they are under your control so you can trust them. BYOD, no way even with NAC, accidents or maliciousness could turn your network to Swiss cheese before you knew what was going on.