ceebster Posted September 9, 2013 Posted September 9, 2013 Hi Folks This post is aimed at all the schools that have successfully installed and are managing a BYOD solution within their school. We are in the process of configuring hours, but just curious of the thought of others. • Did anyone install a full NAP solution including having the client devices check for up to date AV / updates etc • Do you have a transparent proxy in your solution? • Do you allow your guests / to print • Do you allow your guests / students to plug their laptops into the school power to charge their laptops up? • Do you track what the students are browsing? • How have you authenticated them onto the wireless? • How have you protected your wired network? • Do you have an AUP that all your users have to accept before they come on line. Sorry for many questions but we just getting our head round it and its not as simple as just deploying the network. Many Thanks Chris
CyberNerd Posted September 9, 2013 Posted September 9, 2013 • Did anyone install a full NAP solution including having the client devices check for up to date AV / updates etc No • Do you have a transparent proxy in your solution? Yes, but only for certain devices (different SSID) everything else is a logged in connection to smoothwall. • Do you allow your guests / to print Yes via Papercut web print • Do you allow your guests / students to plug their laptops into the school power to charge their laptops up? Yes, 6th form have some 'charging lockers' • Do you track what the students are browsing? Only if they are not using transparent! • How have you authenticated them onto the wireless? Give them all the password. • How have you protected your wired network? The wireless student network is completely firewalled from the internal network, they can only access our proxy, web and Citrix servers. • Do you have an AUP that all your users have to accept before they come on line. Yes. We currently have about 500 machines connecting in and usually just under 400 at any one time. I had quick count up today by mac address identification and found that 247/377 (65%) were apple devices!
ceebster Posted September 9, 2013 Author Posted September 9, 2013 Hi There Thanks for that Couple of questions from our reply. Charging Lockers - where did you get these from? The wired network - what stops a student taking a network cable out of a PC, plugging it into their Laptop and connecting to your main desktop network? Thanks Chris
gshaw Posted September 9, 2013 Posted September 9, 2013 (edited) • Did anyone install a full NAP solution including having the client devices check for up to date AV / updates etc We did but it's a menace and causes more problems than it solves, especially on iOS and Android devices (doesn't seem to have a clue what to do with them) Being replaced by a simpler LDAP authentication \ guest isolation model on a separate VLAN and Internet connection • Do you have a transparent proxy in your solution? Effectively yes (goes through our Palo Alto where all traffic is inspected seamlessly on its way through for URLs, application signatures and so on) • Do you allow your guests / to print Will do via Papercut once we get that configured • Do you allow your guests / students to plug their laptops into the school power to charge their laptops up? Not sure on this one, good point and worth further investigation • Do you track what the students are browsing? Yes via the filtering etc • How have you authenticated them onto the wireless? LDAP lookup for valid staff \ student account • How have you protected your wired network? Policies on switches • Do you have an AUP that all your users have to accept before they come on line. Yes, the usual "by connecting to the network you accept the terms of the AUP" kind of line, along with a link to it on the Aruba portal Edited September 9, 2013 by gshaw
zag Posted September 9, 2013 Posted September 9, 2013 (edited) • Did anyone install a full NAP solution including having the client devices check for up to date AV / updates etc No, thats far too complicated for what we wanted • Do you have a transparent proxy in your solution? Yes • Do you allow your guests / to print No but would be easy enough to impliment web print via papercut I would have thought • Do you allow your guests / students to plug their laptops into the school power to charge their laptops up? yes • Do you track what the students are browsing? yes • How have you authenticated them onto the wireless? SSID password and aruba captive portal • How have you protected your wired network? Never needed to really but the proxy wont work unless they configure it to the correct port • Do you have an AUP that all your users have to accept before they come on line. No but we did update our ICT policies Edited September 9, 2013 by zag
CyberNerd Posted September 9, 2013 Posted September 9, 2013 Hi There Thanks for that Couple of questions from our reply. Charging Lockers - where did you get these from? The wired network - what stops a student taking a network cable out of a PC, plugging it into their Laptop and connecting to your main desktop network? Thanks Chris Bretford SafeCharge 10 Blue (Coin) (BSL-10-C-BLU) - www.misco.co.uk In theory nothing prevents the kids plugging directly into the school network. I've not put in any NAC (I did look quite seriously at packetfence though). It's not been much of an issue because there aren't very many places where they can connect other than in ICT suites. There are a few places such as in the library where I've put all of the network connections into the same VLAN as the firewalled wireless. Other than that I've not been too worried. I guess there is a thoretical risk and maybe I'll tackle it with packetfence in the future.
ceebster Posted September 9, 2013 Author Posted September 9, 2013 Hi Zag What Transparent proxy do you use? Can your student use any plug to charge their device - how do you get around Pat testing? THanks Chris
zag Posted September 9, 2013 Posted September 9, 2013 We use smoothwall for the transparent proxy. Yes they can plugin in most shared areas such as the LRC, or restaurant hall. PAT testing no idea! They are not school owned devices so I guess its the owners responsibility. I can't see how we could ever enforce PAT testing. Saying that we do PAT test our boarders stuff.
ConradJones Posted September 9, 2013 Posted September 9, 2013 Hi Zag What Transparent proxy do you use? Can your student use any plug to charge their device - how do you get around Pat testing? THanks Chris theres no legal requirement to pat test your own stuff, you don't have to pat test theirs. it does however have to be in good condition thats but it doesn't specifically have to be pat tested.
ceebster Posted September 9, 2013 Author Posted September 9, 2013 theres no legal requirement to pat test your own stuff, you don't have to pat test theirs. it does however have to be in good condition thats but it doesn't specifically have to be pat tested. So if a student comes in with their laptop and starts tripping the power - don't you have to ensure what's connecting the your electricity is safe? Just curious. Thanks Chris
ConradJones Posted September 9, 2013 Posted September 9, 2013 i didn't say that, i said specifically pat tested.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now