BYOD -Help - How to do it for free with this set up?

[tj2419]

Hi

 

I have been asked to set up a BYOD network for use by our sixth form. I don't have any budget to pay for a system so needing to do it for free

 

Current Hardware

• Ruckus Wireless Network - ZD3000 and AP's across school
  
• HP 1910 switches
  
• Council run web filter that they created themselves that uses a proxy address
  

 

What we want

• We want sixth form to be able to bring in any device IOS, android and windows and be able to connect as easily as possible.
  
• Traffic needs to be filtered via proxy.
  
• Want it to try and have as few steps as possible for sixth form to link up to the wireless
  
• If possible some sort of way to prove they are from the school AD credentials?
  

 

Ideas

• Possibly QR code to scan to install a profile on IOS devices with wifi and proxy details in it. But they would need to have some connection already to download the profile. Any way to have a limited kind of provisioning network to download the profile but nothing else?
  
• WPAD maybe for windows clients
  
• Don't really have any experience with android so not sure on a method with that
  

 

Any ideas or suggestions would be extremely useful.

 

Thanks

[Tallwood_6]

Guest BYOD on its own WLAN and VLAN, setup some ACLs on the WLAN using the zone director and some rate limiting if needed.

Transparent filtering with a Captive portal of some kind which requires users authenticate before going out to the web so the receive appropriate filtering and activity is logged?

What do you have doing your web filtering currently and how is it currently setup?

[tj2419]

Guest BYOD on its own WLAN and VLAN, setup some ACLs on the WLAN using the zone director and some rate limiting if needed.

Transparent filtering with a Captive portal of some kind which requires users authenticate before going out to the web so the receive appropriate filtering and activity is logged?

What do you have doing your web filtering currently and how is it currently setup?

 

Hi

 

Our filtering is currently a custom system developed by our LEA. We don't really have any options to change configuration on that but it filters based on AD groups by traffic through a proxy.

 

When you say transparent filtering through a captive portal could you elaborate a little sorry. This is all new territory for me.

 

Cheers

[DMcCoy]

AD credentials is going to need a CAL, you may need to see what is actually covered under your license agreements. Also DHCP from a windows server or DNS is going to need a CAL. Small linux box or something like a pfsense firewall for dhcp/dns/wpad would be good for a FOSS option.

[spc-rocket]

Hi

 

I have been asked to set up a BYOD network for use by our sixth form. I don't have any budget to pay for a system so needing to do it for free

 

Current Hardware

• Ruckus Wireless Network - ZD3000 and AP's across school
  
• HP 1910 switches
  
• Council run web filter that they created themselves that uses a proxy address
  

 

What we want

• We want sixth form to be able to bring in any device IOS, android and windows and be able to connect as easily as possible.
  
• Traffic needs to be filtered via proxy.
  
• Want it to try and have as few steps as possible for sixth form to link up to the wireless
  
• If possible some sort of way to prove they are from the school AD credentials?
  

 

Ideas

• Possibly QR code to scan to install a profile on IOS devices with wifi and proxy details in it. But they would need to have some connection already to download the profile. Any way to have a limited kind of provisioning network to download the profile but nothing else?
  
• WPAD maybe for windows clients
  
• Don't really have any experience with android so not sure on a method with that
  

 

Any ideas or suggestions would be extremely useful.

 

Thanks

 

Hi there,

 

We are doing the same things as your described but advertising the SSID so its easier for staff and students to provision the devices. We have Radius server which works with ruckus zone director to assign dynamic vlans (single BYOD ssid to reduce the no. of ssids) based on user credentials. The credentials are validated by radius to the AD. Its the same username and password that students and staff uses to access the normal school network.

 

The access for internet is handled by captive portal so no need to have pac or wpad files for clients.

 

It works well and makes the whole provision easier.

 

We split it into 5 vlans (there are other vlans for other purposes) for the 4 year groups (Y10-13) and staff. We're a large school so had to plan capacity in terms of IP addressing etc.

 

From a self service provision point of view they have to as a one off put their username and password to connect to the BYOD network and then daily enter username and password for the internet (Captive portal), so the first time it is dual logon (for wifi and 2nd for internet).

 

 

Hope this helps,

 

Ash.

Edited October 9, 2014 by spc-rocket

[Duke5A]

Free, reliable and painless: pick two. I've been through this trying to use Squid that doubles as a captive portal for terms of use and to transparently proxy traffic to a cache peer for filtering. It just doesn't work reliably. The big hang up is HTTPS and unless you control the client to where you can install a cert for the Squid proxy the client will throw cert errors when visiting HTTPS enabled sites.

 

The only way around this was to put instructions on the captive portal page for people to configure the Squid box as a proxy on their device to get access to HTTPS enabled sites. The entire setup is a giant mess that ultimately works, but is a huge pain for the end user.

 

You're going to have to spend money.