kennysarmy Posted March 10, 2015 Posted March 10, 2015 We've just had a situation where all 505 IP addresses allocated to our BYOD network where taken. They are allocated via DHCP with a 7 hour lease time. I am guessing we are running out because students own devices are remembering the MERU wi-fi network and auto-connecting each time they are in range of one of our AP's. I can reduce the lease time down, but will this really make a difference? How many IP addresses do you have available for your BYOD wireless networks?
localzuk Posted March 10, 2015 Posted March 10, 2015 The place to start is this - how many devices do you ever have connected to your BYOD network? If it is close to the 505, then you just need more IPs. If its nowhere near close, then your lease time is too long.
kennysarmy Posted March 10, 2015 Author Posted March 10, 2015 The place to start is this - how many devices do you ever have connected to your BYOD network? If it is close to the 505, then you just need more IPs. If its nowhere near close, then your lease time is too long. If I check the MERU controller it states that there are about 210 devices connected to the BYOD network....so I will reduce the lease time down to 3 hours and monitor tomorrow. Cheers
Stuclark Posted March 10, 2015 Posted March 10, 2015 We have roughly 66000 addresses available on our wireless; but only see aprox 1000 active clients at any one time.
Boredguy Posted March 10, 2015 Posted March 10, 2015 We had 240 addresses assigned for our BYoD, since we were only expecting a few devices, but we hit that limit last week, so I just upped it to a full 1000 incase we have all the staff and students using their own devices. We have a 3 hr lease time but better safe than sorry. Don't think I'll go for 66000 addresses at this stage
Chris_ Posted March 10, 2015 Posted March 10, 2015 We have 65,000 IP addresses available on our BYOD network. We haven't run out yet.
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 So last night I dialled in when everyone was off site and deleted all the IP addresses that were leased and shortened the lease time to 3 hours (from 7 hours) Currently we have 243 devices connected to all our wifi networks and I've checked the DHCP statistics again and it's saying Total Addresses 505 In Use = 454 (89%) Available = 51 (10%) If I check the Address Leases however it only shows our 47 Apple TV's as Reserved and a further 47 other devices, probably staff and students phones and other mobile devices. Arrgggg what's going on?
kearton Posted March 11, 2015 Posted March 11, 2015 Arrgggg what's going on? Are any of your SSIDs "Open" networks? If so, (m)any nearby devices just try to connect because they can see the network and hog an IP address (I mainly see this with Student's iPhones on our Guest network here). It's a PITA.
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 Are any of your SSIDs "Open" networks? If so, (m)any nearby devices just try to connect because they can see the network and hog an IP address (I mainly see this with Student's iPhones on our Guest network here). It's a PITA. Not OPEN - they join our BYOD network using their domain credentials.... But I don't understand how more IP addresses can be being used as shown in the statistics than are actually being used....
zag Posted March 11, 2015 Posted March 11, 2015 We have 256 IP's dedicated to it. We use MAC address filtering so know exactly who is connecting. Not even come close even with 200 registered users.
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 We have 256 IP's dedicated to it. We use MAC address filtering so know exactly who is connecting. Not even come close even with 200 registered users. so any students who want to use your BYOD wireless have to come and give you their mac address??
localzuk Posted March 11, 2015 Posted March 11, 2015 Not OPEN - they join our BYOD network using their domain credentials.... But I don't understand how more IP addresses can be being used as shown in the statistics than are actually being used.... Ah, question - is the "authentication" part a captive portal? The reason I ask is that the device is given an IP address before authentication then - so even if they connect briefly in passing, they still get an IP, which won't expire for the length of time specified. The only real way to deal with that would be to: a) Move to a different type of authentication - one where the device isn't given an IP before auth or b) Have more IPs in the pool c) Some form of pre-authentication based on hardware address - eg. MAC filtering.
zag Posted March 11, 2015 Posted March 11, 2015 so any students who want to use your BYOD wireless have to come and give you their mac address?? Yes, we have a surveymonkey form they have to fill in, then I just copy and paste the MAC they submit to our DHCP server allow list
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 Ah, question - is the "authentication" part a captive portal? The reason I ask is that the device is given an IP address before authentication then - so even if they connect briefly in passing, they still get an IP, which won't expire for the length of time specified. The only real way to deal with that would be to: a) Move to a different type of authentication - one where the device isn't given an IP before auth or b) Have more IPs in the pool c) Some form of pre-authentication based on hardware address - eg. MAC filtering. WEIRDLY! I've logged back in to the DHCP console and now it's showing all the IP's that are in use.... That does n't help with us running out of IP's but at least the statistics/leases in use seems to tally now.
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 We have 65,000 IP addresses available on our BYOD network. We haven't run out yet. @Chris_ How have you managed that? I was under the impression here that all our network traffic had to originate from an RM (SWGfL) provided IP address? A few years ago they gave us a new range of 4096 addresses.
localzuk Posted March 11, 2015 Posted March 11, 2015 @Chris_ How have you managed that? I was under the impression here that all our network traffic had to originate from an RM (SWGfL) provided IP address? A few years ago they gave us a new range of 4096 addresses. You can NAT it. So it'll appear as if its from one of their addresses. 1
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 You can NAT it. So it'll appear as if its from one of their addresses. Ah, I see, is this something setup on the DHCP server, the core switch, the meru controller or the Smoothwall? or all!? I may need to seek further advice on this....
MicrodigitUK Posted March 11, 2015 Posted March 11, 2015 @Chris_ How have you managed that? I was under the impression here that all our network traffic had to originate from an RM (SWGfL) provided IP address? A few years ago they gave us a new range of 4096 addresses. We have 2 x 4096 addresse ranges with the SWGFL. One 4096 addresse range for main school network out of one port on the SWGfL router. And the second 4096 addresse range for BYOD network out of other port on the SWGfL router. We did once have an old 254 addresse range for OLD separate admin network but traded it in for our new BYOD 4096 range. Or just NAT 5 or 6 SWGfL IP aggresses in a pool over to a new privet IP address range for your BYOD. We do this with our catering network that is running on a privet 172.16.0.0 range. We use our own Cisco router to achieve this NAT setup on top of the SWGfL one. 1
localzuk Posted March 11, 2015 Posted March 11, 2015 Its a bunch of it all really! You'd have your routing setup on your core, between your VLANs/subnets, your DHCP would have the new range to issue out, and you'd NAT with some form of edge device which relays things up to SWGfL. Smoothwall would do this for you. You'd not need to change anything on the controller though I think.
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 Its a bunch of it all really! You'd have your routing setup on your core, between your VLANs/subnets, your DHCP would have the new range to issue out, and you'd NAT with some form of edge device which relays things up to SWGfL. Smoothwall would do this for you. You'd not need to change anything on the controller though I think. Thanks. So no new hardware - just reconfigurations? New DHCP range, changes to core switch to add in new routing (new vlan?) and then find out how to NAT using the existing smoothwall?
Techie2000 Posted March 11, 2015 Posted March 11, 2015 Is there a best practice or a recommended method of increasing a DHCP scope within Windows Server DHCP?
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 Pretty much, yeah. I've created the new DHCP scope, pinged an email off to Smoothwall to find out what to do on their device and reckon I can create a new wi-fi on the MERU controller, it's just the bits on the routing (core switch) I might need to speak to one of our partners with... Cheers for your help.
kennysarmy Posted March 11, 2015 Author Posted March 11, 2015 Its a bunch of it all really! You'd have your routing setup on your core, between your VLANs/subnets, your DHCP would have the new range to issue out, and you'd NAT with some form of edge device which relays things up to SWGfL. Smoothwall would do this for you. You'd not need to change anything on the controller though I think. I may have hit upon a problem, our Smoothwall does not have the "firewall" feature under the Networking side menu - so may not be able to perform NAT...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now