BT/O2 Wifi Hotspots in Schools

[garethEds]

Morning all,

I'm not sure how other schools operate their wifi networks but as far as I am aware my LEA do not allow BYOD for pupils. I believe this is because of bandwidth worries (which I understand).

However, with a Sixth Form centre, a unique selling point for us would be BYOD - especially as I guess the Sixth Form Colleges may offer it.

We are also loosing Sixth Form pupils to the local bakery at lunchtimes because it has free wifi. So they go with their laptops and order food whilst surfing the web and not using their data allowances. This has a knock on effect of taking money away from the school dinner hall and the Sixth Form Cafe.

So - has anyone looked into it? I have asked BT and O2 what they can offer. O2 supply McDonalds whilst BT supply places like STarbucks etc. I have no idea of the cost or the logistics but unless the LEA implement something soon it is an area we will have to consider.

Any opinions or experience out there?

Gareth

[synaesthesia]

Separate, business FttC line? Few hundred a year, no doubt around or even less than you'd get from those o2/bt offerings, depending on your wifi setup may be able to direct BYOD traffic over your existing system to the fttc line...

[zag]

Yep a quick solution would be to add a separate VDSL line, and run a guest system off that. We did that for a while in our boarding houses and it worked quite well. We used the IP filtering they provided and their router.

 

We now have full BYOD over our Aruba controller captive portal and smoothwall. It works very well but was complicated to setup.

[FN-GM]

Due to not being in control of the machines, expect an increased amount of bandwidth from BYOD.

 

Have you considered dumping you LA totally if they are restrictive? Maybe people have found (including myself in the past) it cheaper to go with an ISP direct.

 

Thanks

[garethEds]

Due to not being in control of the machines, expect an increased amount of bandwidth from BYOD.

Have you considered dumping you LA totally if they are restrictive? Maybe people have found (including myself in the past) it cheaper to go with an ISP direct.

Thanks

 

Leaving the LEA? Don't get me started on that :-) It's a conversations we are having but due to SIMS being held centrallry, they basically have us over a barrel.

 

Gareth

[forkies]

Leaving the LEA? Don't get me started on that :-) It's a conversations we are having but due to SIMS being held centrallry, they basically have us over a barrel.

 

Gareth

 

Leave the lea and host sims yourself? Its your data so just get them to give you the database.

[Blue_Cookeh]

I know BT WiFi are primarily concerned about unique foot traffic. Places like Starbucks and McDonald's will attract enough of their existing customers, or people who are willing to pay, to make it worth their while. Not so sure a school would offer that. They end up doing surveys and all sorts before even thinking about putting a solution in.

[Edu-IT]

Have you thought about maybe a company like @SchoolsBroadband or Exa who can provide a filtered internet connection? That way, all you would have to pay for is your connection going in an the access points, and not have to worry about further costs for onsite filtering? At least in the beginning.

[GrumbleDook]

Leave the lea and host sims yourself? Its your data so just get them to give you the database.

 

Wales. A lot of centralised controls linked to funding.

 

Politically, a hot potato!

[3s-gtech]

We offer BYOD to all students. Bandwidth is an issue through the central Smoothwall filtering currently, but I've never seen issues for personal devices which don't go through the Smoothie. We've got over 1000 users on it, so may be worth a shot. We're on 100Mbit to the LEA 300Mbit backbone.

[garethEds]

We offer BYOD to all students. Bandwidth is an issue through the central Smoothwall filtering currently, but I've never seen issues for personal devices which don't go through the Smoothie. We've got over 1000 users on it, so may be worth a shot. We're on 100Mbit to the LEA 300Mbit backbone.

 

Hi - how to you register the machines onto the network? We are after self-registration of the device onto the wifi and then using their school username/password to access everything. We used to have a guest network but now we have to give each device it's own key. we have been provided with a list of pre-shared keys but it's a hassle.

[FN-GM]

Hi - how to you register the machines onto the network? We are after self-registration of the device onto the wifi and then using their school username/password to access everything. We used to have a guest network but now we have to give each device it's own key. we have been provided with a list of pre-shared keys but it's a hassle.

 

Smoothwall has a radius service. You use your AD credentials to connect to the SSID and it filters and logs based on the credentials used to connect to the SSID.

[fiza]

Downloading https inspection certificates onto student devices has been a big headache for us. Mainly because students don't read instructions, then get stuck and seek us out to rectify things.

[zag]

You can also use DHCP to only allow MAC addresses. We have an online form they fill out with their MAC address then I just ass that to our DHCP allow list.

 

Works really well in practice.

[FN-GM]

Using MAC addresses like that isn't very secure.

[3s-gtech]

Hi - how to you register the machines onto the network? We are after self-registration of the device onto the wifi and then using their school username/password to access everything. We used to have a guest network but now we have to give each device it's own key. we have been provided with a list of pre-shared keys but it's a hassle.

 

NPS Server on a DC, this is tied to the guest SSID on the wifi network. The students accept the AUP which then adds them into the AD group that can authenticate. They accept the AUP and their normal AD logon details get them on.

[zag]

Using MAC addresses like that isn't very secure.

 

Can I ask why not? We've been using the system for 5 years now with no issues at all. Every device is tracked and authorized by its hardware MAC address. Any issues we simply de-register the device and it can no longer connect t the guest wifi. Their MAC is tied to their captive portal login so there is no real scope to fake it or change it.

[FN-GM]

You can spoof them in about 30 seconds. You're tracking devices by mac address so someone can pretend to be someone else very easily.

[zag]

You can spoof them in about 30 seconds. You're tracking devices by mac address so someone can pretend to be someone else very easily.

 

Yes but their MAC is registered against their username, so I really don't see how spoofing is an issue. It would be immediately obvious.

 

Our wireless system also list the device type and platform, so for example if someone had an android phone and was spoofing the MAC address of a laptop they have registered it would show up.

 

As I said, we've used the system for years and have not had 1 single issue. Its works really well from our experience.

[GrumbleDook]

It all depends on whether you have the time to check and cross reference. Within that time someone may be in, abused the system and gone.