Guest Wi-Fi - What do I need to know...?

[PyROm]

We run Unifi and Smoothwall here. We use the unifi voucher system. Reception has a stack of printed vouchers which are set to allow 24 hours wifi access, they write the name on the bottom of the voucher and tear it off (it includes a second copy of the voucher code) this way if they do anything untoward on the internet we can trace it back to them (I believe if you don't do this the school is legally responsible for anything they do using your wifi). Reception are under strict orders that they dont give vouchers to students. The guests are on a separate vlan and we use Smoothwall as a router, we just give them access to the internet, which is 99% unfiltered (lots of problems with various people needing certain awkward sites and vpn`s). We do not decrypt and inspect guest wifi, so no need for a certificate on their device.

[Primus]

At my last school I implemented guest WiFi after a similar conversation, ie everyone has it, why don't we?

 

The specific example was for people coming from NHS and LA who were on working visits.

 

Obviously I did it, but all the while grumbling to myself "what kind of organisation sends people out to work at remote sites without providing an independent way of accessing the internet?"

 

And for governors "out of people who want to bring their own mobile device to meetings, who doesn't have a phone which can run a hotspot?"

 

Eight years ago it would have seemed reasonable, but with the current price of data packages and with full strength 4G signal, it seems unnecessary to me.

 

Rant over [emoji57]

 

Not everywhere has good 4G - we have a school slap bang in the city centre where coverage is spotty. Providing guest WiFi is something I'd expect a school to do, but I would expect them to filter it and keep track of who is using each account. That means a little bit of work creating a guide etc so that people can onboard themselves by joining using RADIUS creds and then trust the MITM cert.

[Davit2005]

2. Use a layer 2 VLAN and terminate this straight onto your firewall. The traffic isn’t routed at all on the switch.

 

+ 1, Terminating the Guest WiFi on the firewall is a lot easier to restrict/allow than working with ACLs on switches.

 

Once you have enabled Layer 3 on a switch every vlan that has an IP address gateway on that switch becomes routable unless you have ACLs. If you have multiple layer 3 switches with dynamic routing then you could expose more vlans to the same risks.

Edited October 23, 2020 by Davit2005

[msi_school]

Not everywhere has good 4G - we have a school slap bang in the city centre where coverage is spotty. Providing guest WiFi is something I'd expect a school to do, but I would expect them to filter it and keep track of who is using each account. That means a little bit of work creating a guide etc so that people can onboard themselves by joining using RADIUS creds and then trust the MITM cert.

 

I don't think I have ever had a guest be able to trust the MITM certificate without help, the captive portal is difficult for most of them. I have produced guides, videos and talked them through the process but just finding the correct instructions for their device seems to defeat most people. To be fair the decision tree is fairly difficult especially for android phones.

[Koldov]

Use a layer 2 VLAN and terminate this straight onto your firewall. The traffic isn’t routed at all on the switch.

 

Unfortunately I don't think we have access to an on-site firewall, it is an LGfL network that comes in through a Virgin router and then onto the Cisco switches.

 

IIRC, the LGfL firewall is somewhere on their network as we are a part of that...

[FN-GM]

Unfortunately I don't think we have access to an on-site firewall, it is an LGfL network that comes in through a Virgin router and then onto the Cisco switches.

 

IIRC, the LGfL firewall is somewhere on their network as we are a part of that...

 

The other option might be better.

 

The Access Control List isn’t too big of a deal. For this purpose it will be quite small and simple.

 

I will post up an example for people to look at tomorrow.

[Primus]

We run Unifi and Smoothwall here. We use the unifi voucher system. Reception has a stack of printed vouchers which are set to allow 24 hours wifi access, they write the name on the bottom of the voucher and tear it off (it includes a second copy of the voucher code) this way if they do anything untoward on the internet we can trace it back to them (I believe if you don't do this the school is legally responsible for anything they do using your wifi). Reception are under strict orders that they dont give vouchers to students. The guests are on a separate vlan and we use Smoothwall as a router, we just give them access to the internet, which is 99% unfiltered (lots of problems with various people needing certain awkward sites and vpn`s). We do not decrypt and inspect guest wifi, so no need for a certificate on their device.

 

Filtering should be applied with SSL interception as without it's pointless.

[PyROm]

Filtering should be applied with SSL interception as without it's pointless.

 

Yep... except I am doing minimal filtering (where just the FQDN is good enough, which can be got without interception) on the guest wifi.

[Primus]

Yep... except I am doing minimal filtering (where just the FQDN is good enough, which can be got without interception) on the guest wifi.

 

To effectively filter to the degree necessary in a school you need to do more than that. There is plenty of content out there that won't be filtered by just the FQDN.

 

Are you suggesting your guests are less filtered than your staff?

[Koldov]

Although I don't wish to further derail this thread from the OP .... the question has some merit, but surely it can only be answered within context.

 

Do I think the very few 'guests' (Govenors, LEA staff) are going to be sitting in the meeting room doing anything remotely suspicious....

 

Or am I posting the SSID and password up and letting every Tom, Dick and Harry, run around the school joining the guest wi-fi (or using it as part of a BYOD strategy)...?

 

Hmmmm... talking of which, SSID - should it be broadcast or hidden?

[Primus]

Although I don't wish to further derail this thread from the OP .... the question has some merit, but surely it can only be answered within context.

 

Do I think the very few 'guests' (Govenors, LEA staff) are going to be sitting in the meeting room doing anything remotely suspicious....

 

Or am I posting the SSID and password up and letting every Tom, Dick and Harry, run around the school joining the guest wi-fi (or using it as part of a BYOD strategy)...?

 

Hmmmm... talking of which, SSID - should it be broadcast or hidden?

 

Broadcast the SSID - don't make it harder than it has to be.

 

Assume all network users are capable of doing something suspicious.

[Koldov]

Are you suggesting your guests are less filtered than your staff?

 

I would think that our 'guests' would be less filtered than the staff, or at least differently filtered - our staff who are in contact with the children all day everyday have reasonably strict filtering with exceptions (they can't access things like 'webmail') - I wouldn't expect to filter that for guests...

 

Assume all network users are capable of doing something suspicious.

 

Of course, I just wondered in my situation as I will have zero control over it when set-up (and it appears I will have even less access to the logs etc), if I should actually make it harder than it needs to be (I know as has been stated 'everyone' has cheap 4G data plans), but I've plenty of staff/teachers ask me for the wi-fi password over the years - if it becomes very common knowledge there's no way of me stopping it!

 

I know security by obscurity is frowned on, but at least it's something...?

[Primus]

I would think that our 'guests' would be less filtered than the staff, or at least differently filtered - our staff who are in contact with the children all day everyday have reasonably strict filtering with exceptions (they can't access things like 'webmail') - I wouldn't expect to filter that for guests...

 

 

 

Of course, I just wondered in my situation as I will have zero control over it when set-up (and it appears I will have even less access to the logs etc), if I should actually make it harder than it needs to be (I know as has been stated 'everyone' has cheap 4G data plans), but I've plenty of staff/teachers ask me for the wi-fi password over the years - if it becomes very common knowledge there's no way of me stopping it!

 

I know security by obscurity is frowned on, but at least it's something...?

 

I wouldn't give guests greater access than staff - staff access is the least restrictive I would grant anyone. That said I wouldn't block webmail etc for staff - a degree of personal use is permitted.

 

You're providing a service, this service has a clear benefit, why make it harder than it needs to be?

 

Governors are volunteers, expecting them to use their own data in a meeting etc would be wrong IMO.

 

Security by obscurity is no security at all.

 

Do not use a preshared key, setup RADIUS!

 

Why would you want to stop people using your guest network?

[TechMonkey]

I wouldn't give guests greater access than staff - staff access is the least restrictive I would grant anyone.

 

Won't you just get pupils connecting to the Guest wifi to get better access then?

[Primus]

Won't you just get pupils connecting to the Guest wifi to get better access then?

 

No because access is granted using RADIUS so the correct user gets the correct filtering.

[Koldov]

I've not looked into RADIUS, how does the user get into the database of the RADIUS server?

[Primus]

I've not looked into RADIUS, how does the user get into the database of the RADIUS server?

 

Our RADIUS uses AD accounts.

[Koldov]

How does that work for guests?

[Primus]

How does that work for guests?

 

We have AD accounts for guests, when they've been used we record who used them.

[supportman]

I've not looked into RADIUS, how does the user get into the database of the RADIUS server?

 

Ad usually, takes about 5mins to setup a radius server in windows and add a AD group for access.

 

You can test the radius rules with this small app, I found it really useful rather than doing it on the wireless controller:

 

https://support.secureauth.com/hc/en-us/articles/360019651812-How-To-Test-RADIUS-Using-NTRadPing

[Koldov]

rather than doing it on the wireless controller

 

Is this something that needs access to the network configuration then, or just something added to Windows Server?

[Koldov]

And what authenticates and how?

 

Users or computers?

 

Do they need to 'log-in' to use the network after RADIUS is set-up?

[PyROm]

We issue all teachers with laptops, these connect to their own ssid and have decrypt and inspect turned on. They can also use their school login to connect to a staff BYOD ssid, again with decrypt and inspect turned on. Students are not given any wifi access. Visitors can use the guest wifi, it has a fixed pre-shared key, however once connected they cannot do anything until the enter a valid voucher code into a web page to unblock access (station to station access is disabled as well). The guest network is firewalled off from the rest of school network so they can only access the internet, even dns lookups are handled by our firewall on not DC`s

 

We do very little filtering of teachers internet, we used to heavily filter it but after several years it was clear that it was counter productive, caused a lot of work for teachers checking sites they wanted to use worked correctly and disrupted lessons if they couldn't get on something they wanted to. We changed to minimal filtering, just filtering porn, proxies, hacking sites and limiting file types they can download etc. on the grounds that the teachers are trained professionals, trained in safeguarding and signed up to follow school policy's.

 

Guest access is the same as teacher access except we don't use decrypt and inspect, although this might slightly weaken some of the filtering but the majority is there. We used to use decrypt and inspect, but getting Ofsted inspectors, county auditors, school nurse, careers advisors etc. to hand over their laptops to have a certificate installed (none of them were willing to follow a guide and do it themselves), and then have to go away and fiddle to get their obscure portal/vpn/webmail through the proxy just looks unprofessional, takes time away from the visitor and did not give any extra security to the school. I should point out we do not allow parents on the guest wifi.

[Primus]

And what authenticates and how?

 

Users or computers?

 

Do they need to 'log-in' to use the network after RADIUS is set-up?

 

You're getting into very detailed discussions here. What do you mean log in to use the network? They use their AD creds to join the network.

 

You can use RADIUS on a user or computer basis. For a guest network it'll be using user creds.

[PyROm]

To use radius you setup the NPS server (radius) on a windows server and setup rules, eg. allow access if user is a member of this group. Then on your access points you tell them to authenticate against your NPS/radius server. When the user clicks on the wifi ssid in their wifi list, it will ask them for their username and password, the ap then checks this against the NPS to see if it is allowed to connect.