Allowing Students on non-domained devices access to the internet

[Joko]

I have been handed a rather odd issue by SLT and would like to know your thoughts on this as i need abit of a sanity check.

 

We have all new Aruba Wi-Fi instant in school and currently the only people that can connect are Sixth Form students and Staff via BYOD. We have some windows tablets that can't be domain joined and i have been asked to get them on the Wi-Fi, so students can access the internet. My main priority is that when students are on the internet, Smoothwall can authenticate their usernames.

 

 

• I have tried to set MAC filtering up on the Aruba. However, this somewhat does work but it passes the MAC address through to my Radius (windows) server. Which i can only assume will not play well with our Smoothwall as it's passing in the MAC address rather than a username.
  
• I was then thinking to just have a WPA2 password and then instantly have it re-direct to smoothwalls login authentication page - however, worried that there will not really be any time out on this, so the previous student may still be logged in when student B connects the lesson after.
  
• I could try EAP-TLS with a cert on the device - but i will still have the problem with bullet point 2.
  

 

I could allow students access to BYOD and have it set to 802.1x - but the clever students will know a VPN will bypass our smoothwall.

 

Any ideas?

 

Thanks.