BYOD / iPad filtering with Sophos XG

[CyBeRkId2002]

Cross posting as I think this may be a more appropriate forum:

 

Morning all,

 

I am starting a new job in the next few months and my brain is already ticking over on a number of systems I haven't used before. One of these is best practice using a Sophos XG for BYOD (something we do not use in my current workplace) and iPads (which we do use). I am well versed in Safeguarding requirements and have been using a combination of Securly and Classroom.Cloud - but need to get my head around what is possible with the Sophos. Understandably the school will want and expect any changes to be as seamless and frictionless for students as possible.

 

BYOD

 

So far I have concluded my options may be:

 

Open access on to the WiFi (obviously with locked down access to just internet / DNS / DHCP etc.) coupled with a captive portal for the Sophos where users enter AD credentials. This is possibly my preferred option.

Potentially setting up 802.1x on the Wifi and passing through the authentication credentials to Sophos XG? Not sure if this is possible

Some kind of MAC restriction and logging who has what IP. Seems longwinded and slightly archaic

 

 

What are others doing and are there any other better options I have missed? Regarding the first option (if that is best), what are likely to be the areas of friction? I will want a secure connection to the Sophos for auth so suspect purchasing a certificate would be best so users do not have to install one for that purpose. Even so, I suspect a certificate would need to be installed for SSL inspection if going down this route.

 

Ipads

 

Options for these I think are similar to the above but again would love to hear what others are doing. With the captive portal option I guess I can set a timeout of inactivity for authentication. My thinking is I would probably want this shorter for iPads (possibly 15 minutes or so) which are used by multiple students, than BYOD devices which will be 1:1. I suspect with the captive portal it will be a one-size fits all though.

 

Any guidance on best practice in these scenarios would be greatly appreciated! If people have any consultants who they can recommend who really know these areas to help in best practice particularly in the education sector again, it would be much appreciated.

[Guest Guest]

We use 802.1x and RADIUS SSO with our XGS.

 

Once the user has connected to our network for the first time and installed the filter CA the process is seamless to the end user

 

Been setup this way for the last year or so and had no issues

[CyBeRkId2002]

Thanks Kieran. My knowledge on 802.1x is limited at best (and more on the WiFi / certificate side) so I have some follow-up question if that's ok.

 

Is the 802.1x setup on the Sophos, or the wireless system? I am guessing the former.

Do you have an open network for the actual WiFi?

What do you use for the RADIUS Auth? Microsoft NPS?

What certs are required for the client? One from the Microsoft CA? Or just one you download from the Sophos. How do you get this on Client devices? Simple instructions for students to follow? I presume they have access to where this is hosted before full authentication.

 

So many questions. Did you get someone in to configure, or sort it in-house

[Guest Guest]

Thanks Kieran. My knowledge on 802.1x is limited at best (and more on the WiFi / certificate side) so I have some follow-up question if that's ok.

 

Is the 802.1x setup on the Sophos, or the wireless system? I am guessing the former.

Do you have an open network for the actual WiFi?

What do you use for the RADIUS Auth? Microsoft NPS?

What certs are required for the client? One from the Microsoft CA? Or just one you download from the Sophos. How do you get this on Client devices? Simple instructions for students to follow? I presume they have access to where this is hosted before full authentication.

 

So many questions. Did you get someone in to configure, or sort it in-house

 

We have a single SSID using WPA2-Enterprise, the VLAN is set depending on the account which is used to connect

 

You’d need to configure your wireless to use a RADIUS server (I used NPS) for authentication, NPS would need to be configured to forward accounting data to your Sophos Appliance

 

We require students to install our CA certificate as we have TLS inspection enabled, no other certificates are required on student devices. Documentation is provided on how to install the certificate, usually mobile data is used for that though.

 

I configured it in house

 

These links may be helpful

 

https://doc.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/Servers/RADIUS/AuthenticationConfigureRADIUS/index.html#

 

 

https://blog.matrixpost.net/set-up-a-radius-server-on-windows-server-2019-for-802-1x-wireless-connections/

[ITMat]

Hi kieran1990,

 

I guess you host a captive portal page or something on another server (where you list instructions/distribute the CA cert)?

 

Kind regards,

 

Mat

[Guest Guest]

No we don’t have a captive portal.

 

We sent instructions out via email, host the certificate on OneDrive and shorten the link using bit.ly

[ITMat]

Oh I see, so you expect people to do it before they arrive/connect (or those links are allowed through your Sophos box at all times)?

 

Or is there an open network for grabbing that stuff?

 

Hopefully I'm making sense.

 

Thanks,

 

Mat

[Guest Guest]

99% of devices being connected are smart phones, mobile data is usually used.

 

We don’t TLS inspect our guest VLAN, tried it but had too many issues with devices managed by the LA etc and not being able to install the certificate