BYOD in a boarding school - if I had hair I would be tearing it out.

[Rilot]

Morning all

I'm banging my head against this one.....

 

I took on a new school recently which had literally zero restrictions on the BYOD wifi. This had to change.

 

My setup:

Ruckus WiFi using Smartzone

Smoothwall firewall

 

I've recently implemented RADIUS authentication via NPS with accounting forwarded to Smoothwall but it's causing more issues than it's solved. I'm not doing SSL inspection at this point.

 

Issue 1 - Different android devices deal with certificates in different ways. Some will just join, others require me to type the name of the radius server in to the "domain" filed, others require the students name in the "anonymous" field etc. etc. Can't write a guide due to there being so many different versions. iOS is fine, just trust the certificate and off you go. This is a massive headache for me and my students. Yes, I have a public certificate for the RADIUS server.

 

Issue 2 - Smoothwall seems to only tie the username to the IP address about 50% of the time in guardian. If I search on an IP address for example, I will see the IP listed against a username, but other times I will see it listed against itself. This causes a problem because anything that doesn't get picked up doesn't get the correct filtering applied (I have a high level of filtering applied for unauthenticated requests). I tried using the Smoothwall as the actual RADIUS server and the DHCP server to see if this would solve the issue but it didn't.

 

The main issue is that we are a boarding school. I can't say "Right, no more BYOD!" as that's just not cricket for the boarding students. Nor can I force them to only have certain devices.

 

I just can't figure out how to do this in such a way that both protects the kids from dangerous stuff, while giving boarding students more access (but still stopping the dangerous stuff), and being as simple as possible so that a year 7 student can do it without messing around.

 

I'm considering forgoing the RADIUS authentication and just doing a captive portal that authenticates against AD once per day with accounting forwarded to Smoothwall. That doesn't get me around the issue I'm having with Smoothwall not linking usernames to IPs all the time though.

 

Stressed IT manager here. Any advice would be appreciated.

[jnfarmer]

Not sure if you can do this with Smartzone, but have Ruckus One with CloudPath, we do a captive portal onboarding with M365 (in your case AD) which then gives the pupil a DPSK.

 

Not sure about the issues with Smoothwall not linking usernames to IPs. We use Lightspeed and it does it without any problems. Might be one to kick to Smoothwall?

[psydii]

Its been a long time since I looked at what the market can offer in this regard. We do a variation on the below and have done for 14 years.

 

1) require pupils to register their device mac address with you. (randomised mac addresses must be disabled)

2) A subnet per year group (at least). Each with a scope configured with "reservations" only, each registered device gets a reservation in the appropriate scope.

3) radius auth based on username. your can then drop pupils into correct subnets based on their group membership.

4) On the filtering platform, filter rules based on subnet rather than user/group.

 

You might want additional subnets available for cases where additional restrictions need to be applied (as a sanction, or for special projects)

 

You now can map ip to users, and have some granularity on the control of access to services.

 

If you don't mind cross referencing several sources when doing and investigation, you can skip the MAC address/DHCP reservation part. This is basically how we do things. If I need to trace a device back to a user I have to go splunking in NPS logs / DHCP logs to see who has that address.

 

With regard to RADIUS/TLS being a headache - generally only once or twice per pupil every three or so years. How to get through the logon screens correctly is the sort of knowledge that spreads thorough a student body on its own. If you have TLS MITM inspection or intend to, then your might as well stand up your own CA to serve radius and the firewall/proxy and have them import those root cert.

[Guest]

Hey,

 

From my expericence Smoothwall can be a bit complex when you want to start doing stuff towards. Securly has always been my fav filtering system it can link stuff against a username properly. Im assuming your using a MDM which can deploy the certificate and URL out. I believe they have a certifcate for each device.

 

Not the cheapest but its defienetly one off the best from what I think. If you need any help let me know have some connections at a couple off MSP's and some at Securly

 

Thanks

[drewp]

For the Boarding SSIDs I have it setup to send RADIUS Auth to NPS and the Acc to the Smoothwall server - not forwarding the ACC from NPS to Smoothwall.

Also have other SSID sending RADIUS Auth and Acc directly to the Smoothwall server.

 

Smoothwall has an Auth option for "Redirect users to SSL Login page (with session cookie)" you could look at. It would need the devices to have the SSL Certificate from your Smoothwall Server to be installed on the BYOD to work, but you would also need that installed for HTTPS Interception.

 

I have found Google Pixel Phones are difficult to get working with self-signed certificates...

[thimon]

We’re a boarding school with BYOD. We use a captive portal which is pretty reliable.

[TechMonkey]

Get CloudPath. We have a similar setup to you, including boarding, and use CloudPath to give each pupil a DPSK. With boarders we then push a boarding house only VLAN that we can then identify them on when they are in the boarding house to give more relaxed access. When they are in school they revert to school rules. This allows them to be ill at the boarding house and call mum, or watch netflix, without having special access around the school, or restricting the pupils to timed access.

 

As for Smoothwall identifying users, no issues at all, nothing complex just works. One thing to check is that the URLs giving IP addresses a usernames aren't in the AuthBypass category. I found at my current school that a lot had been put in the AuthBypass which meant users weren't identified and you couldn't then allow staff access and not pupils.

 

Happy to talk more if you want to chat about it.

[chris_uk]

Morning all

I'm banging my head against this one.....

 

I took on a new school recently which had literally zero restrictions on the BYOD wifi. This had to change.

 

My setup:

Ruckus WiFi using Smartzone

Smoothwall firewall

 

I've recently implemented RADIUS authentication via NPS with accounting forwarded to Smoothwall but it's causing more issues than it's solved. I'm not doing SSL inspection at this point.

 

Issue 1 - Different android devices deal with certificates in different ways. Some will just join, others require me to type the name of the radius server in to the "domain" filed, others require the students name in the "anonymous" field etc. etc. Can't write a guide due to there being so many different versions. iOS is fine, just trust the certificate and off you go. This is a massive headache for me and my students. Yes, I have a public certificate for the RADIUS server.

 

Issue 2 - Smoothwall seems to only tie the username to the IP address about 50% of the time in guardian. If I search on an IP address for example, I will see the IP listed against a username, but other times I will see it listed against itself. This causes a problem because anything that doesn't get picked up doesn't get the correct filtering applied (I have a high level of filtering applied for unauthenticated requests). I tried using the Smoothwall as the actual RADIUS server and the DHCP server to see if this would solve the issue but it didn't.

 

The main issue is that we are a boarding school. I can't say "Right, no more BYOD!" as that's just not cricket for the boarding students. Nor can I force them to only have certain devices.

 

I just can't figure out how to do this in such a way that both protects the kids from dangerous stuff, while giving boarding students more access (but still stopping the dangerous stuff), and being as simple as possible so that a year 7 student can do it without messing around.

 

I'm considering forgoing the RADIUS authentication and just doing a captive portal that authenticates against AD once per day with accounting forwarded to Smoothwall. That doesn't get me around the issue I'm having with Smoothwall not linking usernames to IPs all the time though.

 

Stressed IT manager here. Any advice would be appreciated.

 

Speak to Net-Ctrl (They do have an account on here) - http://www.net-ctrl.com They set this up for me with NPS, Smoothwall and Ruckus. Really worth speaking to them to get some work done.

 

Chris

[tom_newton]

Misidentification is usually down to roaming between access points, and the AP not sending intermediate radius accounting messages. As long as the smoothwall is getting the right data from your aps, you should be OK

 

 

I'd still say it's your best bet, as once folks are logged in, that's them sorted for good.

 

Have you a support ticket active?

 

Tom

[synaesthesia]

Whats the ballpark cost for Cloudpath? With BYOD getting more and more difficult, 3rd party solutions like this might be a necessity. Even with the best out of the box solutions from the usuals (firewalls, wifi's captive portals, NPS, radius etc) it's being made so much harder by increasing security requirements, particularly whilst privacy rights increase and your average person is only just capable of connecting to a wifi let alone downloading a certificate, installing the certificate, trusting the certificate; all on a myriad of devices which are impossible to document for because the settings/procedure differs from OS to OS and version to version

[Net-Ctrl]

Cloudpath is a tiered pricing models - the more users the cheaper it gets. It's licensed per user, not device, so any user can have multiple devices. Which works nicely in a boarding environment as you can create each student their own "bubble" almost like a segregated network for their own devices all mapped back to them as a user. As an admin you can define different workflows for different users, and devices, that said. It's not a silver bullet, and a specific device or OS can limit onboarding options.

 

If anyone would like more information please send me a PM and I can set-up a call with one of our SEs to go through your use-case to see if it would help solve challenges and also a demo.

[Net-Ctrl]

@Rilot if it helps in your situation we could get one of our SE's to take a look at your existing setup and offer up any advice, and discuss things like Cloudpath should the conversation go that way.

 

As for others with questions about Ruckus set-ups. Please also feel free to always send me a PM to run through anything. We'll always help where we can. I may not know the answers but can likely find someone that does.

[TechMonkey]

As an alternative to my previous post, you can provision DPSK natively in SmartZone but I don't know how well this works in practice so you could use it as proof of concept at no extra costs and without the fancy VLAN fiddling.

 

I would still recommend CloudPath though.

[Rilot]

Thanks for the advice everyone. I did actually solve the Smoothwall issue yesterday. There was a "do not filter" rule in place for a huge number of domains. When this is active it of course doesn't log the username. Turned it off and we're golden.

I will investigate DPSKs. Sounds like a decent solution.

[MartinT]

We use Cloudpath together with our Ruckus APs and Smoothwall for filtering by year group. We also use IDex on our domain controllers, including the NPS server for RADIUS. BYOD is for Sixth Formers only here, all lower year groups are denied (they have their phones locked in Yondr pouches during the day).

 

I agree that installing the certificate from the getmitm page is the most tricky step in our instructions and different Android flavours behave differently. Apple is no better with their need to install and trust. We give instructions for Android, iOS, iPadOS, Windows, MacOS. We do not support Chromebooks.

 

I was going to say to look for do not filter rules, but it looks like you've sorted it.

Edited February 21, 2024 by MartinT