BYOD and filtering/Monitoring

[newpersn]

Hello all.

 

Bit of a mind dump:

 

Just looking for feedback from other schools in terms of filtering and monitoring of BYODs.

 

We are allowing Year 12 to bring your own device in the new school year and looking at various things currently. I've been here for 3 weeks and still picking though bits.

 

We have a flat network currently with SWGfL (which we are looking at changing in the near future)

 

We are replacing our aging wifi system to cambium system over the summer.

 

We did look at isolating BYOD traffic though the wifi system but they couldn't connect to the Internet without putting the proxy in. (We do have transparent as well)

 

We don't have much of a DHCP scope to play with. (10.x.x.x/21 )

 

We use RouterOS 10.x.x.1 at the start of the network. Mikrotik switches. (We do have some old HP still going but these will be replaced during the Summer)

 

My questions in a random order.

 

How simple is it to add a vLan outside our scope but routed though the connection?

 

We also have lightspeed alert and filter (filter not been setup my the looks of it) can i use this with BYOD traffic to filter/ monitor without making the end user do anything.

 

We do not want to install anything on BYOD devices we don't own.

 

Please let me know what you've done regarding BYOD.?

[CrootUK]

Most common for BYOD/Guest networks is they sit in a different vlan, where its layer 3 interface is on a device that capable of ACLs or Firewall rules, depending on what access points you have some may also have “client isolation” where it does that on the AP itself.

 

ontop of the the network separation they should usually be Web filtered with https inspection (this requires a cert installing on the devices usually straight forward with QR) now depending on your policies/contracts with isps etc https inspection may not be required but usually it is..

 

To my knowledge Lightspeed only offers dns filtering for unmanaged/byod devices (this maybe wrong dont quote me on it) which may be enough for your school, but you need to understand the pros and cons and ensure its communicated with Head/SLT/Safeguarding Leads

 

I would advise looking at the DfE digital standards for this as it will point you in the correct direction and offer you backing when making these changes.

 

https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/filtering-and-monitoring-standards-for-schools-and-colleges

 

for us, all our schools the byod/guest networks are in a different vlan, with web filtering + https inspection and outbound/inter-vlans traffic blocked on firewall.

Edited June 27, 2024 by CrootUK

[Warwick_Tech]

Looks like Croot has the basics of this question down.

 

But yes, you don't want guest devices to ever touch your main DHCP, this is for your devices only so you can control HTTPS inspection certification etc.

 

We don't have HTTPS decrypt and inspect on the guest WIFI as not everyone or every device can install the certificates; however, it's still all filtered through the main Firewall.

 

The way we have DHCP configured is we have our main DHCP, but the firewall can also have DHCP connection, so we have a range for staff, a range for guests, a range for students and a range for 6th form - We use Unifi switching and AP's so it's really easy to setup a new SSID, assign it a VLAN, configure the rules and it all directs back to the firewall giving secure access, complaint with KCSIE without compromising the central network.

 

Feel free to throw out any more questions.

[newpersn]

Little bump on this.

 

Any one got any other ideas for filtering/monitoring for BYOD,

[timbo343]

Little bump on this.

 

Any one got any other ideas for filtering/monitoring for BYOD,

The issue is you're going to have is not installing something on devices you don't own.

 

Having user authentication be it a web form or radius auth should present your user to your filter so they are assigned the correct filtering rules.

 

You won't be able to inspect the search terms as you've not installed a MitM certificate on the device you at best you can only do DNS / URL filtering.

 

In a way, i'd say BYOD lf students has had it's day and schools shoud be looking at 1:1 company owned devices, even down to the level of students being able to purchase their own devices and enroll them onto the cloud network (i'm talking from a Google Workspace experience), that for me still gives bumpy grounds as there needs to be clear expectations from parents and school staff about what happens if.

 

In terms of the BYOD network, is it used for devices without a SIM such as laptops and tablets? If phones are going to be connected to the BYOD and i was a student, i'd just use my data and tether / hotspot my own devices to my phone.

 

Schools really need to be looking at 1:1 devices or at least company devices for full management and yep instead of having static IT rooms the cost has now been shifted to portable 1:1 devices.

 

The other way is to ask said users to install a MitM on the device for full inspection or ask them to install a "work profile" on the device but honestly how mant people will be happy a work profile is being installed?

 

You're going to need to VLAN the BYOD away from your main network, do this either by your filter / firewall or your core switches. Layer 3 switches will be able to do the DHCP and VLAN management or if your firewall / filter can do it (i use a smoothwall for all mine) let your firewall handle it.

Edited July 4, 2024 by timbo343

[supportman]

The issue is you're going to have is not installing something on devices you don't own.

 

Having user authentication be it a web form or radius auth should present your user to your filter so they are assigned the correct filtering rules.

 

You won't be able to inspect the search terms as you've not installed a MitM certificate on the device you at best you can only do DNS / URL filtering.

 

In a way, i'd say BYOD lf students has had it's day and schools shoud be looking at 1:1 company owned devices, even down to the level of students being able to purchase their own devices and enroll them onto the cloud network (i'm talking from a Google Workspace experience), that for me still gives bumpy grounds as there needs to be clear expectations from parents and school staff about what happens if.

 

In terms of the BYOD network, is it used for devices without a SIM such as laptops and tablets? If phones are going to be connected to the BYOD and i was a student, i'd just use my data and tether / hotspot my own devices to my phone.

 

Schools really need to be looking at 1:1 devices or at least company devices for full management and yep instead of having static IT rooms the cost has now been shifted to portable 1:1 devices.

 

The other way is to ask said users to install a MitM on the device for full inspection or ask them to install a "work profile" on the device but honestly how mant people will be happy a work profile is being installed?

 

You're going to need to VLAN the BYOD away from your main network, do this either by your filter / firewall or your core switches. Layer 3 switches will be able to do the DHCP and VLAN management or if your firewall / filter can do it (i use a smoothwall for all mine) let your firewall handle it.

 

I'm just trying to set this up on smoothwall and getting a bit lost. Do you have a basic guide on how you did it?

 

I've seen you can define a new interface as a VLAN but get stuck after that in terms of setting up the DHCP and scope.

[timbo343]

I'm just trying to set this up on smoothwall and getting a bit lost. Do you have a basic guide on how you did it?

 

I've seen you can define a new interface as a VLAN but get stuck after that in terms of setting up the DHCP and scope.

 

The best way i do this is (it's a bit of to and frowing) but it's the basics:

 

Go to Services > DHCP > DHCP Server and create a new DHCP range and Subnet

 

Create the VLAN interface in Network > Config > Interfaces

Under the new VLAN interface, expand the IP ADDRESSES and add the Gateway of that VLAN

 

Go back to Services > DHCP > Global. Enable the network / DHCP interface.

 

Go into Web Proxy > Authentication > Manage Policies. Give the VLAN a Transparent Auth Policy so it can get out to the net.

 

Then go to Network > Firewall > Firewall Rules. Create a new section for this new VLAN and give it some rules.

 

Don't forget to go into Network > Firewall > Smoothwall Access. Add a new section for the new VLAN in here and assign ALL ICMP TYPES, DNS PROXY, RADIUS if you need that and any other Services that the clients might need to use to talk directly to the smoothwall.