BYOD Onboarding - How do you do it?

[StephenPink]

Hi all,

Looking to desperately improve the experience for our BYOD - primarily the sixth form site. In order to meet KCSIE requirements, of course we have to perform SSL inspection - which means students loading certificates. This is a horrendous job for most, especially the various Android flavours out there. 

We are looking to refresh the WiFi in the future, however in the mean time are limited to our current Unifi kit. So I've been looking around, and have got the following ideas/possibilities;

- PacketFence - covers the NAC aspect but not clear if it has a slicker way of loading the certificates; other than a captive portal that could host the files as part of the initial open/joining?

- GEANT CAT - CAT/tutorials/Configuration.md at master · GEANT/CAT - seems very complicated, and no clear instructions on customising, but that is designed to build certificate/WiFi configuration installers for eduroam, however is open source and can be customised for anything?

 

Is there a slick, free solution out there that I haven't found yet? Is anyone using either of the above to support their BYOD users?

Cheers,
Stephen

 

[synaesthesia]

Don't think it's likely to become a slick experience any time soon; we are still stuck between being able to provide that level of connectivity whilst retaining the level of reporting we need. Unfortunately the best thing that could happen would be a change from the phone OS manufacturers; there's nothing "server end" that is going to help no matter how loudly it sings, you still need to get a certificate on the device. The flavour of wifi system you have has little real impact, besides maybe offering a quicker way to offer the certificate download, and that's not much of a help. 

I do wonder if there's anything client-side which may be able to help streamline this; an app on whatever flavour device that can help install that certificate, connect to the network and automatically chose the correct settings for PEAP WTF IP DHCP DOMAIN ANONYMOUS USER CERTIFICATE etc.

[mrbios]

PacketFence is on my to-do list for looking into this (has been for a while now...). Only alternatives that are more streamlined is cloudPKI solutions i think, like those from SecureW2, but they're horrifically expensive in relation to the benefit they provide.