Numpty guide to set up BYOD with Smoothwall

[themightymrp]

I seem to be going round in circles reading articles and getting myself in a twist.

 

Does anybody have a real easy guide to set up BYOD on a Smoothwall? We use Aruba Instants for our Wi-Fi with various SSID's, one of which is designated for BYOD. I'd like it so that if students (sixth form only) connect to this, they need to sign in with AD credentials, possibly with the prompt to install the filtering certificate (needed?). I'd like Safeguarding reports to show the name of the user and not the device IP.

 

We have the RADIUS service installed on a Windows Server, but it doesn't do a whole lot at present. How would we set Smoothwall to use that for RADIUS?

 

Many thanks for any pointers

[tom_newton]

The short answer is that you need to set up radius accounting on the Aruba, and point that at the Smoothwall - which will then pick up those messages.

 

If you are struggling do call in to your CSM and they can arrange someone to help you (if you dont know who that is, drop me a PM and I will find them)

[timbo343]

5 hours ago, themightymrp said:

I seem to be going round in circles reading articles and getting myself in a twist.

 

Does anybody have a real easy guide to set up BYOD on a Smoothwall? We use Aruba Instants for our Wi-Fi with various SSID's, one of which is designated for BYOD. I'd like it so that if students (sixth form only) connect to this, they need to sign in with AD credentials, possibly with the prompt to install the filtering certificate (needed?). I'd like Safeguarding reports to show the name of the user and not the device IP.

 

We have the RADIUS service installed on a Windows Server, but it doesn't do a whole lot at present. How would we set Smoothwall to use that for RADIUS?

 

Many thanks for any pointers

 

All our Primaries are set up with Aruba APs with Radius for BYOD Staff and Guest access using Windows AD accounting and Smoothwall auth.

 

Can talk you through it if you like.

[themightymrp]

On 06/06/2025 at 17:38, timbo343 said:

 

All our Primaries are set up with Aruba APs with Radius for BYOD Staff and Guest access using Windows AD accounting and Smoothwall auth.

 

Can talk you through it if you like.

That would be amazing! How do you want to do it and when would you have availability?

[timbo343]

12 minutes ago, themightymrp said:

That would be amazing! How do you want to do it and when would you have availability?

 

I'll PM you 👍

[Craig_Allen2020]

It would be good to see this guide too. I am currently at a loss.

[themightymrp]

I'll compile my notes that I took after a session with @timbo343 - but I'm still struggling to get mine to work. Our school setups are quite different and I'm trying to adapt what I've been told to work with ours. Do you use your Smoothwall for VLAN management? Or a core switch?

[Craig_Allen2020]

Core Switch. Cisco Meraki.

[timbo343]

Ah we use the Smoothwall as our device to host the VLANs, DHCP, DNS, etc which is where @themightymrp is having an issue.

 

I would have thought a rule in the core switches of something like "ip route 0.0.0.0 0.0.0.0 <IP_Address_Smoothwall>" would be required or at least something like "ip route <VLAN_IP_Address> <Subnet_address> <IP_Address_Smoothwall>"

[themightymrp]

That's pretty much exactly as we do - the core switch's default gateway is the Smoothwall. Just struggling to figure out why it isn't doing it. I'll get there eventually! 

[tom_newton]

How far have you got? Are the users being logged in on the Smoothwall?

[themightymrp]

I don't think so no. I was asking @timbo343 about if they use IDex as their authentication directory, and they do. But they also have Active Directory listed. We only have IDex so not sure if that could be an issue?

 

I've probably missed something somewhere, it's having time to figure it out that I'm struggling with right now.

[tom_newton]

The first part is getting usernames into the smoothie - dont worry about groups (which is where idex comes in) until you have sorted that. You want to be seeing users pop up in logged in users. That involves getting the radius accounting pointed at the smoothwall from the APs. Once that's working, its downhill from there.

[tom_newton]

If you PM me tho I can see what help we can offer directly

[ibpalle]

One snag with RADIUS traffic is that it sometimes comes from APs, rather than the controller IP. To check where the traffic is coming from, enable incoming traffic audit in network - settings - advanced temporarily. Then go to the reports - realtime - firewall and filter for ports 1812 and 1813.

 

The source IPs should be listed. Make sure those match the authorised client settings in services - authentication - BYOD.

 

Also - the accounting is what logs the user in. Auth can be done by other servers if need be.

 

 

[timbo343]

Here's the steps i used to configure the Smoothwall as VLAN host for the BYODs

 

Interface Setup

 

DHCP setup

 

DHCP allocation to the Interface

 

Firewall Rules for the interfaces

DNS|HTTP|HTTPS|ICMP

 

Smoothwall Access Rules for the interfaces

53|1812|1813|ICMP

 

Locations Setup

 

Web Proxy Auth setup with Core Auth

 

HTTPS bypass rule not to check HTTPS traffic

 

Radius Auth Setup (Service > Auth > BYOD > Access Control rules - based on local Smoothwall groups)

 

Add the local network IP address with the CIDR to the Radius Clients as Aruba APs are centrally managed without a controller.

 

Add the Shared Secret on the Radius page in Smoothwall.

 

 

[themightymrp]

I've made progress! In the end I took pot luck and added Active Directory as a secondary "Directory" to compliment Idex. As soon as I did this, logons started to work! So not sure if purely Idex works with it?

 

I need to tinker a little bit to ensure the filtering is picking up correctly but I might be there. @timbo343 thanks for all the help with this