SSIDs

[rjf99]

We are having a Wi-Fi refresh, and it is a good time to introduce better SSIDs. We have the following need:

 

- access for guests to internet only e.g. no LAN

- access for teachers on their laptops on an individual SSID - MSP have advised that this will allow for separate filtering for these devices and management have agreed to this

- access for student devices such as 1:1 iPads, shared iPads, Chromebooks etc.

- access for staff on personal phones - some staff are currently using these to access LAN resources such as printers - appreciate this isn't sound from a security point of view

- access for interactive tv's etc. in classrooms - these will receive the same filtering as every other SSID except for 'teacher on their laptops'

 

I want the SSID names to be as clear as possible. Let's say our school is called St Mark's. I am wondering about

 

SM_Guest - captive portal, no LAN, normal level of filtering
SM_Staff_Laptop - less restrictive filtering
SM_Student - Student devices, LAN access, normal level of filtering

SM_Staff_Phones - normal level of filtering, no LAN

 

There is maybe a need for one final network so that if someone wants to connect say an interactive tv, they know to use that network rather than the teacher laptop?

Or should they use SM_Student for that? Or should I rename that to SM_Student_Access to make it more clear that it's for devices used by a student?

 

We are not in the UK, btw.

[ThomL]

Could you use radius authentication/802.1x? If so you could set policies that should eliminate several of those SSID - allowing you to combine to one SSID with different policies applied based on the device or user account joining the network. I think you could possibly combine SM_Staff_Laptop, SM_Student, SM_Staff_Phones but it depends on the equipment you are using for WiFi/filtering/networking. 

 

I currently have 1 SSID for Guest users that visit the school, which allows registration via a customised Meraki Portal and then another SSID that is used by staff/students/governors/tills that places the different users/devices onto various vlans based on policies in the NPS/Meraki configurations and then our smoothwall applies different levels of filtering and our Firewall cluster is controlling the inter-vlan routing to control 'LAN' access. I plan to tweak this further - I need to use more certificate based authentication and have started looking at using PPSK for guest users as we have issues with devices that cannot use radius/make it through the registration portal e.g. credit card readers used to take payment.

 

I think you want as few SSIDs as possible, Ciso Meraki documentation states a max of 3 SSIDs broadcast per AP. 

[msi_school]

As @Thoml says you  will nbe better off reducing your SSIDs the AP can only talk to one SSID at a atime so if you are running two SSIDs you have already doubled your latency.

[Rob_D]

Why do you want teachers' laptops filtered differently than their other devices? 

 

Last time we were looking at wifi I had one vendor pitch a single SSID setup, everything would go through NPS, your domain devices would NPS based on machine account/certificate and staff, studetnts and visitors would authenticate using user account NPS linked to their AD accounts and you would manage visitors in AD. For all the user auth devices, NPS then passes the username onto the web filtering so the logged in user gets their "normal" level of web filtering (the same as when they log into a domain jioned device).

 

In the end we went with separate guest, domain and BYOD SSIDs, but I wouldn't want any more than that and I still wonder if we could merge the domain and BYOD SSIDs and let NPS sort out VLAN access.

[Davit2005]

100% you want to limit the SSIDs. You could do this with 2 at minimum I suggest. The reason I'd suggest 2 is that you can hide the org (managed devices) WiFi to stop confusion then have one for BYOD/Guests SSID. The BYOD/guest can authenticate against captive portal and depending on whether staff/student or guest could be separated still. The managed devices can have a device certificate and the 802.1x SSID set in group policies. We had this setup at a previous org and it worked very well. Jus be on top of the certificate renewals for the managed devices.

 

The video below is an example.

 

https://www.youtube.com/watch?v=2G8rpnVFnAc

Edited October 24, 2025 by Davit2005

[RedwayNetworks_Michael]

18 hours ago, rjf99 said:

We are having a Wi-Fi refresh, and it is a good time to introduce better SSIDs. We have the following need:

 

- access for guests to internet only e.g. no LAN

- access for teachers on their laptops on an individual SSID - MSP have advised that this will allow for separate filtering for these devices and management have agreed to this

- access for student devices such as 1:1 iPads, shared iPads, Chromebooks etc.

- access for staff on personal phones - some staff are currently using these to access LAN resources such as printers - appreciate this isn't sound from a security point of view

- access for interactive tv's etc. in classrooms - these will receive the same filtering as every other SSID except for 'teacher on their laptops'

 

I want the SSID names to be as clear as possible. Let's say our school is called St Mark's. I am wondering about

 

SM_Guest - captive portal, no LAN, normal level of filtering
SM_Staff_Laptop - less restrictive filtering
SM_Student - Student devices, LAN access, normal level of filtering

SM_Staff_Phones - normal level of filtering, no LAN

 

There is maybe a need for one final network so that if someone wants to connect say an interactive tv, they know to use that network rather than the teacher laptop?

Or should they use SM_Student for that? Or should I rename that to SM_Student_Access to make it more clear that it's for devices used by a student?

 

We are not in the UK, btw.

Less is better, some solutions now allow you to have multiple passwords for one SSID which can help keep them down. 

Its easy to get carried away and have lots of SSIDs but simple is best

[KK20]

we have two SSID, "secure" and "guest".  Secure is 802.1x with machine certificates, used for our domain devices (there is a fudge for chromebooks).  Guest uses packetfence NAC.  The native VLAN for guest pops a request to packetfence which checks to see if that client is authenticated, if so then the authenticated user is put on an appropriate vlan - student and staff go on a vlan that needs securly authentication via their 365, pure guests or visitors get dropped on a dns heavily filtered securly vlan.  Firewall filters DNS so only our internal DNS or securly can be used.

 

Essentially, have two SSID, one for known devices, one for unknown devices.  The unknown SSID will use packetfence to decide which VLAN they should eventually land on.

 

I would also avoid SSIDs with passwords on BYOD (possibly not an issue on domain devices if you lock them down), unless you dont mind the password going on the internet.  It is a single netsh command to export password in clear.

[mavhc]

which MSP, what filtering system? Seems like you're being a bit limited by their solution

 

As for whether many SSIDs slow things down, it's mostly due to the data transfer rate of the beacon frames, which may still default to 1Mbps, increase that.

[psydii]

2 hours ago, KK20 said:

....secure is 802.1x with machine certificates, used for our domain devices (there is a fudge for chromebooks)....

That's the second time you've mentioned that in the last few hours.  I'm intrigued to hear how you do it, as there is a similar problem to overcome for Entra Joined / MDM managed Windows and Apple devices.

[KK20]

For our chromebooks.

 

AD

Have a low level account with minimal/zero privs.  Add this user to a specific group.

 

Radius

Have a connection policy that accepts member of the group created above as authorised.

 

Google Admin side:

Device managed WIFI as a WPA2 802.1x enterprise, PEAP, add the inner user as the low level account.  Make sure the domain CA certificate is selected (and installed on the chromebook, we do this alongside our securly certificate - also clears using our internal web pages that get certs from the domain CA too)

 

Thats it.  Radius accounting will show the connecting user as the low level account but will at least show the mac address of the chromebook.  I know of other schools have a separate USER managed wifi that used the logged on user to essentially reconnect after the user logs onto the chromebook.  so the device profile will authenticate 802.1x via the low level account as a device, then reconnect as a user when logged in using those credentials.  I didnt see the point personally so didnt implement.