Setting up an open access wireless network for students

[Bruce123]

We are looking a providing an open access wireless network to enable our learners to bring in their own laptops / PDAs and connect to the Internet using our Internet connection. It is something that they have been asking for, and would also help balance the demand with the availability of our wireless laptops.

 

I wondered whether anyone already has facility in your school/College and if so, how it was achieved?

 

Did you allow the laptops direct access to the Internet (via NAT routing) or did you use the Web proxy auto discovery protocol?

 

I would prefere the first option as it removes the complexities of having to get the "proxy server : port" into their browsers, and potential issues if this configuration remains when they try to access the Internet using their own connection at home. Or should either of these be serious concerns?

 

The problem with the former is that on our network the clients have always accessed the Internet using IE with a proxy server (ISA 2006) and have not needed or been granted direct access to the Internet (i.e. via NAT). So we would have to set this up for these laptops and enable resolutuion of DNS external addresses, which also was not required previously (done on by the proxy server).

 

How have you dealt with authentication? My thoughts are to leave the wireless network open and and have the students logon to a webpage to gain access to the Internet (802.1X and webpage)? How have you done this?

 

We have Wireless Smart Switches - WFS709TP for central managment of our wireless network, so setting up an additional SSID assigned to a new VLAN should be easy enough, and we can point this to a 802.1X server for authentication. How have you done this?

 

Have you permitted users connecting in this way access to other services on your network (such as printing and a full Terminal Service connection)?

 

Have you restricted access for this clients at layer 2/3, and if so how have you done this?

 

Any advice is much appreciated.

 

Thanks,

 

Bruce.

 

Leeds, UK.

[CyberNerd]

We setup:

 

separate SSID for students on new VLAN

Very simple wireless password (we nearly went for unencrypted for ease of use, but decided against it)

WPAD proxy autoconfig, proxy.pac for unsupported devices (iphones etc)

Firewall gives access to smoothwall proxy server only.

 

Students authenticate to AD via smoothwall.

 

edit:

 

I would prefere the first option as it removes the complexities of having to get the "proxy server : port" into their browsers, and potential issues if this configuration remains when they try to access the Internet using their own connection at home. Or should either of these be serious concerns?

 

not a big issue. combine these methods:

http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol

http://en.wikipedia.org/wiki/Proxy_auto-config

Edited October 3, 2010 by CyberNerd
addition

[dhicks]

Did you allow the laptops direct access to the Internet (via NAT routing) or did you use the Web proxy auto discovery protocol?

 

We used a filter/firewall capable of being a transparent proxy (SmoothWall or Squid).

 

How have you dealt with authentication? My thoughts are to leave the wireless network open and and have the students logon to a webpage to gain access to the Internet (802.1X and webpage)?

 

Makes sense - SmoothWall will let you leave an "unfiltered" catagory that doesn't need any authentication, so everyone can just come along and use it. You can then just restrict some sites by requireing a username and password (integrated from AD) to be entered.

 

Have you permitted users connecting in this way access to other services on your network (such as printing and a full Terminal Service connection)?

 

I'd keep the student / wireless network on a separate VLAN and allow access to Terminal Services over a VPN if needed.

 

--

David Hicks