smarties11

By full 802.1X I mean that we are using a WPA3 enterprise SSID, using RADIUS for authentication. We use NPS for the RADIUS server (configured to only allow sixth form students) and then send accounting packets to SmoothWall for filtering policy. Obviously the issue with this now is that this method uses mschapv2 for the password so we'll have issues with Windows devices joining.

The way we used to achieve this with Ruckus was to use an open OWE SSID, with captive portal page which sent accounting packets to SmoothWall to apply correct filter policy. Sadly, this doesn't work correctly with our new Cambium Wi-Fi, which is why we transitioned to full 802.1X 😣

Awesome thanks for confirming 🙂 That's one less headache to worry about...

Thank you, this looks encouraging! Has your NPS server been updated to October CU? Wasn't sure if the changes were client side only or both client and server side.

🤣 don't want to go down the PSK route as need to be able to track and log activity against individual users as per DfE guidance We were using captive portal before on Ruckus but sadly this doesn't work properly on our new Cambium (ahem) Wi-Fi system - we made the choice to go full 802.1X on the basis of it being more secure 🤣

Not an issue for domain devices as we have been using certificate authentication (currently PEAP-EAP-TLS) for many years. It will be an issue though for Windows devices joining our staff and student Wi-Fi where we use 802.1x with PEAP-MSCHAPv2 for password authentication. Is there an alternative in this scenario to maintain password based authentication rather than certificate? Infact it might be an issue for all devices including non-windows if NPS itself won't accept MSCHAPv2 anymore?

Good news on the cnMaestro side, particularly where they mention migration to on-prem, hopefully confirms their commitment to a new on-prem release that isn't cloud anchored. For us though the biggest issue is still lack of support and inability to maintain ongoing compliance. This could change I suppose if there is a buyer for enterprise Wi-Fi but I fear a buyer might dump support for existing products once they've reached any minimum periods agreed in a sale.

I think cnMaestro going with the point to point stuff tells us all we need to know about enterprise WiFi. Clearly there will be no rescue for this element now 😞 If cnMaestro is maintained by Airspan for a while then it gives some breathing space, but we've still just bought a brand new enterprise WiFi solution that is dead in the water. DfE state that all hardware and software should be in active support as part of their technology standards and the same is true of CE/CE+. Compliance cannot be achieved. I still can't believe the timing of this, only 4 weeks ago we were mounting the new APs 😞

Oh no 😞 Our experience on the deployment side has been really positive. And it's performing really well. But that's not much use if the whole ecosystem is shelved 😞 Is there anything I can help with? Could it be interference - have you scaled back your radio power at all. Redway recommended the following for us (with an AP in each classroom) - 2.4ghz - 8 to 14dBm, 20Mhz channel width - 5ghz - 11 to 17dBm, 40Mhz channel width (with channels 144 and 165 turned off) - 6ghz - 12 to 18dBm, 80Mhz channel width

We are CE+ certified here and are 11-18. Just coming up to our third renewal. Personally I don't think it will be too long before the DfE mandate CE in Schools as part of their digital and technology standards. Although I know some schools just "tick the boxes" where CE is self certified - my daughter's new school for example are CE certified across the whole trust but her account doesn't have MFA enabled.... Anyway, back on topic - we received all of our APs, we're just waiting for a single PoE injector for a single 55X AP which is in a dense room as our switches are PoE+ not PoE++. Might have to scour eBay!

I think the insurmountable issue here is ongoing compliance. A local controller will solve the immediate problem of the cloud controller going dark, but how long will it be before a security vulnerability is discovered in either the controller itself or the WAP firmware? If that vulnerability carries a CVSS score of 7.0 or higher, there goes any realistic chance of maintaining Cyber Essentials or Cyber Essentials Plus accreditation. Unless there is a buy out from a competitor I don't see how schools will be able to continue with this solution for anything more than a stop gap. Out of interest, how many others are in the same position as me, having had a brand-new Cambium deployment installed as recently as August? I'm massively regretting not sticking with Ruckus now 😭

There is an onprem version of cnMaestro, however in my quick research this evening it looks like it has to be activated via Cambium servers first. It might be worth spinning one up now and activating and then powering down in case it's needed in the future? The biggest issue I think is ongoing development and bug fixes. If this is abandoned then how long will it be until the solution is effectively useless because there are so many bugs / incompatibilities with newer devices etc? We ditched Ruckus for Cambium as it represented a ~£4k total saving Y1-Y5 and then at least £7k total saving Y6-Y10 once Ruckus annual support became payable. I really hope we haven't made the wrong decision. We're really happy with it as a solution, it has been straightforward to deploy and has been performing really well. If it does get purchased by a competitor then presumably the competitor will just want to integrate the APs into their own cloud platform (like Cambium did when they bought Xirrus)

FFS, how typical is this after deploying our solution over the summer 🙄 Fingers crossed that there is an interested buyer. Might be wise to buy a few spare APs for any future warranty issues!

Anyone seeing issues today with local SIMS? This morning SIMS was really slow for users and occasionally hanging for a couple of minutes. Noticed that the CPU usage was constantly high for sqlservr.exe on the server. Rebooted, has been fine all day - now it is doing the same. Just wondering if there has been another issue with the Services Manager or anything else?

Hi Rob, Thanks for your insights! If we can't get the captive portal working then I think we will likely go down a similar route. In addition to lockouts, we also enforce password changes every 45 days, so we'd likely need to consider not doing this anymore and being less aggressive on the lockout policy. As you say, with Entra / MFA these things are less important now, but I feel still a consideration for the case of an on-site brute force from another student etc. Appreciate your input, it's definitely some food for thought 🙂

@FragglePete @RobFuller Thank you both! Are you doing this with an 802.1X SSID or are you using OWE with a splash page (captive portal)? We are trying to achieve the latter and it all works beautifully on a single AP but when you roam the client to the next AP, internet connection is lost. SmoothWall then sees the traffic from that client as unauthenticated. So there is an issue with the authentication/accounting packets when roaming. I have Lee at Redway and Cambium looking at it for us, just wondering if there was any knowledge here from someone who has achieved the same. We are using full 802.1X radius to NPS and accounting to SmoothWall for our staff SSID and that roams fine. But reluctant to use this method for students as it's more complicated for them to sign in, and when users change passwords and forget to update wireless profile on all their devices it triggers our account lockout policies. Plus there's nothing to stop a sixth form student (BYOD allowed) signing in a lower school student (BYOD not allowed), a daily captive portal sign in hinders this. The account lockout is already a bit of an admin burden on our staff SSID although we have them fairly well trained now! Thank you ☺️

Hi All, I was just wondering - those of you who replied to say you are using Cambium - are any of you using a splash page for your student BYOD Wi-Fi, sending RADIUS auth to NPS and then RADIUS accounting packets to SmoothWall (or another web filter) to apply filtering policy? This is the only bit we're struggling to get working correctly and I wondered if anyone has any tips to share 🙂 Thanks Andy

Thank you to everyone who has responded. The overwhelmingly positive support of Cambium has been really reassuring, and we have decided to go with them for our new deployment 🙂

Yes, we have received an alert since turning off DEX.

You are an absolute legend! Turned off and my frozen session immediately opened. Thank you 🙂 This is bad news for SIMS, though. They're already in dodgy territory by forcing us over to Next Gen for certain modules when the whole system is far from ready. Thanks again

We're seeing login issues with SIMS (local) today. I rebooted the server first thing, that fixed it. Then it happened again later on. Again, a reboot fixed. Happened again since, so I am looking now for the cause. Users logged into SIMS are not affected. They can continue to work no problem. But new users can't login. There are no errors; it accepts the password (and tells you if it is wrong) and then you just get the SIMS splash screen forever. No clues in the event logs. I have logged a case with SIMS but I am wondering if anyone else has seen this issue?

Hi All, We're in the process of procuring a new Wi-Fi 7 solution for our School. We're currently a Ruckus site and have had great experiences with them, and have no reason to not select them again - except price. We've had a Cambium quotation pitched - I've had the demo of the management UI and it looks good. I am looking for real world feedback from Schools who are currently using Cambium - and in particular any comparisons against Ruckus. Cambium have quoted X7-35X APs, and Ruckus have quoted R575 (due to be released in the summer). We currently running Ruckus R510, with the Virtual Smartzone controller. There's about £3.5k between the quotes (~55 APs) which is enough of a saving to warrant serious consideration. For context we are a secondary School of approx 850 pupils. Thank you 🙂

Sorry to hijack this thread - but seemed a good place to ask! Those of you using UniFi - which reseller are you using? We are looking at a new WiFi solution this summer and I want UniFi to be in the mix - so recommendations for resellers would be appreciated!

Thanks @ChetterHummin! Apologies, it's an S10 we have. I don't know why I put S6, I can't even use the typo excuse......😂 Obviously we have this already so it does make sense to continue with it in many ways, where it can operate as a firewall and is capable of load balancing the two lines. I just wasn't sure how strong it performs as firewall, when compared to for example a FortiGate? Infrastructure wise, we've probably been stung by our emPSN experiences. In the last three years, their service has been down probably 7 or 8 times, and every time it's been because of an issue in their datacentre, affecting all customers, rather than line issues. Also aware of the issues that SchoolsBroadband faced recently - again, DC issues that affected all customers. So I suppose in my brain a solution where the backup line is as diverse as possible from the main line makes sense!

We've been with emPSN for our broadband for many years, with the filtering done on prem with a SmoothWall physical box. We also have a 1gbps FTTP backup line (local provider to our area, not OR) which we manually connect to the SmoothWall on the (very many) occasions emPSN have let us down. emPSN are closing in October, and by coincidence this is when our SmoothWall contract ends too. We have been happy with SmoothWall and would happily stay with them IF that's the best solution. My question is, what does the BEST broadband, filter and firewall setup look like in 2026? Our key requirements are: - load balancing / failover of a new leased line and existing FTTP backup - user level filtering on BYOD (as we do currently with SmoothWall) - as cyber resilient as possible - current generation modern filtering We've contacted a couple of companies already - the solutions are very diverse across companies from fully managed service (in their own DCs) to on-prem firewall and filter. My key concerns are: - is the SmoothWall S6 a good enough firewall for a wires only leased line / existing FTTP? - Using a managed service with the infrastructure in their DCs is a SPOF should they have issues (as emPSN often do) - I fear that cloud based filters are going to be easy to bypass with VPNs and present challenges for user level BYOD - do Schools who connect directly to the Internet from their site see more issues with cyber attacks, DDOS etc than those who route through a managed service / JANET What would you do? Thanks!