BYOD and RADIUS

Forum|Forum|1 year ago
January 8, 2025
6 replies
2236 views

We're a K-12 boarding school with a ton of BYOD devices on our network. Currently, we have three SSIDs: Open (Mac auth), 802.1x MS-CHAP v2, and WPA2-Personal for guest access.

We need to keep the open network around for devices that can't do 802.1x auth like gaming consoles. My question is, how do you handle BYOD device authentication? Is 802.1x still the only game in town? We need it to be fast and simple. I'd like to avoid EAP-TLS for these types of devices as it can make the onboarding more difficult. This is why we're still using EAP-PEAP.

Any suggestions?

ebilcari

Staff

The simplest way is to use MAC filtering/authentication through RADIUS and host registration, authentication through the Portal. There is an example shown in this article for guests.

If the users already have an account in LDAP or in a remote RADIUS server, a Standard login through the portal is also possible. There is a dedicated portal section for Game device registration.
If the network need to be secure than EAP-PEAP is still good to go, FNAC supports a local RADIUS server and Winbind.

Emirjon

pminarik

Staff

Nothing has really changed with wifi in the recent years. It's still either open, PSK, or EAP (802.1x/"Enterprise"), nothing else.

(captive portal, or anything else, being optional on top of either of the primary three methods)

nkuhl30Author

New Member

How does everyone handle EAP-TLS through a portal registration?

ebilcari

Staff

FNAC has the EasyConnect tool but it currently supports only EAP-PEAP and not TLS:

Supplicant Policies are applied to the host using an agent, except in the case of iOS devices where the user is prompted to download the configuration from the Captive Portal. The Dissolvable Agent or the Persistent Agent is used for Windows and macOS hosts and the Mobile Agent is used for Android devices.

Emirjon

nkuhl30Author

New Member

Thanks but we're already doing PEAP without the need for an agent and Supplicant Connect. I'm guessing there's no way to do TLS unless the cert is already pushed to the end user device beforehand?

Sign up

Login with SSO

Login to the community

Login with SSO