New SSID Recommendation

Question

Hello, everyone!I hope you are all doing great. I have the task of creating a new SSID for our campus accommodation. This SSID must have limited access, meaning the users should only access the Internet, not local resources, such as servers, PCs, network devices, such as printers, etc. We already have three other SSIDs with two lines coming from the ISP, meaning we also have SD-WAN.The main line is 100Mbps while the backup is 30Mbps. The backup is used for employees with limited access and guests.After business hours, most of the time, there could only be a few people working, so I was thinking of using the main line so it could handle the tens to hundreds of users. I am also planning to give the access points at the building only this new SSID with a schedule to work after business hours until the next day's morning. My questions are:1- Should I create a WPA2 Personal or WPA2 Enterprise to have the best monitoring and logs? The WPA3 implementation will be more headache for me to manage their usernames and passwords. WPA2 will not show who is doing what.2- How should I define my policies and how many policies should I create to have the best security?3- DO I need a separate SD-WAN zone and rule or should I just add the new SSID to the existing one of the main line?4- Should I implement application control and web filtering?5- Should I give half of the speed (50Mbps) to this new SSID?6- What are somethings I may have forgotten to ask and should consider?  Best regards,

atakannatak · Accepted Answer

Hi @sagvan ,

Here are some recommendations and answers to your questions for creating a new SSID with limited access on your infrastructure:

1. WPA2 vs. WPA3
WPA2:

Easier to manage with a shared password.
Less secure than WPA3 but still widely used.
Limited ability to track individual users.

WPA3:

More secure, especially against brute-force attacks.
Individualized encryption (SAE) offers better protection.
Slightly more complex to manage, requiring user-specific credentials.

Recommendation: If security is a priority and your client devices support WPA3, it’s worth implementing WPA3. However, if ease of management is more important and WPA2 provides sufficient security for your use case, WPA2 is acceptable. For better monitoring and logging, consider using WPA2-Enterprise or WPA3-Enterprise with a RADIUS server to manage individual user credentials.

2. Policies for Best Security
Two main policies (one to allow Internet access and one to block local resources) should suffice. Add more granular policies if needed based on specific requirements.

3. SD-WAN Zone and Rule
If your current SD-WAN setup is not overly complex, adding the new SSID to the existing SD-WAN should be fine. Create a specific SD-WAN rule to prioritize traffic during off-peak hours.

4. Application Control and Web Filtering
Yes, implement both application control and web filtering to enhance security and ensure appropriate use of the network.

5. Bandwidth Allocation
Allocate bandwidth based on expected usage to prevent network congestion. Consider 50Mbps if you anticipate high usage during off-peak hours.

Recommendation: Start with 50Mbps and monitor the usage. Adjust as needed based on actual performance and user experience.

6.Additional Considerations
Access Point Scheduling: Implement the schedule to activate the SSID during desired hours. Ensure that the new SSID is only active during specified hours to manage network load and security.
Guest Network Configuration: Ensure the new SSID is configured as a guest network with appropriate isolation. So, it has proper isolation and security for users connecting to the new SSID.
Quality of Service (QoS): Implement QoS policies to prioritize critical traffic.
Monitoring and Alerts: Set up monitoring and alerting to quickly respond to any issues or unusual activity.
User Education: Inform users about the new SSID, its purpose, and any access limitations.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

ozkanaltas · Answer

Hello @sagvan ,

1- You can use WPA3 SAE with FSSO for more security. WPA3 SAE Uses old-style pre-shared key authentication and if you implement FSSO with that, you can see the username through FSSO.

2-You just want to give access to the internet. Because of that, one rule is enough for that.

3- In my opinion there is no need for the new zone. You can use the existing zone.

4- If you want, yes. This depends on your company policies. But my advice is every time to enable web filtering profiles on internet rules. This rule should be configured with a block for harmful websites.

5-Also this depends on your decision, you said that I just use this ssid after work hours. If your bandwidth isn't used on after work hours you can give 50mbit.

Sign up

Login with SSO

Login to the community

Login with SSO