WPA2 Enterprise - Android Problem

Question

Hello, everyone!I hope you are all doing great. We have already implemented 3 SSIDs, one of which was supposed to be for guests only, with WPA2 Personal, and the other two were for employees and managers. However, since some employees had Android phones, which did not accept WPA2 Personal, we had to share the guest SSID password with them. The number of such users increased, and made it more difficult to ekep track of the users traffic, and the worst was that they also shared the password with other employees. I have also created another SSID for the residency building, but I have not shared it with the residents, except one for testing purposes. My question is, does Android have a solution for this? What should I do if I want to create a new SSID for the employees and residents with a new WPA2 SSID with same privileges as the guest SSID? Note: We have Fortigate-100F and multiple FortiAP-231F. Best regards,

abelio · Answer

Hello Sagvan

As you know, WPA2 Personal involves distribute the PSK among your users, manageable for a small group, but unacceptable as the number of users increases.
Although 8 SSIDs are supported, it' s advisable not to add many SSIDs (unless required).

If you cannot deploy WPA2 or 3 Enterprise as Security Mode for managers and employees, consider WPA2 with Captive Portal at least.

For guest access you could add a disclaimer (see 'email collection' feature for tracking).
You could also authenticate users with password to permit network access controlled by firewall policies, and additionally allow access to only members of a specified user group.

Anyway, WPA2 Personal also offers 'multiple shared keys' feature under the same SSID. (FGT 100F supports that), an option to consider.

https://docs.fortinet.com/document/fortiap/7.4.0/fortiwifi-and-fortiap-configuration-guide/292926/captive-portal-security

Hope it helps.

As @ebilcari pointed, Enterprise security mode is the way to go when you have to deal with manager,employees and guest access to wireless and wired resources, but other requirements must be met (Radius/LDAP etc)

Sign up

Login with SSO

Login to the community

Login with SSO