Information Systems:Implementing staff and guest WiFi networks

In progress.

Overview

This page will document the design/implementation of staff and guest wireless networks. This mini-project builds upon the current, recently upgraded wireless setup, which was acquired and implemented primarily to serve the RF guns in the DC. Wireless hardware is already in place; this documentation relates only to software configuration of these new networks.

It is worth noting that these staff and guest wireless networks were/are not a requirement - rather this is a side project to get more value out of the wireless infrastructure and to provide a perk to staff and guests.

Configuration

Staff network

• SSID: uwd_staff
• Authentication: MAC authentication + Captive Portal fallback.
• Encryption method: TBD

The staff network will use MAC authentication as the primary authentication method and captive portal as the fallback. The reason this particular scheme is being used is to satisfy the following conditions, as decided on by management:

• Staff should see a sign-in page initially, where they can authenticate their device using pre-defined user credentials. (Any web page presentation requires captive portal.)
• Initial sign-in should also present a Terms of Conditions page that they must accept.
• After initial login, staff would not be required to frequently re-authenticate using captive portal. Their device should be 'remembered' as being 'approved'. (MAC address uniquely identifies network devices.)
• Ability to identify user/devices on the network to some extent. (Prevents use of pre-shared key).

WPA-Enterprise is commonly used in enterprise wireless deployments, but where EAP is involved, certificates are required. That level of security is just a bit beyond what the company needs, considering that the staff and guest wireless networks will not have access to the company intranet.

Caveats

While MAC authentication + captive portal achieves the requirements above, our specific implementation comes with a few significant limitations/caveats:

• Our wireless infrastructure uses one of the APs as the controller (a.k.a virtual AP controller). Since it has limited resources, WiNG cannot run a database server/service.
• Captive portal.

Guest network

Authentication: Captive Portal