RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Jason Cook]

Another +1 for waiting waiting waiting for Cisco's version of PPSK. 
Disappointing how long it's taking, I'm hoping that means they get it right or 
at least present it usefully.

For dorms we still offer our standard dot1x networks that we have on-campus 
including eduroam but then we also have plain PSK network. On the PSK side of 
things we aim to make it like an "at home student". So PSK, it's shared, I'd 
rather not but hey it works. One of our areas in in the CBD. We use a separate 
ISP to provide them internet access and they terminate into our border firewall 
and are treated as 'outside'. So they'll need VPN to access intrant or jump on 
our UofA/eduroam networks for that, predominantly though many students services 
are accessible from outside.

It's been working pretty well for us, but I still aim to move to the PPSK 
model. Aerohive's implementation is pretty nice.



--
Jason Cook
Technology Services
The University of Adelaide, AUSTRALIA 5005
Ph: +61 8 8313 4800

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Wednesday, 29 March 2017 2:19 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

+1 for PPSK. Hopefully it's an effective implementation on Cisco's part.


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Jeffrey D. Sessler
Sent: Tuesday, March 28, 2017 11:43 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

I'm moving toward this too, although I'm going the PPSK route (once Cisco gets 
it out of beta).

In my opinion it just doesn't make sense to push more restrictive methods on 
residential/students. It's just a huge hassle they have to endure for 4 years 
and then they'll never deal with it again.

Jeff

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 7:18 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellma

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Kanan E Simpson]

Chris,

We are doing the same as most other universities. 802.1x for staff and student 
access (dynamic vlan assignment via radius) and Open/Mac Auth for non802.1x 
devices using Cisco ISE self-registration portal. We allow them to register up 
to 5 devices. The devices are automatically purged from the mac auth group 
after 30+ days of inactivity. This helps maintain the current information.

As for WPA Personal where everyone knows the passphrase, in my opinion, I don’t 
recommend. You would be better off having a completely open SSID. At least with 
an open SSID, your users will know that the SSID is open and they are not 
protected verses, giving them “encrypted” SSID with a known passphrase and they 
“think” they are protect but really not.


Kanan Simpson
Network Services Engineer
Valdosta State University

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Chris Brezil
Sent: Monday, March 27, 2017 9:17 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: [WIRELESS-LAN] Dorm Wireless Authentication

Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS
INFORMATION TECHNOLOGY<http://www.newschool.edu/information-technology>

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu<http://www.newschool.edu/marketing-communication/email-signature.html>
  |  212.229.5300 x4512

[https://docs.google.com/uc?export=download=0Bz9BzY1rvKW_bDQ4SU1RUmpfMTQ=0Bz9BzY1rvKW_cWtOekJTQ2RIdFFhQ3h1T0h3a3p3Vk9KT2pVPQ]
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/discuss.

Re: [WIRELESS-LAN] Dorm Wireless Authentication

[Steven D. Veron]

Our Residence Halls are handled by an outside ISP. They recently deployed a new 
Ruckus solution with one AP per every 3 suites (each suite holds 2 people). 
They have one PSK for the entire network that is posted on the wall when you 
walk in the Commons area. Not a way that I would have done it, but it works and 
with them doing it we don't have to mess with DMCA type stuff. Students are not 
allowed to bring personal routers. So far we have heard nothing but good things.



We briefly talked about how we would have done it internally, and we would have 
gone the route of Ruckus DPSK which is their version of PPSK. Give one 
onboarding network that allows DPSK generation for any devices they need, and 
then the secure network.


Steven D Veron

Senior Network Analyst- I.T. Infrastructure | Lamar 
University<http://www.lamar.edu/> – Texas State University 
System<http://www.tsus.edu/> | 
sve...@lamar.edu<mailto:patrick.stew...@lamar.edu> | office - 409.880.2386


[1461864200676_ITlogo.jpg]



From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
<WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Chris Brezil 
<brez...@newschool.edu>
Sent: Wednesday, March 29, 2017 5:02:10 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Our dormitories are not on our man campus network and have Internet connections 
through secondary ISPs. So the question of "bad" usage in our case is a bit 
further complicated.

When we spoke to some of our Dorm RAs about our plan to roll out wireless in 
the spaces, some of the immediate reaction was what would students, who are 
accustomed to using many wireless consumer based devices with easy "home" 
setup, have to deal with now if there was a university wireless infrastructure 
in place. So that is why we are trying to understand what the right balance of 
security vs. customer service (in this case, the this is "my home" 
experience...) priorities for this use case.

Chris

On Tue, Mar 28, 2017 at 12:05 PM, Chris Adams (IT) 
<chris.ad...@ung.edu<mailto:chris.ad...@ung.edu>> wrote:
We handle our non-802.1x dorm devices using Aerohive’s PPSK implementation. We 
allow 1 device per key and drop them in a VLAN that is not enforced by our NAC.

PPSK are handed our by our ITSD and the keys automatically roll each calendar 
year.

Thanks,

Chris Adams, CISSP

Director, Network & Telecom Services
Division of Information Technology
University of North Georgia
E-Mail: chris.ad...@ung.edu<mailto:chris.ad...@ung.edu> | Office: (706) 867-2891

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>]
 On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 11:49 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

+1 for PPSK. Hopefully it’s an effective implementation on Cisco’s part.


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>]
 On Behalf Of Jeffrey D. Sessler
Sent: Tuesday, March 28, 2017 11:43 AM

To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

I’m moving toward this too, although I’m going the PPSK route (once Cisco gets 
it out of beta).

In my opinion it just doesn’t make sense to push more restrictive methods on 
residential/students. It’s just a huge hassle they have to endure for 4 years 
and then they’ll never deal with it again.

Jeff

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 7:18 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu<http://its.syr.edu>
SYRACUSE UNIVERSITY
syr.edu<http://syr.edu>

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only “gadgets and games”, or is it used for laptops as 
well? A majority of

Re: [WIRELESS-LAN] Dorm Wireless Authentication

[Chris Brezil]

Our dormitories are not on our man campus network and have Internet
connections through secondary ISPs. So the question of "bad" usage in our
case is a bit further complicated.

When we spoke to some of our Dorm RAs about our plan to roll out wireless
in the spaces, some of the immediate reaction was what would students, who
are accustomed to using many wireless consumer based devices with easy
"home" setup, have to deal with now if there was a university wireless
infrastructure in place. So that is why we are trying to understand what
the right balance of security vs. customer service (in this case, the this
is "my home" experience...) priorities for this use case.

Chris

On Tue, Mar 28, 2017 at 12:05 PM, Chris Adams (IT) <chris.ad...@ung.edu>
wrote:

> We handle our non-802.1x dorm devices using Aerohive’s PPSK
> implementation. We allow 1 device per key and drop them in a VLAN that is
> not enforced by our NAC.
>
>
>
> PPSK are handed our by our ITSD and the keys automatically roll each
> calendar year.
>
>
>
> Thanks,
>
>
>
> Chris Adams, CISSP
>
>
>
> Director, Network & Telecom Services
>
> Division of Information Technology
>
> University of North Georgia
>
> E-Mail: chris.ad...@ung.edu | Office: (706) 867-2891
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] *On Behalf Of *Lee H Badman
> *Sent:* Tuesday, March 28, 2017 11:49 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> +1 for PPSK. Hopefully it’s an effective implementation on Cisco’s part.
>
>
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] *On Behalf Of *Jeffrey D. Sessler
> *Sent:* Tuesday, March 28, 2017 11:43 AM
>
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> I’m moving toward this too, although I’m going the PPSK route (once Cisco
> gets it out of beta).
>
>
>
> In my opinion it just doesn’t make sense to push more restrictive methods
> on residential/students. It’s just a huge hassle they have to endure for 4
> years and then they’ll never deal with it again.
>
>
>
> Jeff
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [
> mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>] *On Behalf Of *Lee H Badman
> *Sent:* Tuesday, March 28, 2017 7:18 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> Absolutely no device restrictions. No preshare. Get on and go. But zero
> campus access, that requires using the authenticated network.
>
>
>
> *Lee Badman* | Network Architect
>
> Adjunct Instructor | CWNE #200
> Information Technology Services
> 206 Machinery Hall
> 120 Smith Drive
> Syracuse, New York 13244
>
> *t* 315.443.3003  * f* 315.443.4325   *e* lhbad...@syr.edu *w* its.syr.edu
>
> *SYRACUSE UNIVERSITY*
> syr.edu
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [
> mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>] *On Behalf Of *Thomas Carter
> *Sent:* Tuesday, March 28, 2017 10:04 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> Is it restricted to only “gadgets and games”, or is it used for laptops as
> well? A majority of the services our students use are Internet facing also,
> so Internet-only access would still give them access to the services they
> need.
>
>
>
> I assume there is an authenticated SSID also?
>
> *Thomas Carter*
> Network & Operations Manager / IT
>
> *Austin College*
> 900 North Grand Avenue
> Sherman, TX 75090
>
> Phone: 903-813-2564
> www.austincollege.edu
>
> [image: http://www.austincollege.edu/images/AusColl_Logo_Email.gif]
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [
> mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>] *On Behalf Of *Lee H Badman
> *Sent:* Tuesday, March 28, 2017 8:23 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> After kicking tires on leading classification engines and weighing
> solution dollars and support costs, we opted to pilot a wide open "gadget
> and games" SSID in the dorms that only have Internet access for all the
> oddballs. With almost a full year in, it's been very 

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Chris Adams (IT)]

We handle our non-802.1x dorm devices using Aerohive's PPSK implementation. We 
allow 1 device per key and drop them in a VLAN that is not enforced by our NAC.

PPSK are handed our by our ITSD and the keys automatically roll each calendar 
year.

Thanks,

Chris Adams, CISSP

Director, Network & Telecom Services
Division of Information Technology
University of North Georgia
E-Mail: chris.ad...@ung.edu<mailto:chris.ad...@ung.edu> | Office: (706) 867-2891

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 11:49 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

+1 for PPSK. Hopefully it's an effective implementation on Cisco's part.


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Jeffrey D. Sessler
Sent: Tuesday, March 28, 2017 11:43 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

I'm moving toward this too, although I'm going the PPSK route (once Cisco gets 
it out of beta).

In my opinion it just doesn't make sense to push more restrictive methods on 
residential/students. It's just a huge hassle they have to endure for 4 years 
and then they'll never deal with it again.

Jeff

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 7:18 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Lee H Badman]

+1 for PPSK. Hopefully it's an effective implementation on Cisco's part.


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Jeffrey D. Sessler
Sent: Tuesday, March 28, 2017 11:43 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

I'm moving toward this too, although I'm going the PPSK route (once Cisco gets 
it out of beta).

In my opinion it just doesn't make sense to push more restrictive methods on 
residential/students. It's just a huge hassle they have to endure for 4 years 
and then they'll never deal with it again.

Jeff

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 7:18 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. 

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Jeffrey D. Sessler]

I'm moving toward this too, although I'm going the PPSK route (once Cisco gets 
it out of beta).

In my opinion it just doesn't make sense to push more restrictive methods on 
residential/students. It's just a huge hassle they have to endure for 4 years 
and then they'll never deal with it again.

Jeff

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 7:18 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASS

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Jeffrey D. Sessler]

Define bad?

For example, most colleges go to extraordinary lengths to locate/deliver DMCA  
notices when there is no legal reason to do so.

Jeff

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Bucklaew, Jerry
Sent: Tuesday, March 28, 2017 7:22 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

How do you track them down when they do something bad?

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 10:18 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of settin

Re: [WIRELESS-LAN] Dorm Wireless Authentication

[Hunter Fuller]

Your replies have addressed what I was asking wrt security concerns. Thanks
for the detail.

On Tue, Mar 28, 2017 at 9:34 AM Lee H Badman <lhbad...@syr.edu> wrote:

> We don’t see a lot of bad coming out of the gadgets. If a laptop lands on
> that network- which is still security monitored- and does something bad,
> odds are extremely high that the device has also been used on the secure
> network because that’s where anything to do with campus is done. Our logs
> are rich, so it’s easy to correlate same device on multiple networks. If
> “bad” happens and we truly can’t find them period in logs for identity,
>  the degree of “bad” drives what happens next. But we have worked through
> every scenario we could think of and derived procedural answers that work
> for us.
>
>
>
> -Lee
>
>
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] *On Behalf Of *Bucklaew, Jerry
> *Sent:* Tuesday, March 28, 2017 10:22 AM
>
>
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> How do you track them down when they do something bad?
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [
> mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>] *On Behalf Of *Lee H Badman
> *Sent:* Tuesday, March 28, 2017 10:18 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> Absolutely no device restrictions. No preshare. Get on and go. But zero
> campus access, that requires using the authenticated network.
>
>
>
> *Lee Badman* | Network Architect
>
> Adjunct Instructor | CWNE #200
> Information Technology Services
> 206 Machinery Hall
> 120 Smith Drive
> Syracuse, New York 13244
>
> *t* 315.443.3003 <(315)%20443-3003>  * f* 315.443.4325 <(315)%20443-4325>
> *e* lhbad...@syr.edu *w* its.syr.edu
>
> *SYRACUSE UNIVERSITY*
> syr.edu
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [
> mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>] *On Behalf Of *Thomas Carter
> *Sent:* Tuesday, March 28, 2017 10:04 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> Is it restricted to only “gadgets and games”, or is it used for laptops as
> well? A majority of the services our students use are Internet facing also,
> so Internet-only access would still give them access to the services they
> need.
>
>
>
> I assume there is an authenticated SSID also?
>
> *Thomas Carter*
> Network & Operations Manager / IT
>
> *Austin College*
> 900 North Grand Avenue
> Sherman, TX 75090
>
> Phone: 903-813-2564 <(903)%20813-2564>
> www.austincollege.edu
>
> [image: image001.gif]
>
>
>
> *From:* The EDUCAUSE Wireless Issues Constituent Group Listserv [
> mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>] *On Behalf Of *Lee H Badman
> *Sent:* Tuesday, March 28, 2017 8:23 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Dorm Wireless Authentication
>
>
>
> After kicking tires on leading classification engines and weighing
> solution dollars and support costs, we opted to pilot a wide open "gadget
> and games" SSID in the dorms that only have Internet access for all the
> oddballs. With almost a full year in, it's been very well used and received
> and we've been able to answer all of our own security questions that anyone
> would be contemplating. I think we'll be moving forward with this model.
>
> Lee Badman (mobile)
>
>
> On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) <
> bosbo...@liberty.edu> wrote:
>
> Here is another vote for ClearPass with Aruba wireless.
>
>
>
> When an Apple TV is registered, it is also registered as an AirGroup
> personal device so the owner’s 802.1X Apple device can use AirPlay to
> display content on the device. We also use Aruba’s Dynamic Multicast
> Optimization to provide multicast IPTV over wireless.
>
>
>
>
>
> *Bruce Osborne*
>
> *Senior Network Engineer*
>
> *Network Operations - Wireless*
>
>  *(434) 592-4229 <(434)%20592-4229>*
>
> *LIBERTY UNIVERSITY*
>
> *Training Champions for Christ since 1971*
>
>
>
> *From:* Robert Spellman [mailto:rsp...@bates.edu <rsp...@bates.edu>]
> *Sent:* Monday, March 27, 2017 9:33 AM
> *Subject:* Re: Dorm Wireless Authentication
>
>
>
> We use Aruba Clearpass, a

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Lee H Badman]

You assume correctly, Tim.


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Cappalli, Tim (Aruba)
Sent: Tuesday, March 28, 2017 10:25 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Lee, so I assume you’re not supporting mDNS and DLNA based services?


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
<WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>> 
on behalf of "Bucklaew, Jerry" <j...@buffalo.edu<mailto:j...@buffalo.edu>>
Reply-To: The EDUCAUSE Wireless Issues Constituent Group Listserv 
<WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>>
Date: Tuesday, March 28, 2017 at 10:22 AM
To: 
"WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>" 
<WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

How do you track them down when they do something bad?

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 10:18 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only “gadgets and games”, or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[ttp://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner’s 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba’s Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. 

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Lee H Badman]

We don't see a lot of bad coming out of the gadgets. If a laptop lands on that 
network- which is still security monitored- and does something bad, odds are 
extremely high that the device has also been used on the secure network because 
that's where anything to do with campus is done. Our logs are rich, so it's 
easy to correlate same device on multiple networks. If "bad" happens and we 
truly can't find them period in logs for identity,  the degree of "bad" drives 
what happens next. But we have worked through every scenario we could think of 
and derived procedural answers that work for us.

-Lee


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Bucklaew, Jerry
Sent: Tuesday, March 28, 2017 10:22 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

How do you track them down when they do something bad?

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 10:18 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authentic

Re: [WIRELESS-LAN] Dorm Wireless Authentication

[Cappalli, Tim (Aruba)]

Lee, so I assume you’re not supporting mDNS and DLNA based services?


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
<WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of "Bucklaew, Jerry" 
<j...@buffalo.edu>
Reply-To: The EDUCAUSE Wireless Issues Constituent Group Listserv 
<WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Date: Tuesday, March 28, 2017 at 10:22 AM
To: "WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU" <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

How do you track them down when they do something bad?

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 10:18 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only “gadgets and games”, or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[ttp://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner’s 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba’s Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Ma

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Bucklaew, Jerry]

How do you track them down when they do something bad?

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 10:18 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS
INFORMATION TECHNOLOGY<http://www.newschool.edu/information-technology>

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu<http://www.newschool.edu/marketing-communication/email-sig

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Lee H Badman]

Absolutely no device restrictions. No preshare. Get on and go. But zero campus 
access, that requires using the authenticated network.

Lee Badman | Network Architect

Adjunct Instructor | CWNE #200
Information Technology Services
206 Machinery Hall
120 Smith Drive
Syracuse, New York 13244
t 315.443.3003   f 315.443.4325   e lhbad...@syr.edu<mailto:lhbad...@syr.edu> w 
its.syr.edu
SYRACUSE UNIVERSITY
syr.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Thomas Carter
Sent: Tuesday, March 28, 2017 10:04 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS
INFORMATION TECHNOLOGY<http://www.newschool.edu/information-technology>

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu<http://www.newschool.edu/marketing-communication/email-signature.html>
  |  212.229.5300 x4512

[https://docs.google.com/uc?export=download=0Bz9BzY1rvKW_bDQ4SU1RUmpfMTQ=0Bz9BzY1rvKW_cWtOekJTQ2RIdFFhQ3h1T0h3a3p3Vk9KT2pVPQ]
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

** Participation and subscription informat

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Thomas Carter]

Is it restricted to only "gadgets and games", or is it used for laptops as 
well? A majority of the services our students use are Internet facing also, so 
Internet-only access would still give them access to the services they need.

I assume there is an authenticated SSID also?
Thomas Carter
Network & Operations Manager / IT
Austin College
900 North Grand Avenue
Sherman, TX 75090
Phone: 903-813-2564
www.austincollege.edu<http://www.austincollege.edu/>
[http://www.austincollege.edu/images/AusColl_Logo_Email.gif]

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Lee H Badman
Sent: Tuesday, March 28, 2017 8:23 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS
INFORMATION TECHNOLOGY<http://www.newschool.edu/information-technology>

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu<http://www.newschool.edu/marketing-communication/email-signature.html>
  |  212.229.5300 x4512

[https://docs.google.com/uc?export=download=0Bz9BzY1rvKW_bDQ4SU1RUmpfMTQ=0Bz9BzY1rvKW_cWtOekJTQ2RIdFFhQ3h1T0h3a3p3Vk9KT2pVPQ]
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/discuss.

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Lee H Badman]

Hi Hunter,

I’d have to know what “security concerns” mean in this context, as that’s a 
pretty broad and variable phrase.

DMCA is no different than anywhere else on campus- we track down who offended 
(and we get very few to begin with). We have yet to have one that is 
untraceable, and have an acceptable (to our security officer and CIO) action 
plan if one ever was untraceable. I know this is vague, but easier to explain 
verbally rather than typing out a book. Same goes for Law Enforcement (who we 
have a great working relationship with in a number of directions).  Even on an 
open network, we have several ways of identifying either the person behind the 
device in our ecosystem, or minimally the device itself and using that to find 
the offender (in the worst cases) or simply blocking that device from further 
activity if it doesn’t rise to the level of absolutely needing to identify the 
user.

-Lee





From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Hunter Fuller
Sent: Tuesday, March 28, 2017 9:42 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Dorm Wireless Authentication

How do you handle security concerns, DMCA, and law enforcement requests for 
this ESSID?

On Tue, Mar 28, 2017 at 8:23 AM Lee H Badman 
<lhbad...@syr.edu<mailto:lhbad...@syr.edu>> wrote:
After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
<bosbo...@liberty.edu<mailto:bosbo...@liberty.edu>> wrote:
Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner’s 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba’s Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229<tel:(434)%20592-4229>
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
<brez...@newschool.edu<mailto:brez...@newschool.edu>> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS
INFORMATION TECHNOLOGY<http://www.newschool.edu/information-technology>

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu<http://www.newschool.edu/marketing-communication/email-signature.html>
  |  212.229.5300 x4512<tel:(212)%20229-5300>

[https://docs.google.com/uc?export=download=0Bz9BzY1rvKW_bDQ4SU1RUmpfMTQ=0Bz9BzY1rvKW_cWtOekJTQ2RIdFFhQ3h1T0h3a3p3Vk9KT2pVPQ]
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educa

Re: [WIRELESS-LAN] Dorm Wireless Authentication

[Hunter Fuller]

How do you handle security concerns, DMCA, and law enforcement requests for
this ESSID?

On Tue, Mar 28, 2017 at 8:23 AM Lee H Badman  wrote:

After kicking tires on leading classification engines and weighing solution
dollars and support costs, we opted to pilot a wide open "gadget and games"
SSID in the dorms that only have Internet access for all the oddballs. With
almost a full year in, it's been very well used and received and we've been
able to answer all of our own security questions that anyone would be
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) <
bosbo...@liberty.edu> wrote:

Here is another vote for ClearPass with Aruba wireless.



When an Apple TV is registered, it is also registered as an AirGroup
personal device so the owner’s 802.1X Apple device can use AirPlay to
display content on the device. We also use Aruba’s Dynamic Multicast
Optimization to provide multicast IPTV over wireless.





*Bruce Osborne*

*Senior Network Engineer*

*Network Operations - Wireless*

 *(434) 592-4229 <(434)%20592-4229>*

*LIBERTY UNIVERSITY*

*Training Champions for Christ since 1971*



*From:* Robert Spellman [mailto:rsp...@bates.edu ]
*Sent:* Monday, March 27, 2017 9:33 AM
*Subject:* Re: Dorm Wireless Authentication



We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X,
and the other open, doing MAC based authentication.  Clearpass allows users
to register their own devices for MAC authentication by logging into the
Clearpass guest portal.  Students can register devices for a year, while
guests can register devices for 2 days.



Rob



Robert Spellman

Bates College

Information and Library Services



On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil  wrote:

Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently
we mainly just cover some of the common areas and students for the most
part bring in their own routers. As most folks can appreciate, this has
caused years of technical problems and is also not seen as great customer
service.

On our main campus wifi, we have people authenticate using 802.1x radius
authentication using their university username and password. We have some
concerns about doing this in the dormitories however. We know that students
bring all sorts of consumer grade devices that require network access into
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices
will not work with username and password authentication and we are not
looking to Mac exclude these devices on the network, given the overhead of
setting this up. So we are looking possibly at doing WPA Personal with a
passphrase that would be given to students.

What are others doing? Has this come up as an issue for any of you?

Best,

Chris


-- 

CHRIS BREZIL
*ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS*
INFORMATION TECHNOLOGY 

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu

 |  212.229.5300
x4512 <(212)%20229-5300>

** Participation and subscription information for this EDUCAUSE
Constituent Group discussion list can be found at
http://www.educause.edu/discuss.



** Participation and subscription information for this EDUCAUSE
Constituent Group discussion list can be found at
http://www.educause.edu/discuss.
** Participation and subscription information for this EDUCAUSE
Constituent Group discussion list can be found at
http://www.educause.edu/discuss.

** Participation and subscription information for this EDUCAUSE
Constituent Group discussion list can be found at
http://www.educause.edu/discuss.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/discuss.

Re: [WIRELESS-LAN] Dorm Wireless Authentication

[Lee H Badman]

After kicking tires on leading classification engines and weighing solution 
dollars and support costs, we opted to pilot a wide open "gadget and games" 
SSID in the dorms that only have Internet access for all the oddballs. With 
almost a full year in, it's been very well used and received and we've been 
able to answer all of our own security questions that anyone would be 
contemplating. I think we'll be moving forward with this model.

Lee Badman (mobile)

On Mar 28, 2017, at 7:48 AM, Osborne, Bruce W (Network Operations) 
> wrote:

Here is another vote for ClearPass with Aruba wireless.

When an Apple TV is registered, it is also registered as an AirGroup personal 
device so the owner's 802.1X Apple device can use AirPlay to display content on 
the device. We also use Aruba's Dynamic Multicast Optimization to provide 
multicast IPTV over wireless.


Bruce Osborne
Senior Network Engineer
Network Operations - Wireless
 (434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971

From: Robert Spellman [mailto:rsp...@bates.edu]
Sent: Monday, March 27, 2017 9:33 AM
Subject: Re: Dorm Wireless Authentication

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X, and 
the other open, doing MAC based authentication.  Clearpass allows users to 
register their own devices for MAC authentication by logging into the Clearpass 
guest portal.  Students can register devices for a year, while guests can 
register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil 
> wrote:
Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS
INFORMATION TECHNOLOGY

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu
  |  212.229.5300 x4512

[https://docs.google.com/uc?export=download=0Bz9BzY1rvKW_bDQ4SU1RUmpfMTQ=0Bz9BzY1rvKW_cWtOekJTQ2RIdFFhQ3h1T0h3a3p3Vk9KT2pVPQ]
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/discuss.

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Bryan Ward]

Hi Chris,

We use 802.1x authentication for wireless across campus, including the 
residential buildings.
(We also restrict broadcast and MDNS/Bonjour traffic on our WiFi networks, so 
many of the devices you mention won’t work here regardless of supporting dot1x.)
In my experience, a lot of modern devices do actually work with dot1x.  We’ve 
even worked with a student to get his Raspberry Pi board working with dot1x.
We also suggest that users plug into an Ethernet jack if they have any concerns 
(all our dorm rooms have 1 or 2 of them that can be activated).

We’ve had very few (if any) complaints from students about dot1x authentication 
in the dorms.  Occasionally we run into an academic system that needs WiFi and 
doesn’t support dot1x, and after making sure that this is actually needed and 
approved, etc. we do have a hidden SSID with WPA encryption and MAC 
authentication that can be deployed to the necessary areas on campus.  We’ve 
only got maybe a dozen of these situations total.

--
Bryan Ward
Network Engineer
Dartmouth College Network Services
603-646-2245
bryan.w...@dartmouth.edu<mailto:bryan.w...@dartmouth.edu>

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Chris Brezil
Sent: Monday, March 27, 2017 9:17 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: [WIRELESS-LAN] Dorm Wireless Authentication

Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS
INFORMATION TECHNOLOGY<http://www.newschool.edu/information-technology>

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu<http://www.newschool.edu/marketing-communication/email-signature.html>
  |  212.229.5300 x4512

[https://docs.google.com/uc?export=download=0Bz9BzY1rvKW_bDQ4SU1RUmpfMTQ=0Bz9BzY1rvKW_cWtOekJTQ2RIdFFhQ3h1T0h3a3p3Vk9KT2pVPQ]
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/discuss.

RE: [WIRELESS-LAN] Dorm Wireless Authentication

[Bucklaew, Jerry]

We have two ssid’s.  One a “start here” that will do 802.1x onboarding, guest 
access and mac registration.  That one is all mac auth based.  The other is the 
802.1x ssid.  We onboard about 80% of the devices to 802.1x.

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Chris Brezil
Sent: Monday, March 27, 2017 9:17 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: [WIRELESS-LAN] Dorm Wireless Authentication

Good morning everyone,

We are planning a larger scale roll out of wireless in our dorms. Currently we 
mainly just cover some of the common areas and students for the most part bring 
in their own routers. As most folks can appreciate, this has caused years of 
technical problems and is also not seen as great customer service.

On our main campus wifi, we have people authenticate using 802.1x radius 
authentication using their university username and password. We have some 
concerns about doing this in the dormitories however. We know that students 
bring all sorts of consumer grade devices that require network access into 
their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices will 
not work with username and password authentication and we are not looking to 
Mac exclude these devices on the network, given the overhead of setting this 
up. So we are looking possibly at doing WPA Personal with a passphrase that 
would be given to students.

What are others doing? Has this come up as an issue for any of you?
Best,
Chris

--

CHRIS BREZIL
ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS
INFORMATION TECHNOLOGY<http://www.newschool.edu/information-technology>

71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
brez...@newschool.edu<http://www.newschool.edu/marketing-communication/email-signature.html>
  |  212.229.5300 x4512

[https://docs.google.com/uc?export=download=0Bz9BzY1rvKW_bDQ4SU1RUmpfMTQ=0Bz9BzY1rvKW_cWtOekJTQ2RIdFFhQ3h1T0h3a3p3Vk9KT2pVPQ]
** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/discuss.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/discuss.

Re: [WIRELESS-LAN] Dorm Wireless Authentication

[Robert Spellman]

We use Aruba Clearpass, and have two SSID's on campus, one which is 802.1X,
and the other open, doing MAC based authentication.  Clearpass allows users
to register their own devices for MAC authentication by logging into the
Clearpass guest portal.  Students can register devices for a year, while
guests can register devices for 2 days.

Rob

Robert Spellman
Bates College
Information and Library Services

On Mon, Mar 27, 2017 at 9:16 AM, Chris Brezil  wrote:

> Good morning everyone,
>
> We are planning a larger scale roll out of wireless in our dorms.
> Currently we mainly just cover some of the common areas and students for
> the most part bring in their own routers. As most folks can appreciate,
> this has caused years of technical problems and is also not seen as great
> customer service.
>
> On our main campus wifi, we have people authenticate using 802.1x radius
> authentication using their university username and password. We have some
> concerns about doing this in the dormitories however. We know that students
> bring all sorts of consumer grade devices that require network access into
> their rooms, such as Apple TV, Amazon Echos, etc. Many of these devices
> will not work with username and password authentication and we are not
> looking to Mac exclude these devices on the network, given the overhead of
> setting this up. So we are looking possibly at doing WPA Personal with a
> passphrase that would be given to students.
>
> What are others doing? Has this come up as an issue for any of you?
>
> Best,
> Chris
>
> --
>
> CHRIS BREZIL
> *ASSISTANT VICE PRESIDENT, ENTERPRISE OPERATIONS*
> INFORMATION TECHNOLOGY 
>
> 71 FIFTH AVENUE, 9th FLOOR, NEW YORK, NY 10003
> brez...@newschool.edu
>   |
> 212.229.5300 x4512
>
> 
>
> ** Participation and subscription information for this EDUCAUSE
> Constituent Group discussion list can be found at http://www.educause.edu/
> discuss.
>
>

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/discuss.