Hi, We have been using eduroam as our primary SSID for a number of years; users can simply select the network and enter their username and password, accept the certificate and they're good to go. One thing we've found to be successful for us is to accept both just the username and username@domain to enhance usability but the drawback is that we will have a few eduroam configured devices that won't work at other institutions.
We have RADIATOR perform a lookup via LDAP to determine the class of user (student, staff, high school user (as we have a high school as part of our University campus) and return the appropriate Tunnel Group ID for AAA override. If there is no attribute in LDAP, we place them on the guest VLAN by default, however, the guest VLAN and student VLANs are identical in terms of access control. Tristan --- Tristan Gulyas tristan.gul...@monash.edu Wireless Network Engineer M: +61 403224484 eSolutions division P: +61 3 9902 9092 Building 205 Monash University 3800 Australia On 16/02/2013, at 8:55 AM, "Johnson, Neil M" <neil-john...@uiowa.edu> wrote: > We have been using eduroam as our primary SSID since the fall. We could put > non "@uiowa.edu" users in a separate VLAN that appears outside our border, > but the acutual number of non iowa users on campus is so small that it wasn't > deemed worth the effort to setup and maintain. > > Implementing eduroam as our primary SSID happened to happily conicide with > campus encoraging users to use"use...@uiowa.edu" as their default username in > order for them to access "cloud" services being implemented in the near > future. > > -Neil > From: The EDUCAUSE Wireless Issues Constituent Group Listserv > [WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] on behalf of Steve Bohrer > [skboh...@simons-rock.edu] > Sent: Friday, February 15, 2013 3:13 PM > To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU > Subject: Re: [WIRELESS-LAN] About the eduroam configuration on Freeradius > > On Feb 15, 2013, at 3:24 PM, Linchuan Yang <linchuan.y...@concordia.ca> wrote: > >> Dear All >> >> Do you use different radius servers for your local SSID and eduroam SSID? >> >> Currently, we are using the same radius servers for both of SSID, and we >> found that some of our local users login with eduroam SSID inside our campus. >> >> We want to block our local users (both user...@concordia.ca and user123)to >> login with eduroam SSID, could you please explain how to modify the >> proxy.conf or other configuration files on Freeradius (Linux version)? > > > We take a different approach, and use "eduroam" as our primary SSID > campus-wide. That is, all of our local users always connect to eduroam, even > when they are not roaming. Our radius server knows they are local because > they have our realm in their username, and we can use their other local LDAP > attributes to put them into the proper VLAN. Our radius server also puts > non-Simon's Rock eduroam users in to an eduroam guest VLAN. (We have an open > SSID with instructions for connecting to eduroam, and some special case guest > VLANs, but no other SSID for our local users). > > The benefit is that our users only ever need to do one wifi config, and > eduroam "just works" when they travel to other federation campuses or to EDU > conventions and such, because it is exactly the same wifi config that they > use every day on campus. > > Steve Bohrer > Network Admin, ITS > Bard College at Simon's Rock > 413-528-7645 > ********** Participation and subscription information for this EDUCAUSE > Constituent Group discussion list can be found at > http://www.educause.edu/groups/. > ********** Participation and subscription information for this EDUCAUSE > Constituent Group discussion list can be found > athttp://www.educause.edu/groups/. --- Tristan Gulyas tristan.gul...@monash.edu Wireless Network Engineer M: +61 403224484 eSolutions division P: +61 3 9902 9092 Building 205 Monash University 3800 Australia ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
