topic Re: Best practice for staff BYOD devices in Aerohive Migrated Content

Best practice for staff BYOD devices

robert_davies — Wed, 22 May 2019 22:00:54 GMT

We currently have a setup where guests access the WLAN using 802.11x Radius authentication. We are having multiple issues with users AD accounts getting locked out when their passwords need updating and a BYOD device that they have forgotten about attempts to connect with their old credentials. Im looking for a way of preventing this from happening. Maybe a captive portal staff members connect to initially which then sends them a password to their work email address to connect them to the network. Any ideas if this is possible? or a better idea?

Re: Best practice for staff BYOD devices

samantha_lynn — Thu, 23 May 2019 20:09:57 GMT

We generally don't recommend Radius for BYOD, I might recommend a PPSK option instead. You can lock the PPSK credentials to certain MAC addresses, or a certain number of devices allowed to use the same PPSK credentials if you'd like.

Re: Best practice for staff BYOD devices

robert_davies — Thu, 23 May 2019 20:20:18 GMT

Hi Sam

Thanks for the response. What we were hopefully looking to do was allow staff to connect to a captive portal and add their work email address. They can then get the ppsk from their work email address and use that to connect to the office wifi. Does this sound plausible?

Regards

Robert Davies | Infrastructure Engineer
for and on behalf of Charles Russell Speechlys LLP

T: +44 (0)20 7438 2266
F: +44 (0)20 7203 0200
charlesrussellspeechlys.com

Re: Best practice for staff BYOD devices

samantha_lynn — Thu, 23 May 2019 20:25:41 GMT

You could set up a self registration SSID, and instruct them to use their work email addresses, and then they'd get the password sent to their inbox. However, we can't limit the self registration CWP to a particular domain, so it would be possible for non-employees to also register via the self registration CWP.

Re: Best practice for staff BYOD devices

dennis_tobias — Thu, 23 May 2019 20:43:21 GMT

What version of HiveManager are you using? Depending on the version you are using you could potentially make use of the Aerohive API. My organization has employee on-boarding/off-boarding automated and part of the process is to provision/de-provision accounts for BYOD. We also have an internal support portal where employees can go and do BYOD self-service. The API is super simple to use - just go to developer.aerohive.com and sign up for an account so you can get access to the documentation. NOTE: The API does NOT work for Hivemanager NG on-prem so you must either be using Classic with the online ID Manager or using HiveManager Select.

Re: Best practice for staff BYOD devices

robert_davies — Fri, 24 May 2019 16:50:11 GMT

Hi Dennis

We are using cloud based Aerohive NG. Ive just created an account and am looking through the documentation. What you are doing at your organisation sounds very interesting. Hopefully i can make sense of the information on the website.

Regards

Re: Best practice for staff BYOD devices

JonasD_Complit — Mon, 03 Jun 2019 14:08:08 GMT

We are creating a solution where users can login with Azure/office365 credentials and than they get a ppsk back. If the employee leaves the company we delete the ppsk. We also link the user to a user profile based on Azure/Office365 groups. Probably we will make a product from this solution.

But indeed if you know api's you can create this by your own.

Re: Best practice for staff BYOD devices

JonasD_Complit — Mon, 03 Jun 2019 14:09:00 GMT

Hi Dennis, what is not working on the op-prem? Our visititor registration solution is also working with the on-prem version

Re: Best practice for staff BYOD devices

systeembeheer6 — Thu, 10 Oct 2019 16:55:04 GMT

@Jonas Dekkers

That sounds like a great feature. What is the progress. We would be very interested.

Best Regards,

Re: Best practice for staff BYOD devices

JonasD_Complit — Thu, 10 Oct 2019 19:36:29 GMT

Dear, the first version is in beta.

Can you send an email to info@wiflex.eu? We can setup a demo account for you.