topic Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions. in Aerohive Migrated Content

I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

tdupont — Mon, 13 Jan 2020 04:58:49 GMT

I would ideally like to have 3 SSID's set up. The first will be for all division owned wireless devices, which I would like to have connect automatically, likely by MAC Authentication. The second SSID will be for all AD Users to connect via AD Authentication. The third SSID would be for all school division guests/visitors.

Here are the questions I have.

1 - If I configure MAC Authentication on one SSID, will our division owned wireless devices connect automatically if the SSID is hidden or will some form of user intervention still be required to connect? We have several mobile labs (laptop carts) that we would like to make sure are connected to the network whenever powered on to make sure we can remote into them if necessary, but also want to make sure that any and all updates we push out are being installed. even when not in use.

2 - What would be the most efficient method to allow guests to connect to our network while being able to identify users, monitor and track user network/internet activity? I would like to ensure staff and students are not connecting to this guest SSID so access will be limited to guests only. One method I considered is creating local AD users, where these usernames and passwords are left with the secretary in each school for convenience purposes, but I am wondering if there is a better way. My understanding is I can set it up so that a staff member has to "sponsor" a user to connect, but I am not sure how secure this is as I believe there are some staff members who would allow students to use their email addresses for this. Some staff members have already given out the current password to students. This is one of the reasons why we are looking to switch to a more secure network configuration.

Thank you for any assistance with this.

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

samantha_lynn — Mon, 13 Jan 2020 23:36:26 GMT

For the MAC authentication SSID, users would still need to tell their devices to connect to the SSID. Then their devices would submit their MAC addresses as credentials, but not before the device attempts to connect to the SSID so some manual intervention is required, at least for the initial connection.

For making sure only guests are on the guest SSID, you can set up employee approval self registration for the guest SSID. The problem would be that anyone in your domain can approve requests, so you would run in to issues where teachers had the ability to approve students so long as they are in the same domain. However, they won't get the requests directly unless you enter their email address in as an approver in the ExtremeCloud QI set up, so they'd have to know that they could do this and the student would have to enter that teachers email directly rather than just a general registration, so that may not come up very much. Alternatively if you can create a sub-domain for your guest approvers to use, then only they would have access to approve guest SSID requests.

This guide reviews how to set up Employee Approval in ExtremeCloud IQ: https://thehivecommunity.aerohive.com/s/article/Employee-Approval-with-Self-Registration-SSID-in-NG

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

tdupont — Tue, 14 Jan 2020 00:05:48 GMT

Thank you for this info. Now I guess I am wondering if there might be a better way to approach this.

Ideally, I would like to have all division owned wireless devices connect automatically, so as to be able to download and install Windows and other updates automatically through our Windows Server Update Service (WSUS) over night without user intervention. However, we would want to prevent users from gaining access to the wireless password and therefore prevent BYOD devices from connecting to the SSID. What would be the best method to approach this?

As for the Employee Approval with Self Registration, my understanding is that when a user enters a staff members email address, the staff sponsor will be emailed the password that can then be forwarded to the end user. Is this correct? This might be a good option for guests as we can add school secretaries to the sub-domain and therefore be our "Guest Approvers" as all guests must enter and register at the school office upon arrival to any of our schools.

As for any student and staff BYOD devices, I am confident the AD Authentication process will work best for this.

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

samantha_lynn — Tue, 14 Jan 2020 00:20:32 GMT

For your division owned devices, I think MAC auth is still the way to go, you would just need to connect them for the first time. After that, unless they are manually changed to a different network, they should automatically connect to the SSID when it's available. I think you'd need to use windows groups to manage the updates, that isn't something we'd configure on the Aerohive side of things. This would only get tricky if the division owned devices left the network at night and then returned, in that case the users would have to manually choose to connect to the original SSID again.

For self registration, the user will register themselves and receive a password right away. That password won't be good until the user is approved though, so the employee that you've set up as an approver will still need to approve the user but they won't have to manage passwords.

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

tdupont — Tue, 14 Jan 2020 00:29:10 GMT

That makes sense. Thanks again Sam.

just one more question......

If we decide to go with MAC Authentication, which now seems to be the best option, will user intervention be needed each time a device is powered on or restarted? We don’t anticipate any of our division owned equipment to leave our schools or joining other wireless networks.

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

samantha_lynn — Tue, 14 Jan 2020 00:34:16 GMT

It depends a little on the client device, but most client types will attempt to connect to the last SSID they were connected to when restarted, so as long as the device isn't reset completely and doesn't connect to a different network, it should still automatically re-join the correct SSID.

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

tdupont — Tue, 14 Jan 2020 02:49:04 GMT

Thanks again Sam. One last (I hope) question...... In regards to teh self-registration........

Seeing as we have some 10 or 11 locations (subnets) in our network, would it be possible to have all guest connection requests be directed to a specif user/approver depending on the subnet they are attempting to connect to?

As an example, I would like to designate the secretary at each school to be the one to approve or deny connection requests, but only for guests in their respective schools. That way, when guests arrive at the school office, the secretary can give directions for connecting to the wireless network.

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

samantha_lynn — Tue, 14 Jan 2020 03:29:52 GMT

I don't think we have a way of routing requests based on location to certain approvers, but if guests are checking in at the front desk, you could leave instructions for connecting to the wifi with a particular email specified at each location. When the guest registers, they'll be asked to provide an email address for approval, and the instructions at the front desk could indicate what email address they should use.

If you'd like to see that feature added to a later release, I'd encourage you to file a feature request with your sales engineer so we can start developing a way to indicate a specific approver per site.

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

tdupont — Wed, 15 Jan 2020 23:47:14 GMT

Sam,

Would you have a link to the Employee Approval with Self Registration set up for HiveManager Classic? Or will the instructions be the same as NG?

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

samantha_lynn — Thu, 16 Jan 2020 02:01:22 GMT

Hello, this guide reviews how to set this up in Classic, but you would need a separate subscription to IDM for employee approval using Classic, where as it's built in to NG: https://thehivecommunity.aerohive.com/s/article/Self-Registration-SSID-with-IDM

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

tdupont — Thu, 16 Jan 2020 04:03:16 GMT

Thanks Sam. Now how will I be able to find out the options to either purchase the ID Manager subscription, or to upgrade our HiveManager subscription from Classic to NG?

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

samantha_lynn — Thu, 16 Jan 2020 04:08:22 GMT

You would want to speak with your sales engineer about either purchasing an IDM subscription or changing over to Extreme Cloud IQ (formerly known as HiveManager NG). I've emailed you your accounts sales engineer and their email address so you know who to reach out to.

Re: I am setting up a Radius Server in our school division using HiveManager Classic. I would like to ideally have 3 SSID's set up. I will roll this out and test it one school at a time. But I have a few questions.

tdupont — Thu, 16 Jan 2020 04:09:54 GMT

Thank you for all your assistance.