Guest WiFi - is there any way to secure it?

[agroch]

I wonder is there is a better way to expose Guest wifi. Currently we use self registration with registration period of 2 hours and scheduled to turn off that SSID at night. I know there is a way to do it with social login, but this is not the best option.

Is there a way for guest to somehow request a temporary key instead which is revoked after 2 hours for example?

[agroch]

I also wonder if there is any step by step guide how to create that. I found instructions for NG, but not for Classic.

https://thehivecommunity.aerohive.com/s/article/Employee-Approval-with-Self-Registration-SSID-in-NG

[agroch]

Thank Sam, I have better picture of it now. I have 3 SSIDs currently:

1.Secure - 802.1X

2.Connect - PPSK

3.Guest -CWP -open

2.Connect is used by our internal managed devices. What would be the best to add Guest PPSK users? I dont want to create 4th SSID (Guest authenticated with PPSK).

Ideally, would nice to use 3.Guest with CWP and then with PPSK but I am worried its not possible. So letting Guest users they will receive PPKS key and should connect either to 2.Connect WiFi or create 4th SSID (which may not be the best idea) - Any advice?

[samantha_lynn]

The open SSID that they connect to when they need to register does not allow access to any page other than that CWP. So they don't need any credentials to get to the page to enter their information. Once they've entered that information, they would connect to the PPSK SSID. If they tried to connect to the Open SSID for any reason other than to register, they won't be able to access any internal resources or external addresses at all.

[agroch]

But when they connect to CWP portal they don't have to have any keys in order to connect to Guest SSID at first place - correct? Or they do have to have already some pre shared key?

[samantha_lynn]

Exactly, so the connection work flow for the end user is that they connect to the registration SSID, which takes them to a CWP page to enter their information, including their email address. Once they've submitted their information, they will receive an email at the address they submitted when they registered with the credentials they will use to connect to the PPSK SSID set up for your self registration guests. It is an automatic process for the credentials to be delivered to the user once they've registered.

Here is an example of the user group settings I'm referencing: