topic BYOD Single versus Dual SSID Flow in Network Access Control

BYOD Single versus Dual SSID Flow

GQ — Mon, 17 Jul 2017 17:44:05 GMT

just quick anectodal fact finding, do you advocate (or which do you mostly see) with BYOD: single or dual SSID registration flows?

assuming modern advances in iOS, Android, Windows, and WLC/ISE code?

Is it a simple question of 'if mobile OSs only, single SSID makes more sense' or 'if organization already has an open Guest SSID, use Dual'?

Re: BYOD Single versus Dual SSID Flow

gbekmezi-DD — Mon, 17 Jul 2017 20:40:18 GMT

Since you are asking for anecdotal feedback, I prefer single SSID whenever possible.

Re: BYOD Single versus Dual SSID Flow

hariholla — Mon, 17 Jul 2017 20:49:26 GMT

We do not have latest CVD on BYOD, but here's what we have from the last written document in this aspect:

Some considerations when selecting a single versus dual SSID configuration:

Some organizations prefer having a dedicated SSID for on-boarding devices.

Others see dual SSID as an extra management burden.

A second SSID adds channel overhead.

Enabling too many SSIDs may degrade wireless performance.

The organization’s unique requirements and preferences will dictate which model to deploy. The configurations of both the ISE and WLC may be easily modified to support either single or dual SSID deployments.

Cisco Unified Access (UA) and Bring Your Own Device (BYOD) CVD - BYOD Wireless Infrastructure Design [Design Zone for En…

Re: BYOD Single versus Dual SSID Flow

howon — Tue, 18 Jul 2017 04:17:35 GMT

Adding to Hari's list:

Pros of Single-SSID:

User experience is better for iDevice users as SSID switching from OPEN to SECURED does not require user intervention
This is a unique capability of ISE where competitor solution forces user to login twice while ISE can take user information from 802.1X session without asking for the user to login again to the web portal
Fast-SSID change does not need to be enabled on the WLC

Pros of Dual-SSID:

Can provide visible guidance to the user on the BYOD process before logging in

Re: BYOD Single versus Dual SSID Flow

Craig Hyps — Tue, 18 Jul 2017 10:37:50 GMT

Other cases where dual-SSID may be favored include:

* ID Store is LDAP and cannot start with PEAP with MSCHAPv2 currently to LDAP store

* Wired deployment where cannot assume client already has 802.1X enabled on wired interface.

Re: BYOD Single versus Dual SSID Flow

howon — Thu, 27 Jul 2017 14:38:36 GMT

FYI, I've consolidated the answers here:

ISE BYOD: Dual vs. Single SSID Onboarding