topic Re: Limiting personal devices in Wireless

Limiting personal devices

RandyK1 — Tue, 19 Sep 2023 21:04:11 GMT

Unfortunately , the employee wifi password was shared with employees prior to my arrival . We now have a lot of personal devices connecting. What is the best method to resolve this? We have Azure AD

Re: Limiting personal devices

MerakiGnome — Tue, 19 Sep 2023 21:44:02 GMT

Change the password.

Re: Limiting personal devices

Karsten Iwen — Tue, 19 Sep 2023 22:06:26 GMT

I would go one step further than @DarrenOC

Either move to 802.1X or, if you want to keep PSKs, push the passphrase to the clients with an MDM. That way the users can not read the password.

In addition to that, allow the users to connect their personal devices with a different SSID/profile with reduced connectivity to your internal network.

Re: Limiting personal devices

leewalhovd — Tue, 19 Sep 2023 23:03:03 GMT

I would convert the SSID to an IPSK without radius with a new and old PSK and remove the old password after an audit of the clients. Any device that is connecting to the Old PSK will stop working once the IPSK is removed that covers the old PSK. It's a nice way to rotate passwords without breaking connections entirely.
https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_Authentication_without_RADIUS

Re: Limiting personal devices

RandyK1 — Wed, 20 Sep 2023 16:41:56 GMT

What solution for 802.1 x would stop the employees from just using their phone and authenticate there

Re: Limiting personal devices

Karsten Iwen — Wed, 20 Sep 2023 16:50:20 GMT

Nothing when using Username/PW. But you would see which devices belong to which user and could issue "corrective actions" (whatever this will be). With certificates, the amount of criminal energy of the user will be much higher.

Re: Limiting personal devices

leewalhovd — Wed, 20 Sep 2023 16:56:08 GMT

802.1x auth can use many things to validate a device, for example, certificates on the device. Depending on control, or lack of control of the devices would determine what is appropriate. If you don't keep the certificate from users, as in they have admin access to the devices certificate authentication won't guarantee they can't move the certificate to another device to authenticate.
https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise#User_vs._Machine_Authentication