Security for New Wireless Network

[Terence Lockette]

Hello all,

I'm in the process of planning, designing, and deploying a new wireless network.  This new wireless network will be for guest access only in residential buildings for the families of our patients that stay for an extended period of time.  I have a 2504 WLC that will manage roughly 42 LWAPs.  I would like to use 802.1x with PEAP either locally on the WLC or on a AAA RADIUS server.  The problem I'm having is trying to determine whether to use the dot1x framework due to the possibility of some BYODs not supporting it.  My initial thought was to use 802.1x with PEAP to secure/encrypt user traffic at layer 2 then use Web Auth to take them to a portal page (not sure if this can actually be done).  However, if I have to concern myself with devices that don't support 802.1x then I would have to resort to another security method or use no security and just use Web Auth.  Any ideas as to what solution I can use to keep our guests communications secure as well as redirect them to a portal page to accept an AUP and log in with an ID/Password combination?  Thanks!

Regards,

Terence

[George Stefanick]

I understand your concern. I work in healthcare and manage a large wifi network in the Texas Medical Center. While you can do 802.1X and aup it has it's challenges because of byod. A guest network is suppose to be ease of access which is either an open network or a open network with aup. But understanding you want to secure the users transmissions. You will need to choose open and full support of byod or 802.1X and possible limitation.

Also keep in mind 802.1X has client count limitations.

Sent from Cisco Technical Support iPad App

[Leo Laohoo]

What I don't understand is if the APs will be installed in temporary residences for families of patients, why do you need 802.1x for?

[Terence Lockette]

Thanks guys,

I got my answer today regarding this question.  It looks like we're not interested in securing guest wireless Internet access.  So we're going to use a Web Auth to a captive portal with an AUP before redirecting them to their requested Web site.  Thanks again for your responses.