I am a network admin at a high school in South Africa, running on a Microsoft network. We have approximately 150 PCs around the campus, of which at least 130 are wired to the network. The remaining are staff laptops. All IP addresses are assigned using a DHCP server.
Currently, our wi-fi access is limited to a few locations where those staff are located. We're using WPA with a long key which is not made available to students. To my knowledge, this key is safe.
It would make more sense, however, to use RADIUS authentication but I have some questions about how it works in practice.
- Will machines that are added to the domain authenticate automatically to the wi-fi network? Or is it user-based? Can it be both?
- Will devices like a PSP / iPod touch / Blackberry / etc / be able to connect to the WiFi network if it uses RADIUS authentication? I would want this to happen.
I do have WAPs that support RADIUS authentication. I would just need to turn the RADIUS functionality on from a MS 2003 Server.
Given the mobile-device requirement, would using a captive-portal be better? I know from experience in airports that it can be done (if the device has a browser).
Which brings me to questions regarding Captive portals:
- Can I limit the captive portal to Wi-Fi connected devices only? I don't particularly want to have to set up MAC address exceptions for all existing network machines (in my understanding, it just increases the opportunity for MAC address spoofing).
- How is this done? Do I have a separate address range for WiFi access devices and then will the captive portal route between the two networks? It is important to emphasise that the WAPs share a physical network with other machines that are not to be captive-portalled.
Your experience and insight will be appreciated!
Edit: In order to get a little more clarity on whether a Captive Portal is even feasible, I've asked this question.