We are implementing a new WiFi network at my work, and I am trying to think through a design of the security for the network.
Use case 1: guests. We will have a captive portal setup, guests will accept an acceptable use policy and will be restricted to only the Internet, no access to LAN. Simple enough, we will let the firewall block dangerous ports and not much to worry about since they can't touch our primary network.
Use case 2: employees with BYOD and company owned laptops that might spend months offsite before being brought in to the office. Mix of Windows and OSX. They will authenticate with WPA2-Enterprise to our AD/RADIUS. Is there a good way to give these folks secure LAN access to internal servers?
My thought was that just giving these folks unrestricted access to the LAN is problematic. If they are domain-joined, they will eventually receive security updates from WSUS, but not necessarily before they connect. Anti-Virus is also not guaranteed. With the wired network we have in place now, this is minor, but I can see BYOD growing with the addition of a wifi network, particularly for our large crop of summer interns.
I have looked into Microsoft Network Access Protection to enforce security settings and quarantine non-compliant devices, but I am not sure how it will work with OS X (the only agent I could find, the UNET one, has some broken links on the website and pricing is unclear). It also seems to be pretty complex.
Is this overkill? In the real world, how do others handle this scenario? Is there a simpler Network Access Control solution folks like?