 |
 |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Peter, > I didn't think the following suitable > for the 'WIRELESS-ADMIN' list for obvious reasons! > > Pre Windows XP SP3 where Microsoft have opted to 'hide' > 802.1x on wired interfaces (until the relevant service is started) > I vaguely thought end-user configuration of 802.1x for wired interfaces > was slightly easier than the wireless equivalent. It is. But the Windows supplicant can be very temperamental. I'd recommend writing your documentation such, that it includes the installation of SecureW2, and then configures an EAP-TTLS-PAP profile. Your users will thank you in the future. > > Now we've progressed to a certain point with a rollout > of 802.1x wireless we're pondering whether to go the whole hog > and go for 802.1x wired in our Halls for the next academic year as well. > > Can anyone here comment on whether they opted for 802.1x (and as a result > but not necessarily 'eduroam') everywhere for itinerant users > or that you're still maintaining seperate systems and why? We opted for 802.1X on wired back in 2007. It really depends on your networking hardware as to what you can support. The way we've got it set up means that eduroam users can connect in residences just as well as students; very good for conferences etc... There's no real reason to maintain separate systems; the trick is getting the VLANs you need disseminated to al the points in the network where they could be potentially assigned. > > Looking at websites for a few institutions I can see places where > web-based 'registration' systems are still in place, for example. They're not really required. With RADIUS accounting you'll always have a record of who used what and where. Though it's good to have some kind of captive portal to disseminate instructions/ patches/ etc, and record AUP acceptance. I know Cico switches do Mac-Auth bypass, so that if a supplicant doesn't respond they get authenticated by MAC-Address. You can use the mac-auth process to assign them to a setup and quarantine VLAN, then just redirect all web traffic on that VLAN to a captive portal. Best Regards, Arran PS: I don't know how much inter college cooperation goes on between University of London institutions, but I know Alexander Clouter at SOAS has done some development work with 802.1X on wired. He might be able to offer you some more advice. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkomvDwACgkQcaklux5oVKJVzgCeMZ9RPptUSAyXJzwBSOVe2dUS w4oAn3AIUE3Vm35Dwp6yE99fGi6lCUKo =AupW -----END PGP SIGNATURE-----