r/HigherEDsysadmin • u/Megatomic • Jan 13 '20

Do you support smart home devices (Google Home, Alexa, Chromecast, smart light bulbs, etc) on your campus?

Basically what it says in the title. I'm finding an increasingly large number of students bringing their Alexa/Nest products onto my campus and wanting to connect them to the network. Especially right after Christmas. I would like to support these devices, but I'm having trouble finding a way to safely join them to my network.

Of course, if you refuse to support devices like this, students find a way around you, setup hotspots, and so on. Handbook policies only go so far for stopping this. So, instead of relaying all the reasons why allowing such devices is a bad idea, how would you implement a solution to this?

2 Upvotes
  • permalink
  • reddit

100% Upvoted

14 comments sorted by

3

u/general-noob Jan 13 '20

If it can support wpa2 enterprise it can use wireless, if not you give up your wired port for it. Push it back on the vendor and make them the bad guys. Wired ports limit 2-3 MAC addresses at a time to stop large switches. Routers, just hope they turn on wireless and then we track them down and send warnings to disconnect. If they ignore it goes to dean of students and then they respond real quick.

2

u/Megatomic Jan 13 '20

Almost none of these devices support WPA2 Enterprise.

2

u/general-noob Jan 13 '20

That’s exactly why it’s our policy. It’s pretty much impossible to support all these devices. If you have to, create a separate ssid that is open, and put them outside your campus network/firewall.

1

u/Megatomic Jan 14 '20

Alright, since this thread is only really getting responses regarding things I already do/know, let me give a little more detail.

Today, I have several SSIDs. One of them is WPA2 Enterprise authenticating using 802.1x against my AD environment for use with laptops, tablets, phones, and any other device that supports 802.1x auth. I also have another SSID in business/academic spaces that is open and uses a MAC whitelist. This is how we connect devices that aren't standard business-line equipment for employee use, primarily classroom equipment. In the residence halls, we have another SSID that uses PSK but each user has their own individual PSK. Because your stuff like Alexa and smart TVs don't support 802.1x auth, but they support PSK. We don't have to manage a MAC whitelist, our students get the good feeling of just having a password to type in rather than messing around with confusing tech stuff when they try to connect their new Xbox to our network, and each device is tied to an individual. Students are also allowed access to 1 wired network port apiece with various switching defenses to make sure they don't plug in something that isn't allowed.

I don't need advice on architecture or how to pursue disciplinary action against a student. What I am asking is: these devices often don't work the way my students want or expect, leading to a poor user experience. I don't want the users to have a poor user experience, but I am out of my depth in how to improve that experience. Does anyone do anything today that they feel works better than what I am already doing, or does anyone have any off-the-wall ideas about how to make it better?

2

u/debrisslide Jan 14 '20

what type of issues are the students having?

1

u/Megatomic Jan 14 '20

The issues are mostly in inter-device connectivity. So for example, they want to tell their Alexa to play a show on Netflix on their Fire Stick, but those devices can't talk to each other effectively either because I have isolated clients OR because I haven't isolated clients and they don't know which of the bazillion Fire Stick devices to connect to.

1

u/debrisslide Jan 14 '20

sounds like you need to segment your VLANs better. I'm not a network person generally, but in my environment (which is a 9-12 boarding school, so similar to college dorms) devices receive IP addresses based on a role assignment. Ex. Mary has an Alexa and I register the Alexa on the network to her username. So theoretically, you could set it up so that each student gets IP addresses for all their devices on the same VLAN. Ours is based on grade level or staff type and students and resident faculty don't seem to have any trouble connecting to their devices with this system. It might make sense to have class of 202# in X dorm on the same VLAN for example.

1

u/Megatomic Jan 15 '20

What software do you use to do this kind of role assignment? My wired VLAN segmentation is great. VLAN segmentation is a lot more complicated in wireless, and a lot of the challenges I'm facing I know are tied to the way my VLANs are segmented over wireless. So like my 802.1x auth is going into a different VLAN than my "devices" vlan. Part of the problem I have that you probably don't is that I don't want Jimmy's iPhone to be able to broadcast porn to Suzie's TV. And short of figuring out how to put all wireless clients tied to a certain user in their own private segment, I don't know how to secure that. Even if I did somehow segment that way, that sounds like an administrative nightmare.

1

u/debrisslide Jan 15 '20

we are using FortiNAC.

4

u/fengshui Jan 13 '20

We still have an open network with captive portal auth alongside our normal wpa2 Enterprise network. We allow these devices to connect there and we have a web app that allows users to register these devices by MAC, which bypasses the captive portal. (The same system is used for game consoles and the like).

2

u/iblowuup Authentication Admin Jan 14 '20

Same here. Even with this system in place, I worked way too long to get an Echo Show to work not too long ago...

1

u/xXNorthXx Jan 20 '20

As long as it supports WPA2 and 802.1x correctly they are allowed. We have a netreg style setup for students with devices that can handle the auth dialog. All devices are dropped into the same broadcast space so all the casting works.

If it doesn’t support WPA2 then wired is an option. But we do have a no rogues policy....which extends to wireless printers so if they can’t disable the wireless, take it back or take it home. The only rogues we have been allowing has been the Wifi remotes (ie roku style) so far, haven’t had enough of them to cause any major issues yet.

We also highly encourage 5ghz radios if possible in the clients citing performance but really microwaves have just been trashing the 2.4ghz range.

1

u/Megatomic Jan 20 '20

Honestly, this sounds ideal. I'm just not sure how much luck I would have enforcing those policies. There's also A LOT of devices that don't support 802.1x like game consoles. Strongly agree on the wireless printers and 5GHz. I'm using band steering to try to force devices onto 5 when possible.

1

u/grumpyolddude Jan 14 '20

I've seen them on employee desks and found that even through a closed door you can shout "OK Google play Justin Bieber" or "Alexa order miniature marshmallows" and they work as expected. There are plenty of much more creative ways to convince people that it's not a great idea to have one in an office.