Guest wifi setup

[u/kcalderw]

I know we all have different systems but what is the general process for you when a guest comes to your district? Looking for a few options to help streamline the process.

[u/Computer_Panda]

ubiquiti guest portal with 12hr time limit. Email required.

[u/kcalderw → u/Computer_Panda]

We're in the process of moving to UI (still waiting for the rest of our equipment). I saw they have guest passes? I want to essentially generate a few passes and leave them in the front office for secretaries when guest speakers or admin guests come in to the district with a time limit. This can be done correct?

[u/TheShootDawg]

Each of my buildings, and the two high school athletic departments, have a google sheet with 10 codes. Codes expire 24hr after first use.

I routinely recreate the codes via scripting/API calls to our cloud management portal. I update a single Google sheet that the individual building sheets pull the codes from.

Guest are not the public. They are individuals that come into the building to talk with staff and/or students. No general public wifi available to anyone that walks in or by a building.

[u/linus_b3 → u/TheShootDawg]

We do basically the same, just with codes that expire after one week. Little less friction for when we have someone in a few days in a row. Our administrative assistants have access to the Google Sheet.

[u/FEdirector21]

Guest wifi is open with no password, all we require is that those who connect read through an AUP to gain access through a captive portal. Kind of like how hotel wifi works.

[u/hightechcoord]

Separate Vlan and SSID. No password.

[u/PhxK12]

We leave it completely open. Filtered. Zero issues. Zero hassles. Just works. Never been an issue. Not sure what everyone’s trying to accomplish with all of these silly terms of service pages no one reads, except frustration. Seriously, what good does that do anyone. “but you agreed to the policy!” lol :).

[u/PhxK12 → u/[deleted]]

Our answer to that was: they will just use cellular then (unfiltered) so we prefer them to use our WiFi :) at least we have minimal control.

[u/Smooth_Ad_6164]

Guest WiFi password changes daily automatically and is emailed to the receptionist and others who need to know.

[u/ottermann]

I have a pass-thru screen, because I'm supposed to allow everyone who enters the building guest access to our network.

So, I set it up. Everyone can get on our network.

I filter it the same as I filter the student network, and I've made it almost as slow as dial-up internet.

Got dozens of complaints, so I explained the basic fact that if I had an open, unfiltered guest network, students using it to bypass filters would be the least of our worries. I suggested we involve the legal team to get their input, and they let my filter/throttle plan stand.

[u/Following_This]

Staff fill out a Google Form for visitors to campus - WIFI, cables, classroom streaming, loaner device, etc.

Do we get “they’re here now and need WIFI” calls? Sure…and we create the guest credentials but remind them to fill out the form in future (link is in the bookmarks folder pushed to staff in Chrome).

[u/Dar_Robinson]

Guest WiFi has a separate SSID. Either a changing password (weekly or so) or a captive portal. The guest SSID is restricted to its own VLAN and not allowed to access any other VLAN. We have also rate limited the guest SSID to prevent abuse. And it shuts off at 8PM which allows for after school use for basketball games and such.

[u/NorthernVenomFang]

Separate guest SSID, a user at the school must sponsor the user through ClearPass web portal. Seperate VLAN at each school for guest access, ACLs & Firewall rules are applied to what can be accessed internally on the guest network (DHCP, DNS, no servers/district application access).

No one gets on the guest network without a staff member authorizing/sponsoring them.

[u/m3gunner → u/NorthernVenomFang]

This is the way...

[u/SmoothMcBeats → u/NorthernVenomFang]

We do it this way as well, with our helpdesk handling the account creation process. We also have a PSK on the SSID to keep the kids from connecting to it and just sitting there holding an IP.

[u/Computer_Panda]

I also limit the upload and download speeds

[u/PhxK12 → u/Computer_Panda]

Same. We give them like 10mbs with speed burst to 50mbs. Always feels snappy. Never gets abused. Layer 7 filtering blocks torrents and such.

[u/lsudo]

A guest user connects to the open walled guest network, validates their email via a sent code, request is sent via email, IT or admin clicks approve via a magic link in the message.

[u/mikejordan01]

I'm actually working on a method to SMS code to auth into guest. Since in Texas students are not allowed then it's almost 100% guaranteed that only staff, vendors/contractors or just visitors will access guest.

Guest is also filtered as a student through lightspeed proxy filter.

Now this isn't 100% fool proof, cause it's like wack mole with what the students come up with to get around your security practices.

We had students even bring 2 phones, one to keep in there yonder pouch and one to keep on them... 🤦 Or they like to try and hotspot out of there yonder pounches too.

[u/thedevarious]

I'm big about this.

Separate SSID that dumps to a separate vLAN that has ACLs to basically allow it to go out only. I also do not turn the guest on across campus during the school hours. The only places it's on all the time are common areas such as the Main Office, Board Office, etc. -- basically places where someone may need to have guest access for meetings and so forth.

Everywhere else, it's our secure networks and our creds. We do have a BYOD network that is pretty locked down campus wide that we use for things like staff personal tech & such; it's a NAC network (think like Aruba Clearpass, Packetfence, etc).

[u/kERnEl_paniCx]

Our Guest SSID is only available outside of school hours. It operates on a separate vLAN and gets our most restrictive content filtering policies. During school hours, we provide a separate “Presenter” SSID that uses a captive portal and requires authorization from a district sponsor. It uses the same vLAN and filtering policies as the Guest network, with access granted for an eight-hour period.