At 11:22 AM -0400 2006/08/11, Roy Atkinson wrote:
>Actually, the most common setup I've seen is the one we use. Our
>802.11x network is wide open, campus-wide, and set up as part of our
>"Visitor VLAN." That VLAN does not have access to any internal
>resources, but allows visitors to connect to the Internet. We also
>provide our employees who have laptops with VPN clients, and the VPN
>is required for all internal access--intranet, email, servers, etc.
>We also have 2 WPA2 networks under construction to support other
>wireless devices.
>
>So, you can be in any of our conference rooms, auditoriums, lobbies,
>etc. and get good wireless connectivity, but you can't get internal
>resources without RADIUS authentication.

We do something similar, but we allow ssh, HTTP, and HTTPS
from the wDMZ into campus, as they are allowed in from the Internet.
We don't allow port 25 in or out, though -- no spamming (unless you
run VPN).

They're setting up a separate WPA2 SSID on the same APs,
which will be equivalent to being on an Ethernet jack. It's waiting
on the RADIUS bit, currently.

Chris
--
Chris Pepper: <http://www.reppep.com/~pepper/>
Rockefeller University: <http://www.rockefeller.edu/>

[ reply ]