Eduroam is a secure wireless network for the education community but it has limitations that prevent some devices from connecting. SWIS-Lite was created at Swansea University as an alternative wireless network to support devices that Eduroam cannot, like games consoles and e-readers. SWIS-Lite uses a web-based registration system and MAC address authentication over RADIUS to assign devices to VLANs based on their type. This provides basic WiFi access for non-traditional devices while maintaining some security through device isolation on separate VLANs.

2. SWIS-Lite @ Swansea: When eduroam doesn't fit By Gareth Ayres Gregynog Colloquium Conf 2011

3. Agenda 1.0Wi-Fi, Eduroam, SU1X, and previous presentations 2.0Eduroam is great but… 3.0SWIS-Lite

4. 1.1 Eduroam Deploying Eduroam : Last years presentation “eduroam (education roaming) is the secure, world-wide roaming access service developed for the international research and education community.” WWW.EDUROAM.ORG

5. 1.2 Eduroam Broken Down: Example USER@REALM G.j.ayres@swansea.ac.uk

10. Automatically configures XP, Vista, 7

11. Installs certs and provides help

12. Deployed from setup SSID during registration

13. http://su1x.sourceforge.net/

14. By Swansea University (Janet UK funded)

15. Open Source

17. ~850 Lightweight access points

18. 4 Cisco WiSM’s

20. 2.0 Eduroam is great but... Eduroamis complicated: WPA2-Enterprise, PEAP etc... What about games consoles? Student Survey demanded it! Only support for basic home wireless such as WPA2-PSK?!?! Eduroam is a non-starter...

21. 2.1 SWIS-Console 2010-2011 Web based registration through eduroam-setup http://swis.swan.ac.uk/console/ WPA2-PSK network broadcast in halls of residence only, that uses mac-auth over radius to ensure only registered devices can get into a VLAN.

23. Registration form uses MAC OUI to check the device is a gaming device

24. Users warned of risks

26. 2.3 Device Types 2007 & 2009

27. 2.4 OS 2007 & 2009

28. 2.5 2010 – 2011 Device Types

29. 2.6 2010 – 2011 Device Types

31. E-Book readers

32. Digital Signage Stations

33. Low-tech Mobiles

34. Cheap Tablets / Netbooks

36. Mac-Auth for VLAN assignment

38. Different VLANs for different device types

39. Different ports/ACL for different VLAN

40. Device Fingerprinting with NMAP

42. Thank You – Any Questions? Gareth Ayres: g.j.ayres@swansea.ac.uk Links: http://www.eduroam.org/ http://www.ja.net/services/authentication-and-authorisation/janet-roaming.html https://github.com/GarethAyres/SU1X https://code.google.com/p/su1x-droid/