This document discusses eduroam, a global roaming service for research and education. It provides an overview of eduroam's technology, policies, business model and resources. It also describes recent infrastructure updates and upcoming changes to eduroam in the US. Finally, it proposes a solution called ANYROAM to address the problem of hotspots not supporting eduroam and to allow both eduroam and ANYROAM users to roam on the same wireless networks.

1. Philippe Hanset
ANYROAM LLC
phanset@anyroam.net
AirHeads 2013 Las Vegas

2. eduroam is a NET+ Service
AirHeads 2013 Las Vegas
+Internet NET
www.internet2.edu/netplus/eduroam/
www.eduroam.us
This work has received support from

3. eduroam is provided by
AirHeads 2013 Las Vegas

4. Growth in one year
AirHeads 2013 Las Vegas

5. Why provide eduroam?
(even if you already provide visitor‐access)
To be compaNble …
– You users can join eduroam when traveling
– You can welcome eduroam users on your campus
AirHeads 2013 Las Vegas

6. Technology Overview
• eduroam is WPA2 enterprise “on a string”
• eduroam is EAP insensiNve
• EncrypNon
– IniNal authenNcaNon between device and home
RADIUS
– traffic between device and WLAN
• Great service for IdenNty Based Networking
• Reminder: WPA2‐ent. (AKA 802.1x) is a Layer 2
protocol
AirHeads 2013 Las Vegas

7. New eduroam‐US infrastructure
• Two new servers on the Internet2 backbone
– Kansas
– Virginia
• Conversion coming in the next months
– We will contact you
AirHeads 2013 Las Vegas

8. Policies
• No Web portal between authenNcaNon and Internet
• Users always contact Home Helpdesk first
• Minimum set of ports required
• 6 Months RADIUS logs retenNon
• Global AUP work in progress to address:
– No guarantee of service
– Obey local laws (When in Rome do as the Romans do)
• Handling of abuse
– Block users (MAC, REALM, CUI)
– DMCA complaints
AirHeads 2013 Las Vegas

9. Business Model
• Free for Internet2 members
• Yearly fee for non‐members
– Current model is idenNcal to InCommon
– New model coming up to address small schools
AirHeads 2013 Las Vegas

10. Resources
• Administrator Guide at eduroam.us and also
eduroam.org
• Internet2 discussion list for administrators
• TF‐MNM (a TERENA resource)
• Our team will help you from A to Z
AirHeads 2013 Las Vegas

11. RADIUS‐TLS
• Replaces the RADIUS shared secret (MD5
agacks)
• Supported by:
RADIATOR, FreeRADIUS, radsecproxy
• PKI for US‐eduroam‐federaNon required
AirHeads 2013 Las Vegas

12. Dynamic Discovery
• NAPTR entry in DNS zones
• Solves the internaNonal .edu problem and
non hierarchical domains
(oar.net, maxgigapop.net, nordu.net)
• Only the Top Level RADIUS Server of a
federaNon (FLRS) needs to be compaNble but
all non‐edu (or .edu located outside of US)
domains need NAPTR entry
AirHeads 2013 Las Vegas

13. The eduroam problem
• Hotspots are not interested to carry the
eduroam SSID (too much technology for too
few users)
• Schools on eduroam enjoy the service but sNll
have to maintain a Web portal for all visitors
that are not eduroam users (the majority!)
AirHeads 2013 Las Vegas

14. The ANYROAM soluKon
• Give non‐edu users the opportunity to acquire
WPA2‐enterprise compaNble credenNals
• Peer the eduroam federaNon with the ANYROAM
service
• Convince Hotspot to carry the ANYROAM SSID
• Allow eduroam users to join the ANYROAM SSID
at various Hotspots
• Use your exisNng eduroam SSID on campus to
welcome visitors. No need to provision, just to
grant access.
AirHeads 2013 Las Vegas

15. Contact us…
support@anyroam.net
AirHeads 2013 Las Vegas