Agreed with Brent. Especially with the increased risk from ransomware, logical design for security is incredibly important -- not just to protect against external threats, but also against compromise from the inside. Credential compromise, student and/or employee BYOD, and visitors are all considerations.
We have long had a zoned network (servers, trusted clients, public, DMZ, etc.) with all traffic between zones flowing through our Palo Alto firewalls, no access to our "private" network without faculty/staff credentials or certificate-based authentication from school-owned devices (we push the certs with GPOs for Windows and Jamf Pro for Macs), and client isolation on our "public" wireless network for guests and students. We also have separate VLANs for servers (we have a couple of VLANs based on required service access), wired networking in each building, our public and private wireless networks, and various other higher-security (e.g., financial and POS endpoints, security cameras, access control) and lower-security (e.g., IoT, AV systems, campus residences) devices, with some passing through the firewalls and/or with limited routing, and others with more permissive routing.
We are in the planning stages of increasing security; we are looking to route all inter-VLAN traffic through our firewalls and shut off credential access to our private wireless network, which will have the effect of only allowing school-owned devices access to most parts of our network (our public network can only access network projection and printing; all other access on that network is to our DMZ or the internet).
Our actual wireless hardware has had relatively few changes over the years. We have some newer AP models, but still have some decade-old 802.11ac WAPs in a few core academic buildings, and even some older 802.11n hardware in some residences and facilities buildings. We're going to be doing some re-evaluation soon based on architecture changes our current vendor (Aruba) is requiring, but the logical design has been a bigger concern for us recently.
------------------------------
David Fulton-Howard
Interim Director of Information Technology
McDonogh School
Owings Mills, MD
------------------------------
Original Message:
Sent: 02-03-2025 08:29 AM
From: Brent Halsey
Subject: Wifi/networking in indy schools: magazine input
In addition to the technical specs and capabilities of the hardware (switches, access points, cables, etc), the logical design of the network is so essential. Physical segmentation with subnets and virtual segmentation with VLANs help to keep least privileged access by design. Choices around wireless authentication like RADIUS, pre-shared keys, or managed network profiles from device management platforms. How and where to do URL filtering; at the device level, wireless access point level, firewall, etc. These are all topics that I'd love to explore with ATLIS peers to compare notes and see what creative solutions work best in other schools. Great topics!
------------------------------
Brent Halsey
Columbus Academy
Gahanna OH
Original Message:
Sent: 01-23-2025 12:08 PM
From: Ashley Cross
Subject: Wifi/networking in indy schools: magazine input
Hey all,
I'm discussing wifi and networking for independent schools with EdTech Magazine soon. Let me know if you have any input or specific examples that address these questions for the article:
What are some of the unique challenges that private, charter and independent schools have that may make upgrading to networking a challenge?
Despite the hurdles, why does it make sense for these schools to consider upgrading? For example, what does Wi-Fi 6 or 6E do that Wi-Fi 5 or Wi-Fi 4 can't accomplish?
#ITSystemsandSupport
#Leadership
------------------------------
Dr. Ashley Cross
Senior Director of Education and Content
www.theatlis.org
888-502-8547
------------------------------