I am providing pro bono technology support to a UK-based charity. They started off small but have grown and now offer workspace for other local charities, circa 50 office seats. They do a lot of good work for their community and they are all volunteers themselves. Their current network comprises of a 1Gb/s leased line into a managed switch and then shared out amungst 3 x WiFi Access Points. No firewall, no network authentication, no network segregation, WiFi password written on posters pinned up around the floor!!
I need to ‘enterprise network’ them up, but my networking knowledge is rudimentary at best. Would somebody mind ‘checking my work’ by reviewing/commenting on my strategy below?
Wired v Wireless
The building they are in is fully wired up for Ethernet, they are just not using it. Strategy: move switch and fibre to floor cabinet, patch outlets to switch, encourage use of wired Ethernet but allow WiFi, setup isolated WiFi guest access (Internet only).
Anybody and everybody can currently connect to their network. Strategy: implement 802.1X network authentication using EAP for both wired and wireless connections. How to implement plug’n’play authentication? MAC address registration too hard, self-registration via captive portal? Need RADIUS server? Implemented in switch or pfSense NUC?
All network devices are currently connected together – data breach potential is high. Strategy: implement 802.1Q VLANs for each organisation. Organisations move around, tagging individual switch ports too hard, can VLAN be assigned via captive portal together with 802.1X authentication? Can VLANs be assigned to WiFi access?
They have a few business-class network connected printers, but no centralised management, no Active Directory Services etc. Strategy: unsure. Do universal print management services exist that can run on a switch or a NUC? Printer access can’t be restricted to any individual VLAN, how to authenticate or share across VLANs?
They have about £1.27 left from their original grant funding! Everything needs to be done on the cheap i.e. not best, just good enough.
I know that I’m asking for a man-weeks’ worth of networking consultancy here! I don’t mind doing all the research / legwork if I can just get a steer from the experts.
All advice warmly welcomed.