1. The Vulnerability of Pre-Shared Keys (WPA2-PSK)
Using a shared Wi-Fi password across an enterprise office creates severe security liabilities: whenever an employee or contractor departs, the shared key must be manually updated on dozens of devices. Furthermore, pre-shared keys allow any compromised endpoint on the SSID to eavesdrop on unencrypted broadcast traffic.
2. WPA2-Enterprise and IEEE 802.1X Architecture
WPA2-Enterprise replaces shared passwords with individualized credentials. The architecture consists of three entities: the Supplicant (user device), the Authenticator (Wi-Fi Access Point), and the Authentication Server (FreeRADIUS or Windows Network Policy Server). Users authenticate using their individual corporate domain accounts.
3. Integrating FreeRADIUS with Active Directory via EAP-PEAP
Using PEAP-MSCHAPv2 (Protected Extensible Authentication Protocol), the user device negotiates a secure TLS tunnel with the RADIUS server before transmitting domain credentials. FreeRADIUS validates the username and password against the Active Directory LDAP or Kerberos backend.
4. Dynamic VLAN Assignment
Configure the RADIUS server to return RFC 2868 Tunnel-Private-Group-ID attributes during authentication. This dynamically assigns employees to the internal corporate VLAN while shunting contractors and guest accounts to an isolated, firewalled DMZ VLAN with direct internet access only.
