In brief
One shared passphrase is a problem for both security and records. Why staff belong on 802.1X/RADIUS and guests on the portal, with setup notes.
In most businesses the staff Wi-Fi runs on a single password. It is told on the first day, written on a note, and walks out of the door with every employee who leaves. This post explains why a shared password is weak for both security and records, and how to separate staff and guest networks properly.
What a shared password does and does not do
A shared password (WPA2/WPA3-Personal) encrypts the air traffic, and it does that well. What it does not do is tell people apart. Forty people who know the password join the network as the same "identity". That has two consequences:
Security. A former employee, a visiting supplier or a customer who overheard the password can connect as long as the password stays the same. Changing it means reconnecting every phone, laptop and printer. That is why passwords go unchanged for years.
Records. If a connection from the staff network causes trouble, all you have is "someone on the staff network". The DHCP log on the access point or modem is short-lived, unsigned and not tied to a person.
The internal IP assignment records that Law 5651 expects from a public-access provider concern primarily the access you open to guests. How far the record-keeping duty extends to a staff network can depend on the type of business; get legal advice on that. If you decide to keep records, a record kept behind a shared password does not show the person. That is a technical fact.
The right method for staff: 802.1X and RADIUS
802.1X is the Wi-Fi standard where each user connects with their own credentials. The access point asks a RADIUS server behind it to verify the user. In this setup the access point is called the NAS (Network Access Server); the RADIUS server checks the credentials and accepts or rejects the session.
What you gain:
- Every employee has their own username and password (or certificate).
- When someone leaves, you disable the account; nobody reconnects, and no password changes.
- RADIUS produces a record of who connected, with which device, and when.
- You can assign VLANs per user if you wish: accounting on one, the warehouse on another.
The cost: you need a RADIUS server and a user directory. If you already have a directory (your office accounts, for instance), it usually connects to that. Most business-class access points support 802.1X; consumer modems usually do not.
Where the box fits
Hotspot-Box's main job is the guest network: captive portal, SMS code, coupon, e-mail and registered-user login; chaining internal IP assignment records with SHA-256 digests and time-stamping them; keeping them for 2 years.
Beyond that, the box can set up a NAS integration with RADIUS-capable access points. If your access point speaks RADIUS, guest sessions are managed on the access point side in step with the box. This is an extra reinforcement on top of plan management that already works independently of the access point brand (speed, session length, idle timeout, device count, daily quota).
For the staff network you use your existing RADIUS/directory infrastructure. The box does not aim to run your staff network; what it does is separate the staff and guest networks by VLAN and take full charge of the guest side.
Recommended layout
| Network | SSID | Authentication | VLAN | Records |
|---|---|---|---|---|
| Staff | Hidden or visible name | 802.1X / RADIUS | Staff VLAN | RADIUS session records, directory logs |
| Guests | Open, no passphrase | Captive portal (SMS code, coupon, e-mail) | Guest VLAN | Signed on the box, 2 years |
| Devices (printer, POS, TV) | Guest or a separate device VLAN | MAC exemption | As appropriate | Visible on the box |
The critical row in this table is the VLAN separation. The guest network must not reach staff resources (file server, camera recorder, till software). The box is a firewall that separates the guest network (pfSense based); it does not replace a corporate UTM, but it cuts off the guest's path into your internal network.
Migration plan
Moving from a shared password to 802.1X does not happen in a day. Our suggested order:
- Separate the guests first. Set up the guest SSID as an open network with the portal and connect it to the box. You do not need to stop staff from joining the guest network; if they do, a record is created, nothing more.
- Sort out the devices. For printers, POS terminals and TVs that cannot enter credentials, define MAC exemptions or open a separate device VLAN.
- Pilot with staff. Move one department to 802.1X. Explain the profile setup for phones and laptops in a one-page guide.
- Switch off the shared password. If the pilot works, retire the old SSID. If a device still cannot connect, go back to step 3.
In a small business 802.1X may be more than you need. Then do at least this: keep the staff network on its own VLAN, change the password once a year, and change it immediately after an employee leaves. Know that this does not solve the record problem; it only narrows the leak window.
Common mistakes
- Guests and staff on the same SSID, trusting that "guests don't know the password". It leaks in the first week.
- Running a captive portal on the staff VLAN. Staff tire of entering codes five times a day and drift back to a shared password. 802.1X is for staff; the portal is for guests.
- Putting the printer on the guest network without an exemption. The printer cannot see a portal, cannot connect, and "the Wi-Fi is broken" complaints follow.
- Leaving client isolation off. Devices on the guest VLAN should not see each other.
How the box works with your existing access points is on the box page; for a virtualised setup see the virtual appliance page. Send us your network diagram and we will draw up the VLAN plan together.
This article is for general information and is not legal advice.