eduroam 802.1X with a campus identity - Laptops
- Phones
- Tablets
Stays exactly as it is.
The residence hall password stopped being a secret in week one.
Most halls run on one shared Wi-Fi password, because it is the only thing every device understands. Laptops and phones can use eduroam or another 802.1X network. Game consoles, smart TVs, streaming sticks and printers usually cannot.
So the password ends up on a whiteboard, in a group chat and on every visitor’s phone, and everyone who has it lands on the same network as every resident.
Client isolation on: nobody can cast to their own TV. Client isolation off: everyone can cast to yours.
One password for the building. Or a network for every room.
Vandelay Hall has four floors, 32 rooms and one network name. With a shared password, everyone is on one flat network. With EasyPSK, each room has its own key and its own private network.
1key for the whole hall
1flat network for everyone
140devices outside room 204 that can reach it
Vandelay Hall is an example. The platform generates every key. Residents never choose one.
Six everyday moments. Each one goes differently.
When One shared password A key per room
A key leaks The whole hall is exposed until you change the password. One room is exposed. Regenerate that room’s key and nobody else notices.
You change the key Every console, TV and laptop in the building drops off at once. Only the devices in that room reconnect.
A student brings a console or a TV It gets the shared password, or a MAC registration form. It uses the room’s key, like home Wi-Fi. Instant groups register devices on first connect.
A phone uses a private MAC address MAC-based registration breaks until the new address is added. Nothing breaks. The key identifies the room, not the address.
Someone wants to cast or print All or nothing: client isolation blocks it for everyone, or the network opens it to everyone. It works inside the room and stays invisible outside it.
The term ends The password lives on in every phone that ever had it. Each room’s access ends on the date you set.
From room list to connected, before the boxes are unpacked.
Self-Service Portal · resident view - Before move-in
Housing creates a group per room
One by one or in bulk. Every group gets its own key, generated by the platform, on the residence hall SSID.
- At check-in
The student opens the Self-Service Portal
They sign in with a magic link sent to their email, or with campus single sign-on over SAML 2.0, and see the network name, the key and a QR code.
- The first minute
Every device joins with that one key
The phone scans the QR code. The laptop, the console and the TV take the same key. In Instant groups devices register themselves on first connect, so nobody collects MAC addresses.
- All term
The room is its own private network
The key decides where a device lands. The room’s devices share their network, so casting and the printer work, and the resident can see what is connected.
- Move-out
Access ends when the stay does
A validity window ends the group’s access on a set date, or housing regenerates the key for the next resident.
Housing and IT stay in control
Set the rules once. Every room follows them.
Administrators work in the administration portal. Residents handle their own room in the Self-Service Portal: they see the key, scan the QR code and check which devices are connected.
- A group per room, suite or student, created one by one, as a numbered series or from a CSV
- A device cap and an end date per group: the room is archived when the term ends
- A device block list that keeps one device out even with the right key
- Stricter flavours where needed: Approved admits only pre-registered devices, Dedicated gives every device its own key
- Sites and Site managers: housing staff run their own buildings in the Self-Service Portal, printed key cards included
- An onboarding rule that gives a student a room of their own at the first sign-in with a campus email
- An audit trail of every change and user event
Keep eduroam. Add one network for everything else.
EasyPSK does not replace your 802.1X network. Devices that can use eduroam keep using it. One EasyPSK network takes the devices that cannot, and gives each room a home-like network of its own.
vandelay-halls EasyPSK with a key per room - Game consoles
- Smart TVs
- Streaming sticks
- Smart speakers
- Printers
- Any phone or laptop, too
Every room is its own private network.
Running eduroam yourself? EntryPoint is cloud RADIUS for eduroam, as identity provider and service provider. Netgraph for education
Runs on the Cisco wireless you already have.
Cisco Meraki
MR access points on firmware 30.6 or newer, with Identity PSK with RADIUS on the SSID and external DHCP (bridged).
Cisco Catalyst 9800
Wireless controllers on IOS-XE 17.6.1 or later in local mode, using Cisco’s Easy PSK on the WLAN.
Cloud RADIUS · No servers on campus · 100,000+ keys
The short answers.
Something else on your mind? Talk to an engineer.
Do students have to register the MAC addresses of their devices?
No. In Instant groups the key decides which network a device joins, and devices register themselves the first time they connect. MAC addresses only need to be registered in Approved and Dedicated groups, which are meant for stricter cases.
Does it work with private or randomized MAC addresses?
Yes. Because the key, not the MAC address, identifies the group, a phone or laptop using a private Wi-Fi address joins its room’s network with the key alone in an Instant group.
What about game consoles, smart TVs and streaming sticks?
Anything that can join a Wi-Fi network with a password can use EasyPSK. The device enters the room’s key like any home Wi-Fi password and lands in the room’s private network.
Does EasyPSK replace eduroam?
No. Keep eduroam or your own 802.1X network for devices that support it, and add one EasyPSK SSID for the devices that cannot use 802.1X and for residents who want a home-like network in their room.
What happens when a key is shared or a student moves out?
Regenerate that group’s key. Only the devices in that group are disconnected and reconnect with the new key. Every other room is untouched. A validity window can also end a group’s access on a set date.
Can students sign in with our campus single sign-on?
Yes. The Self-Service Portal supports SAML 2.0 single sign-on, and magic-link sign-in by email is the default.
Which wireless hardware does it need?
Cisco Meraki MR access points on firmware 30.6 or newer, or a Cisco Catalyst 9800 wireless controller on IOS-XE 17.6.1 or later in local mode. EasyPSK acts as the SSID’s RADIUS service in the cloud, reached over RadSec or privately through Service Connector.
How many rooms can one campus have?
EasyPSK via RADIUS handles more than 100,000 keys and scales horizontally, so the number of rooms is not the limiting factor.