ePSK - Multiple Pre-Shared Keys


@chimeranzl wrote:

Agreed as above, username showing in column for ePSK clients would be considerably useful.  Hoping this will be added soon for security reasons... (eg: identifying those who still have an ePSK loaded in - but perhaps shouldn't) as relying on the persons device name isn't really suitable enough (especially in the hospitality industry)

Also the ability to edit an ePSK entry would be convenient too.

Other than that - great this is released, good start as a very nice to have for many of our clients.


yes we are adding the option to have the ePSK username show up in the client dashboard and tables in firmware version 3.11.3 coming out in a couple of weeks.

Great new feature! Do you know when ther will be added api’s to the cloud version. We have some great to tools to integrate with cambium

This feature is incredible! Just solved my MDU issue.  I have a question / feature request with it...

We use Sonar for our ISP billing and do a bunch of Option 82 stuff to track MAC addresses to customers. In MDUs that are hardwired, we put the MAC address of the switch port as an inventory item for the customer so no matter what device they plug into the connection from us, it gets tracked back to them using Option 82.

In the ePSK world, I'd like to create an ePSK "user" for each apartment number. In the MAC address field, I'd rather enter a MAC address from the private reserved pool and then option 82 that MAC so any device that uses that sPSK password gets that MAC associated to it as the "Remote Agent ID" in option 82. Now, I can add the privae MAC to Sonar to that customer and then any phone, computer, TV, iot device, etc they use will show up in Sonar with the IP address it grabbed using option 82.  We do all the DHCP batcher scripting on the back side but if the "MAC Address" field in ePSK could be used in Option 82 instead of just restricting a single MAC (or add an additional "Option 82 MAC" field to the ePSK entry that wrote itself as the "Remtoe Agent ID" for every deivce, this would really be incredible.

1 Like

Really nice feature for education. (We are a K - 12 school with 80 x e600)

I'd like to know how many ePSK entries per SSID are allowed.

Edit: (Looks like 1024 from what I can see........not really enough for a K-12 school)

Also the main problem with the current ePSK implementation is that any adds/deletes causes the AP to drop all sesssions on all SSIDs for 10 or so seconds.

This makes it impossible to onboard students real time.

Any plans to change this behaviour ?

Also would be good to bind a single ePSK to multiple mac addresses or limit the number of times a single ePSK can be used in no mac binding specified.

Thanks

Phil

Cloud support for API's is in the roadmap( exact date not yet decided). Once the API support is added in cloud, ePSK API will be supported.

So will cloud API support for ePSK allow add / delete of ePSK without dropping all connections to an AP ?

As of now any change in the radio/wlan confguration will result in client getting disconnected and connect back immediately. 


@Anandakrishnan  wrote:

As of now any change in the radio/wlan confguration will result in client getting disconnected and connect back immediately. 


Are there any plans to support config changes without the AP needing to reboot / drop connections?

Two questions:

1: ePSK is compatible 2ith "not newer" smartphones?

2: Can you explain me better about the different VLAN thing different VLAN and same SSID)?

I have a different VLAN for every WLAN. In the WLAN filed you can put the VLAN associated with that WLAN.

In the VLAN field under WLAN, wich VLAN you need to set to use ePSK with same SSID but different VLAN?

Thank you!

Really terrible that ap's need to reboot if you create one ePSK. Will this be fixed in the feature? Cloud solutions like Aerohive and Mist systems can work without rebooting the access point.

Will the limit of 1024 epsk's also be increased in the future?

Hi, any news on new firmware release?


@Telemar wrote:

Two questions:

1: ePSK is compatible 2ith "not newer" smartphones?

2: Can you explain me better about the different VLAN thing different VLAN and same SSID)?

I have a different VLAN for every WLAN. In the WLAN filed you can put the VLAN associated with that WLAN.

In the VLAN field under WLAN, wich VLAN you need to set to use ePSK with same SSID but different VLAN?

Thank you!


ePSK is compatiable with any smartphone that supports WPA2, which is basically everysmart phone that has been made in the last 10 years or so.

With ePSK you can set a VLAN per ePSK. This setting will override the VLAN set for the SSID. For example if you have a WLAN with VLAN 1 and on that WLAN you have a ePSK with VLAN 2 when the user connects to the WLAN with the ePSK they will be placed on VLAN2.

AP will not reboot when there is any add/delete of ePSK entries. instead clients already connected will have a momentary break.

1 Like

AP will not reboot adding or deleting epsk configuration . I would suggest better create bulk epsk keys and export epsk csv file & add multiple changes ( adding / removing  ) epsk data . Import same csv changed file back . This would avoid multiple time clients disconnection .    

1 Like

@hvgsit wrote:

Really nice feature for education. (We are a K - 12 school with 80 x e600)

I'd like to know how many ePSK entries per SSID are allowed.

Edit: (Looks like 1024 from what I can see........not really enough for a K-12 school)

Also the main problem with the current ePSK implementation is that any adds/deletes causes the AP to drop all sesssions on all SSIDs for 10 or so seconds.

This makes it impossible to onboard students real time.

Any plans to change this behaviour ?

Also would be good to bind a single ePSK to multiple mac addresses or limit the number of times a single ePSK can be used in no mac binding specified.

Thanks

Phil


We are looking to enhance this feature in the next few months in two ways which should help your use-case:

- increase the supported ePSKs from 300 to around 4000

- maintain the ePSK list in cnMaestro and have the AP lookup instead of making this part of the AP configuration. This will allow easier updates via API since then the changes would be to cnMaestro config and will not result in the AP being reconfigured. the AP reconfiguraiton is where you are seeing the SSIDs being reset and connections briefly dropped.

We dont have an exact date yet, likely in the Oct-Nov timeframe.

1 Like

@firefly wrote:

@hvgsit wrote:

Really nice feature for education. (We are a K - 12 school with 80 x e600)

I'd like to know how many ePSK entries per SSID are allowed.

Edit: (Looks like 1024 from what I can see........not really enough for a K-12 school)

Also the main problem with the current ePSK implementation is that any adds/deletes causes the AP to drop all sesssions on all SSIDs for 10 or so seconds.

This makes it impossible to onboard students real time.

Any plans to change this behaviour ?

Also would be good to bind a single ePSK to multiple mac addresses or limit the number of times a single ePSK can be used in no mac binding specified.

Thanks

Phil


We are looking to enhance this feature in the next few months in two ways which should help your use-case:

- increase the supported ePSKs from 300 to around 4000

- maintain the ePSK list in cnMaestro and have the AP lookup instead of making this part of the AP configuration. This will allow easier updates via API since then the changes would be to cnMaestro config and will not result in the AP being reconfigured. the AP reconfiguraiton is where you are seeing the SSIDs being reset and connections briefly dropped.

We dont have an exact date yet, likely in the Oct-Nov timeframe.


That's great news!

Sounds great. 4000 limit would be fantastic.

The ability to add / delete ePSK without AP reconfig would make ePSK useful as we can onboard students realtime.

Will this feature be available for Cloud controller ?

Thanks,

Phil


@hvgsit wrote:

Sounds great. 4000 limit would be fantastic.

The ability to add / delete ePSK without AP reconfig would make ePSK useful as we can onboard students realtime.

Will this feature be available for Cloud controller ?

Thanks,

Phil


Yes the plan is to make this available on both cloud as well as on-premises. 

Any news to show the epsk username on dashboard and tables?
Thanks


@firefly wrote:

@hvgsit wrote:

Sounds great. 4000 limit would be fantastic.

The ability to add / delete ePSK without AP reconfig would make ePSK useful as we can onboard students realtime.

Will this feature be available for Cloud controller ?

Thanks,

Phil


Yes the plan is to make this available on both cloud as well as on-premises. 


Fantastic !!!