Public kiosk tablets at the clerk’s office will use a guest-style S…

Question

Public kiosk tablets at the clerk’s office will use a guest-style SSID. Why must that SSID avoid the staff RADIUS realm?

Accepted Answer

Guest and kiosk authentication should be isolated from the staff Enterprise AAA realm to prevent credential and policy crossover — Don’t let lobby kiosks check in at the employee RADIUS desk. Separate guest/kiosk auth so staff passwords and policies don’t leak into public devices—and never ‘fixnet the enable secret’ as Wi-Fi auth.

Answer

Kiosks need the staff realm so they inherit employee group policies automatically

Answer

RADIUS realms are irrelevant; one AAA identity space should serve guests and staff

Answer

Kiosks should authenticate with the wireless controller’s enable password via Telnet

Public kiosk tablets at the clerk’s office will use a guest-style SSID. Why must that SSID avoid the staff RADIUS realm?

Short Explanation

Full Explanation