1

I have an air quality IoT device that connects to WiFi and report data to the cloud and are planning to install 100+ devices at a customer location. To install a device, the customer has to connect to it and provision it with their network credentials (SSID and password). The issue we are facing is that the customer (for security reasons) changes their WiFi WPA2 password every week.

How can one configure a WiFi network to allow some devices (identified by their MAC address maybe) to connect to a WPA2 password protected network without a password? We have already suggested partitioning the network into a main customer facing network and a hidden network for the IoT devices and are getting push backs on that solution.

Improve this question
2
  • It is actually pretty foolish to have such devices on the production network. IoT things should be isolated on a separate network. There are still far too many vulnerabilities with IoT devices, and they are routinely compromised and used for things like botnets. By the way, there is no such thing as a hidden Wi-Fi network, and MAC address restrictions are a joke because it is beyond easy to sniff, discover a permitted MAC address, and clone that address.
    – Ron Maupin ♦
    May 11, 2018 at 18:19
  • I second Ron and Ron's comments - things like these do not belong on an internal network. However, you may want to nudge our customer towards a more contemporary WLAN authentication setup. The given customer seems to run a WLAN setup that can accomodate "100+" devices, so I it seems plausible that there's more than just 2 or 3 accesspoints in use, which in turn leads to the assumption that some form of WLAN controller is available too, and that opens a path to mutliple SSIDs and different authentication methods per SSID... Is there more you can tell us about the given setup?
    – Marc 'netztier' Luethi
    May 14, 2018 at 20:22

1 Answer 1

Reset to default
3

In short, you can't.

One option is to create a separate WLAN (with a separate SSID) that has a static password. You should also apply strong filtering on that WLAN, so that the devices can reach only the necessary destinations.

As @ronmaupin points out, IoT devices tend to have all sorts of vulnerabilities. So putting them on a general production WLAN is a bad idea.

Improve this answer
1
  • fair enough! The issue is that most of our customers don't have the technical resources or are just not willing to setup and maintain a separate isolated network so we have to work with what we get :/
    – ananio
    May 11, 2018 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.