![](bg3.png)
In early 2016, UII started the digital
transformation project to improve digital readiness of
the university. One of the key projects is to improve
network infrastructures with the focus of providing
better internet connectivity through WiFi. It was then
decided that UII would deploy 802.1x authentication
method to authenticate WiFi enabled devices within
campus.
UII has roughly 25,000 students and 5,000
employees and contractors. UII has tens of buildings
at 5 different campus location. In total, UII occupies
for more than 35 hectares area and today has 720
active wireless access points providing full coverage
of indoor WiFi in all academic and residential
buildings.
UII wireless networks currently supports 802.11a,
802.11g, 802.11n, and 802.11ac exclusively. UII
dropped its support to 802.11b in 2017 as it reduced
the quality of WiFi services within campus. The SSID
broadcasted within campus are UIIConnect,
UIIGuest, and eduroam. Out of three, UIIConnect and
eduroam both use 802.1x authentication mode, and
UIIGuest uses captive portal as the authentication
mode.
The purpose of 802.1x wireless authentication is
to accept or reject users who want full access to a
network using 802.1x protocol (Stanley et. al. 2005).
The difference between 802.1x authentication and
captive portal authentication is that, in captive portal,
user will associate first with the network (receiving
resources such as IP addresses) and then authenticate
the connectivity with captive portal landing page.
Unless user is authenticated, user can’t really browse
the internet. Unlike captive portal, 802.1x
authentication method prevents user from associating
with the network unless they were authenticated first.
From security point of view, 802.1x provides
more secure access to the network. Users will not
receive IP address and network connectivity before
getting authenticated. In users’ point of view, the
difference is that, in 802.1x authentication users only
need to insert username once, and the rest is handled
by the device itself, but in captive portal, the process
of authentication is necessary every time users want
to access the internet resources.
All access points are Cisco Aironet which are
controlled by Cisco Wireless Controller (Cisco WLC
5520 series). Each access point serves a distance from
25 to 40 meters and allow high density users from 60-
150 users at a time for each access point. The backend
of the authentication is based on freeRADUS and
Active Directory and tied with our next generation
firewall, Palo Alto 5000 series, to identify type of
applications accessed by users within university
network.
Each classroom is equipped with access points
with few exceptions for small tutorial class room
where one access points are utilised by more than one
classroom. Each access point is named according to
the physical location e.g. building name, floor, and
code number. UII also make note of each access
point’s coordinate for future cross referencing. This
information will enable us to map all access points
and overlay it on top of building diagrams.
Unlike pre-2016 approach where individual
departments are able to offer their own network, all
networks in UII after mid-2016 are all controlled
centrally from university. This strategy is used to
ensure the delivery of exactly the same internet
quality in all area within campus. Before mid-2016,
the internet quality among departments and buildings
were quite differs, some are good, and some others
are not. By centralizing the connectivity, we can
provide bandwidth for each user for up to 150Mbps.
After the implementation of 802.1x authentication
method, the culture of the people changes. They
appreciate the easiness and the security provided by
the WiFi network. No actions required, and they
automatically connected to the network. The
appreciation in return is that more people are
working, studying, and doing many other activities
within campus. The convenience of “set and forget
concept” and also fast internet speed attracts those
users. Users are always connected to WiFi networks
within campus unless they intentionally preferred not
to connect to the network. In return, the number of
users increased tenfold to more than 12,000 users
during its peak time (mid of semester) in 2019
compared to end of 2015 where we only saw 1000
users during the day at peak time.
2.2 Impact of 802.1x WiFi
Authentication Deployment
With the 802.1x deployment, where it always
connected to a highspeed internet access , many users
use internet for more than 5 hours a day which
indicate that these users stayed in campus most of the
time during the day. UII started to see people flocking
into certain areas. Some areas are fuller than others
due to close proximity to e.g. cafes, amenities, health
care, or student centre. More non-laptops users are
connected to the network.
The association of this users with the WiFi
networks provides a lot of opportunity on how exactly
users are behaving in the university. For example, UII
starts to collect data from users movements, as now
How 802.1x Enhances Knowledge Extraction from Large Scale Campus WiFi Deployment
393