My company wants to add wireless access for customers in waiting areas. However, I do not want our employees taking their laptops to work and abusing company time and resources. Currently, the waiting areas have wired connections with unrestricted internet access. What is the best way to allow customers (who may return regularly) wireless internet access, yet prevent the company from becoming a hotspot for its employees and other non-customers?
Short of somehow reducing the range of the AP’s to the perimeter of the waiting areas, I’ve not yet found a definite solution. The closest thing to what I need that I could gather was using IAS with a MAC filter and session timeouts (user connects >> MAC address is logged >> after X minutes, MAC is disconnected and blocked indefinitely). While the concept works, anyone could simply spoof another random MAC address every X minutes to have infinite access.
Important note: customer access is on its own VLAN and gateway (obviously separating it from the rest of our network).
