The number of people who have access to the Internet in schools is divided into two natural groups: one for teaching at the teacher’s and student’s offices, and one for students’ living. The former are connected to the interior systems of teaching, finance, research, and the latter mainly with dorms, which are tactile. If not segregated, the flow of students takes a small part of the office belt, even more so when the network is broken down, it reaches the inner net horizontally. When the school WiFi system is designed, it is necessary to figure out the boundaries of these two types of networks.
SSIID first, VLAN first.
The most basic segregation is wireless. Student networks and office networks should use different SSIDs, with different VLANs behind them. This separates the second floor, where students’ WiFi and teachers’ WiFi are not in the same broadcast area. Some school plans, one SSID across the school, are very isolated by post-certification privileges, which are weak when they are bypassed. We suggest at least two SSIDs on the wireless side, for teaching staff, and for dormitories and public areas.
The network of offices must be able to reach Dane.
The teacher’s office network is supposed to visit the internal system of teaching, finance, etc., so that the office VLAN will be connected with the intranet, but this connection is controlled and authorized by role. Student networks should be located in an Internet-only isolation area, which defaults cannot access any internal system. The function of the billing system here is that students’ accounts, even if certified, are not available for internal connections only in their student VLAN. We have seen schools misassembly the network and office co-location, resulting in students being able to sweep through the financial system and sweat."I don't think we can get a visit."Let's assume.
The visitors' network needs to be one more layer apart.
The visitors’ network is more isolated: SSID alone, VLAN alone, Internet access only, speed limits, and time-limited failures. Visitors’ accounts are issued by front desk or conference organizers, and the billing system students and office systems are completely independent. We suggest that the visitors’ network need no bills, so that temporary passes can be issued to avoid involving outsiders in the school’s accounting system.
The bandwidth is based on a networked pool. Don't squeeze each other.
The student dormitories can fill the exits at night, and if the office network shares a pool of outlets, teachers can check the information at night. We suggest that separate bandwidth pools be allocated to the student network and the office network on the side of the exports, which are secure for the offices, and that students be flexible in sharing them. The billing system provides every type of network with a bandwidth strategy, the rate of work to keep the floor safe, and the ceiling for students to share.
The audit and log will be retained separately.
The legal requirements for the two types of networks are different. Student networks involve the protection and management of minors’ behaviour online, with more stringent log retention requirements; office networks involve teaching staff privacy and a restraint in their retention range.
The separation of the student and office networks is not a technical display, but an essential requirement for security in the campus network.
Isolation is by configuration, not by agreement.
We've seen the school talk."Student networks do not access the Internet"But the actual configuration of VLAN is a common route, but no one goes there. This sort of isolation breaks down when it comes to being in agreement. It must be written into configurations, dropped into equipment, and reviewed periodically. It is recommended that each semester be validated for its effectiveness: an attempt on student networks to access the internal system address to confirm that it does not work. Many security issues are not undesigned, they are not fixed, and the time has been changed for a long time.
Special visits to teaching and scientific research must be kept clean.
The separation cannot be too fatal, or teachers and graduate students can be stopped in dormitories to try to run a laboratory computing and a database of literature. We suggest that a white list channel be opened for student networks, with designated addresses such as academic resources purchased by schools, library databases, etc., which remain inaccessible. This will maintain the core system without delay in conducting research. The white list is maintained jointly by libraries and informationization, and updated with the purchase of resources.