Project Initiation Document template: Moving to a single service SSID: eduroam

Download as PDFDownload as PDF
Project Initiation Document

Project Code                                   : ‘JRS-single-primary-SSID-xx’

Project Title                                    : Single Primary eduroam SSID

Author                                            : xxxx

Date                                      : xx/xx/xxxx

Authorised By                                 : xxxx

Date                                      : xx/xx/xxxx



At the time when Wi-Fi services were first widely deployed in UK research and academic organisations there was a wide variety in the capabilities of the different wireless hardware components and software supplicants. In addition to this, organisations tended to segregate wireless services for specific user groups and purposes. As a result of this, organisations generally created a number of separate wireless service networks, each with its own SSID (service set identifier), and each serving a different need.

SSID naming conventions vary but the examples shown below are typical of those found at organisations:

  • ‘brandname’ – usually the flagship service SSID offering WPA and/or WPA2 Enterprise wireless
  • ‘eduroam’ – introduced to allow visitors (and usually the host organisation’s own users) to connect to the eduroam service
  • ‘web-captive’ – usually introduced to provide basic network connectivity to devices which were not able to connect WPA/WPA2 enterprise networks
  • ‘special-pda’ (hidden) – created, for example, for Windows Mobile 5 clients which could not connect to a mixed (WPA/WPA2) mode network
  • ‘commercialbrand’ – created for visitors (typically also using a captive portal system) going to commercial broadband

As well as these a number of other SSIDs can typically be found around campus, belonging to:

  • commercial hot-zone providers (e.g. The Cloud, BT Openzone)
  • sporting bodies based on the campus
  • spin-off start-up companies
  • personal access points of students in halls of residence
  • home access points in properties neighbouring the campus (e.g. ‘linksys’, ‘belkin54g’)
  • rogue access points connected to the campus network.

This bewildering array of SSIDs introduces confusion: users are not sure which network they should be using and may end up using an inappropriate one. Given this confusing situation, and considering that wireless technology has now advanced to the point that there is no technical need for multiple SSIDs, it is proposed that the complexity of wireless services be reduced by consolidating the SSIDs in use, ideally to one.

Whilst it may seem that ‘brandname’ is the obvious choice for this primary SSID, given that this carries the organisation’s branding, it is actually more desirable to move to using the ‘eduroam’ SSID. The reasons for this are:

  • eduroam sites are obliged to broadcast the eduroam SSID for visitors whether or not any other SSID is broadcast.
  • Users need to be able to test their eduroam configuration to ensure that, when they leave the site and roam to other organisations, it works; therefore, ideally the eduroam SSID needs to be broadcast across the network.
  • Faced with an assortment of SSIDs many users may be unsure what eduroam can provide for them; by making it the standard SSID, its profile will be raised, leading to the recognition amongst users that they will be able to achieve network connectivity wherever they see it broadcast.
  • Having eduroam as the default means that users’ devices will be configured and ready to roam and do not need to set up an extra SSID for when they visit another eduroam organisation. This simplifies configuration for users.
  • eduroam is a global brand easily recognisable by both visitors and home users.



  • Move to a single SSID of ‘eduroam’.
  • Ensure students keep the same security, access levels and capabilities as if they were on the residential network.
  • Ensure staff keep the same security, access levels and capabilities as if they were on the staff network.
  • Provide settings for any desktop/laptop service.
  • Provide proper notice and documentation of the changes to the service.


  • Less noise/pollution of Wi-Fi RF space (fewer BSSIDs).
  • Easier administration with a single point of entry – all authorization/network decisions are based in backend RADIUS infrastructure.
  • Single point configuration. Users correctly configured for their own organisation (with local policy to enforce @realm checking) will connect at other organisations straight away.
  • Fewer SSIDs in supplicant – less confusion for the user.
  • Fewer BSSIDs – less traffic to ‘wake’ clients and better battery lifetime



The scope of this project is to reduce the number of SSIDs in use by wireless services down to one. As a consequence a number of backend infrastructure changes will need to be made. User documentation and auto deployment (e.g. with su1x or ConnectXpress) will also need to be updated.



  • Staff availability within the IT department.
  • Windows 7 Desktop/Laptop service capabilities (automatic provisioning of eduroam settings).
  • Old wireless devices in use which cannot be configured to use eduroam.
  • VLAN override abilities of wireless equipment in use.



  • Users being unable to access wireless network due to old hardware.
  • Windows 7 Desktop/Laptop service users being unable to access eduroam at other organisations due to mismatches in configuration.
  • Users not being aware of the changes occurring and not reconfiguring their device for the changeover.
  • Organisational resistance to dropping the ‘brandname’ SSID branding.


Project Management

Steering Group

Senior Management Sponsor       :          

Project Manager                           :          


Wireless/Networking Team          :



  • Implementation of VLAN override on eduroam wireless network.
  • Changes to address space/VLANs to handle increased numbers of devices and backend authorization decisions.
  • Windows 7 Desktop/Laptop configuration settings.
  • Removal of ‘special-pda’ SSID.
  • Removal of ‘brandname’ SSID.
  • Removal of ‘web-captive’ SSID.
  • Updated configuration utilities.
  • Updated configuration documentation.


Suggested Schedule

  • TBA



  • Principally staff time. Estimated staff time required: