A campus where 10,000 devices join Wi-Fi 6E securely, and visiting scholars sign in with their home credentials

A university network serves some of the most varied users anywhere: first-year students with a console and two phones, faculty with managed laptops, researchers with instruments that run decades-old operating systems, and visitors who arrive for a conference. The old design relied on one campus-wide password and a wired network that stopped at the walls of each building. It could not identify who or what was connected, it could not give a visiting scholar a quick way online, and it was struggling in lecture halls with hundreds of simultaneous clients.

The design starts with identity. University-managed laptops and phones get a certificate from device management and authenticate with EAP-TLS under IEEE 802.1X, so the user never types a password into a Wi-Fi dialog. Devices that cannot do 802.1X, such as game consoles and streaming boxes, are registered by the student and receive a per-device pre-shared key tied to that person. The university's RADIUS servers also take part in the eduroam federation: a visiting scholar's request is routed by the realm in the outer identity to their home institution over RadSec, which is RADIUS over TLS (RFC 6614), and the home institution's answer decides access. The university's own students and staff roam the same way at other member campuses.

The radio design uses Wi-Fi 6E. Surveying the buildings with real client counts drove the placement of 1,100 access points; the 6 GHz band, with its 1,200 MHz of clean spectrum and mandatory WPA3, carries the dense lecture halls, while 5 GHz and 2.4 GHz remain for older clients. Switching is multi-gigabit and powered by IEEE 802.3bt PoE++, with 25G uplinks and a redundant 100G core. Behind authentication, RADIUS dynamic authorization (RFC 5176) lets the network move a device between VLANs or tighten its access list the moment its status changes, for example an expired certificate or a malware flag raised by endpoint protection.

Deployment went building by building over one academic year, with residence halls last so students were never offered an unfinished network at the start of term. The old SSID stayed on in parallel until each building had been measured, and a migration profile pushed through device management moved managed devices to the new network without a visit to a help desk. Testing included load tests with hundreds of laptops in a lecture hall, an eduroam test account at partner institutions in both directions, a RADIUS server failure during peak sign-in and a 6 GHz client-compatibility matrix, so that nobody learned in September which devices could not use the new band.

The outcome is a campus where the sign-in method follows the device rather than a shared password, visitors from other universities connect with the credentials they already have, and a lecture hall of 600 laptops keeps working. Research labs, administration, residence halls and building systems are separate segments, and a compromised student device can no longer reach administrative systems. Help desk calls about Wi-Fi fell because registration and certificates are automatic, and the university has a clear record of what is connected, which supports its obligations to protect student records.