Migrating a Corporate SSID from WPA2-PSK to 802.1X with Medical Devices
A healthcare provider is migrating 800 employees from a shared WPA2-PSK to 802.1X EAP-TLS across 120 APs at two hospitals. The RADIUS servers are in a central data center, and the WAN latency to the hospitals is about 80 ms. Employees use managed laptops and a smaller number of unmanaged tablets. Clinical devices such as infusion pumps and badge readers only support WPA2-PSK and cannot run an 802.1X supplicant. Vendors currently use the same shared PSK as employees, and the security team wants that stopped. Guest access is required in waiting areas, with sponsor approval and no access to clinical VLANs. The organization uses Mist WLAN templates and wants to avoid disrupting clinical devices during the change.
1. Design the SSIDs, VLANs, and policy separation. Which devices go on which SSID and why?
Read the worked answer
Create separate SSIDs and VLANs: employee 802.1X EAP-TLS on a corporate VLAN, clinical devices on a PSK SSID with a device VLAN and ACL, vendors on a sponsored/dynamic PSK or captive portal, and guest on a captive portal with client isolation. Use Mist WLAN templates at org level for common SSIDs and site overrides for VLAN/RADIUS. Assign roles/policies so the PSK SSID cannot reach clinical servers. For EAP-TLS, issue client certificates from internal PKI and configure RADIUS with certificate validation. Do not put medical devices on the employee SSID; they often lack 802.1X supplicants. Document which SSID maps to which VLAN and policy.
2. Address RADIUS design, 80 ms latency, and CoA/dynamic VLAN. What must be tested before rollout?
Read the worked answer
Use two RADIUS servers in the data center with failover, and consider a local RADIUS at each hospital if 80 ms latency or WAN loss is a concern. 80 ms is workable for authentication but adds time-to-connect; measure it. Enable CoA/dynamic VLAN if you need VLAN changes after authentication. For EAP-TLS, validate the server certificate chain and client certificate EKU; test with a pilot group. If the WAN fails, 802.1X to the data center fails; either deploy local RADIUS or a fallback PSK SSID for critical staff. Do not use CoA unless the RADIUS and AP support it and the VLAN change is tested.
3. How should the shared PSK be retired, and how should vendor and guest access be handled without breaking clinical devices?
Read the worked answer
Retire the shared PSK. For vendors, use a per-vendor PSK or a Mist NAC-sponsored portal so credentials expire. Rotate the medical-device PSK on a schedule and restrict it by VLAN/ACL and MAC allowlist where possible. Guest uses a captive portal with sponsor approval and bandwidth limit. For employee EAP-TLS, distribute certificates via MDM; for unmanaged devices, use a separate onboarding SSID. Monitor failed auth and rogue PSK use via Mist. Test that a revoked vendor PSK stops working and that guest cannot reach clinical VLANs.