A friend of mine is the owner of a medium sized gym. He wants to provide WiFi to his customers and asked me to come up with a concept and eventually also deploy it. As a computer scientist I have a thorough understanding of information security but no experience in actually deploying a system that is used by many users. Because WiFi is not mission critical to his business that is okay for both of us.
Rationale for WPA2 Enterprise
Our main concern here is Availability: We want to make sure that the WiFi is available to the customers. With a simple captive portal we could not prevent random users from hogging the network bandwidth using MAC spoofing and disconnecting legitimate users in the process. We will make use of IEEE 802.11w to prevent users from being disconnected by some script kiddy using kali.
I realize that most businesses like coffeeshops or even big hotels deploy a simple captive portal which is inherently insecure. I guess that is because they have to be compatible with old devices and operating systems. Since our customers will use their somewhat recent smartphone we can safely drop this requirement. How easy is it on current smartphones to connect to a WPA2 network? Is there some kind of auto configuration on android(I know it's super easy on iPhone)? Should I support PEAP, EAP-TTLS or both?
Are there other caveats when deploying WPA2 Enterprise instead of a captive portal in this environment that I have to be aware of?