The Challenge
An Australian independent school needed to assign students to different network segments based on their grade level. Each grade required its own VLAN and subnet so the firewall could apply age-appropriate content-filtering rules. Manually configuring VLAN assignments was not sustainable as students moved between grades each year.
The school also operated two MDM platforms: one for Windows devices and one for Macs. Any certificate solution would have to integrate with both platforms and deliver the right certificate attributes to trigger the correct VLAN assignment.
The IT team managed devices across an entire campus of students and staff, all connecting through the same wireless infrastructure. Separate VLANs per grade were already in place, but the authentication mechanism tying a device to the right VLAN had to be automated and made identity-aware.
The Solution
SecureW2 implemented a cloud PKI solution that issues certificates with group membership attributes embedded directly in the certificate payload. This architecture enabled Cloud RADIUS to read those attributes at the authentication stage and immediately assign each device to the correct VLAN, based on the student’s grade-level group in the school’s identity provider.
For Windows devices, certificates deploy through SCEP profiles configured in the MDM platform. Mac devices receive certificates through a separate MDM integration. Both paths deliver certificates from the same SecureW2 PKI instance, keeping the certificate authority chain unified across platforms.
The school’s firewall uses VLAN and subnet information to apply differentiated content filtering. A Year 7 device lands on a different VLAN than a Year 12 device, and the firewall rules reflect the appropriate access level for each grade. When a student advances to the next grade, their group membership updates in the identity provider, and the next certificate issued carries the new VLAN assignment.
The Results
- Dynamic VLAN assignment by grade: Certificates carry group attributes that place each device on the correct network segment automatically.
- Two MDM platforms, one PKI: Windows and Mac devices both receive certificates from the same cloud certificate authority.
- Automated content filtering compliance: Per-grade firewall rules apply without manual network configuration when students change grades.