internet control per click for teachers in a classroom

[Holli69]

Hi ,

we have a customer, a K12 school with full Meraki Stack (MX,MS,MR). Our MDM is Intune. All devices (teacher and students) are Apple  iPads.

The teachers want to control the internet via click on a button or via an APP or via a (captive) portal, so the students are still connected to WiFi Access Points, but without Internet access.

Is this possible, maybe with JAMF or Apple Classroom or any 3rd Party Hardware (Time for Kids, Endoospot...) or an Meraki APP in the marketplace ?

Has anyone the same situation or experience  ?

It's difficult to find a solution in Google !

[LG]

I'm thinking a firewall rule on the AP that the teacher is connected could block everybody's internet access, but, what about the teacher itself or other APs nearby?

You can use chatGPT, Gemini, Copilot, to ask for the code and create something like a webapp to achieve what you want, i faced something similar (another use case) and worked..

The challenge here is to determine who and how you block...

If students have one SSID and teacher another, you could ask for a code to change the availability of the students SSID. The teacher would have a screen to select wich classroom their are (and as such, the AP there) and for how long they want the student SSID disabled.
But this does not achieve the wifi connectivity you want to keep. Any requirements for such connectivity (local, to the classroom it self? airplay?)

Hope that helps with a direction... I don't think there's an app ready for that..

[Pavithran_Che]

You can give create a SSID Manager - one of the admin role, so they can enable and disable the SSID. 

But they will get access on configuration part of SSID as well. 

[cmr]

Assuming that you want local network access for the students all the time and they are on a separate SSID/VLAN/subnet then you would control this with an access control list.  If all student devices are wireless then this could be on the MRs, otherwise it could be on the MX or possibly MSs.  They can be changed using the APIs so that would be the route I would look at.

[Holli69]

students and teachers have same SSID, but different VLANs via a RADIUS Server (EAP-TLS/Certificates).

Teachers should be able to reach the Internet,students sometimes, depends on the teacher who permit or deny the Internet access for the students via a click on a botton. The idea with a SSID per classroom is good, but Meraki offer only 16 SSID's and the school is huge with approx. 60 classrooms.

Maybe a Meraki Engineer can help me, maybe it's possible with SM instead of Intune.

[alemabrahao]

Intune supports Apple Classroom and can configure shared devices, so, you can push network restrictions, but not toggle them live from a teacher’s device.

Apple Shared Device Mode and Guest Temporary Sessions - Cisco Meraki Documentation

[PhilipDAth]

By the MT30 smart button, and then configure an automation to turn the WiFi off and on.

https://meraki.cisco.com/product/sensors/indoor-sensors/mt30/

https://documentation.meraki.com/MT/MT_General_Articles/MT_Automation_Builder

[Holli69]

Hi, sounds good. Do you know, If it's possible with the MT30 to disable only the AP in the classroom,while other AP's are working, so that every teacher can control the AP in his classroom. SSID disable ist nit a good Idea,because of 60 classrooms,but only 16 SSIDs possible. Not possible to get all classrooms with different SSIDs

[PhilipDAth · Accepted solution]

I believe you can turn switch ports off and on.

[cmr]

@Holli69, you can definitely do that.  I have used that feature for years, mainly to disconnect my daughter's computer from the internet when she was a student and up late!

[cmr]

That will disable whatever (the AP in your case) that is connected to the switchport.  you can also send a webhook command to do pretty much anything you like.  You could use this to add or remove a tag from an AP and have the student SSID only active on APs with the tag.