Wi-Fi in the office with access logs and user authorization in AD?

Question

WiFi

Good time.
Big bosses demand to cover the office with a Wi-Fi network, to access the Internet from their personal phones / tablets / laptops. Of course, they themselves say that you need to buy a zuxel kinetic, put it at the secretary, let there be happiness.
Of course, I don’t like this option - I want to organize access so that every sneeze is reflected in the logs, plus I don’t want to maintain a separate user database when there is AD. So far, we are talking about one access point, without roaming (but again, I want to make a decision with a margin for the implementation of this very roaming in the future).
From the equipment there are a couple of Mikrotiks, from the software a squid with configured ntml authorization, and a domain on win2012r2. How to connect all this into a whole working system? What to raise, what to buy?

Answer 1

Considering that half of the work has been done, half of the software and hardware is there, you can look in the direction of authorization with a radius of users from the domain at the points themselves. To do this:
1. We raise the Network Policy Server role on any virtual machine from the domain, add the necessary policies to it, and radius clients (add dots by IPs). These settings are googled or calculated
2. At the points of Mikrotik - raise the WPA2-E authorization by login password.
3. On them, you make a redirect for HTTP traffic to squid - thereby switching everything to a transparent proxy mode
4. On the squid, configure statistics collection.
Everything will work safer and more flexible than the Kerio option, and cleaner in terms of licenses. But with the setting you have to tinker.

Answer 2

Ready solution - Kerio Control. He takes accounts from AD, keeps logs, and manages policies. Nice combine.
Village roaming - configure the same SSID at the points. Non-rustic usually means buying a proprietary solution (points and controller) from one of the vendors.
In total, you allocate a server with two network cards, one - "to the world", the second - to the point, put Kerio on it, and turn off everything (DNS, DHCP, NAT) on the point - just leave the WiFi-Ethernet bridge.

Answer 3

Isn't it easier to raise a guest wifi without access to a corporate network and put restrictions on the bandwidth of this grid