Wireless access point with multiple security modes

1. A gateway apparatus, comprising:

a hardware platform comprising a processor and a memory;

a wireless network interface; and

instructions encoded within the memory to instruct the processor to:

provide a first virtual access point (VAP) secured by an IEEE 802.1x extensible authentication protocol (EAP) enterprise security method;

provide a second VAP, separate from the first VAP, and secured by a WiFi protected access pre-shared key (WPA-PSK) method;

onboard a first device, comprising determining that the first device supports the EAP method, and requiring the first device to enroll to the first VAP with the EAP method;

onboard a second device, comprising determining that the second device does not support the EAP method, and requiring the second device to enroll to the second VAP with the WPA-PSK method; and

provide separate subnetworks for the first VAP and second VAP.

2. The gateway apparatus of claim 1 , wherein onboarding the device comprises fingerprinting the device to determine its expected capability.

3. The gateway apparatus of claim 2 , wherein fingerprinting the device comprises querying a device identification service.

4. The gateway apparatus of claim 3 , wherein the device identification service is a cloud service.

5. The gateway apparatus of claim 1 , wherein the EAP method provides EAP transport layer security (EAP-TLS) if the device supports EAP-TLS, or EAP Password (EAP-PWD) to the device if the device supports EAP-PWD and not EAP-TLS.

6. The gateway apparatus of claim 1 , wherein the instructions are further to provide separate sub-networks for the first VAP and second VAP.

7. The gateway apparatus of claim 1 , wherein onboarding the device comprises providing a quick response (QR) code with credentials.

8. The gateway apparatus of claim 1 , wherein the instructions are also to provide wireless connection via a default PSK.

9. The gateway apparatus of claim 8 , wherein the instructions are to assign devices that connect via the default PSK to a constrained network.

10. The gateway apparatus of claim 9 , wherein the constrained network is limited to device onboarding.

11. One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to:

provide gateway service for a WiFi network;

provide at least a first subnetwork and second subnetwork on the WiFi network, wherein the first subnetwork and second subnetwork are separate from one another, and wherein the first subnetwork is accessible via a first virtual access point (VAP), and the second subnetwork is accessible via a second VAP;

secure the first VAP with an extensible authentication protocol (EAP) security method;

secure the second VAP with a WiFi protected access pre-shared key (WPA-PSK) method;

detect a connection attempt from a new device;

onboard the new device, comprising determining whether the device supports the EAP security method, and requiring the device to enroll with the first VAP via the EAP method if the device supports the EAP security method; and

if the device does not support the EAP security method, enrolling the device to the second VAP with the WPA-PSK method.

12. The one or more tangible, non-transitory computer-readable media of claim 11 , wherein onboarding the device comprises providing a credential profile.

13. The one or more tangible, non-transitory computer-readable media of claim 12 , wherein the credential profile includes an enrollment uniform resource locator (URL), an identity, and a secret for EAP-TLS onboarding.

14. The one or more tangible, non-transitory computer-readable media of claim 12 , wherein the credential profile includes an identity and a secret for EAP-PWD onboarding.

15. The one or more tangible, non-transitory computer-readable media of claim 12 , wherein the credential profile includes a device-specific credential for PSK onboarding, wherein the device-specific credential is associated with a media access control (MAC) address of the device.

16. The one or more tangible, non-transitory computer-readable media of claim 11 , wherein the instructions are further to provide a remote authentication dial-in user service (RADIUS) server.

17. The one or more tangible, non-transitory computer-readable media of claim 11 , wherein the instructions are further to provide a device presence protocol (DPP) server.

18. The one or more tangible, non-transitory computer-readable media of claim 11 , wherein the instructions are further to provide device-specific network use or security policies.

19. A computer-implemented method of providing a wireless gateway, comprising:

dividing a wireless network into at least a first subnetwork and second subnetwork, wherein the first subnetwork and the second subnetwork are divided from one another;

providing a first virtual access point (VAP) into the first subnetwork, and a second VAP into the second subnetwork;

securing the first VAP with an extensible authentication protocol (EAP) security method;

securing the second VAP with a second security method;

detecting a connection attempt from a new device;

onboarding the new device, comprising determining whether the device supports the EAP security method, and enrolling the device to the first VAP with the EAP security method if the device supports the EAP security method; and

if the device does not support the EAP security method, enrolling the device to the second VAP with the second security method.

20. The method of claim 19 , wherein onboarding the device comprises fingerprinting the device to determine its expected capability.