Wireless certification in the smart park is more complicated than hotel and mall. The hotel’s core users are guests, with a relatively homogeneous landscape; the main demand for the mall is visitor access and marketing. There are also office buildings, dormitories, canteens, conference rooms, outdoor public areas in the park where the use of each scene varies completely from one site to another, using habits and bandwidth requirements.
NATHHEL_BRAND, in the Wireless Park Wireless Certification Program, addressed this issue by:By region and user layer, then technically put different strategies into practiceAnd then we'll take it down and say,
One, what APs are chosen from different regions to determine whether the back certification strategy will run.
Many parks do wireless certification programs to see how the authentication function fits, but in fact the APP selection and deployment position has a greater impact on the final experience. The AP is wrong, and it takes more time to adjust the strategy and users' experiences are not much better.
Office site, with a large number of users and a high individual AP coverage, the interference is relatively manageable. The indoor top-up AP is a standard configuration, POPE powered, and network is connected.
Hostel scenesThe most difficult. The room is unified, walls are dense, wireless signals are seriously decomposing. If the signal from the next room is plugged in with a top AP, the user has a bad experience. Standard practice is to use a panel into a wall AP.——The 86 panel directly replaces the dark box in the room, with each room covered independently, full of signals and without damage to the wall. This deployment method, which NATSHEL_BRAND has tested in many campus accommodation projects, is currently the most stable option.
Cafeteria, gymnasium, conference roomThis high-intensity scenario, with a very high user density and the number of access devices, has been accompanied by a high frequency of traditional deployments. NatShell is responding with a high-level WIFI6 coverage programme, where single AP throughput under 802.11ax agreements is more than double that of WIFI5, which is supported by 5G bands and 2.4G, making full use of 5G spectrum resources, and deploying up to 13 non-disturbing channels in the same space.
Outdoor public areasThe outdoor APs are used to support waterproofing, flood-proofing, dust-proofing, sun-proofing and still work in extreme weather.
II. SSID and VLAN 1.
The NATSHEL_BRAND campus programme, SSIID planning is one of the core components. Each SSID corresponds to different user groups, different SIDAs walk different VLANs and send different access controls and Qos strategies on AC controllers.
The common SSID plan is as follows:
SSID1——Park staff, take the AD domain authentication or Portal account password and access the intranet system and extranet with the highest level of authority.
SSID2——Visitors to the park, take SMS or temporary visitor codes and access the extranet and do not have access to the intranet system.
SSID3——Hostel households• Independent account certification, access to the billing system, monthly or long-term fees, access rights and extranets.
Each SSID is separated from each other on three levels. The employee SSID VLAN has access to the intranet server, visitors SSID VLAN are only used for NAT and the dormitory SSID VLAN is using separate billing channels.
III. Secrecy roaming to solve staff mobility
The campus office buildings often move between meeting rooms, offices and teahouses.
NATSHEL_BRAND 's L2/L3 quick roaming solves the problem. Users go from AP1 to AP2 coverage, and the authentication status follows, without re-entry. The quick drifting realization is that AC controller coordinates multiple AP switchings at backstage, user terminals remain valid during the switchover, and no access side of the gateway can sense how this cruise will take place.
This capability is particularly important for parks with cross-story needs: NATSHEL_BRAND supports the L3 cruise, and the authentication status can be maintained without affecting business continuity when users move between different VLANs.
IV. SPECIAL ISSUES OF THE HOUSE PLACE SHOWING: HOW TO TAKE A OVER-APPLE IN A UNION OF EQUIPMENT
The campus dormitory has a typical problem: four people in one dormitory, each with two or three devices (cell phones, flatboards, notebooks), and if every device is built separately, there is a huge administrative workload.
The problem has two dimensions:
First, the management dimension.——NATSHEL_BRAND’s bandwidth distribution strategy can be capped by account number, or distributed dynamically by online numbers. For example, an account number of three devices at the same time is online, and excess equipment automatically limits speed or refuses access.
Second, the technical dimension——MAC Seamless Authentication is useful here. The account number and terminal MAC address are first tied, then access is automatically released without the need to write a password every time. The quantity of binding can be capped (e.g. up to five devices attached to an account), beyond which equipment requires approval by the administrator. This ensures ease of use and controls the misuse space for common accounts.
V. Traffic control of high-security scenes: video applications cannot be allowed to eat all bandwidth
The most feared thing about a high-bandwidth area such as canteens and conference rooms is that some users are filling up bandwidth, leaving other users without access to the net.
The NatShell traffic control strategy can be carefully distributed by type of application. The system recognizes more than 3600 web applications, with full speed for video-type applications (P2P downloads, network television), game-type applications and priority access to office applications (OA systems, videoconferences). Key business bandwidth is guaranteed, and non-critical operations cannot be crowded.
Meanwhile, the traffic control strategy can be adjusted over time. Hostel scenes have fewer online numbers during daytime, peak flow concentrations at night, and canteen lunches are concentrated and almost no one is using them for lunch break.
VI. Log retention and auditing: not only hotels need it
Many people think that Log Audit is a hotel and cyber cafe, which the inner network of the park does not need. In fact, security compliance in the park is often stricter than in hotels.——There may be government agencies, financial institutions and large enterprises in the park where the superior authorities have clear requirements for web logs.
NATSHEL_BRAND log server can record all users ' access to the Internet in their entirety: terminal MAC, IP address, time off from network, URL access, type of application, data flow. Log retention cycle is configured by default for no less than 180 days and adjusted to a six-month or longer period as required by the Alpha requirement. Logs can be retained locally and are supported for delivery to third party audit platforms.
For enterprise parks with built-in safety requirements, Log Audit has an additional value: the anomaly is traced. The Internet server was attacked one night, and all then-accessing terminals MACs and access records are recorded in logs, so that the security team can quickly locate which account number and which device initiated the request.
After all, the smart park wireless certification is based on AP selections, SSIID hierarchy is framework, flow control is guarantee, NATSHEL_LOG_AUDIT is bottom line. The four links are different and the whole system works steadily. NATSHEL_BRAND has product capacity for each of these stages, which were confirmed by the sample at a time when it was validated.