The acceptance test for wireless authentication systems is usually done well. Test accounts work, Portal pages are shot, the certification log checks, and the receipt reports sign-off, but many problems come out after the system has actually run.
NATSHEL_BRAND has summarized these issues in various scenarios, some at the technology configuration level and others at the transport management level. Here are a few of the most frequent occurrences that can be stepped down in advance.
I. Users say they can't access the Internet, but there are people on the online user list.
This is the type of problem that has the highest frequency after being online. It is clear: users play Portal pages repeatedly or alert password errors, but the account number is in normal condition and the person's record can be seen on the list of online users of the authentication system.
The problem is not always in the certification system, but rather in theAC and authentication system connection configurationUp. The entire authentication process is: the user sends a request for certification → Portal server received request → Radius certified. → AC received access-Access. → AC's down-the-link policy is released online. The user will feel it if anything goes wrong on this route."I can't get on the net.", but the certification log is clean.
There are several common reasons.
First: AC side timeout is too short.At the time of centralization, Radius was not responding fast enough and AC was waiting to pass through. The Portal authentication server at NATSHEL_BRAND supports more than 4,000 certifications per second, but if the overtime parameters on the AC side are not aligned, the authentication capacity is no longer strong.
Second: VLAN distribution is inconsistent.User certification was passed, but VLAN labels sent by AC were not matched to the intended strategy group and users were placed in the wrong network and virtually out of reach.
Third: Delay in strategy.AC received a certification response and the strategy was delayed, and the user has received it."Authentication successful"The question is not easy to detect when the acceptance test is conducted, because the combined volume in the testing environment is much lower than it actually gets online.
The search for such questions depends on the entire chain and not only on the certification log. NatShell has a complete authentication process tracking log backstage, which shows the response time and return code for each link, and the operator follows the log paragraph by segment and quickly finds root causes.
II. Multi-plant equipment docking, and there's a problem that doesn't know who it is
The AP is the manufacturer, the AC is the one, and the switcher is the same. The certification system also connects to third parties Radius and SMS. This multi-manufacturers interface is the most heavily drawn site in the network project.
The Portal certification system of NatShell and the Radius authentication server support aACs and switches for more than a dozen mainstream manufacturers, including H3C, Hing, Rough, RUCKUS, ARUBA etc. While the docking capacity is available, problems arise in actual projects with compatibility of different firmware versions and with the interface details of different configuration parameters.
The most effective prevention approach is:Complete docking tests are performed before project acceptance and do not wait for problems to arise from the line.The NatShell project team will be able to inter-link the manufacturer's equipment individually during the receiving and inspection phase, verifying that Radius reporting format, Portal jump logic, VLAN's strategy is normal. If there are problems, it reveals a clear boundary of responsibility between AB and AB. When you wait to get up line, then coordinate the engineers of various manufacturers, with much higher costs for skin extraction.
iii. The bandwidth is filled by a few users, most of whom follow the card
The bandwidth is not enough, usually not because the total export bandwidth is too small, but ratherThe traffic distribution strategy didn't work or was too rough.The common case is that the master bandwidth ceiling is only set and not distributed by user, end, application, fine.
NATHELL_BRAND’s flow control program addresses this problem. The NE-series current gateway identifies more than 3600 network applications, provides full speed limits on high-flow applications and uses priority channels for critical operations. For example, limit P2P downloads to a maximum bandwidth of 50 Mbps, ensuring that the OA system and videoconferencing are always sufficiently bandwidth.
A precondition is that the traffic recognition and bandwidth control strategy be configured before it is online. After it is up-line, the configuration will require a re-understand of the traffic model by the carrier, with parameters not necessarily accurate, and testing and validation time. It is best to design the flow control strategy at the programme design stage.
IV. Private routers and multi-equipment accounts shared, with no perceived billing system
This scene is common in dormitories, apartments, shared office space. A room has a certified account, access to which users connect their routers and three or four devices that are all connected through the NAT of the routers, and only one account is recorded in the billing system, with four or five units actually shared.
The harm of such problems is more than a miscalculation.——The private router changes the terminal MAC address and IP distribution logic, network system perceptions of network caps are disabled, security audit log records only of the routers themselves, and no endpoint under the router is visible.
NatShell has the ability to detect this scenario. By analysing terminal access patterns, DHCP distribution behaviour, flow characteristics, the system can identify and warn or limit a suspected private router. This function needs to be configured properly to be effective, many projects are not specifically tested at the receiving and inspection stage, have been inspected regularly after being connected and have been drilled by users.
Better to do so would be to match bandwidth and equipment numbers strategies: each account number with a maximum N device online, exceeding the denial of access; or to maintain continuous monitoring of high-flow terminals, where unusual behaviour is detected automatically down or banned.
V. Portal page is open slowly, and users think authentication failed
The loading speed of Portal authentication pages directly affects users’ perception of the entire authentication process."Could not close temporary folder: %s"Instead of actually failing to authenticate, the page loads were too slow and the user was impatient and simply abandoned.
Several factors influence the speed of loading Portal pages.
First: Portal server performance is inadequate.In a high-scaling certification scene, Portal servers handle large number of user page requests simultaneously, and if the server CPU and memory are not configured enough, the response will slow. The netshell_brand Portal server supports cluster deployment, which can be addressed horizontally with high distribution, pressure testing at the receiving and inspection stage, simulation of peak time user numbers, and see if the server is able to hold up.
Second: page resources are too large.A lot of hotels and malls have been making a really cool Portal page, high-level maps, flash animations, video background.——The best Portal page that users experience is lightweight, with clear core information and load time in three seconds. The Portal service of NATSHEL_BRAND suggests that A-page resources be controlled by not using a show-of-the-art design to influence the underlying experiences.
Third: Reference to external resources.Some Portal pages cite external CDN resources (e.g. fonts, icon libraries), which can be affected if access to the CDN is unstable. The most secure approach is localizing external resources, all of which are placed on local servers and not dependent on their connectivity to the outside network.
The logs have a few days of life-cycle failure, and the superior inspection came to discover that.
The Internet Security Technical Measures Regulations require that an Internet log be kept for at least six months.
However, in actual projects, the log retention cycle of systems configurations is often biased. Some database space is not estimated enough and the log automatic clean-up cycle is set short; others have problems with log server deployment structures and some web section logs are not fully captured; others have been pushed off the log feed interface for months without anyone knowing that data has not actually reached the Web platform.
This is a matter that requires periodic log integrity checks. The NATSHEL_BRAND service package contains regular inspection items, which check the correctness of the log retention cycle configuration, normal log-publishing and sufficient storage space. Regular inspections are not possible, and this is the last line of defense for compliance.
After all, most of the problems with wireless certification systems are not quality problems in the system itself, but rather a failure to detect marginal scenes during the receiving and inspection phase, lack of regular inspections at the stage of the transport, and failure to refine the flow control and equipment number strategy at the programme stage. More pressure tests are performed before the line is online, and once a month after the line is connected, many problems can be detected and solved during the budding period.