Most of the companies are deployed.Business Wireless Network CertificationThis problem is encountered when both employees and visitors use WiFi, but the two categories of rights should be completely different.——Either the access is too wide and visitors can access something that should not be visited; or the access is too tight and staff experience is poor.
The core of the solution is a multiSSID strategy. Simply put: On the same wireless device, two (or more) different names of WiFi are broadcast, each with different VLANs, different authentication methods and different online strategies.
How exactly did this happen: the AC controller (wire-controlled) managed all of the APs, configured multiple SSIDs on aAC and tied up one VLAN per SSIDD. The Portal server at NATSHEL_BRAND pushed different authentication pages for different SSIDs——The staff member SSID ejects the domain account login and the visitor SSIID ejects the SMS certificate page.
Here is a common field of implementation error: thinking that many SSIDs are multi-coded, and that one password will distinguish between employees and visitors. This is not really isolation, which is no longer isolated when the code leaks, and the password is not tied to an identity, and it cannot trace who is online.
Staff network. The authentication is done using the AD domain account or the OA account, and the employee does not need additional passwords. The intranet resource can be accessed after the certification, bandwidth strategy is either fast or role-leveld. The employee equipment supports the MAC binding, then connects automatically to Seamless Authentication without having to re-install a code.
Visitors ' NetworkThe certificate is certified by text message, a visitor enters the cell phone number acceptance code, and after completing the authentication, only the Internet is accessible, with all of the Intranet resources isolated.——For example, visitor certification is valid for eight hours and the maturity is automatically offline without an account number remaining online after the visitor leaves.
The NTSHELL_BRAND V7 strategy hierarchy was designed for this scene.——After the certification has been completed, each of the two categories follows its own strategy, with speed limits, online time and access scopes configured independently and managed in a single back-office without having to operate two separate systems.
A more detailed design point: Certification successfully jumps. After a visitor completes SMS certification, he can set up automatic jump to the specified page, such as company officials network, day activity notice, and welcome page. This is a function that does not add extra IT workload but can bring brand exposure. If an employee succeeds, he can also jump to work status, for example by jumping to the intranet portal. The authentication page itself supports customization, adding company logo, advertising content, without displaying a single system default page.
There is also a situation that needs to be designed separately: visiting high-security scenes."Assist in scanning the authentication"——When visitors connect WiFi, the visitor is authorized to visit through a two-dimensional code sweep, one-on-one access mode, and the access behaviour is tied to specific interviewees with greater retroactive audit capability. This approach suits companies with high network security requirements, which are not necessarily required for ordinary office settings and selected according to actual needs.
Before deployment, there are a few things to confirm:
The first is whether the AC supports multi-SSID and VLAN divisions. Most mainstream brands on the market support it, but older equipment may have SSID numbers that require early confirmation.
The second is whether VLAN is configured in the switchboard and router level. Many SSIDs correspond to more VLAN, and if the switch is not equipped with the corresponding VLAN, traffic will be mixed and the isolated effect will be zero.
The visitor VLAN is going to go through independent exports or separate NAT rules to ensure that visitors are not allowed access to the Intranet.Business Wireless Network CertificationThe most neglected security blind spot in the world.——The certification is done, but the inner network is not isolated, and visitors can access internal resources by scanning their way online.
With regard to the treatment of dumb terminals in multiple SSID settings, printers, IOT devices, and access-free equipment cannot go through the Portal certification process. It is usually done by creating a separate SSID that is open only to the MAC white list or by installing a MAC white list strategy under staff SSID to exempt them from authentication. If there are fewer items, just log on desk-by-desk addresses at V7; if there are many enterprises with large numbers of equipment, they have to pre-package the list of mute terminal equipment and import it in bulk, otherwise the implementation phase will be confusing.
There is a special case to be said alone: the company’s conference room and lobby are often the same physical space, but there are different strategic needs. There may be internal discussions in the meeting room, visitors should not be connected; the lobby is open reception area, visitors can have access.——The AP in the conference room is only for SSID staff, not for visitors.Business Wireless Network CertificationThe ability to reach the ground, the alignment of the network layer is at least as important as the certification system itself and both directions need to be pursued simultaneously, not one after another.