One of the factory's IT managers recently encountered an interesting case. I told them that they had over 200 APs in their area, and that as a result, no certification was needed for staff members to access the Internet, no visitors to the building unit next door, and even for people to connect to the Intranet. He asked me if I wanted to go on to a network access certification system. I asked him what your current network structure was. He said it was dialed with PPOE. I said you had a certification in your scheme itself. The problem is not whether to go to the system but that the protocol was wrong.
These problems are common in actual projects. Many companies have gone astray from the first step when planning access to networks.——Focusing on choosing which manufacturer to produce, how many bandwidths and how many APs to put in, has not given any serious thought to the fact that the certification agreement itself does not match the business scene. Once the deal is wrong, whatever the strategy or system is going on back there is a pithead.
Network access certification systemThe three most common protocols in the field are PPPoE, 802.1X and Portal. They represent three different access ideas, applicable to a completely different scenario. Right, half of the implementation is saved; wrong, fire is extinguished every day.
PPoE: Operators play the rest, business is careful
The PPOPE agreement has been used for several decades by broadband operators, with technological maturity and stability issues. It is a point-to-point dial-up that requires dial-up software to be configured on each terminal or a login code to be written in the router.
In the business scene, PPOE's hard wounds are obvious.——Not all equipment supports PPOE dialling, especially mobile terminals and physical networking devices. You either have to separate each device from the other or open a bridge on AP so that it is bypassed and made for nothing.
There is also a real problem: PPOE dials the terminal resources and some of the engineering software has compatibility problems in the PPPoE environment. I have seen one case where the MES system at the factory plant was doing data collection because PPOE was re-routed, which resulted directly in the loss of a batch of data, and then half a day after it was checked that the authentication protocol was acting strangely.
The PPoE is suitable for the following scenarios: a light cat or gateway device on the operator ' s access side, with the operator performing dialling and authentication; and very few cases of PPPoE in the intra-enterprise access layer unless all your terminal equipment is standardizedly managed PC and you have the ability to deploy a client on each device.
802.1X: Fit for mute terminals and high safety scenes, but with a high deployment threshold
802.1X is a port-based network access control protocol, which is based on authentication at the port level of the switchboard or AP——The device is only certified and the port is open and the network is accessible. It does not need to install client software on each terminal, but requires 802.1X functionality on a switch or wireless controller with RADIUS server.
The greatest benefit of 802.1X is that it's transparent about the end. After the employee has been connected to WiFi, the system automatically ejects the authentication interface without any manual configuration of parameters. Once authentication is adopted, the device is permanently online until active delineation or certification expires. This experience is much better than PPOE.
First, you need to have equipment that supports 802.1X, not all switches and APs. Second, 802.1X needs to connect with the RADIUS server, which itself maintains a user database, and interfaces with an enterprise ' s AD domain or OA system, which is carried out in a process that has no low cycle or transportation costs.
There is another point that can be easily ignored: 802.1X requires equipment types. Not all equipment supports 802.1X certifications, such as old printers, industrial sensors, some home-grown mobile phones, and may not have done the same thing.
802.1X is suitable for two scenarios: a high-security office environment, such as financial institutions and government agencies, which requires strict control of each network equipment; and a medium-sized and large enterprise with relatively uniform end-types, dominated by notebooks and desktop machines. If you have many types of terminal equipment and are highly mobile, you must measure them.
Portal Certification: Most flexible, but balanced in experience and safety
Portal authentication, also called Web certification, is the most flexible of all three options. After a user has access to WiFi, the browser automatically ejects the authentication page and enters an account code or a sweep to access the Internet. This process is the most intuitive for users, without software, without parameters, mobile phones and computers.
Portal authentication is flexible in that it can do very sophisticated strategic controls. The system of certification based on Portal can determine who the user is, what time accesss to the Internet, which AP or floor accesses, what website is on it and then decide which one of these pages is to be pushed, how much bandwidth is given, and how long it is allowed. This fine control is difficult for PPPoE and 802.1X.
But Portal is not perfect either. It's less secure than 802.1X, because it's certified on the HTTP floor and there is a theoretical risk of being attacked by an intermediary. In most business office settings, however, this risk is manageable. Moreover, Portal certification relies on browsers, some equipment that does not support opening them.——Like printer print, sweep gun network.——The project is not going to be able to use Portal authentication.
Portal certification also has a painful effect: page experience. There is a wide gap in the Portal page customization capabilities of individual manufacturers. Some systems can only push fixed templates, ugly pages, unable to adapt themselves to mobile phones, slow jumps and staff members use their own odious channels. A good Portal experience should be able to do this: cellular and computer adaptation to the page, support for the login of micro-mail or text message keys, automatic spin over enterprise intranets after authentication is successful, with the entire process completed within three seconds.
How does the NatShell platform address compatibility issues?
NATSHEL_BRAND's cable-wireding and unified authentication platform supports the PPPoE, 802.1X and Portal simultaneously, which is critical for practical projects. The current situation in many enterprises is that production workshops are connected to a PPPOE dumb terminal, office areas 802.1X, mobile offices and visitors to Portal——Three scenarios exist simultaneously, and the agreed needs for each scenario differ.
If a system supports only one agreement, it can be perfected and all the scenes are forced into the same agreement. But the reality is that there are many types of end-uses in an enterprise, different business needs, one set that really works.Network access certification system, must be able to accommodate multiple protocols at the same time and manage user strategies centrally at backstage.
NATSHEL_BRAND’s platform also supports, at the protocol level, aC and switchboard equipment for multiple manufacturers, including mainstream producers such as H3C, China, China, Sharp, Cube, Cisco, Juniper. This means that if an enterprise has a branded wireless controller, it does not need to replace existing equipment, then it can match directly on the NatSHELL_BAND platform. For enterprises that have already invested a large amount of equipment, the cost of replacing this capacity is real.
The core judgement logic of the selection protocol
If I may also sum up a simple and gross judgement: ask myself three questions first.
First, your endpoint is mainly human or equipment. If it's a terminal for people like cell phones, notebooks, tablets, priority is given to Portal or 802.1X, and experience is good. If it's an industrial sensor, camera, sweep gun, and so on, preference is given to the white list of PPOE or MAC addresses.
Second, how much is your need for security control? In financial, government, and medical industries with high data security requirements, preference is given to 802.1X, which will be accompanied by access to the cable ports, and tightens the safe border.
Third question, how much time do you have to budget for integration? If an enterprise has already deployed a domain and the IT team is capable of RADIUS and 802.1X connections, it can choose 802.1X. Portal is the best option if you want to get on fast and not to switch.
In other words, the agreement is not as advanced as possible but rather as compatible as possible.Network access certification systemThe right choice is made, and the implementation of the latter is half-conservative; it's wrong.
Sometimes the simplest Portal is the best solution, sometimes companies pay a lot of money for 802.1X. Finally, they find that engineers don't work at all, equipment doesn't work, and they go to IT every day."What if it happens?", which is much more cost-effective than filling the pit after selection.