A client told me to talk. They were on the hook.Network access certification systemAnd then, with a lot of strategy, it turns out the strategy is not working.——Visitors can access the financial intranet, ordinary employees get online as fast as administrators, and the system runs a time-temporal strategy when nobody uses it on weekends. He suspects that there are bugs in the system, and I've seen it before, and the problem is the logic of the strategy configuration.
The client uses a 4W strategy, which is when Wen (time), Where, Who (user), What (page specified). The 4W strategy is itself a good design, but many people use it as an empty question.——Filling up four dimensions is considered effective. In fact, the core of the 4W strategy is a priority judgement and multi-conditional matching, which is wrongly matched to no match.
NatShellNetwork access certification systemExtended the system to 4W+B.——One more Brownser (browser self-adapted).
Let us say what these five dimensions understand and match to be effective.
Not all four dimensions are filled to calculate the configuration successfully.
The basic logic of the 4W strategy is that, after a terminal launch, the system will match all strategies. The rule for matching is that the request meets all the requirements of a strategy and the strategy becomes effective. If no strategy is fully matched, then the default policy is followed.
The problem is that"Default policy"This part. Many of the executive engineers have fine-tuned the 4W strategy, but forgot to match it with the default policy——The default strategy is configured on the most relaxed set of conditions, which should theoretically be left when all specific strategies are not matched. The result is that visitors are connected because the end type or IP section of a visitor is not covered by any specific strategy and go directly to the default policy, which in turn has no bandwidth limits and access rights limit, which means they have no control.
The correct order of configuration should be: to match the default strategy with a more rigorous defense; to mix it with specific strategies and to open up the mouths of particular groups. To make the default strategy the most liberal, then to put all controls on the specific strategy.——As long as any matching rule is not taken into account, the default strategy will be overtaken and control will lapse.
Whoa dimension: user grouping is more complicated than imagined
Who is the user that's assigned, sounds simple, but it's easy to make mistakes when configured. The common error is to divide the user groups too thick.——Throw all the employees in."Staff"Team, throw all the visitors in."Visitors"group. This divide meets basic needs, but if you need to refine control, the particle size is not enough.
The best way to do this is to divide the user groups according to their business attributes. In manufacturing enterprises, for example, users can be divided into: R & D teams, production workshops groups, administrative logistics groups, foreign-coloured construction units, resident visitors groups, temporary visitor groups. Each group has a bandwidth ceiling, online duration, accessable web segments, and authentication periods that are all configured separately.
NATSHEL_BRAND supports the setting of different access strategies by user group, including top-down bandwidth limits, simultaneous terminal numbers, daily Internet access times, and allowed access periods. These are automatically tied at the moment of adoption of a user certification without manual intervention.
Where dimensions: not geographic location, equipment location
Where is the designated location, but in the wireless network,"Location"This concept is expressed through AP. Specifically, the dimensions of where are configured are AP groups, APIs or acIPs.——Which means the system determines which APA is connected to the terminal."Location"。
The logic behind this design is that, in the same building, the first floor hall and the third floor research area have different security needs, and visitors on the first floor, WiFi and visitors are located in the conference room, WiFi, and control strategies should be different. Through the Where dimension, one user can get different authentication pages and access rights under different APs.
When implemented, attention needs to be paid to AP group planning. If the AAP is not planned for prior deployment, all APs are mixed into a default group, and the Wheel strategy is no longer useful. The correct approach is to identify with the business department before the AAP deployment what the functionality of each region is, then labeling the AP by region, grouping it, and later when you configure the Where strategy.
When dimensions: Time strategy pits on holiday
When you set the time, this dimension looks simple.——The weekday is allowed to be online at a time or several, and it can be used on weekends. But when you're actually set up, there's a hole that many people don't notice: holiday holidays.
The time strategy of many companies is to:"8 - 18:00 Working day"The result is that the system finds these days to be no workday, and the strategy does not match. If there are no hidden limits in the default strategy, the network is completely liberalized and uncontrollable throughout the holiday period.
The solution is two: to configure holidays in isolation, by manually updating them before they take place; and to support the system’s alignment of official holiday calendars with automatic exclusion of holiday periods included in the workday logic. NatShell ’s strategy system supports custom time templates that can be pre-defined for working days, rest days, and holidays, which are directly referenced in strategies and much more reliable than manual line-by-line configurations.
What dimension: Specifies that the page is not just a jump
What specifies a page, most people understand as"Which site to jump after authentication has been successful". This is just the basic function. The What dimension has another role: it can be used to send different Portal authentication pages depending on the user group and access location.
In hotel scenes, for example, visitors to the lobby and tenants have different certification pages: guests can push brand names and adverts on their services. Visitors’ pages can limit bandwidth and push business service information. In a chain of business scenes, visitors from different cities’ gates, after WiFi, can show local door sales and get accurate distribution.
This ability test is the flexibility of Portal template systems. The Portal template for NATSHEL_BRAND supports source-level customisation, which can be designed at any time using HTML, CSS, JS while supporting terminal adaptation——PC and mobile phones have different page versions, and user experience is guaranteed.
Brownser dimension: Self-adaptation is a label not an item
Browser is the one from 4W+B."B"It means that, depending on the type of terminal browser, different authentication pages and authentication processes are appropriate. In multi-end age, this capability is already marked.
If Portal pages do not support self-adaptation, mobile phone users see a reduced version of the PC end, which is difficult to operate and the certification success rate will decline significantly. The NatShell Portal system supports determination of terminal types based on User-Agent and then pushes appropriate page versions——PC ends with a PC-end page, mobile phones with a PHP-side page, and the flatboard version. Users certify on their cell phone that pages do not need to slide around, zoom in or shrink, and experience similar to the original APP.
The criteria for determining the effectiveness of the strategy: what was taken at the time of testing
Finally, a question of integrity: how can it be verified that the strategy 4W has actually been put into effect?
Standard practice is to test at least three sets of different properties.Network access certification system, one is WiFi in the normal area of the general employee account company to verify whether the base strategy is valid; one is WiFi in the visitor ' s area of the account to verify that the visitors ' strategy is rigorous; and one is intentionally manufactured"Border conditions"——For example, WiFi, a staff account for visitors’ area, is used to see if the strategy has been triggered. If an employee uses his own account to connect WiFi to the visitors’ area, but gets a team strategy (not a visitor’s strategy), it suggests that there may be a problem with the priority of the Shere dimension.
Many configuration errors are not exposed in normal settings, but only when the border conditions are deliberately created. More is done on the system’s way to the site, and much later will be saved by the operation.