At this time last year, we took over a wireless coverage project for manufacturing parks.——"We can get the Internet off the line. Don't let anyone else get involved."That's all. I thought it was a standard move, and this is what happened."Simple"The problem is not wireless coverage itself, but wireless certification, a pit that was unexpectedly identified at every step. Here are the main issues that have been stepped up over the year for the team to come up with.
The first pit appeared during the needs confirmation phase. Before the start of the project, IT Division A made it clear that the inside network staff had access to the Internet with a code number and visitors with a cell phone number. It sounded standard, and the mainstream option was satisfied. But only after the contract had been signed in, it became apparent that the IT sector had only office areas and that the equipment network at the workshop was not within their jurisdiction.
Almost all manufacturing customers do not mention this part of the equipment at the stage of demand recognition, and they implicitly agree that IT is considered in a uniform way, but in practice production networks and office networks are often managed by different IT teams, with each other’s needs unknown. There is only one solution: when researching demand is done, ask for information on all types of equipment to be connected, and list them separately, each identifying the authentication method.
The second pit is that the authentication and authorization are not handled separately."Who are you?"The mandate is to deal with"What can you do?"But many of the first parties and even the conglomerators mix them up. Thinking that they could access ERPs and file servers on the intranet as long as their employees were connected to WiFi. It turns out that Treasury computers are wireless, but cannot access financial systems, while Personnel computers can access financial data.
Three things are needed to address this problem: wireless authentication systems need to be linked to the cable network 802.1X or MAC binding strategy; each SSID corresponding VLAN needs and business system privileges for matching mapping; and a full access path test must be performed with a real business account before going online. Many projects have problems here, not because they cannot be technically done, but because there is no clear definition in the scope of the project as to who will be certified, who will be authorized and how the two systems will be connected.
The third pit is high usage and not authenticated. Wireless certification systems serve as web portals, with a huge impact when problems arise. I have seen a project where wireless authentication on A uses single-point deployments, server hard disk malfunctions after three months of official access, and entire wireless networks in the park are disabled. IT only took two days to recover, while hundreds of employees were unable to access the Internet and business directly complained about the CEO office.
High-use is not a question selection. The system must at least be prepped with a double-screen, the meeting between the pre-prepareds has to be synchronized to verify the real switch effect, and the log must be kept intact. A real failure switch exercise must be performed before you go online.——Not to let the carrier read the document, but to turn down the main node, see if it is properly taken over, whether users are keeping their chats online and whether the business system is affected. Many teams find exercise too cumbersome, but this is precisely the least part of the province.
The fourth pit came from regulatory compliance checks. This pit is rarely mentioned at the beginning of the project, since compliance inspections usually take place after a period of online operation. But many projects are surprised when an inspection arrives. Common problems are that the retention cycle for certification logs is insufficient and many systems default to remain only 30 days, but some industries require at least six months of regulation; the log format does not meet requirements, and the inspecting party requires full access logs with time stampes, source IPs, accounts, target URLs, but the system output log formats are linked only and do not have operational-level access information; There was also the problem of multiple users sharing accounts, and the inspection party found multiple IP addresses at the same time in the same account, which could not be identified and alerted by the system.
Compliance requirements must be clear at the system design stage, and cannot wait until the project is online. Once the log format is fixed, it will be very difficult to change the data structure.
The last pit is a transport-vitage transfer. Many projects have delivered wireless certification systems to the IT department in A, and the integrated operator has done the job. But the daily transportation capability of the IT department in A is often not as good as it needs to function properly.
It is recommended that a complete guidebook be provided for the delivery of projects, not just an operating manual, but rather a flow chart for routine failure check paths. A formal training session on the transfer of traffic should also be conducted to clarify the daily health checks of the system, how frequently problems are handled and when there are cases where integrated operators need to be contacted.