When enterprises choose wireless certification schemes, there are four technical routes that are common on the market: Portal web-based certification, 802.1X enterprise-level certification, MAC address white list authentication, SMS-licensing certification. Each of these programmes has its own set of applications and hard wounds, none of which is a panacea. We actually deploy and compare them in these projects to organize real performances for reference by selected teams.
Portal web pages have the highest degree of authentication. Users automatically eject a certificate page after SSID connections, entering an account password or cell phone number to access the Internet. Implementation is difficult, user acceptance is high and expansionary. But limitations are also evident: Portal pages experience mobile devices with mixed experiences, some mobile phone systems automatically intercept windows leading to certification failures; authentication processes rely on browsers, the object network equipment is completely unusable; security depends on encryption of Portal pages, which carries the risk of theft using the check code when it is transmitted; The performance decline is evident in the dense environment, where slow or even time-consuming page loads are common when thousands of users simultaneously initiate authentication requests.
802.1X certification is the highest technical threshold and highest security level in four programmes. It is based on the Radius protocol, which supports various authentication methods such as EAP-PEAP, EAP-TLS on access levels. The enterprise domain control, LDAP directory service can be used as a source of account numbers, and IT does not need to maintain two sets of account numbers. The advantage of 802.1X is that authentication takes place on equipment access layers and does not have access to the network from the outset; it supports certificate certifications in both directions, with security well beyond Portal; and it allows for and has a coherent strategic control of the network, whether by using webline or WiFi, with the same authority. The shortcomings of 802.1X are also highlighted: client software support is required and compatibility between different operating systems needs to be validated individually; few of the devices can support 802.1X protocols when there is a large presence of network equipment; and the configuration of cable and wireless uniform controls is more complex and requires professional networks and security teams to maintain them.
The MAC address list looks like the easiest way to do it.——The system is connected to the MAC address, which allows access. In practical projects, this option is suitable for a small number of equipment, with little change and completely physically manageable scenarios such as stationary engineering in factory workshops. Its fatal flaw is that it has no identification capability, MAC addresses can be forged, and maintenance costs increase linearly with the quantity of equipment. After hundreds of devices, managers are largely unable to maintain them manually and have to go on automated management tools, but then back into the system's orbit.
SMS authentication is essentially a Portal-certified variant, replacing the account code with a cell phone number. The core advantage is that users experience well.——Users do not need to keep a code for their accounts, and mobile phones are available to everyone and receive the authentication codes quickly. This is a popular programme in tourist sites that reach the public at hotels, exhibition halls, malls, etc. But when used within an enterprise, problems arise: SMS access relies on operators, some of the plant areas have poor remote signals, certification codes are delayed or even failed; there are significant stress on SMS channels during peak periods when large numbers of employees simultaneously authenticate them; more importantly, cellular numbers are not corporate identifications per se, cannot be connected to internal HR systems or AD domains, staff members need manual write-offs after they leave, cannot connect with HR systems and there are gaps in security management.
The selection has a simple framework: if office personnel are the dominant and security requirements are certain, priority is given to the 802.1X and Portal hybrid deployments——Staff use 802.1X and visitors use Portal; if the equipment is high, individual certification schemes for this part of the equipment need to be designed and not imposed by the authentication logic; SMS-certified or Portal are the most pragmatic options when it is open to the public; IT-viability capacity is limited within 100 people and Portal certification maintenance costs are lowest.
Several other pits need to be thought out at the typographical stage: first, the relationship between certification systems and wireless controllers and APs, some of which can only be certified at the AP level and cannot be controlled uniformly at the AC level, a constraint that directly affects programme design; second, the issue of uniform regulation of multi-brand branches, whether headquarters and factories require a unified certification strategy or are operating independently, which determines whether the accreditation system is structured in a centralized or distributed manner; third, the processing of BYOD scenes, and whether the authentication strategy is consistent with corporate equipment when employees use their own mobile phones and computer connections, and whether they want to make fingerprint identification of equipment. These issues are not well thought out in advance and the options identified during the opt-in phase are likely to be subject to adjustments at the implementation stage.