Many people have had this experience: walk into a café or hotel lobby, go to WiFi without the password, just open the browser and pop up a login page, enter a cell number or room number, and then get online. The whole process is natural, but the underlying rationale is not simple.
This is Portal authentication, also called a mandatory portal. The workflow is basically as follows: WiFi is connected to the device and the IP address is assigned but not actually accessed. Users open browsers to initiate requests, wireless access points or Authentication Gateway intercepts this request and directs it back to an authentication page.
This process has several key nodes.
The first is DHCP distribution. After the device has been connected to WiFi, an IP address is obtained from the DHCP server, but access rights for this IP are limited and usually only available on local networks and NATSHEL_AUTH_GATEWAY.
The second is HTTP interception. Users access 100 degrees and the Portal device in the wireless network captures this request. Because it has not been certified, the device returns 302 redirection to guide users to the authentication page.
The third is identification. Users enter a cell number, room number or account password on the authentication page and add the IP of this device to the white list after the system has been validated and release it on the gateway.
The fourth is to keep the session. After authentication, Portal maintains a session, and users do not need to re-authenticate pages or access new sites.
There is a notable contradiction: Portal certification is based on HTTP interception, but the HTTPS traffic is encrypted and Authentication Gateway cannot interpret its content or direct re-direct the HTTPS website.
The mechanism to address this problem is CAPTIVE PORTAL DETEECTION, which makes it mandatory to test the portal. The mainstream operating system has built this function: after the device is connected to WiFi, the system automatically accesses a predefined detection URL, such as apple devices to captive.apple.com. If you return to re-direction or contain specific content, the system believes that the current network requires Portal authentication and automatically ejects the authentication page. If you return normal, indicate that the certificate has been certified.
Technically, Portal Authentication Gateway is usually deployed at the AC (wireless controller) or export gateway levels. Small-scale sites use one-stop machines and large locations require independent certified server clusters. V7 supports multiple deployment options that can be flexible depending on the size of the site.
Portal certification is widely used for several reasons.
For users, the operation is simple. No passwords are required, no client needs to be installed, and a browser can be certified. This approach is particularly popular in public places, with user education costs almost zero.
For operators, user information can be collected. Hotels collect residential cell numbers and malls collect visitor information for marketing purposes.
From a security perspective, Portal certification has achieved network access control. Not everyone has direct access to the network, and must pass through identification.
The limitations are also evident. The most obvious is the question of experience: one intermediate page must be used to access the Internet, possibly for the first time with a slight wait. If the authentication page fails to load slowly or re-direct, the experience will be greatly compromised. Moreover, Portal certifies the legitimacy of access to the main authentication device rather than the security of the data itself.
There is also a common problem: failure to re-direct. A browser cache or an ad intercept plugin may cause the authentication page to fail to pop out.
With regard to security, users fear that a cell phone number or account password will be stolen. Portal pages in the regular site are usually encrypted using HTTPS, and data transfers are protected by SSL/TLS and securely match those of normal websites. If a place uses a self-signed certificate, the browser ejects a security warning, which some users simply drop.
From a technical selection perspective, enterprises and institutions often choose the right options when deploying Portal certifications according to their size, number of users and compliance requirements. The V7 NATSHEL_AUTH_BILLING system provides multiple configurations from single-stage equipment to clustering deployments that can accommodate dozens of people to tens of thousands of people.
Portal certification is the mainstream choice for public access, balancing operational convenience, security compliance and deployment costs. The V7 NATSHEL_AUTH_BILLING system supports multiple Portal authentication methods that can be configured flexibly to meet a variety of needs from hotels to universities based on different scenarios.