In the technology selection discussion for Wireless Certification of Business, 802.1X is almost a no-go name. Almost all mainstream network equipment manufacturers have included it as core capability on their product pages, and all technologies have a beautiful protocol map in PPTs.——The structure described in the White Paper is clear: terminal requests for connection, AP through-line EAP frames, RADIUS servers to authenticate identity and release after authentication. It sounds completely unintended. Security and convenience are both available. But you really ask an IT that handles business web security and how 802.1X works on actual projects, eight out of ten will wrinkle their eyes.
It has three practical problems that are indissoluble in its location: the fragmentation of end-adaptation, maintenance costs for certificate management, and fundamental incompatibility with the visitors’ scene. These three challenges are too great to be met, and 802.1X is simply a "speak there" presence on the company's wireless, not a "use it." The integrated firm was willing to talk about the advantages of 802.1X at the programme design stage, but often did not take the initiative to mention these three pits, which needed project experience to fill and were not bypassed by functional parameters.
** The first canon is continuous fragmentation of end-adapted.** 802.1X relies on the EAP protocol, which varies greatly from one operating system to another, which is not usually written in white papers. Windows has originally supported 802.1X starting with Vista and its configuration portals are configured in wireless network properties that enable companies to be configured through group tactics and operate well within standard Windows environments. But the EAP configuration interface of MacOS has been modified several times across different versions, the pre- and post configurations of Marcos Monterey are not fully compatible, and the old version of the config file format of Marcos is being migrated to a new system. The 802.1X support for mobile panels is more uneven, the EAP configuration of iOS devices needs to be distributed through a.mobilileconfig profile, and the level of support at enterprise level varies between Android camps from manufacturer to manufacturer for 802.1X, with some low-end Android models supporting only AP or simple PEAP. The reality is that most enterprises have a much more complex end type than described in the technical white paper, and relying entirely on 802.1X means that the IT sector will maintain a separate configuration for each terminal, which will become a full-time job when there are over 500 terminals. This cost is often not accounted for during the selection phase, and the total can be more expensive than buying a certification system with end fit.
** Second canon is certificate management.** If the enterprise uses a two-way certification based on certificates, security is highest in all EAP methods, each connection requires a client and server's two-way authentication certificate, and the means of attack for counterfeiting RADIFUS are largely not feasible. But there is no free lunch, and EAP TLS presupposes that the business has a complete PKI system: deployment of internal CA, issuance of terminal certificates, updating mechanisms before the certificate expires, immediate effect of revocation of the certificate——These four things sound standard, but each one of the actual dimensions is a pit. The internal CA certificates expire without the employee knowing that his computer was suddenly offline because they did not give clear false information on the terminal and users knew only that WiFi was not connected to them, and because the certificate expired. The CA server moved, all terminals were re-registered, Windows was fine, and the macos and Linux certificates re-registering process was completely different. Real-time updates of certificate revocation lists are also a technical task, and if used in CRL mode, the cancellation notice is delayed, and if used in OSP, the client and the OCSP server are connected to another secure link. Many enterprises turn back to second option PEAP-MSCHAPv2, which is a way of using user names with passwords, no certification requirements for terminals, but with security less hierarchically defined levels——The password can be broken violently offline, and all codes are exposed to leaks when the RADIFUS server is breached. In a local environment, PEAP-MSCHAPv2 needs to be configured with ADCS, which is not very complex and has been misdirected, many companies have NPS configurations that are in the hands of integrated agents and later transport teams are difficult to move themselves.
** The third canal is a visitor's scene.** 802.1X was designed for authorized equipment and authorized users, the main subject of which is equipment and user, and visitors have no business account, how to access it? This is a blind area of 802.1X born. A common solution is to open up a unique visitor-specific SSID, which takes Portal certification, receives temporary accounts through mobile phone numbers or authentication codes, and after certification is accepted on the extranet but not on the intranet. The program is not logical, but it actually works, when visitors come in, even WiFi, the front desk, or IT get accounts and lose certification codes, with a much more complicated process than 802.1X, with poor visitor experience and a bigger front office workload. And the number of accounts certified by visitors Portal is short-lived, visitors are required to reaccredited after expiry, and companies with large peak time visits have high support pressure on the front desk and IT. More practically, the larger the business, the higher the visitor flow, the more friction of this process, some firms simply turn their visitor SSID into password sharing mode for reasons of economy, which directly bypasses the accreditation mechanism and burys security risks.
So many enterprises end up with a mix: internal employees use 802.1X, visitors walk Portal, special equipment take the MAC white list or two-dimensional certification. Three sets of mechanisms coexisting means three sets of transport logic, three different types of fault check paths, three different security strategy boundaries, and if there are gaps in border processing, it creates a safety risk point. The real situation in the company's wireless is a technical programme "in theory, conditions for practice" that companies should ask at the stage of their selection: how do you plan to solve terminal debrisization, how much effort the IT team can put into terminal adaptation? How much resources are you going to invest in certificate management, whether it's PEAP or PKI? What is the proportion of your visitor scenes, how many visitors per day or hundreds at peak? The answer to these three questions determines how well 802.1X will live in your company.