When a company is small, the problem with wireless certification is relatively simple: buy an AC, plus dozens of APs, and have RADIUS attached to the domain account, so that the office network can be used. IT has fewer people, less equipment, problems are clear, people can be located in 10 minutes of trouble. But once the business starts having branches, it can be identified.——Whether it's multiple offices in the same city, or inter-city molecular companies, or special scenes like factories, warehouses, doors and so forth.——The complexity of wireless authentication is not linear growth, but exponential rise. Can headquarters IT manage each branch's AP? Could the certification strategy for branches be centrally developed by Headquarters? Does it involve spending? Who will take responsibility? These issues are usually not very much asked at the project evaluation stage, but they are the most common points of debacle that can lead to a serious renegotiation of the entire project.
The first reality of multi-branch wireless authentication is not technology but bandwidth and delay. 802.1X certification requires a RADIUS server to respond, and if the branch RADIUS points to headquarters, each request for certification goes across wide area networks. Wide area network (WAN) links quality and local area network (LAN) quality within the office network are one level of quantity less than 100 milliseconds of delayed return and exit is hard in the certification scene. Branches use ordinary Internet special lines with normal chain quality, while RADIUS requests an Internet export delay typically between 100 and 300 milliseconds, which may be higher at peak times. The experience of certification failure is bad: the employee's cell phone or computer is connected to wireless back-links for more than a dozen seconds, and it's far less than the cable network. Many staff try again and again to fail and complain about IT sector failure. More trouble is that 802.1X users in all branches are cut off if RADIUS is dead.——This is not a malfunction of an equipment but a network of 100 people that has been paralysed and the IT department completely incompetent to its branches before the headquarters failure resumes. So there are two ways for RADIUS deployments in multi-branch settings: centralizing, or localizing their deployments simultaneously. Both options have costs, which are high on network quality and experience instability in areas with poor Internet access; The latter are twice the complexity of their transport dimensions, and the configuration version management, certificate updates and strategy synchronization of the branch local RADIUS require each of them to be accompanied by a supporting service tool. Small and medium-sized enterprises without SD-WAN or centralized control platforms simply cannot run the maintenance rhythm of the local RADIUS.
But the actual demand for branches often has its own special circumstances, and headquarters’ one-size-fits-all strategy is likely to be difficult to handle. For example, Headquarters requires that all wireless terminals must be certified by a real name, but there are large numbers of external construction workers, short-term partners, ad hoc account openings and recovery management costs are extremely high, and branch IT either operates in violation of the rules to open a regular staff account or to release visitors at risk. And for example, headquarters has banned private access for security reasons, but some branch by-product needs do exist.——Branch executives often use their own iPad to create a white list for the top-ups, which is not accessible under HQ compliance. The biggest pit in multi-branch businesses’ wireless strategy is to push the HQ strategy back to branches as it does, either because of massive complaints from branch users that affect operations or because branch IT has been forced to open up its own white list to bypass compliance controls.
** Third problem is the long chain of malfunctioning.** On single sites, wireless authentication problems arise, and IT can basically locate ACs, APs, switches or RADIUS for 10 minutes on site, physical visibility and hand contact accessibility. But when crossing stations, failure may occur in branch AP Radio interference, local switch port configuration, access routers ACL, NAT conversion issues, wide area network (WAN) network drop packages, service anomalies at headquarters RADIUS servers——Each more segment, the time of screening is twice as high and the failure surface is usually larger than a single site, and a network shake can result in all branches being over-timed for authentication requests. More trouble is that wireless certification failures often affect people rather than one person, unlike server failures only affecting that device.——Certification of 100 individuals is time-consuming, meaning that 100 persons are working on IT worksheets at the same time. The IT sector is not only subject to a workload, but also direct inquiries and pressure from business departments and management. Psychological stress on personnel carrying security services is much greater than actual technical check-up pressures.
A truly effective multi-branch wireless authentication structure is not a centralized "headquarters controls everything" or a decentralized "division of branches" but** hierarchical control with clear lines of authority and responsibility. Headquarters is responsible for the baseline of accounts sources and certification strategies, where all staff members are synchronized from headquarters AD or nailed to create local accounts only for distribution; branch is responsible for the fine-tuning and routine operation of local access strategies such as temporary opening and recycling of visitors' accounts; RADIUS is deployed locally but configured by headquarters and cannot be adapted separately, but can be matched locally by access control strategies within headquarters mandates. This structure is clear and reasonable, but landing requires a mature automated transport system and configuration management platform, without which tools to support it, the branch IT can be killed by synchronizing and version checks per moon-based configuration. Before selecting one, ask what kind of architecture your own capability will sustain, rather than pursuing a centralized control system that is blindly functional.——The more robust the functionality means that the more complex the transport configuration, the more burdensome the small- and medium-scale branch networks are with too much control systems.