The director of each school’s network centre faces a seemingly simple and practically detailed question: how do people come out here?——These people cannot either give the official school job a number or let people get their eyes off the Internet. If they turn that off too lightly, there will be even greater problems: visitors’ accounts are used to transmit illegal content on campus sites, IPs are not available, and temporary accounts are sold out of school in bulk.
Visitors ' access options: three mainstream approaches with separate pits
The first is that an open visitor WiFi, without certification, can use it. This way the constructioner likes to do it because he does not have to symmetry with a billing system, pulls a SSID alone, carries an independent VLAN, and exports a single broadband directly. But as head of an information centre, the biggest risk is real name compliance. So more and more schools have phased out this programme in the years, retaining it only on a few temporary occasions (e.g. large events on playgrounds) and also making minimal physical marks with SMS codes.
The second approach is to log in the SMS code. Visitors join WiFi and jump onto Portal, entering cell phone numbers, receiving certificates, filling them, and accessing the Internet. The advantage of this approach is that everyone can operate without having to register an account early. A further hidden problem is the rate of text messaging, especially in the suburbs where universities are located, some operators have a blind area and parents do not receive the WiFi half-day certification code and experience it poorly.
The third option is to generate temporary accounts from the service, which is now a mainstream type of programme: a certified school staff (e.g. administrative teachers, mentors, graduate instructors) will create a time-limited temporary Internet account for visitors on a self-help page or micro-letter applet in the system. A valid account number (one day, three days, one week) can be set up and a maximum limit on traffic or quotas for long periods. The account number generated is either a random numerical string or a two-dimensional code that visitors can access online with a certificate entered or scanned on Portal. The advantage of this approach is to delegate the certification responsibility to the school staff, and if something happens, it can be traced to the generator without cost-of-sMS.——Administrative teachers are unlikely to be willing to use the temporary account if it is generated in a process that exceeds three steps or requires access to a complex management backstage.
Classification management of actual scenes: not all visitors are treated as one.
The real-situ visitor management programme should divide visitors into categories, with different types of access. The first category is high frequency academic visitors such as professors from cooperating units and business people who meet regularly. Such persons should be given a permanent visitor account for three months or six months, with mobile phone numbers and identity numbers attached to the web logs, as well as a short-term low-frequency visitor, such as those who attend a lecture, students who come to interview, parents who visit children, text message identification codes or school personnel who generate temporary accounts for no more than three days. The third category is a mass visitor, such as 200 students who arrive in summer training courses, at which point it is not realistic to pass SMS or temporarily generate accounts. It is more pragmatic to import temporary accounts from the billing system in bulk, to establish uniform validity and quota, and to report passwords on the day of the start of the course.
There is a special category of visitors that needs to be handled separately: examination inspectors and superior examiners. These people cannot access the regular visitor process because you don't know when they will arrive or how many."VIP Visitors"Account group, verify by binding a generic test password, but the password is only valid during the examination and will expire immediately after completion.
The most easily stepped pits: recovery of provisional accounts and retention of logs
The problem with temporary accounts is not the generation, but the recovery. Many school visits focus on whether to get visitors online without looking at how to handle expired accounts. As a result, a large number of temporarily closed accounts are still in the system and it is small to use database resources.
The correct approach is that accounts are valid from 1 to 2 and the billing system not only changes account status to"Expired", and also synchronize the cleanup of all online conversations on the account, the MAC-tied caches, and the list of certified devices for Radius or Portal. Some systems are not designed completely at this point, but only state-of-the-account fields have been changed without notification that access levels are being kicked down, resulting in the equipment already connected to be still working.
The logs are kept, and the Internet logs for temporary visitors account are maintained at least six months as the official ones. A common problem is that the visitor account is registered with a mobile phone number, but when you leave the country, the system only records a temporary ID number, which is not linked to the log. In future, public security will be able to transfer the records."Account number A123 was visiting IP at what time?", which is not able to match the specific person. So from the first day of the line, you have to bind the actual name of the visitor account (phone number or identity of the person who created it) and the Internet logs.