The campus network certification system is a key component of the university information infrastructure. It determines how teachers and students get access to the network, how they travel between teaching buildings and dormitories, and how they have different access rights. Despite the large number of certified products on the market, there are only three core technical options: Portal Certification, 802.1X Certification, and PPOE Certification.
Portal authentication, also called Web certification, is the most common option in the campus network. Its core idea is to put the authentication process on the application level without having any client installed, and to open a browser to complete the identification. Specifically, when users connect to Wi-Fi or cable networks, DHCP servers assign an IP address first, but the network is limited at this time.——The gateway only releases the HTTP traffic to DNS requests and points to Portal servers, all other data packages being intercepted. When a user opens the browser and tries to access any web site, the gateway intercepts the HTTP request and returns a 302-redirection, forcibly takes the browser to Portal login. The user enters the study number and password on the page, clicks on the login, the Portal server sends authentication through the RADIUS protocol to the gateway via command, then the gateway changes the IP address access control list and creates a communication tunnel.
For public areas with large mobility and complex equipment types, such as libraries, canteens, playgrounds, and so on, Portal is almost the only viable option. The Portal page itself is a portal to information that allows schools to publish notices, display campus news, or even embed operators’ advertisements.
The problem is more common with HTTPS compatibility. More and more websites are now defaulting to use HTTPs, while the re-direction of HTTPs triggers a browser certificate. Students see a browser popping the idea that "Your connection is not private connections" and the first reaction is not to click on "Continue access", but rather to intercept the message to the maintenance community that it is "not connected online". Second, Portal certification is in a state, and the gateways need to maintain each IP session sheet. In an environment where thousands of people are online simultaneously during the start-up season, old gateway devices are easily filled with meeting sheets that new users cannot verify.
802.1X certifies another path. It sinks the authentication to a data chain level, controlling the switch-end state of the exchange port. There are three roles in this framework: client, certifying person (usually switch or wireless controller) and authentication server (generally RADIUS). The user device is "unauthorized" when connected to the switch port via a network or Wi-Fi, which is allowed only for EAPOL certification reports, all other traffic is discarded. The user will only formally access the network if it sends a certificate from the client, and the switcher will encrypt it into a RADIUS message to the authentication server.
802.1X is much more secure than Portal. Because certification takes place before IP addresses are allocated, the attackers cannot even get IP and naturally cannot initiate IP fraud. And 802.1X naturally supports VLAN under-fire.——RADIUS servers tell the switchboard "Segregate this port to VLAN 100" when authentication passes. In this way, students and teaching staff are automatically isolated from different network areas even if they sit in the same office. In the teaching area, 802.1X combines dynamic VLAN with almost standardised. Once the equipment is connected to VLAN, access rights are available at one step without additional strategy configuration.
But the cost of 802.1X is deployment complexity. Each access switcher requires RADIFUS-related parameters, and each terminal has to have a 802.1X client or certificate. Windows and Marcos bring their own 802.1X support, which is convenient, but the compatibility of Andre's equipment varies, and ROM customization by different manufacturers may result in the same configuration being used on A phones and not connected to B phones. The drivers are often blocked by students at their offices asking "Why the roommate's Andre machine doesn't connect me." In addition, " dumb terminals" like cameras, printers, door-defeated controllers cannot run 802.1X clients and require additional MAC authentication side roads to be released.——It's a constant and vigilant offensive.
PPOE is the third option, which is off-line from the operator's broadband access system and was deployed in the campus net accommodation area at an early stage. The PPOPE covers a PPP session on the ether frame, with each user having a logical tunnel. Users enter account codes through dial-up clients, BRAS devices end PPP sessions by completing PAP or CAP certification, and they consult to allocate IP addresses through IPCP. The greatest advantage of PPPoE is that users are segregated. Each PPP session is a separate two-storey tunnel, where users are naturally isolated and there is no problem of ARP fraud. The billing is also very accurate, and the BRAS can report traffic and duration in real time through its RADIUS Accounding, and the operator level calculation accuracy is fully adequate on the campus network.
But the PPOE shortboard is becoming more visible. First, MTU issues. The PPOE head takes eight bytes, which can actually be used from 1500 to 1492, and some of the larger packages that are applied are split up and in extreme cases they are dropped directly. The symptoms are "web pages open but not video loads" or "micro-message messages can be sent but pictures can be moved." Students do not understand what MTU is, and only complain about "net failure". Second, clients depend on the PPOE dialing experience on their mobile phone and peace boards, which is extremely poor and largely unfeasible. When the export bandwidth is upgraded from dozens of G to hundreds of G, BRAS performance bottlenecks are becoming more pronounced and expansion costs are not low.
The pattern of three-prongedity is changing. More and more schools move from PPPoE to IPOE plus Portal in the dormitory area. IPOE retains BRAS's second level segregation capability, while eliminating dial-up client dependency, with Portal covering flexible certification and billing. The teaching area continues to be 802.1X, public areas are connected through Portal, several programmes are reached through unified RADIUS backstage. Students have been certified in the library with Portal, moved to the teaching building automatically to 802.1X, returned to the dormitory to IPOE, and the whole process has been completed by the same number, without experience being aware of the transition between bottom lines.
The choice is not silver. High-security areas are 802.1 X, high-mobile areas are Portal, and historically burdened PPOEs are moved systematically. Knowing the boundaries and costs of each technology is necessary to make a choice that really suits their own school.
(approximately 2050 words)