Most WiFi web-based real name authentication systems documents and cases describe ideal environments: brand-size devices, unified AC controllers, standardized Portal protocols. But in reality, many businesses, parks, campuses have a network environment that is not the same at all. Several different batches of APs were purchased from different manufacturers, some two to three years ago, some recently added, forming a patchworked wireless network. The WiFi network virtual certification system is deployed in such settings, with difficulties for matching far more than described in the document.
Compatibility of the Portal Agreement
The core mechanism of WiFi's web-based real name certification system is Portal authentication——The user connects WiFi, and the non-certification traffic is redirected to the authentication page before the user can access the Internet after completing the authentication. This reorientation process does not fully match the way in which the different brands are used for equipment.
The Portal versions of the agreements that are currently common in the market include Portal 1.0, Portal 2.0 (H3C standard), WISpr (Rovering Standard for Wireless Internet Service Providers) and individual manufacturers’ own extension protocols. These protocols differ in field definitions, paper formats, and Challenge-Response interactive processes. A WiFi network real name certification system that only supports Portal 2.0 and an old AP that only supports Portal 1.0 is blocked, as the user has completed its account code without any response or keeps jumping back to the authentication page.
And the more trouble is that some of the manufacturers' APs exist when they are in the Portal agreement."Private Extension"——The standard agreement is nominal, but some non-touched fields are added or partial logic modified.
Multi-AC controller management splits
In the multi-brand mix group network environment, it is often the case that each branding AP needs its own AC controller to manage and then runs two or three AC controllers simultaneously in the same network. WiFi network real name certification systems need to be associated with these AC controllers to receive authentication requests and send out strategies. But different brands of AC controllers are exposed to different management interfaces, some being RADIUS, some privately owned APIs, and others command lines, and the integration of the docking effort is very high.
In this case, a common solution is to add a layer between the authentication system and the AC controller."Adaptor"——The certification system manufacturer provides an intermediate to translate the standard requests for certification systems into formats that can be understood by each AC controller. This option is theoretically elegant, but in practice, the fit-out maintenance often does not keep pace with the equipment fixture and there may be inconsistencies after each AC controller upgrades the solid.
The problem of wandering around decertification
Users can travel between APs when moving within multi-brand AP coverage. If two APs are travelling from different brands and correspond to different AC controllers, users may experience short authentication breaks while traveling——The former AC controller lost control of the user and the new AC controller was given a re-validation of authentication status, which would result in a need for re-entry if not handled properly.
The impact of re-entry is still acceptable for short periods of time (e.g. walking in a buildingway). But, for continuous online operations (video calls, online meetings, VPN connections), the experience is clear. WiFi network real name authentication systems need to maintain user certification status at the session level and share it with brand AC controllers to make seamless travel possible. This requires that there be a centralized meeting state storage in the certification system, and each AC controller can search this status when taking over users rather than independently maintaining it.
Risks associated with fragmentation of solid version
The equipment fixture version in the mixed network environment is usually highly fragmented: the same type of AP may run five or six different solids simultaneously, some have been discontinued and only a few have just upgraded. This fragmentation may not be visible in daily operations, but it will give rise to substantive problems when WiFi network real name authentication system docks.——The same type of AP, because the solid version may vary between Portal behaviour and require separate tests at docking, cannot be assumed to be identical.
The underlying solution to the fragmentation of solids is a standardized solidware management process, which for many small and medium-sized institutions is long-term work that cannot be completed before the certification system is online. More practical is: to conduct a pre-deployment equipment mapping, record all AAP models and solids versions, to perform ad hoc tests on version variations, and to confirm that each type of equipment can normally be used through the authentication process to gradually consolidate the fixed elements in batches.
Pre-project equipment research is critical.
The most important lesson is that the WiFi network real name certification system is deployed in a multi-brand AP hybrid network environment. The compatibility of equipment should not be detected until the docking phase.
This research seems to be time-consuming, but it is much more efficient than the docking phase when problems are identified and the interim reprogramming is done. The interface of the mixed network can be foreseen mostly in the pre-project period, although many have chosen to do so."We'll do it first. We'll solve the problem later."The strategy is to cause a later period of trouble several times more than expected.