Last year, the manager of technology from the first side threw me in a medium-sized campus to compare three manufacturer schemes. I went over and found three problems that were deliberately bypassed in all three options, which are key to the successful delivery of the entire project. If the selection phase is not clear, then the bottom line is basically digging holes for the implementation team.
The certification agreement is not a technical matter.
Many people come up and talk about Portal as well as 802.1X, which is a different choice. But, frankly, the reality I've encountered on the ground is much more complicated than that. For example, there are old experimental buildings in the park where VLAN does not support the network equipment, and you can talk to him about 802.1X.
The most painful part is that you can fit into several business formats. Some are daily staff, with 802.1 X certifications; others are conference rooms and public spaces, with Portal text messages, and some are network devices, printers, cameras, smart doors locking them up. They're not even going to play Portal pages, they're only certified by the side of the MAC. Three ways of authentication are smooth switching in a WiFi certification system, how SSIDs divide, how VLAN slashes, how strategies work, and all these are going through their head during the selection phase. Many options are written here, and there's no way to say it."Support multiple authentication methods"It is taken away, but it is not true how to support it, what the logic of switching is, or whether there are performance losses.
My own experience is, don't ask the manufacturer when you choose."What kind of certification agreement do you support?"And the answer to that question is always"All in favor."You should ask: What's the logic of your strategy if I hang Portal, 802.1X and MAC certification terminals at the same time under an AC? How do you prioritize them? Switching to reconnect? Ask specific scenes, you can screen half of the manufacturers that only draw PPT.
Authentication Gateway and billing engines should be separated
This problem has been debated more than once in the programme review. Some feel that certification and billing are combined, with ease of management and less failure; others think it should be broken up, while certification is done only for certification and billing, with individual expansions.
From the point of view of the actual dimensions, I conclude that if you have only one business style, such as a pure office or a purely operational one, it's not a problem to combine, but if your WiFi certification system has to balance operating costs,——For example, campus network is charging for hours, hotels are billed daily, and industrial parks have a monthly package.——Then I strongly recommend that NATSHEL_AUTH_GATEWAY and the billing engine be removed. The reason is simple, when authentication protocols are upgraded or switched, you do not want to affect continuity of costing data. In turn, the same thing is true for adjusting the billing strategy, changing the package, changing the settlement cycle, and not requiring you to move Authentication Gateway.
This was done once in a campus project. Authentication Gateway placed on AC to make access determinations for 802.1X and Portal, the tactical server ran into CoA alone to give bandwidth limits and Internet-based time-long strategies, and the billing engine collected traffic and long-term data in real time from Radius’ report on Accoutating. Three components were loosely integrated, all interactively via standard Radius reports. The project was delivered for two years, and the bill engine was never affected by one or more changes in the new payment route because of a security breach. This structure does not determine performance, but rather the room where the wiring is wrong.
Third-party counter."I'll just have the interface."
The most easy way to get past the selection stage is by-linking."Provide standard API interface""Support for third-party system interface"But you go into it and you find out what they call it."Connect"Maybe just a Webbook push, and you're gonna write the middle piece for yourself.
In the case of campuses, it is likely that a check-up on the status of the teaching system, a sales connection to a cartoon system and a SMS platform will be required to issue a code; in the case of hotels, PMS will have to be automatically accessed by guests and the public security audit system will have to be uploaded; and in the case of parks, an automatic staff separation sale for OAs and ad hoc account generation for visitor reservations.
I've had the most painful time, when A chose some WiFi certification system and found it."Standard API"Only one-way push, not an external system callback. This means that we can't automatically synchronize to the authentication system after a staff member's account is cancelled in OA, and all checkouts have to log in manually to backstage operations.——This security hazard, which nobody ever mentioned when they chose.
So I became a habit: when you choose, you ask the manufacturer to open up the testing environment and write a small program to adjust their API, focusing on three capabilities: whether you can call in two directions, if there is a mechanism for echoing, and how much it's going to reach. No idea, one shock.
Finally, the WiFi authentication system is selected only for a list of functions. The functional lists are identical to each other. The real difference is in these unwritten things: architecture design, docking capacity, interoperability of marginal scenes. Ask a few more."If I do this,"The problem is, you can see the most true side of the formula.