Last year, I was helping an intelligent park upgrade the WiFi certification system, and clients came to me with a thick list of equipment that needed access to wireless networks. I looked up the list and there were some strange things: smart water meters, smoke detectors, self-controlled temperature panels, logistics AGV cars, and control modules for parking gates. These devices have one thing in common: they don't have browsers, they don't support 802.1X, and even DHCPs are not working properly. It is much more difficult than expected to get them seamlessly into the WiFi authentication system.
Facilitation and risk of MAC bypass certification
The MAC by-pass authentication is almost the only possible way to access devices without an interface. The simple principle is that when a device is connected to AP, AC initiates a request for MAC certification and Radius is released from the MAC checkout list, pre-into which will be entered on the MAC address white list of the Radius server of the WiFi certification system.
The first is security: the MAC address can be forged. A person who has a little knowledge of the Internet can simply change the MAC address to an address on his own device to one of the white lists, and then bypass the certifications and go directly online. This risk needs particular attention in open areas like parking lots, public corridors.
The second problem is the dynamic change of MAC addresses. More mobile phones and laptops are now defaulting to open random MAC addresses, replacing one with a MAC each time WiFi connects. If you have only made the MAC white list in WiFi certification systems without considering this feature, these devices may not be connected again after the first successful authentication, because when the MAC changed on the second company, Radius could not find the white list.
Our response is stratification. For fixed-location devices, we have a network of things.——Like water meters, smoke senses, gate controllers.——Authentication with MAC by-pass, but in conjunction with port security strategy and AP position at the AC side, limits access to only specific APs or specific exchange ports. For mobile devices, direct users to close random MACs or make device fingerprint recognition on authentication systems, identifying a device using dimensions other than MAC.
When should PSK pre-shared keys be used or not?
PSK is another common way to authenticate WiFi on the network. All devices are given a single password, SSID and equipment have predefined codes that link them directly from the plant. It's much simpler than the MAC white list, but it also has its own problems.
The biggest problem is key management. If all the devices in a WiFi authentication system share a PSK, once this password has been leaked,——Like the employee who left it, or the configuration file of some equipment was exported.——You have to change all the codes. Hundreds of them, spread around the park and some on the ceiling, may be more than you can re-assign a system.
So PSK is better suited to a situation where there are few equipments and the equipment is in a physically safe-controlled area. If the number of equipment is large, wide distribution is widespread, physical security is uncontrollable, I suggest that we go on to certification or MAC sideways strategy binding, though complex to manage, the safety bottom line can be secured.
What CoA and Dynamic Strategy is to be used for the Internet.
There is a special need in the context of the physical network: the device behaves in a fixed manner, but access should not be static. For example, an intelligent meter usually requires only reading and giving it a very small bandwidth; but when solids are upgraded, a large bandwidth channel and download rights for a specific server will need to be opened temporarily.
This places a higher requirement on WiFi certification: not only"Authentication is cleared."The power is called CoA in the Radius protocol.——Approval for change in costing——But many WiFi certification systems are only coAs."Kick off the line."♪ And didn't do it"Dynamic Change Policy"It's like your certification system is only open and you have to find another way to get the keys to every room in the door.
If your WiFi certification system is to manage a lot of material networking devices, don't just look at the selection."Support for not supporting MAC authentication"This shallow question asks the manufacturer: Can your strategic server adapt individual devices to bandwidth limits, ACL rules, VLAN belonging through CoA dynamics? If you need another strategic management platform, then you have to carefully calculate the extra procurement and maintenance costs of this platform.