In the actual deployment of the network Authentication & Billing system, Portal certification and 802.1X certification are two distinct technical routes. Many project managers ask: What is the difference between these two approaches, which one should choose? There is no universal answer to this question, depending on the network structure, end type and capability.
The basic logic of Portal authentication is that"Released and intercepted.". After the user has access to the network, the system allows it to access limited resources (usually authentication server addresses) and to make a mandatory jump to the authentication page for identification when the user opens the browser or initiates the HTTP request. After validation, the system sends authorization instructions to AC or Bras so that users can access the Internet properly. Portal certification does not require end-user requirements, mobile phones, tablets, computers are usable and is suitable for size. In the Natshell NATSHEL_AUTH_BILLING system, Portal supports account codes, text messages, micro-mail scans, one key login, unconscious MAC authentication, etc. and can be changed flexibly according to scene.
The logic of 802.1X authentication is"Authentication, access.". This requires access to a switch or wireless controller to support 802.1X, while the terminal requires a Superlist client or system-set 802.1X (most operating systems are now built in). The common practice in business scenes is to combine 802.1X and LDAP or certification systems so that staff can authenticate on their domain account numbers, equipment authentication, or double authentication of both.
The differences in the use scenarios are more marked.Portal certification is more appropriate for complex end-source and uncomfortable to enforce client-based settingsThe local users’ equipment is so varied and often replaced that it is not possible to require each person to install a specific software, as Portal’s zero-end advantage is reflected.802.1X is better suited to end controlled, well-identified enterprise web sitesIn such settings, managers can manage terminal configurations centrally and achieve stricter access controls through 802.1X, as well as perform end-use security checks in conjunction with NAC.
In this case, the network Authentication & Billing system would support both certification models and manage user accounts, billing records, online status as one unit, or two systems with high management costs. The structure of V7 supports the simultaneous operation of Portal and 802.1X in the same system, integrating it into a user and billing management interface, which is of practical value to multi-scenario integration projects.
There are a few details to confirm when selecting the model.: First, whether access devices support the corresponding authentication model, some old APs only support Portal, and some newly procured switches host 802.1X but not fully supported; second, whether a billing strategy can be implemented in two authentication models, otherwise there will be a set-off between different points of entry; third, how certification failure is handled, Portal usually reoriented to the authentication page, and 802.1X refuses to allocate VLAN, which has different user implications and requires early planning of the guiding process when failure occurs.
Another easy to ignore is the support of mobile devices for 802.1X. iOS and Android for business-level certification support for 802.1X are not fully consistent in different system versions, some require manual import certificates and others need MDM delivery, which creates additional workloads for end management. Portal is usually a lower resistance option if the main user group is a cell phone user.
Summing up: The essence of authentication is to balance user ease of experience and strict access security controls. There is no absolute better way, but only one that is more appropriate to the current situation. It is clear which way to choose, which way to go, is clear when you know the user community, how much end control is available, and what kind of technical support to access equipment.
From a transport-related perspective, there are also clear differences in the daily maintenance workload between the two certification modalitiesPortal certification issues are sorted in relative visuals, and the results and reasons for each authentication can be seen in the accreditation log; 802.1X fault check involves terminal Supplicant configuration, switch port configuration, RADIUS messages interactively, and the chain of check-ups is longer. If there are limited teams of drivers and no 802.1X debugging experience, selecting Portal would make day-to-day maintenance easier.
The last practical consideration is user acceptance.. Portal authentication for users is"Play a page with the browser", most people have seen and operate; 802.1X requires a manual configuration of network connection parameters (filling server addresses, selecting certificates) in some settings, which is easy to abandon for ordinary users. Portal plus an unsensual MAC-free combination is usually smoother in the user’s experience if the user group is not a technical person. The authentication method is designed not only to be technically achievable but also to see whether the user can successfully complete the process during the first networking.
The selection of authentication methods does not mean a permanent one.. The original suitable option may need to be adjusted as the network expands in size and equipment types change. For example, only mobile phones and computers were initially available with Portal; then there was a network of devices introduced into the park that did not have browsers and could not walk through Portal, which would require adding authentication based on the MAC address or 802.1X docking. Authentication & Billing should support multiple authentication approaches and allow for the adoption of a certification logic based on access scenarios, type of equipment or SSID, rather than an approach that can only be used on the whole web. This flexibility should be included in the scope of the study when selecting systems.