What is the problem when we talk about a six-month access project last month that has not been online? Not because it is not functional or physical, but because it is one after another, and the work schedule is running out. Such problems often receive insufficient attention at the beginning of the project, and the cost of remediation becomes high only when they are implemented.
The first most common compatibility problem is at the network equipment level.Access certification systems need to be connected to the switch, wireless AC, firewalls and access control through 802.1X, Portal or MAC addresses. The key here is not."Supported or not"——Mainstream access systems usually refer to support equipment for mainstream manufacturers such as H3C, H3C, sharpness, Cisco. The real problem is compatibility of the protocol version. For example, Portal agreements, which have Portal 1.0, Portal 2.0, CMCC also have its own specifications and support for the agreement in different solid versions of the same manufacturer. Some devices Portal 1.0 run well, and when the firming has been upgraded, Portal reports change their format and access lapses.Not just that."Model in Support List", and to specify the solid version.
Most access systems need to be matched to the existing identity management system (AD, LDAP, OA, HR). The problem is usually three-fold. One is a variation in the LDAP version and one is different from the treatment of some fields by OpenLDAP and Active Directory, which requires field mapping. Another is inconsistent user data formats, such as those with a pure number of system employees, or a mixture of coded letters, and the third is appropriate matching if the access system has predefined format requirements.Mechanism design for incremental synchronizationThe full synchronization takes a long time when the number of users is large, and the incremental synchronization varies considerably from system to system, as it is important to identify when selecting.
Many people don't think ahead of time about the third compatibility issue.——Compatibility of the certification system.If an enterprise uses 802.1X certificates, the format of the certificate, its validity period, and the logic of the revocation list (CRL) need to be aligned with the access system. Some companies issue their own CAs, the chain structure of the certificate and standard network certificates differ, and the ability to properly verify them is a point that requires actual testing.——In the case of Windows domain equipment, certificates can be automatically sent out through group tactics; in the case of BYOD equipment or Mac computers, the process of installing certificates is complex and requires a separate terminal-guiding process.
The fourth is the compatibility of network-level topup. Access to the deployment location (bypass, chaining, distribution) in the network directly affects control effects and risk ranges. The sidewalking has been minimally modified, with low impact on the current network, but support for some access control scenarios (e.g. real time blockage) is less than a combination.How to access the system with minimal network adaptation"Embed"The present malaise is a question of compatibility.The selection recommended that manufacturers be given a specific deployment topping programme, specifying which equipment required configuration changes, how much of the impact on existing business flows was being achieved and what a rollback option would be.
The fifth easy step is where there are already safe products co-exist. Many companies have deployed VPNs, firewall strategies, NAC equipment, terminal management software, etc. before they built access systems. Access to the system may be a strategic conflict with these existing safety products. For example, the firewall has IP-based access control rules and access systems are working on user identity-based access strategies, which could occur if not coordinated."Access system was cleared, but firewall rules intercepted users"In the case of this, it is more difficult to check.Access systems are not a substitute for existing security infrastructure, but rather a strategic synergy with them——This location needs to be established at the beginning of the project.
The final compatibility problem is at the terminal level. There are a variety of end-of-life devices for employees: Windows versions, Mac, Ubuntu, iOS, Android, each operating system has different levels of support for 802.1X and Portal. Some old Windows need to be shut down when authentication is done for 802.1X."Authenticate server certificates". Some mobile phones, when certified in Portal, have a narrow window of time for pop-up pages and disappear before the user can enter the account password page. These problems do not necessarily recur in the laboratory environment but often occur in the real environment.End-to-end testing of access process using the end type (including old equipment) actually used by an enterprise, do not pass through with a standard-configured test machine.
Compatibility is almost inevitable in access projects, and what can be done is to expose them sufficiently early in the project and develop coping options instead of waiting for implementation. A good implementation plan should see the validation of compatibility as a first milestone rather than the last step on the functional line.