One of the most basic technical options for a network access certification system is whether to go 802.1X or Portal. Both roads are mature, but those who have stepped in on the pits know that they apply much more than the boundaries."802.1X is safer and Portal is easier"This simple conclusion is complex.
The essential difference between the two is to be clarified.802.1X starts authentication at the second level of the terminal network, where the terminal is connected to the switchboard port or to WiFi immediately, and the switchboard or AP triggers a request for certification. The end does not have an IP address before authentication passes, nor does it access any web resources. Portal certification is that the terminal has an IP address first and can access the network, but any HTTP request is redirected to the authentication page, which users are able to access until they complete authentication."I'll get an IP or a certificate?"The order of the event determined that the two approaches were different in the following context.
Scenario I: terminal type compatibility.802.1X relies heavily on terminal operating system support and requires a terminal configuration of the Applet client. Windows has 802.1X support, which can be configured in groups and is better experienced. If it's Mac, Linux, iOS, Android, the configuration process is complicated and ordinary users may not be able to do it themselves.——Printers, web cameras, door-restricted systems, sensors, which do not support 802.1X at all. If the whole network forces 802.1X, these devices can only be separated by MAC authentication bypass roads or a VLAN that does not require 802.1X. Portal certification terminals are much wider in compatibility and have access to a browser, with coverage of 802.1X. If you have a large number of nonWindows terminals or dub terminals, you can't get any more than this.Portal certification is an option that cannot be bypassed and 802.1X covers core office terminals, a common mix of which is common.
Scenario II: Differences in user experience.Portal's greatest experience advantage is that"You can use it on the browser.", no pre-installation of any client. Its experience is also obvious: Portal pages are played every time you reconnect the network and if there is no MAC connection, users may certify several times a day."Configure once, and then all automatically", connected to the connection. If a certificate is expired, password changes or equipment changed, 802.1X's malfunction is almost impossible for ordinary users to check on themselves and only to find IT. So there are trade-offs between Portal's user self-help but duplicate certification problems, 802.1X's daily experience flow but failure thresholds are high from the point of view of the cost of carrying the service.
Scenario three: Matching of security phase.802.1X is a level of security that is certainly higher than Portal. 802.1X is used on the second floor to authenticate the identity, and it is small enough to match EAP-TLS certification with dual authentication of equipment and users. Portal is done on HTTP floors, where there are theoretical risks of middleman attacks and page simulation (although this can be mitigated through HTTPS Portal). If you have a scene involving a secret unit, a central office area for financial institutions, an military industrial enterprise, then 802.1X is necessary. In the case of normal business offices, educational institutions, and commercial establishments, Portal’s security strategy (e.g. white list MAC, behavioural audit) is well-designed.
The fourth dimension of judgment is...Compatibility support for network equipment.802.1X requires access to the switchboard or wirelessAC to support 802.1X and properly configure RADIAS server information. The domestic mainstream enterprise level switches are supported, but some low end or wireless APs do not support or support incomplete (e.g., PEAP does not support EAP-TLS only). Portal certification requires relatively simple equipment support——If the existing network equipment is old and the upgrade budget is limited, Portal’s certified equipment compatibility advantages are more pronounced.
Fifth practical factor:Project delivery cycle and transportation of maintenance resources.802.1X usually has a longer implementation cycle than Portal, because it involves end configuration (especially BYOD equipment), certificate system development, switch-over monitoring, etc. If the project requires a short time to be online, Portal is much less pressured. In terms of daily transport, 802.1X ' s terminal side check also requires a certain amount of knowledge on the part of its operators, while Portal ' s questions are relatively straightforward.
In summary, the applicable boundaries are clear: 802.1X is suitable for end-control (business distribution equipment, dominated by Windows), high safety requirements and a professional transport team scenario; Portal is appropriate for terminal diversity, frequent visitors, limited capacity.They're both together, and they're going to be separated by scene.——The core end of the office area is 802.1X, and the visitors’ area, public area, dumb terminal is Portal, which is automatically matched by a system of access to authentication according to SSID, user group or type of equipment. If the system does not support this hybrid access strategy, adaptation in the real environment will be greatly reduced.
There is also a physical dimension of concern that is the migration path for authentication.Some projects start with Portal certification, and as the enterprise security requirements increase, it is hoped that this migration process will move to 802.1X. If access systems do not support both ways of co-existence and gradual switching, it will become a one-time event"Big surgery."——Either a one-time switch across the network is unmanageable; or two separate access systems are required, with double costs. A good access system should be able to move user groups from Portal certification to 802.1X authentication without interruption of operations, and both stages could coexist in the same network, with managers moving forward on a user group basis. This capability can easily be overlooked during the selection phase, but it is important for medium- and long-term IT planning.