The most difficult problem to come up with after a while on the WiFi certification system is not a failure of authentication, but an inexplicable one."Break"and"Carton.". User feedback:"The company's connected, but WiFi is dead and re-informing the code.". The transport of the equipment, CPUs are not high enough to hold them, and the upper band is not full, and there's no obvious error in the log.——It's time to check out the factors that are not easy to see.
The DHCP Address Pool Exhausted is a convenient mode of failure.
WiFi certification system relies on DHCP to assign IP addresses to the terminal."Number of daily online"It's planning, not taking."Peaks online"The plan is to run out of addresses at peak hours. This is shown by the fact that terminals can find WiFi signals but cannot get IPs, or they can get IPs and kick them off without new ones.
There is also one easy to ignore: the DHCP lease is long. If it's 24 hours, a temporary visitor leaves WiFi and the IP address is still 24 hours away. If there's a lot of traffic in one day, it may not be enough for an IP address by afternoon. In a highly mobile scenario.——Like hotel halls and conference rooms.——DHCP leases should be set up shorter, with two to four hours sufficient to ensure that the address is quickly recovered.
Implicit constraints on the ability of NT table capacity to produce a certification system
Each active TCP/UDP session takes a NAT list item while the gateway is being converted. After one user connects WiFi, dozens of applications from backstage will be launched simultaneously.——Micromail, mail, push, application autoup——Each NAT line connects a user with hundreds of forms. If the NAT table capacity of the gateway is one million, a thousand active users use 100,000——It doesn’t look much. If the combined NAT table items are actually capable of processing and distributing them far below the nominal values on the specifications, high-level distributions will result in NAT watch overloading, as shown by the fact that some users have a network that is accessible, somewhat unwieldy, and random.
This is a problem that needs to be addressed in the project selection phase."Maximum number of simultaneous sessions"The actual intake test data is based on the third-party testing body, or direct feedback from peers."Sometimes, it's bad."It's a lot of difficulty checking.
Fake breakbacks due to terminal compatibility
WiFi certification systems are exposed to a variety of terminals in real environments: iPhone generations, Android brands versions, wireless network cards with different types of notebooks, IOT devices. Not all terminals' WiFi drives are based on 802.11 standards, some endpoints are frequently deactivated in PMF-enabled environments, some laptop web cards cannot recognize AP when fast traveling 802.1r is open, and some old IOT devices support only 802.11b/g/n.
These end compatibility problems, the WiFi certification system cannot solve itself.——This is a wireless network level thing. But the authentication system can do one thing: when a MAC address has been successfully certified and broken several times in a short time, it sends this information to the carrier alert, which will check whether it's on the end side, not being taken."WiFi's broken."The complaints were flooded.
ARP Table Item and chain reaction overflowing from MAC Address Table
The MAC address list for the second-floor switch is also capped, with the company-level switch usually having tens of thousands to 100,000. In a large WiFi certification system deployment environment, each exchange port learns a lot of terminal MAC addresses when there are unreasonable divisions and too much broadcasting space, resulting in a near-full load of MAC tables. The consequences of full loading are that the new MAC addresses cannot be studied, the switchboards broadcast the MAC frames in a flood, and the traffic in turn consumes a significant amount of upper bandwidth, creating a vicious circle.
This is not uncommon in WiFi deployments, especially in those settings where AP density is high, end mobility is high, VLAN is not fine-tuned. The solution is to narrow the second floor of broadcasting, make up the VLAN segment and cut the floor or area into a network segment by regular means.
Session management for the Radius server with high simultaneous stress
WiFi certification system relies heavily on the Radius protocol for AAA.——Like a 12-hour canteen area with a huge influx of workers from WiFi or a 8-minute hotel room to get back to their rooms.——Radius servers deal with a large number of authentication requests in an instant. If the simultaneous processing capacity of the Radius server and the TCP connections pool are not set properly, there will be requests for time-out queues."I lost the right password, but it took a few seconds to get the authentication done or just over time."。
The bottom of the Radius agreement is UDP, and requests for overtime are regular food, so clients usually try again.——Like three times a day.——The third time you have not responded, the client will consider the server inaccessible. In a high-suming scenario, the UDP buffer size and authentication processing lines of the Radius server are configured to be superior to their preestimated peaks in advance and cannot be attached by default.
The steady operation of WiFi certification system depends not only on the quality of the product itself, but also on those that are not easily seen in the specifications in a large deployment environment."Invisible boundaries"And, you know, it's more practical to get these boundaries clear than any advanced function.