There is a typical scenario in the commercial WiFi project: operators have built a WiFi certification system and then open this network to tenants or shops in the park. For example, in a technology park, the campus has integrated WiFi coverage and certification, where each host enterprise can start a WiFi service for its own staff.——How to separate network resources so that the management of different tenants does not interfere with each other and fees and statistics are clearly identified.
The separation logic of authentication domain
The first step in the WiFi certification system, in multi-tenant settings, is to create a clear recognition domain segregation logic. Each enterprise is an independent certification area with its own SSID, authentication strategy and user management interface. For an IT manager who logs on to the A enterprise, he can only see and manage the WiFi certification configuration of his own business, and cannot see or operate B data.
The authentication domain is isolated on two levels of system design that require attention. One is the data layer.——User accounts, authentication logs, and online recording of these data must be strictly segregated by the tenant, without risk of inter-tenant data disclosure.——The bandwidth limitation strategy for A-compartment, the time limit policy for access to the Internet, and the layer filtering strategy cannot affect B-business users.
Fees and quota management for network resources
In the multi-tenant model, operators usually need to measure the network usage per tenant. There are generally three measures: charging at a peak of online users, charging at total traffic and charge at bandwidth occupancy. WiFi certification systems require statistical capacity to be available on backstage and these data must be presented in the tenant's dimensions.
There are several areas of the operation that can be easily disputed."Online users"Calculator——Is it a simultaneous or daily count? If the parallel number is an online count, the peak is an hour particle or a minute particle? These calibres must be agreed in advance in the contract, otherwise they can easily be decoupled at the end of the month.
The second is the logic of traffic statistics. A user uses both mobile phones and laptops to access the Internet, so should the flow generated by two devices be counted under an account or separately? If you aggregate it by account number, there is no difficulty in statistical logic.
Functional boundaries of tenant self-help management backstage
WiFi certification should open a self-service management backstage to each tenant in the multitenant mode. The functional boundaries of this backstage need to be carefully designed: too many, with an explosion in the complexity of the transport, and there may be situations where the tenant has misconfigrated itself to create a full network effect; too few, with tenants looking for operators and heavy maintenance loads.
The functional boundaries are roughly as defined in practice: the tenant can manage his SSID name and password, view online user lists, pull authentication logs and web-based behavior logs, configure bandwidth policies and access control strategies within his own tenants, create and manage user accounts himself. But what cannot be moved includes: AP channel and power settings, route configuration, core switch VLAN configuration, any resources for other tenants.
This functional boundary requires a clear design document and confirmation by the system before it is deployed and by the operator.
The division of duties between the multiple tenants' warnings and the transportation service
In the single-tenant environment, any problem with WiFi certification is a matter for the transportation team. But in multi-tenant environments, the first thing to do when it comes to finding out where responsibility belongs is——Is it the operator's infrastructure or is it the tenant's own reconfiguration?
This requires that the alert output of the WiFi certification system must contain information on the tenant’s dimensions."Ten minutes ago, tenant A's SSIID1 started to have a lot of certification failures."——This alert came to the carrier, who knew it was A tenant who changed his password or SSID strategy. If there was no information on the tenant's dimensions, the carrier got one."SSIID1 certification failure rate is higher"We'll have to find out who this SSID1 belongs to.
The SLA that the operator has committed to the tenant can only cover the infrastructure layer.——The configuration level that the tenant manages is not covered by SLA.——For example, the tenant changed the Radius key himself and failed to certify the entire company, a pot operator who did not fail.
Multitenant WiFi administration is a little more than single tenants."Isolation"There is also a case that deserves to be mentioned separately: bandwidth sharing and competition in multi-tenant environments. The campus is a shared pool of resources, shared by all tenants. If there is no band ceiling for the tenant in the WiFi certification system, one tenant can have a large file transmission or video broadcast that could lead to a full strapwig and other tenants’ WiFi experience crashing. The approach is to set bandwidth security and bandwidth ceilings by tenant dimensions in the certification strategy.——Guaranteed minimum bandwidth and not exceeding maximum limit per tenant——And this strategy should be effective at the AC or gateway level, and it cannot be released after Portal has certified, because there will be a window period of several seconds.