There's a Natshell running away from school.——Could be a Portal certification that was deployed by the previous operator or a gateway device that the school itself purchased. Now, go to campus wireless WiFi, and how are the relationships between the two systems handled? Is it going to let the billing system take over all of Authentication Gateway ’s functions, or is it going to keep ATSHEL_AUTH_GATEWAY performing authentication, billing, and strategy alone?
Coupling: Replacement of Authentication Gateway
The tight coupling is done by allowing the campus wireless wifi system to assume authentication and billing functions simultaneously, with the former NATSHEL_AUTH_GATEWAY retired or downgraded to transparent relay. The advantage is architecture simplification: a system-based system-competent certification and billing, strategy configured in one interface, and the wiring does not have to be rotated between two systems. Users are complete chains from authentication to counting, with no breaks in the middle. But the tightness presupposes that the system has sufficient certification capability.——It needs to support all the certification methods that schools have previously provided for Authentication Gateway, including Portal authentication, 802.1X authentication, text message validation, micro-letter authentication etc. If there is some way of certifying that a billing system does not support it, the tight coupling will lose its functionality.
The risk of a tight coupling is the process to switch. The original NATSHEL_AUTH_GATEWAY system is online, with a cut window needed in the middle. The authentication process for school-wide users will be interrupted briefly during the cutting and if the cutting fails, recovery time will depend on the reboot speed of the old Authentication Gateway. The test is designed to be a complete parallel operation test: the system is configured in a testing environment to be similar to the original NATSHEL_AUTH_GATEWAY strategy, using analogue user pressure tests that confirm that the authentication success rate, certification time-consuming and support capability are met. Parallel running tests do not go into the cut; otherwise the recovery costs of the problems after being on line are much higher than the time spent during the testing phase.
Coupling: Authentication Gateway Continues to be certified and the billing system is running backend charges
The pine coupling is done by retaining the authentication function of the existing NATSHEL_AUTH_GATEWAY, and the campus wireless wifi system is responsible only for post-certification billing, bandwidth strategy and log records. Authentication Gateway transmits user information to the billing system through RADIUS billing after user certification has been adopted.——No change to the existing authentication process is only a layer of billing at the back end. The original Authentication Gateway operator does not need to learn new systems, but simply points the target address of the billing message to the new billing server in the RADIUS configuration.
The disadvantage of a pine coupling is that it has been fragmented: the authentication strategy was configured on NATSHEL_AUTH_GATEWAY, and the billing policy was configured on the system. If NATSHEL_AUTH_GATEWAY made some changes in the strategy (e.g. changed presentation of the certification page), the system might not know about it, leading to an inconsistency in the strategic state between the two systems.——Some user groups on Authentication Gateway do not have a corresponding billing strategy in the system, resulting in their certification being passed without charge and for nothing.
Semi-coupled: NATSHEL_AUTH_GATEWAY for front end authentication, billing system for certification agent plus charge
There is also an intermediate option: NATSHEL_AUTH_GATEWAY continues to display and interact with the front end of Portal certification pages, but the processing logic of authentication requests is given to the campus wireless wifi system. Authentication Gateway becomes one"Front-end agent", transmits the authentication requests submitted by users to the RADIUS server of the billing system, which completes the certification judgement and calculation strategy. This retains the appearance of the original certification page and user interaction (the students see or are still seeing the authentication page), but the validation judgement logic is controlled by the billing system. The benefits are that the conversion costs are lower than the tight coupling (the authentication page does not need to be redeveloped) and the tactical control of the pine-coupled concentration (authentic and billing logic is in a system).
The key to half-coupling is the fit for the acceptance protocol. Authentication Gateway needs support in forwarding authentication requests to an external RADIFUS server, rather than making local certification judgements only. If the original NATSHEL_AUTH_GATEWAY does not support external RADIUS transmissions, the semi-coupling will be impossible. This ability must be confirmed during the selection phase.——Ask the supplier."Does your Authentication Gateway support external RADINAS server configuration? Can you forward the authentication request to a third-party server?"If the supplier says so, let him actually demonstrate it in a test environment, rather than just look at the document.
Logical of Collating
The coupling is suitable for a school that wants to fully harmonize its original structure, the former Authentication Gateway is weak or about to be retired. The fetters are appropriate for a school with insufficient manpower to carry its own responsibilities and the old NATSHEL_AUTH_GATEWAY operation is stable and unattended to take risks.
Which one? Not which one?"Best in the world."If the original Authentication Gateway is provided by operators, and the operator does not allow schools to be re-configured, neither the tight nor the half-coupled are possible, but only loose. If the old Authentication Gateway was purchased by the school itself, the information centre could have a fully controlled configuration of it, which can be chosen in three ways, depending on its human capacity and risk preferences.
Common technology pits during the docking process
Whatever coupling approach is chosen, the most easy problems in the process of matching are concentrated in two places: first, the discrepancy between the properties fields of the RADIUS submission and the failure of some attribute billing systems from NATSHEL_AUTH_GATEWAY, which has led to a failure of the costing strategy; second, the time-series problem of starting and ending the message, and then the delay in receiving the stop-counting statements from users after they have been downlined by the system, resulting in overcharges for users. These issues are not structural design solutions but need to be examined on an item-by-article basis during the trial phase of deployment. The screening is done by capturing the RADIFUS message simultaneously between systems using a catch tool, adjusting the configuration to the properties field and time series.
The emergency plan for the cut-off must be no less.
The most common plan is to prepare the emergency plan for the day of the actual splitting."Back to the old NATSHEL_AUTH_GATEWAY stand-alone mode"——If a large area certification failure or an abnormal billing occurs after the new system is online, then the original NATSHEL_AUTH_GATEWAY will be restored to stand-alone status within five minutes, allowing the entire school user to access the Internet first. This retreat program needs to be performed before the cutbacks are done, confirming the step of the back and recovery time. If they do not, the cutout will be in case of problems with full-scale network searches on that day.
The choice of the coupling method is not a technical preference, but a combination of the current state of school networks, their mobility and risk tolerance. If you think about these three options, it's not difficult to fix them. The problem is usually that you don't know what your own constraints are, so that technology can cover all situations."Function is achievable"The binding conditions are determined by"Can you run?"。