The type of WiFi terminal in the school is much more complex than expected. Students' mobile phones, tablets, notebooks, smart watches, games machines, teachers' office computers, teaching equipment, logistics surveillance cameras, door-blocking systems, printers, and temporary equipment for visitor belts. These endpoint certifications vary from network behavior to security requirements."Support all devices"It is so simple that there is a trade-off between the various end categories.
Student terminals are to be managed with a certification capability.
The students bring the endpoints, mobile phones and notebooks, which are the main force and the focus of WiFi's network billing system. Most cellular phones support Portal authentication and 802.1X, with flexible configuration. The laptops are well supported by Windows and Marcos, which have a better 802.1X, and the certificate configuration process for Macos is limited to ordinary users.——802.1X, only Portal, not certified MAC white lists or isolation networks. All terminals cannot be required to follow the same authentication mode, otherwise incompatible end is completely useless.
Priority for availability of teaching equipment
Teaching terminal in the teaching building——Smart blackboard, projectors, teaching tablets, recording equipment——The network availability of these devices directly affects teaching. WiFi network billing systems differ in the logic of managing learning equipment and student terminals: teaching equipment should not be limited by a costing strategy, nor cut off by traffic over-treats. It is recommended that teaching equipment be equipped with an independent SSID or independent security strategy, certified in a MAC white list or certificate, without running a fee-based process. The bandwidth of teaching equipment must be guaranteed, with priority ranking higher than the student terminal. If there is a common set of ACs in student dormitories and teaching areas, the VLAN isolation and QoS strategies should be configured on the AC, ensuring that the flow of instruction is prioritized. This configuration cannot be done separately by the system, but it needs to be coordinated with the network equipment.
Iot equipment is isolated and not included in the billing.
Iot equipment is growing on campus.——Smart door locks, environmental sensors, smart meters, security cameras. These devices are characterized by a large number of quantities, low traffic and weak authentication capability. If IOT equipment is integrated into the uniform management of WiFi network billing systems, it is not matched (most IOT equipment does not support Portal or 802.1X) and the costing data are meaningless (IOT traffic is extremely small but frequently connected, and the system processes these debrisization connections consumes a lot of resources). The correct approach is to isolate IOT equipment from independent networks.——The billing system only handles the interface terminal and IOT equipment is managed on a network management platform.——IOT equipment is generally less secure and isolated from the user network without affecting user data even if it is broken.
Visitors' terminals are time-limited and isolated from the internal network
Visitors' terminals are the most carefully managed combinations. The security status of visitors’ equipment is unknown, with possible malicious software or history of attack. WiFi network billing systems should be designed to provide independent SSID, Portal authentication (input cell phone numbers for a validation code), time-limited use (for example 4 hours), speed limits and complete isolation of internal networks. Visitors’ accreditation should not be done using the number of an internal unified identification system to avoid leaking internal documents.——Visitors can only access the Internet and no servers in the school.
Accuracy of end identification and efficiency of strategy distribution
The technical premise for hybrid terminal management is end recognition.——The method of identification is: MAC address OUI (prefix) recognition, DHCP fingerprinting, HTTP UA identification. The MAC address OUI is the simplest but not accurate (mAC can be forged); DHCP fingerprints are more reliable but require system support; HTTP UA only identifies endpoints with browsers. The accuracy of terminal identification directly affects the efficiency of distribution strategies.——If you recognize an error, the device is assigned to a wrong group of policies and it may not be able to access the Internet properly or the security policy will not work. The recommended combination uses multiple ways to identify the uncertain equipment by default to the lowest-permit group, and then adjusts after the type of identification has been identified.
The core of the trade-off is a balance between security and availability.
All the strategies of mixed terminal matching are essentially one choice.——Security and availability balance. Too tight, user-friendly; too loose, security risk. WiFi network billing system is not perfect, but it's important to vary according to the end type.——High-risk terminals (visiters, unknown equipment) are safe and low-risk terminals (teaching equipment, in-school terminals) are available, with student terminals balancing the two. This balance is not static and is adjusted to security events and user feedback dynamics. A terminal strategy assessment is conducted every semester to see if there is any need for adjustment, which is more dependent than a one-time fit-out.