When many units are preparing to go on WiFi, the focus is on which manufacturer, what package they buy, and when they do, it is only when a real deployment is made. The network environment has a whole bunch of problems that are not clear. The switch does not support mirrors, the AC controller version is too old, DHCP addresses are inadequate, wireless coverage is dead-end, but these issues are not big enough alone, but they can be combined, so the actual authentication page cannot be shot or the certification server gets out.
Model and solid version of core network devices to check item by item
Real names are certified properly, and access to switches, convection switches, wireless ACs, APs and the versions of these devices must support Portal reoriented and necessary message processing. Some units have been built over several periods, with three or four branded equipments running in the same building and solidware versions varying. There was a project where AP is an old brand, solids were parked three years ago, Portal reoriented support was bugs and the vendor had to check remotely for a week before it became solid and upgraded. Such things could be eliminated half a day if pre-deployment versions were confirmed.
Authentication of deployment position and return link quality for servers
The actual name authentication server is located in which section of the network, through which link and through the front-end device communicates directly to the certification success rate. Many units have authentication servers in the core room, but the front AP is distributed across branches with several jumpers and firewalls at intervals. If the return link is lost or a delay in shaking, the user will call out."Connect WiFi"The waiting time to eject the authentication page is long, and many people think the network is broken. The peak period is also measured when checking the delay and drop rates from user terminals to the end of the authentication server. If the chain quality does not meet, either the server is deployed or pre-released on the branch side, which cannot wait until it is online.
The DHCP Address Pool and IP reservation strategy need to be clear.
In a real-name certification scene, the terminal first gets an IP to pop the authentication page, so the size of the DHCP address pool and distribution strategy are particularly critical. Some units have small addresses, which are left with a large amount of printer, camera, joint equipment, little left for cell phone users, crowded at one peak, new terminals do not get IPs, certified pages cannot be played naturally. The check is done by measuring regional end peaks, dissecting the address pool into a region, leaving separate pools for visitors and employees, and then converting fixed devices like video head to static IPs or separate retention sections.
Wireless coverage of blind areas and end compatibility cannot be perceived
The signal is not available, and the real name certification cannot be said to be true. When you check it, you can't just look at a P-point map, but you have to take a few different brands, different systems, to see how powerful and connected you are in every region. Andre and Apple have differences in wireless support, and some national phones have problems matching specific frequency bands. There was a mall project where AP dots were evenly balanced, but it was detected that elevator halls and bathroom doors were leaking, so users couldn't connect to them, let alone authentication pages. The terminal compatibility section, which is recommended to cover at least two generations of apples and four major Andre brands, is not used solely for the one in their possession.
DNS dissecting and Portal reoriented configuration prerequisites
The user first opens the web page after it is connected to WiFi, and the system uses DNS and HTTP to redirect him to the authentication page. This process relies on correct DNS release and reorientation rules. Checks to confirm that the authentication server domain name can be properly solved and not certified for access to the exterior are precisely directed to Portal instead of being cut off directly. Some units have a conservative security strategy whereby uncertified terminals will only use default access to the white list, with DNS banned and redirection triggered. The configuration details are to be finalized at the screening stage, without waiting for temporary changes when deployed.
Firewall and security strategy release of certified traffic
The most common problem is that the SMS code access has been blocked by a firewall, the user has not received it and the authentication card has died; and the security connection to the security switch has been treated as an abnormal flow barrier. These conversations are not opened in advance, but have failed intermittently after being connected."Security strategy", each communication corresponds to a confirmed release policy number.
The pressure to export bandwidth and issue a simultaneous certification is assessed separately.
A lot of people are putting it"Width on the Internet"and"How much do you think the certifications will take?"The output bandwidth determines how fast the user can run and how many people can pass through certification. A 2,000-person complex, with a possible 1,000 mobile phones running at the start of the field two minutes before opening, will be over-exposured if the authentication server is able to carry only 300 co-mingles, and the rest will experience confusion on the ground. The screening phase will be certified and released by top viewing, and then select the specifications of the authentication server instead of pushing it by export bandwidth. This is easily ignored because regular tests are carried by dozens of individuals slowly and without problems.
The authentication boundaries of cable and wireless networks should be cleared
Not all networks are certified by their names. Office wires, surveillance networks, and POS cash lines should not normally be mixed with visitors ' WiFi certifications. The screening process must identify which areas, end types, and which can go online or on a separate white list. The boundaries are unclear, either the equipment that should not be controlled is dead at a later stage, affecting operations; or the name is omitted, leaving a compliance gap. It is proposed to classify the network in an inventory into three categories: mandatory real names, direct white lists, Internet segregation, each type of VLAN and strategy.
Checking conclusions to form a signed document
The results of the network environment check, equipment models, versions, links and site pool planning, strategy release lists should be in a document that is signed by the responsible party for confirmation. This document is both the basis for deployment and the boundary of responsibility for the problems that follow. We have seen too many projects, but we only find one half of them to find an old switcher that doesn't support the required functionality."It's not in the request.""A" says"You didn't ask."The final schedule is delayed by half a month. Detailing and writing the check seems slow, actually the fastest way.