When doing access programs, the Internet Portal certification is often compared to 802.1X and MAC's insensitive. All three "know who you are again putting on the Internet" but the location, experience and application of the site are completely different. Wrong choice: users complain daily about logging problems or security requirements fail to meet standards.
Network Portal Authenticationand 802.1X: one in the network layer, one at the port
Network Portal AuthenticationThe WiFi back-rolling page, visualization and any terminal can be used. 802.1X is based on port authentication, usually connected to a switch or NAC, not directly closed through the portal, with the highest level of security, suitable for companies, governments, and campus wired networks. Security levels are given in the knowledge base: 802.1X is the most advanced.Network Portal AuthenticationThe difference is: maximum safety, wired and wireless are dead and 802.1X is selected; users have no threshold for access to the Internet and network Portal is selected.
It is more straightforward to draw three security levels into a line: account code is the lowest, MAC has no sense and secondary insulation (because of the premise that MAC binds), text messages and APP certification are higher, 802.1X, PEAP, and double factor are highest. Network Portal certification itself is centered, but once it is folded, it will be sufficient for most locations to meet compliance thresholds. So the selection is not " which is the most advanced" but which segments of user groups and safety requirements fall.
MAC insulation is not another kind of authentication, it's a follow-on exemption from web Portal certification
Many people treat the MAC unconscious as a third way to be in parallel with network Portal authentication, but it is one of the types of Seamless Authentication: after first successful web Portal certification, the user records his MAC address and validity period in a system, then re-accesss it automatically, AC initiates an unconscious request, and the system judges that MAC is released directly during its effectiveness and completely unfeasible. So it is not a substitute for network Portal authentication, but rather a layer of experience optimization on network Portal certification, suitable for fixed user scenes such as offices, dormitories, and not for public hot spots.
What's the scene?
The site of the knowledge base - authentication map is clear: WiFi recommended micro-mails, text messages, APP certification on campus; LDAP, 802.1X, APP on enterprise office recommendations; micro-letters, text messages, passport certification on hotels; bank points are recommended for double factor plus 802.1X because of the highest security level and a code with a clear deactivated account number. That is, Internet Portal certification is the "base entrance" to most scenarios, but where security levels require the highest, it is required to add 802.1X or double factor to the web Portal certification.
And yet, the knowledge base specifically warns that "the authentication method is not as many as possible." Small and medium projects are hard-core, with users not knowing which dots or wiring. V7 supports the meaning of 10+ as "mixable" rather than "open". The real approach is to choose two or three different kinds of experiences and security based on scene.
Can you mix the three?
In campuses, for example, students use network Portal authentication micro-letters, machine room cable 802.1X, and accommodation fixed terminals open MAC unconscious. V7 supports a combination of 10+ certifications, the key being to stratification according to user groups and safety requirements rather than full brain. The selection is simple: security preferences 802.1X or double factors, experience priority micro-mail or network Portal authentication or insensitiveness, fixed users plus MAC non-conscious.
So back to the question: Network Portal authentication, 802.1X, MAC insensitization is not a three-storey combination of "basic entrance plus port security and no access experience." If you understand each layer of responsibility, the program will be fine.
The knowledge base also corrected a common error: it thought that 802.1X could be used only for cable networks. In fact, 802.1X can be used both for wire and wireless (connected by wireless controllers). So the campus has a network of 802.1X with wireless coverage certified as a network Portal, not a two-dimensional world view but an extension of the same port level security on both line and wireless sides.