The WiFi certification system is not a good match to the existing AC, but it's not an authentication system itself."We can connect to Radius by supporting him.", the implementation only revealed that AC had built-in Portal and did not support jumping to an external certification page, and that the entire certification programme was to be reversed. The AC docked is a hard threshold that an enterprise WiFi must test before it gets online and cannot rely on brand name guessing.
Radius is not the External Portal
This is the most common misunderstanding. AC supports Radius by simply saying that it can transmit authentication requests to a Radius server, which does not mean that it can redirect its user browser to an external Portal page. External Portal is independent on the AC and requires AC support for moving China ' s Portal Protocol 1.0 or 2.0, or for custom Portal URL jumps. Some of the AC Radius are used only for 802.1X authentication, while Portal certification can be made on a C-margined page, in which case external accreditation systems can only serve as the Ramius backend and cannot customize the authentication page or multifactor authentication.
Six messages to confirm.
The first is the AC brand and model, with different brands of External Portal achieving a wide variety. The Chinese, H3C, and the sharp corporate class are basically supported by the firmer AC, but the specific models are checked for hard copy versions. The second is the solid version, which may differ in Portal's capabilities from one solid to another, some old ones supporting only internal Portal. The third is whether or not to support the Extranal Portal or third-party Portal jump."Support"Not."I think so."The fourth is whether AC has built-in Portal and, if so, whether to switch to external Portal for empty configuration. The fifth is what authentication means are required, which is different for each of the text messages, micromails, LDAPs, double factors. The sixth is where the current network controls are, and whether the AC is on the core or confluence level, determining the flow path that Portal redirects.
Mainstream AC interface points
NATSHEL_BRAND V7 allows the AC and BAS devices of mainstream producers such as China connected to China, Central Hing, H3C, Sharp, RUCKUS, ARUBA, Cisco. The SAT is configured in a certification template for AAC Extranal Portal, which requires the designation of IPs and ports for the Portal server, which are used in conjunction with Radius templates. The Portal of H3C is configured under an ISP domain and requires attention to Portal versions and V7. The Quick AC Portal supports two models: WEB authentication and PPPOE certification, usually WiFi. RUCKUS and ARUBA ' s aAC are more flexible on the external Portal configuration, but there are fewer Chinese documents, and care is taken to match RADIFAS shared keys with NAS-ID when configured.
Portal version to align
The Chinese mobile Portal protocol has versions 1.0 and 2.0, with the AC and authentication systems having to be used in the same version. The version does not allow for a popup of the authentication page most typically, but it is not responded to by entering an account password or the authentication has been successful but not released by AC. The Portal protocol version is read on the AAC list, then the Portal service configuration is viewed at V7 backstage, so that there are two versions that can continue. Some ACs support both versions, so do not select the right one.
AC doesn't support External Portal.
The first is to add NATHHEL_AUTH_GATEWAY to the upper level of AC, with a gateway for Portal re-direction and access control, and AC simply does wireless transmissions, which do not change AC but instead switch to network topping. The second is to combine the AC's built-in Portal and V7 Radius backends, authenticating pages with AC owning them, certifying the V7 Radius, the disadvantage being that authentication pages are undefined and multifactorial certification cannot be done. The third is to replace the AC supporting External Portal, which has the highest cost but cleanest structure. AC was found to be unsupported in the pre-project period, much better than being discovered after being online.
The three most easily stuck points in the connection.
The first is that the AC to Portal server has no access to a route and the Portal page cannot be shot. To get on the AC pin Portal server IP, it is also necessary to confirm that the AC to Portal portal was not blocked by firewalls. The second is that Radius shared keys are inconsistent, the keys on the AC side and V7 side must be identical and none of the other spaces can be used. The third is an error in the NAS-ID or AC IP configuration, and V7 identifies through NAS-ID which AC request for certification is being identified, and the wrong authentication request will be rejected or matched with the wrong policy.
Attention to multiple AC scenes
When the company has multiple floors or buildings with different ACs, each AC is left to separate configuration of the External Portal and Radius. The V7 side can push different Portal pages by parameters such as ACNAME, SSIID, AC IP, SSID pushing LDAP certification pages, visitor SSID text message validation pages. This 4W+B strategy is particularly useful in multiAC settings.
The scene that must be measured at the time of acceptance.
AC docking can't be just measured."It's a success.", to measure the full life cycle: whether WiFi is connected automatically to WiFi, whether it is released normally after authentication has been successful, whether disconnection of re-certification or unconsciousness triggers a re-certification or de-linking, whether account numbers are rejected, whether different SSIDs are sent to different pages and if the AC configuration is maintained after restarting. Six scenarios are fully completed, with only one certification successfully signed and there must be some problem when you go online.
The core principle of the WiFi certification system and AC interface is that prior capacity will be discussed before a programme, and an External Portal is a hard threshold not an option. Four pre-sale recognitions are made for AC branding, solid text, Portal protocol version, Radius configuration, implementation step by block, receiving and inspection phase by step, and acceptance cycle by step.