The most undervalued design of the WiFi certification system is multi-SSID and VLAN. Many business maps are very easy to separate.
Why can't a SSID go down the street?
A SSID means that all users are connected to the same wireless network, with the same authentication methods and the same network privileges and VLAN. Staff need access to an intranet file server, visitors only have Internet access, and a PACT is required to communicate with a specific server, and security levels for three different types of requirements.
Three typical types of SSID design for enterprises
The first category is SSID, which has an automatic synchronization of the LDAP or AD domain, and a personal system that connects to the personnel system. It is certified and assigned to the employee VLAN, which can access the Intranet resources. The second category is SSID, which carries a temporary account number for the text message certification or host guarantee, which is subsequently certified and added to the visitor VLAN, and is restricted to the Internet and cannot access the intranet. The third category is SSID, which operates on the Internet, uses the MAC NatSHELL_SEAMLES_AUTH or pre-shared key, and it has been certified and placed on the VLAN network, which can only access the specified server port, not the public network, nor the staff network. Three types of SSID correspond to three VLANs, separated by ACL or firewalls, which is the standard division for WiFi.
The way SSID and VLAN bind.
SSID and VLAN are tied to the configuration of the AC, each SSID specifies a default VLAN. More flexible is sent through Radius Dynamic VLAN: When users authenticate, the V7 Radius server returns one VLAN ID to the user role, and the AC assigns the user to the corresponding VLAN. Under this same SSID, employees certify after entering staff member VLAN, visitors after accreditation after visiting visitor VLAN without having to build multiple SIDAs. But dynamic VLAN requires that AC support the Tannel-Private-Group-ID properties of Radius, not all of which are supported by ACs, and is to be confirmed in advance. The benefits of dynamic VLAN are small numbers of SSIDs, uniform user experiences, complicated barriers, and misdirected users want to check the RADIUS returns properties.
A validation policy for employee SSID
SSID suggests 802.1X certification to accompany LDAP or AD domain, with the highest security. 802.1X completes authentication at wireless connectivity stage and does not pass even IPs, which is safer than Portal certification. But 802.1X requires terminal configuration of suplicant, Windows and macos, and mobile phones are supported, but the configuration process is unfriendly for unskilled staff. The compromise solution is SSID certification with Portal plus LDAP, opening MAC without awareness after initial authentication, followed by automatic release of connections, which is more secure than a pure password, and has better experience than 802.1X. High-security areas, such as the Ministry of Research and Development and the Finance Zone, must be certified with 802.1 X plus certification.
Visitors SSID authentication policy
SSID is the most common type of SMS authentication for visitors, whose cell number is a real name basis and meets public security audit requirements. But there is a problem with pure SMS certification in the business landscape: visitors do not know which SSID to go to, but they have to explain it orally at the front desk. More commonly, SSIID is open for broadcasting, automatically ejects text-recertifying pages after connections, and the mobile phone number can be entered into to get a valid code.
Special handling of the SSID on the Internet
Cameras, door closures, sensors, and the network terminals do not support Portal authentication or have a browser entering an account code. The Internet is supposed to use MAC Seamless Authentication to pre-record the terminal MAC address into V7 systems and automatically authenticate it when connected. Or with pre-shared keys (PSK), but PSK cannot distinguish between the endpoints, and one key leaks all equipment affected. VLAN ' s ACL on the Internet is strictly restricted: only terminals are allowed to access a specified port of the specified server, access to the Internet is prohibited, access to employee VLAN is forbidden and one camera is broken and cannot move horizontally.
Configuration elements of VLAN separation
VLAN is isolated on the core switch or firewall. Does staff VLAN have access to visitors VLAN? It is not generally allowed, and it does not need to be a visitor's device. Is visitors VLAN able to visit employee VLAN? Absolutely not."Default rejection of all"And then it's a way to go around, easily missing the match, and not using it."Default allows all"The best practice is the principle of minimum authority, which only allows access to ports and protocols necessary for business.
MultiSSID Portal Pushing Strategy
V7 supports the distribution of different Portal pages by a combination of ACNAME, USERIP, SSID, ACI, Time etc. parameters, which is the 4W+B pushback policy. In multiSSID settings, different SSIDs are pushing different authentication pages: SSIID pushes the corporate style LDAP logout, and visitors SSID pushes a simple text message certification page that allows an enterprise to post promotional content. The pushup strategy is configured on the backstage of V7, matching the corresponding page template with the SSID fields reported by AC, without having to be configured separately on AC.
The multi-SSID and VLAN separation of the WiFi certification system are the basis for security structures. Three SSIDs, three VLAN and three sets of authentication strategies are used: a minimum access ACL segregation between VLAN and staff members; not one SSIID but no VLAN isolation, which separates VLAN. Many SIDA designs have to be finalized at the program stage, and then re-routed AC configurations and network pings, which is much more costly.