The WiFi certification system at the enterprise is designed to enhance user experience, and the MAC has no sense of matching. For the first time an employee enters a WiFi account code, it is automatically released without losing it. But the MAC does not have any sense that its equipment has been automatically certified, and its own equipment needs to be re-certified, and the equipment for separating staff can still be automatically connected.
MAC Insensitive Working Principles
The underlying logic of MAC's insense is that after the user has first certified success through Portal or otherwise, it records the MAC address and the number of the account. When the device attached to the MAC address connects to WiFi, AC sends the MAC address to a Radius server, which was found in local databases with a valid numbered account number, directly returns the authentication successfully without requiring user input into the account number password. V7 supports the MAC NATSHEL_SEAMLESS_AUTH and MAC ' s secondary exemption from authentication, i.e. automatic release after first certification during its validity period.
The MAC address can be forged. It's the biggest security risk.
The unconscious security of MAC depends on the sole identity of its address, but the MAC address is counterfeit. The attackers scan the certified MAC address and change their equipment to the same one, so that they can bypass the authentication directly online. Therefore, the MAC's unconsciousness cannot be used alone and must be accompanied by other safety measures: first, the non-perceptive validity period of MAC is limited, it cannot be permanent and complete beyond its expiry. Second, the high security area should not be exposed to MAC in a non-intenseable way, with 802.1X plus certificates. Third, monitoring an abnormal MAC, which has been simultaneously connected to different APs, may be forged by MACs and triggering alarms. Fourth, the visitors ' network should not open MAC unconscious and visitors must be re-certified every time they enter.
The validity settings are key
The unconscious validity of the MAC is too short, and staff often re-release their passwords and experience. It is too long to automatically connect the equipment that leaves them, lost it, and has high security risks. Business scene suggests that ordinary employees be configured on a 7-30 day basis, with high safety areas not opened for three days or no visitors are not open. The period begins at the last online time, not from the first certification time, so that the equipment used by the employee does not expire daily and needs to be recertified after the expiry of the equipment that is permanently unavailable.
Matching process with Portal authentication
The MAC non-conscious and Portal authentication process: the user connects WiFi, where AC first checks whether there is an unsensual MAC record. Recorded and validly released directly, without playing Portal page. No records or expired, AC reoriented to Portal page, and users entered account password authentication. After authentication has been successful, the system automatically records MAC binding, with no sense of next connection. This process requires that AAC support MAC ' s unconscious priority judgement, not all of it supports. Some ACs play Portal pages first, and Radius checks the MAC unconscious after the user has entered the account password. This is a bad experience, so users always see Portal flashes.
Multi-end scene MAC tied
One employee may have a mobile phone, notebooks, tablets and many devices, each of which is different from the MAC, to be tied to the same employee account. The V7 system supports one account numbering multiple MACs, with a binding and distribution terminal limit. The staff has changed their new cell phone, the old phone MAC is still tied, the first connection to the new phone is made through Portal certification, and the new MAC automatically is automatically tied after authentication. If the old phone is no longer in use, the binding will automatically expire after it has been valid and manual cleanup is not required.
Accreditation issues due to MAC changes
Some devices randomize the MAC address, especially mobile phones, using different random MACs for each connection to WiFi in order to protect privacy. This device cannot be used without awareness because it is not always shared with the MAC, which the system considers new and uses Portal authentication every time."Private Wireless Area Network (WLAN) address"Andre."Random MAC"), use a real MAC connection. Or configure an unsophisticated end-print based on the AC, not relying on a MAC address, but this function is not supported by all of the ACs.
Checklist for Serial Numbers
The most serious failure of MAC non-conscious is a serial number: A employee ' s equipment automatically authenticates B staff. The reason is usually a conflict over the MAC address (two of the devices are MAC) or a mislink between Radius. Checking step: first, check on the AC for the current online user ' s MAC and account number matching to confirm the specific device with the string number. Second, check the MAC ' s binding schedule backstage at V7 to see which account number this MAC has tied. Third, if the MAC was bound wrongly, manually clear the MAC and let the user authenticate the correct tie. Fourth, if the MAC addresses clash, find the conflict device, one of which modified the MAC. Serial numbers are a timely issue, as they relate to account security and billing.
MAC non-conscious action list
Confirm whether AAC supports the MAC ' s unconscious prioritization, whether the capacity of the Radius server ' s MAC binding forms is sufficient, whether the validity strategy is configured to a user group and whether random MAC treatment programmes are ready. Check regularly when online: whether the expired MAC bindings are automatically cleared, whether the separated staff ' s MAC bindings are removed, whether the serial number alerts are triggered, and how successful NATSHELL_SEAMLES_AUTH is.
The WiFi certification system of the enterprise has a perfect MAC for unconsciousness: 7-30 days to balance safety and experience, matching Portal certification with non-conscious then bullet pages, multi-end binding and number limits, random MAC notification of closing method, serial numbers timely check clean-up, regular clearance of exits."It's done."It is a function that requires continuous wiring, with no sense of staff, security gaps and experience.