The campus network certification management system is not run independently, and it works with existing school-based network equipment such as wireless controllers, switches, firewalls."The equipment is in, but it's not authenticated.""The certification went through, but it didn't get online."This is a discussion of the interface between campus certification systems and existing network equipment.
First, we'll look at the family background: sorting out the compatible list of existing equipment
The first step in the process is to sort out a list of existing network equipment at schools, including core switches, convection switches, wireless controllers, AP, firewall brands and models. Different manufacturers have different levels of support for agreements such as Radius and Portal, but only by identifying their own profiles before determining which equipment can be directly connected to them or what needs to be adjusted.
Radius docking: running certification and billing
Radius is the core interface protocol between authentication systems and network equipment. The device sends a user certification request to the authentication server through Radius, which validates the server and returns release or rejection. The matching is done with details of Radius ' configuration: authentication port, billing port, shared key, NAS logo, which corresponds to one of the two aspects of the system. It also verifies whether the statement of charges is normal, and schools involved in the charge are required to confirm that all reports of online, offline, real-time billing are processed correctly and avoid inaccurate costing.
Portal docking: allowing the authentication page to pop up normally
In the context of the Web Certification (Portal), the authentication system is to be coordinated with wireless controllers or switches to achieve"Automatically popup authentication pages after user access". The interface points include Portal server configuration, redirection logic, authentication page echo addresses and HTTPS certificate configuration. The docking is verified when the user accesses an uncertified state and can jump automatically to the authentication page; whether the original page will be properly jumped back after authentication has been completed; whether the Portal process is normal after a disconnected reconnection.
VLAN and SSID: Right access recognition
The authentication system is required to correctly send out the strategy, provided that it identifies which network area the user has access to. This depends on VLAN and SSID planning on the side of the network: accommodation, teaching, office, visitors, etc., using different VLAN or SSIDs in different areas, and the certification system will then apply the policy by judging the user ' s region from either NAS identifier or VLAN information upon receipt of a request for certification. The interface phase should be clear about the relationship between VLAN, SSID and the authentication strategy and configure it at the same time as the equipment side and the authentication system, avoiding confusion of strategy.
Connectivity and discharge barriers: positioning of the interface
Multiple device interfaces are most likely to be problematic, with clear lines of barrier at the stage of alignment. The common questions are divided into categories: authentication requests do not reach the certification server (mostly Radius configuration or network problems), authentication servers refuse requests (account numbers or strategy problems), authentication passes without access (most VLAN or access control issues), Portal pages fail to pop up (redirection or certificate problems). Checking first, check the authentication server log, confirm whether the request is arriving, returns what results, then locate equipment and tactics on a layer-by-floor basis.
The campus network certification management system interfaces with existing network equipment, the core of which is"First, we'll get a look at the equipment base, Radius connection, Portal re-direction normal, VLAN and SSID alignment, typographical barrier.". The docking is not a one-time configuration, but a matching of the parameters, strategies and logs on the side of the device and the certification system to allow the authentication system to truly integrate into the existing network and play its rightful managerial role.