The core of web access certification system is"Access"——The way a terminal can access the Intranet and resources. Different ways of accessing it vary in terms of safety, experience, complexity of deployment and application.
802.1X Certification: high-security standard access
802.1X is the standard network access control protocol defined by IEEE and one of the most secure ways to access the network. It is certified controls based on port: when terminal connections are made to a switchboard port, port defaults to shut down and the portal can only be accessed through the 802.1X backend for use. 802.1X supports the EAP (extensible authentication agreement) framework, which combines various certification methods such as PEAP, EAP-TLS, EAP-SIM, certificate authentication, password authentication, SIM card certification etc. 802.1X has the advantage of high security: certification is not completely closed through an interface, terminals are not even able to access IP addresses and have physical barriers to unauthorized access; at the same time, 802.1X is a standard protocol supported by mainstream switches and wireless controllers. The disadvantage is that deployment is more complex: there is a need to install 802.1X on the switchboard, the terminal requires a client or system configuration, and compatibility with old equipment and non-standard terminals may be inadequate. 802.1X is suitable for high safety requirements, especially financial, government, core business etc., which are usually used for cable network access in office areas.
Portal Certification: Flexible and Easy Web Access
Portal authentication (also called Web certification) is a way of accessing the web page. After terminal connections, access to any page will be redirected to the authenticator Portal page, where users enter an account password or otherwise complete authentication and access the network after authentication is approved. Portal authentication has the advantage of being flexible: no user-end installation is required; there is no need for complex configuration of switches; any end-user supporting browsers is available and is particularly friendly to visitors and temporary users; and Portal pages can be customised to display enterprise information, notification announcements, service terms, etc. The disadvantage is that security is relatively low: the pre-certification terminal has acquired an IP address, has access to some of the network ' s resources (at least Portal pages) and there are certain security risks; while Portal certification relies on a redirection mechanism, which may be intercepted by browsers in HTTPS settings and requires special treatment. Portal certification is suitable for visitor networks, public areas, hotels, campuses, etc., where accessibility requirements are high and safety requirements are moderate, and is often used as a supplement to 802.1X for terminals not supporting 802.1X.
MAC Certification: Insensitive terminal access
The system pre-maintains a white list of MAC addresses that allow access, and automatically identifies the MAC addresses after the terminal connects to the network. If it is released automatically, no user will be required to perform any operation. The advantage of MAC certification is total invisibility: users do not need to enter account codes, customers are not needed to install them, end connections are made with automatic authentication passes, and best practices are experienced. The disadvantage is that the MAC address can be forged and the white list maintenance effort (end replacement of the web card, new terminals need to be updated) does not distinguish between different users using the same end. MAC certifies for printers, cameras, IP phones, engineering control equipment, etc. that do not support 802.1X and Portal, or fixed office terminals already registered. In actual deployments, MAC certifies as a fallback method for 802.1X: after terminal attempts fail to authenticate 802.1X, automatically switch to MAC certification to ensure access to terminals that do not support 802.1X. It is important to note that the management of MAC White Lists must be regulated so as not to allow for excessive white lists to render access controls ineffective.
Access by side: no change in the light way of the network
The principle of access is that the system obtains network traffic through a port mirror, identifying terminal IP, MAC, identity etc. and when unauthorized terminals or non-compliant terminals are found, it sends instructions to the switchboard via SNMP or SSH to close counters or modify VLAN. The advantage of access by bypass is that deployment is simple: there is no need to change the current network tops, there is no need to install 802.1X on the switchboard, and there is little impact on the existing network, suitable for old networks and businesses that are reluctant to make major changes in their structure. The disadvantage is that control over access is relatively weak: there are some delays (from detection of irregularities to implementation of closure time) and there is no control over older equipment not supporting SNMP/SSH management; at the same time, the way by which the bypass relies on traffic mirrors may be leaking.
Terminal compliance check: core capacity for access
In addition to authentication, the core capability of the network access certification system is end compliance. During the authentication process, the system not only verifies user identification but also checks the terminal security status: whether the operating system has updated the patches, installed and operated the anti-virus software, updated the virus library, installed the non-compliance software, operated the dangerous process, turned on the firewall, accessed the default outer (U-disk, mobile hard disk, etc.). Based on the results of terminal compliance inspections, different network privileges are allocated to the system: fully compliant terminals receive full access rights, partially compliant terminals have limited access (only access to patch servers, drug-killing servers, etc.), noncompliant terminals are isolated or denied access. Terminal compliance inspections can be carried out by proxy (install proxy software installed at end, more comprehensive information gathering) or non-agent (access through web scans and protocol queries, deployment of simpler but limited information). End compliance checks are key to distinguishing network access from ordinary authentication and are a central means for managing enterprise security. It should be noted that the strategy of compliance checks is reasonable: too many checks affect authentication speed and user experience, too few are not safe to protect, and require a balance between the enterprise ' s security requirements and the end environment.
Combining and selecting access
In actual business deployments, it is often not only one way of accessing but a combination of different approaches. The common combination strategy is that the employee computers in the office area use 802.1X authentication (high security), no MAC certification for 802.1X terminals (printer, camera, etc.) and visitors and temporary users use Portal certification, while side access in old network areas is used as a transition. Different regions and end types use different access modes that provide both safety and compatibility."The safer the better."or"The simpler the better."Over-supply pursuit of high security (all 802.1X) can lead to deployment difficulties, user complaints; over-supplies (all Portal) can result in security risks. Reasonable combinations and subregional deployments are key to successful implementation of network access.
The network access certification system supports a variety of access modes, from high security 802.1X to easy Portal to an unconscious MAC to light side roads with appropriate scenarios. Terminal compliance checks are the core capability for network access and it allows systems not only to verify"Who are you?"Checking."Is your terminal secure?"The company should choose the right combination of access in accordance with the actual environment, and implement it at the subregional, sub-end type. It will find a balance between safety, experience, and compatibility.