The hotel wireless certification system is not an isolated device, but a technical architecture for working with multiple components. Understanding the structure allows hotel technicians and managers to make reasonable judgements when selecting and deploying, avoiding the programme being rendered impenetrable by lack of information on the structure.
Component composition: Authentication Gateway, RADIAS server and management platform
A complete hotel wireless certification system usually has three core components: NATSHEL_AUTH_GATEWAY (Portal Gateway), RADIAS server and management platform. Authentication Gateway is responsible for the jump-off of Portal page delivery and authentication process——When the occupants connect to WiFi and access the Internet, NATSHEL_AUTH_GATEWAY intercepts HTTP requests from residents, redirected to Portal certification pages; after the tenants submitted authentication information, NATSHEL_AUTH_GATEWAY forwarded the request to the RADIUS server for validation; after the validation was adopted, Authentication Gateway issued an authorization order to AC or switchboard to open the user's access. The RADIUS server is the core of the authentication authorization billing and is responsible for authenticating user identity, sending out a grant strategy (VLAN, bandwidth, ACL, etc.), recording billing information. RADIUS is a standardized protocol (RFC 28 65/2866), with most ACs, switchboards, BRAS devices supporting RADIUS client functions that can transmit certification requests to external RADIS servers. The management platform is the system ' s administrative interface providing user administration, strategy configuration, log queries, statistical analysis, systems monitoring, etc., through which hotel network administrators perform daily security. The three components of the actual product may be integrated into a hardware equipment or software system (integrated deployment) or distributed on different servers (distributed deployment). Integrated small and medium hotel deployments are usually sufficient; large hotels or multi-storey chains may need to be deployed in a distributed manner to enhance performance and reliability. Specific component delineation and deployment patterns will have to be determined in relation to product architecture and project requirements, and products from different manufacturers may differ in composition.
Data flow: the complete link from terminal access to Internet release
The most visual way to understand how the hotel wireless certification system works is to see the data flow. The whole authentication process goes down as follows: terminal access first.——The phone or notebook of the guest is connected to the hotel WiFi (AP), AP reports the terminal connection information to AC, and AC assigns IP addresses to the terminal via DHCP. At this point, the terminal has been connected to WiFi but not certified, and the ACL on board limits access to the terminal's network.——Access to DNS servers and NATSHEL_AUTH_GATEWAY is only allowed, all other Internet access is blocked. Portal then reoriented——Residents open browsers to access any HTTP site (e.g. 100 degrees) and request reoriented by the ACL rules to the Portal page of Authentication Gateway. This redirected to either the RPL re-direction function of AC or the NATSHEL_AUTH_GATEWAY transparent proxy feature. Both modern mobile phone operating systems (iOS and Android) have built up a captive portal detection mechanism, automatically send a test request after the terminal connects WiFi, automatically ejecting a recognition page after it has been detected that requires authentication, and liveers do not even need manual access to the browser. Then we'll have to get the authentication information.——Residents enter authentication information (cell number + authentication code, micromail authorization, house number + surname, etc.) on Portal page, click login and authenticate information via HTTPS encrypted to Authentication Gateway. Next is Radius authentication——NATHHEL_AUTH_GATEWAY, upon receipt of authentication information, sends access-Request requests to the RADIAS server containing user names, passwords (or authentication codes), terminal MAC addresses, access to AP locations, Called-Station-ID etc. The RADIAS server authenticates users: SMS interfaces are used for authentication of authentication code for cell number authentication, PMS system interfaces for verification of room and surnames, and micro-mails for authentications are used for authentication of OpenID. After validation, the RADIUS server returns access-Accept to Authentication Gateway and responds to central authorized properties (Filter-Id, Bandwidth-Limit, VLAN-ID etc.); the authentication fails to return Access-Reject.——NATHHELL_AUTH_GATEWAY After receiving Access-Accept, send a delegation of authority directive to AC through the RADIUS Protocol ' s CoA (Chenge of Association) function or Portal protocol, which updates terminal ACL rules, lifts Internet access restrictions and applies corresponding bandwidth limits and VLAN allocations.——The terminal gets access to the Internet, and the occupants can use a new browser to access the Internet.——The RADIAUS server receives on-line requests from AC, recording the user's online time and traffic usage; Authentication Gateway records the resident's authentication log and web behavior log. When a guest is offline (disconnected WiFi, session overtime, manager forced down), AC sends requests for Accounting-Stop, RADIUS ends the billing and generates the full Internet log.
Deployment model: by-pass, serial and cloud deployment
The hotel wireless certification system has three common deployment models, each with an appropriate setting. Sidewalking is the most common model in a hotel setting. NATSHEL_AUTH_GATEWAY by-pass link to the core switchboard (through mirror ports or stand-alone ports) and not serially to the network main path, even if Authentication Gateway malfunctions, does not affect the connectivity of existing networks (although authentication functions temporarily fail). This mode affects the current network, deploy risks are low, failure does not affect the main network; But AC is required to support external Portal redirection functions. If the AC does not support external Portal, side-way deployment will not be able to achieve a full certification process and will have to be deployed or increased by a combination of Authentication Gateway. The co-location is to connect NATSHEL_AUTH_GATEWAY between AC and the core switch (or between the core switch and the export firewall) and all occupants are transported through Authentication Gateway. This model does not depend on the external Portal capabilities of AC, and Authentication Gateway itself can complete Portal re-direction and flow control for a situation where AC does not support external Portal; but the gateway link is located in the main path and if a connection failure could affect the connectivity of the entire network (most products support bypass protection, automatic direct access during malfunctions) and the performance of the gateway is high (to handle all traffic). Cloud deployment is the placement of a RADIUS server and management platform for the certification system on the cloud (public or private), with hotel locations only requiring light-weight Authentication Gateway, or direct use of ACs supporting clouds. This model is centrally managed, flexiblely expanded, without local maintenance servers, especially suitable for multi-storey hotel chains.——Headquarters centrally manages all door-to-door authentication strategies and user data at the cloud end, which only ensures normal Internet connectivity. But cloud-side deployment is more dependent on Internet connectivity, and cloud-end certification may not be possible if the door-to-door Internet breaks (most systems support local cache policies, with locally stored user information continuing to authenticate when offline). Based on NATSHEL_BRAND V7 product information, the system supports a combination of side-tracking deployments, cloud deployments, local deployments and distributional deployment models, depending on what is considered to be a combination of hotel current network architecture, AC equipment capability, door size, IT lift capacity etc. In the old hotel renovation project, since existing equipment may not support external Portal, it is usually necessary to conduct on-site surveys to confirm AC brand and solid version before a deployment programme can be determined, and all equipment cannot be assumed to support standard agreements.
High-availability design: dual-heat and network interconnection authentication
The high availability of the hotel wireless network is 7x24 hours, and the high availability of the certification system directly affects the resident’s experience.——Two Natshells_AUTH_GATEWAY (main or double-live) are deployed, the backup equipment is automatically taken over during the main device failure and the switch time is usually at second level, with the occupants almost undisturbed. Double-engine heat requires synchronization information between two devices through heartbeat (or network heartbeat) (online user lists, session messages, configuration data etc.), to ensure that the back-up device can continue processing traffic from already online users after switching.——The device automatically switch to physical direct mode when malfunctioning, ensuring that network connectivity is not disrupted. Inter-net confirmation is a fault mechanism for cloud end deployment or Internet disruption scenarios. When the authentication system is deployed on cloud ends, local ACs cannot connect to cloud RADIUS servers and new users may not be able to do so. By storing information from certified users (MAC addresses, validity periods, permission strategies etc.) on local gateways or aACs, new users may need to wait for Internet restoration before certification. This mechanism can guarantee most residents an online experience during a short Internet break.——Authentication Gateway Cache configuration information downloaded from cloud (Portal page template, authentication strategy, bandwidth rules, etc.) can continue to provide certification services as cached configurations even if cloud connections are interrupted. The specific ways of achieving and switching indicators for high-availability options are confirmed in combination with product versions and deployment structures, and there may be differences in the availability of different products from vendors. Project planning stages should determine whether dual-er heating is needed, whether local buffers are required, or whether bypass protection is necessary, depending on the business importance of hotels and residence experience requirements.
Borders with existing systems: certification system not to replace AC, firewall and PMS
A common error in the deployment of a hotel wireless certification system is that it can be considered to replace existing network equipment or business systems. In practice, the authentication system has clear functional boundaries and is associated with an existing system rather than substitute.——AC/AP is responsible for the management of wireless signal launch, terminal connections and wireless resources, and the authentication system is responsible for identification and clearance. One cannot work without a RADIUS-Portal agreement. The certification system does not replace the firewall.——The firewalls are responsible for security of the network boundaries (access control, intrusion defense, virus filtering, etc.), and the authentication system is responsible for user identification and network access rights management. Both can be combined (e.g., certification systems synchronize user identity information to firewalls, firewalls are more sophisticated access controls based on user identities).——PMS (Hotel Management System) is responsible for the core hotel operations of guest room management, booking, cash receipt, and customer history. The certification system is responsible for WiFi identification and rights management. Both systems can be interfaced (e.g., a certificate system calls PMS interface to verify house number and surnames, which synchronizes WiFi costs to room bills), but PMS is not part of the certification system, and the feasibility of matching requires confirmation that PMS manufacturers are open to interfaces.——The WIRM device is responsible for identifying and controlling user behaviour (application recognition, URL filtering, flow orthopaedic etc.) and the authentication system is responsible for authentication of user identification and basic bandwidth/competence control.——The certification system provides user identification, and the online behavior management is based on identity conduct control and log records. These boundaries are clear, so that hotels can properly assess needs when planning WiFi certification systems, and avoid over-exploitation of programmes."Need to confirm interface opening, field mapping, connectivity and deployment boundaries"I can't promise you directly."All systems can be connected to the world without any conditions."。
The technical architecture of the hotel wireless certification system is composed of three core components: Authentication Gateway, RADIUS server and management platform, which achieves a full authentication chain from terminal access to Internet release through standard protocol processes such as Portal re-direction, RADIUS certification, CoA licensing. The system supports three modes of side deployment, serial deployment, and cloud end deployment, with hotels selecting suitable deployment modalities based on current network equipment capabilities and door size. The certification system is a work-in-time, rather than an alternative to existing systems such as AC/AP, firewalls, PMS, and online behavior management. For hotels, understanding the components, processes and boundaries of this technology architecture is the basis for rational planning and successful deployment of wireless authentication systems.