The campus network is becoming more wireless, with students moving between dormitories, teaching buildings, libraries, and canteens, all around the place."Who's online, how to authenticate, whether to trace it, how to manage it."This set of questions is connected to a technology system on a platform. It is not equivalent to the WiFi password, nor to a router, but rather to an identity control and operation platform that links the numeric number, terminal, access location, online behaviour and network privileges.
Evolution of technology from open access to authentication control
The campus network has been developed in three stages."Open access"The model, which is used when the network is built, has no identification. It's simple, but it's obvious: anyone can access, and if a security incident does not reach specific people, bandwidth can be absorbed by a few large traffic applications, making it more difficult to manage and audit online behaviour. Many schools then use it."Fixed password"Mode, which sets a uniform password for WiFi and the students enter it online. This is one step further than open access, but the password can easily be passed on to the students, without distinguishing who is connected to the Internet or with user-specific bandwidth and permission management. Logs are only located at the end of MAC address, and no real school number is associated."Certification control"Phase——Schools have a dedicated campus network certification system, and students access the network to complete their identification (school number plus password, mobile phone code, one cartoon, micro-mail, etc.) on Portal pages before they can be certified and open up access rights while recording school number identity with terminals, Internet behavior."Who's online?"The system supports various certification methods such as Portal, PPPOE, 802.1X, PPTP, L2TP, which can be used in many of the dozens of domestic and foreign mainstream plant facilities like Sehua, Nakaeng, H3C, and Elite, based on product information from NATSHEL_BRAD V7 Authentication & Billing. The evolution of the three phases is not a complete substitute relationship, and many schools will have a combination of business equipment for the Tung Hua, Naking, H3C, and other major plants at home and abroad.——Student accommodation is certified in Portal or PPPoE, office areas 802.1X or LDAP, visitor areas are certified by text messages or micro-letters and different regions are accredited differently.
System positioning: identity, access and operating management platform
The core location of the campus network certification system can be understood at three levels. First, it has a single identity layer: it manages the identity information of different groups of people, such as students, faculty and visitors, supports multiple identification sources such as school code codes, one cartoon, cell phone numbers, micromails, LDAP domain accounts, and one account for an individual, avoiding double opening and confusion. Second, access control level: after user authentication is adopted, the system issues web access rights corresponding to identity and role.——Including VLAN allocations, bandwidth limits, access control lists, session length etc., achieved"Who can access what network?"Third is the operational layer: system support costing strategy (blank year, month, day, time and flow), package management, self-service registration, self-help contributions, a full-value card, online user administration, statistical analysis etc., supporting campus network"Free services"Here."Fee-based operations". According to the product information of NATSHEL_BRAND V7, the system is network-based and user management-centred, supporting enterprise-level PORTAL single aircraft with a maximum capacity of 1 million users and Portal certifying more than 4,000 times per second, supporting multiple modes of sidewalking, cloud end deployment, local deployment and distribution."Router plus password"Unlike models, campus network certification systems are an independent management platform that is usually deployed in school rooms or clouds, working through standard protocols (RADIUS, Portal, PPoE, SNP) with equipment such as AC, Bras, switchboard, firewalls and the like on the current network, without replacing existing network equipment. This sidewalk deployment has less impact on the existing network and is a more common mode of deployment in the campus landscape.
Core competency I: Multi-modal authentication and mixed access
The campus network has a complex user base, with different identities, including students, teachers, visitors, temporary trainers, and various end-types (cell phones, notebooks, tablets, smart equipment) and different claims for certification. One of the core competencies of the campus network certification system is to support multiple forms of accreditation and use them in mixed systems. Based on the product information of NATSHEL_BRAND V7, the system supports certification through: account password authentication, one key login authentication, text message authentication, micro-letter authentication, APP certification (enterprise micro-mail, nails, flybooks and custom APP), ID card certification, MAC Seamless Authentication, LDAP authentication, 802.1X authentication, third party data source authentication (one cartoon, OA, arbitrary third-party database), PEAP and EAP-SM authentication, PPPOPE authentication, etc. The following combinations are used in the campus, where students ' dormitories and teaching areas have a school code plus password or a cartoon certification, which is linked to a cathedral-based cartoon system for uniform identification and flat fees; staff office areas with LDAP domain accounts or 802.1X certification, high security and convenience and integration of school personnel systems; visitors and temporary personnel with SMS or microletter authentication without opening an account, which allows for retroactive access; fixed terminals (e.g. classroom multimedia equipment, library search machines, object network terminals) with MAC non-sense or white list certification, with automatic access after initial configuration. The security levels and user experiences vary from one certification to another, and schools should choose the same way as they want to do so. Based on a knowledge base-based mapping of accreditation methods, campus WIFI scenes recommend micro-letter authentication, text message certification, APP certification, alternative account password and NATSHEL_SEAMLESS_AUTH. A mature campus network certification system should support the mix of these modes and can set different certification strategies by region, by SSID, by user group.
Core capacity II: docking with standard protocols for current network equipment
The campus network certification system is not independent, and it needs to be combined with the equipment available in schools such as AC (wire-wire controller), Bras (broadband access server), switchboard, firewalls, etc. to complete the certificate jump, clearance and flow control. There's a common misperception here: many people think that"Equipment support RADIUS"It's like..."Support for the external certification package"RADIUS is the standard protocol for authentication authorization billing, and equipment support for RADIUS only indicates that the device can forward the certification request to an external RADIUS server; but external Portal authentication (i.e., the authentication page seen by the user is provided by the outside system instead of the inside version of the device) requires equipment support"External Portal Jump"or"Third party Portal redirected". In accordance with the rule of Role-5 Technical Adviser, six key messages must be identified as a priority in assessing equipment docking capacity: branding of equipment, model of equipment, support for External Portal/external Portal/third party Portal jumps, whether there is an built-in Portal certification, whether a connection to a cartoon/text message/micromail authentication is required and if the current network control point is available."Support docking"and should state"Requires confirmation of equipment branding and External Portal capabilities"NATSHEL_BRAND V7 supports AC, BRAS, gateways and switchboard equipment for dozens of mainstream domestic and foreign manufacturers such as dock China, Naking, H3C, sharp, RUCKUS, ARUBA, Cisco, JUNIPER, with specific match-making capacity to be confirmed in combination with brand and solid version of the on-site equipment. If the equipment does not support external Portal, the usual alternative is to add NATSHEL_AUTH_GATEWAY (bypassing between AC and core exchanges or by a chain of exports), with NATSHEL_AUTH_GATEWAY responsible for the Portal jump-and-certification process, with equipment only in access control. This approach does not require replacement of existing equipment, which has less impact on the current network.
Core competence III: costing, operations and audit management
The campus network certification system also usually assumes the functions of billing, operation and audit management. In the area of billing, it supports a variety of fee-taking strategies, such as year, month, day, time and traffic, prepaid fees and post-payment models, precision flow counts (through NAC under traffic quotas) and free-of-charge schemes (for special users or special scenarios). For schools that operate on a fee-based basis, the system supports such functions as package management, daily business settlements, daily stoppages, charging cards, third party net silver/payment treasure/micromail payments, etc. students can use mobile phone Portal page self-registration, self-service fees, self-help query costs and online records to be exempted from manual services. On an operational level, the system supports online user management, history record queries, statistical analysis, operating logs, financial statements, etc., which provide school network administrators with real-time access to indicators such as online user numbers, bandwidth usage, certification success rates, etc. by region, by user group, and by holster dimensions of operation data. In the audit context, the system provides for certification logs (accredited session, account, time etc.) and NAT logs (address/port map) and web-based behavioural logs that can be interfaced with third party auditing systems to meet public security requirements. This requires clarity of boundaries: in accordance with NATSHEL_LOG_AUDIT border rules on compliance capacity with public security, V7 systems have basic log capacity varying from independent Log Audit capabilities, which must be confirmed by local regulatory and project requirements, and no commitment should be made to maintain log lengths, field range, query processes."Absolute compliance", which should read"Audit retroactive requirements met by confirmed regulatory requirements and project implementation scope"。
The campus network certification system is from the campus network."Access channel"Heading"Identity control and operational platform"The core technology system. It is multi-procedure and blending of access."Who's online?"The question is whether the campus network will be operated and compliant by means of a pilot roll-out and distribution of certification through a standard agreement with existing network equipment such as AC/BRAS, and through a billing, operation and audit management capacity. Actual deployments require that the school ' s current network equipment (AC/BRAS brand type, support for external Portal), an off-site business system interface such as a cartoon, user group characteristics, compliance requirements etc., select appropriate authentication combinations and deployment structures. Specific site effects are based on survey results and cannot be directly committed to field conditions. For schools, the selection of a flexible certification system, high equipment-to-association capacity and deployment of a campus network certification system with little impact on the current network are important foundations for upgrading the management of the campus network and user experience.