Wireless Authentication solution of Enterprise Local area Network
At present, many enterprise Lans have full wireless coverage, which provides great convenience for employees and customers to access the network. No matter in the company or anywhere in the factory area, you can easily access the company's local area network and the Internet. But this also brings inevitable security problems: once there is unauthorized network access, it will not only occupy valuable bandwidth resources, but also bring virus, * and other local area network security problems.
Therefore, when the local area network is doing wireless coverage, security must be taken into account. Generally speaking, we can start from two aspects:
Reasonable division of VLAN. Wireless access should be in a separate VLAN and control the VLAN's access to resources within the enterprise. Even if there is a malicious * *, it can be controlled within the wireless VLAN.
Carry on the user authentication to the wireless Internet equipment.
Ip-mac binding to devices that surf the Internet wirelessly.
Record the Internet records of wireless Internet, including ip address, mac address, website visit and other information. For inquiry when needed.
In this article, I will focus on the user Web authentication section of WFilter NGF. For wireless devices, the most suitable is "Web authentication" (Portal authentication). The convenience of Web authentication is that the authentication can be completed by entering the user name and password directly through the browser without additional configuration. IOS and windows systems can even pop up authentication pages automatically. The details are as follows:
1. "user name authentication" of "Web authentication"
As shown in the picture, enter the user name and password for authentication. The authentication page can be customized.
Support local authentication, mailbox authentication, LDAP authentication, Radius authentication and multiple authentication methods. It can be achieved:
If the enterprise already has domain control, it can be authenticated directly based on the user name and password of the domain control.
If there is an enterprise mailbox, then using the user name and password of the enterprise mailbox for authentication is also a very convenient means of management.
You can also create local users in WFilter for authentication.
Building a third-party Radius authentication server is also an important authentication means.
After the authentication is completed, you can see the user name of the successful authentication in the real-time traffic graph, and you can configure the Internet strategy, record the Internet behavior, and view the Internet statistics report based on the user configuration. As shown below:
two。 Marketing Certification of "Web Certification"
In order to meet the market needs of enterprises, WFilter's "Web certification" also integrates marketing certification programs, which can support "Wechat Wifi" (follow the official account to surf the Internet) and "Facebook WiFi" by default. Custom marketing certification schemes can also be supported. Take "Wechat WiFi" which is widely used in China as an example, you need to configure it in the official account of Wechat, and then enable it in WFilter.
For the specific use of Wechat wifi, please refer to another blog post: Wechat follow to connect to WIFI, introducing the "Wechat Wifi" and "marketing certification" functions of WFilter
In short, the security of wireless access can not be ignored, user authentication is only one aspect of security, but also need to be used in combination with other management means in order to achieve the best results.
