LevelOne WHG-311, Руководство пользователя, Страница: 23 / 307

23
Administrator/Manager manually.
External Authentication Database is a user account database that is not built inside WHG Controller. Besides
Local database and On-demand database, WHG Controller allows up to three additional External Authentication
databases simultaneously. The types of external Authentication databases supported are RADIUS, POP3, LDAP
(including Active Directory), and NTDomain (Win2K’s NTDS). The database of another WHG Controller device can
be used as an external RADIUS database. External Authentication Database is useful for implementing account
roaming; for example, multiple WHG Controller devices in multiple campuses can share one common external
database. A user needs only one account in the common database to access the network from different campuses.
Service Zone is a logic partition of WHG Controller’s LAN network . The concept of Service Zone is similar to the
concept of virtual LAN (VLAN), which can be used to group the network traffic or network services for clients on the
same VLAN segment, regardless of the clients’ physical locations. That is, several VLAN segments may be in
service at one physical network location as well as devices belonging to one VLAN segment may spread across
multiple physical locations.
Each Service Zone can also be viewed a virtual machine of WHG Controller because each Service Zone can define
its own customized login portal page, and its own gateway properties (such as LAN IP address, DHCP on/off and
address range). The feature of Multiple Service Zone is also useful to service multiple hotspot franchises in
shopping malls or airport terminals by a single WHG Controller.
A Service Zone is uniquely defined by a VLAN tag id (under Tag-Based) and an associated SSID attribute . When a
managed access point (MAP) is added to a Service Zone through WHG Controller’s AP Management feature by the
administrator, the associated SSID will be activated in the MAP along with the VLAN tag of the corresponding
Service Zone.
For example, in the following Figure 2, the administrator plans three logical Service Zones for an academic campus:

The first Service Zone (with SSID=’Student”, and VLAN tag=1) is for students.

The second (with SSID=”Faculty” and VLAN tag=2) for faculties.

The third (SSID=”Guest” and VLAN tag=3) for guests.
A Service Zone may or may not require client authentication , depending on how the administrator sets it up. If a
Service Zone requires user authentication, the client will be prompted for the login in first before using the network
services, no matter whether the client is connecting to its SSID wirelessly or a switch port via wired line,.
Group is a group of user accounts sharing the same access privileges, QoS properties and network policies. Each
client account belongs to a Group. Each Group may or may not be allowed to access a particular Service Zone,
depending on the how the administrator define its access mapping. If the administrator does not assign a new
account to any specific Group, the account belongs to a catch-all group named “None” by default.
Policy is for defining rules, privileges or properties for managing users. Each user group is bound by a Policy within
a given Service Zone. The same group may or may not be bound to the same policy in different Service zones.
There are two tiers of Policies. The first tier is a policy named ‘Global-Policy’. The Global-Policy is a base policy
which will be applied to all users if not applied with another policy. The second tier is called ‘Group-Policy’ or simply