What Is Smart Access?

Why Is Smart Access Required?

Local authentication and MAC address authentication are typically used in IoT terminal network access scenarios, as shown in the following figure. In this case, an access device functions as the local AAA server, while terminal MAC addresses are used as user names and need be entered by administrators on the access device.

Local authentication and MAC address authentication

This solution has the following problems:

• Administrators need to obtain terminal MAC addresses from the device installation personnel, which is inconvenient and significantly delays network access.
• Administrators need to enter terminal MAC addresses on the device as user names and specify passwords for each terminal, which is time-consuming and inefficient.

To solve the preceding problems, Huawei offers the smart access solution. The solution provides three methods for generating accounts:

• Terminal MAC addresses are manually entered as smart access accounts, with no need to configure passwords. Multiple MAC addresses can also be imported in batches through WebMaster. For details about how to configure smart access accounts through WebMaster, see "Smart Access Account Management" in the WebMaster Configuration Guide.
• Terminals are automatically discovered, after which administrators approve the terminals. Smart access accounts are then automatically generated for the terminals. Throughout this process, administrators do not need to enter terminal MAC addresses.
• When terminals match account generation rules, smart access accounts are automatically generated for the terminals, with no need to enter terminal MAC addresses.

How Does Smart Access Achieve Efficient and Convenient Network Access for Terminals?

Common accounts are used for MAC address authentication of local access users. This type of account includes a user name and password, where the user name is converted from a MAC address. Smart access accounts simplify MAC address authentication by requiring only terminal MAC addresses to identify the accounts. In addition, three methods of generating smart access accounts are provided to make it more convenient for administrators to obtain terminal MAC addresses and avoid the need to configure MAC addresses one by one.

• Entering accounts in batches

  MAC addresses can be imported in batches through WebMaster. This method is often used when the administrator has obtained the MAC address list of terminals. MAC addresses can also be manually entered on the device. Only MAC addresses are required for identifying smart access accounts, and no password needs to be configured. A terminal with a specified MAC address is allowed to go online, has a service scheme authorized, and has account description and status configured.

• Automatically generating accounts

  A terminal that attempts to access the network within the specified time range is allowed to go online, has an account in active state automatically generated, and has a service scheme authorized. In the deployment period, by default, all terminals are considered secure, have accounts automatically generated, and are allowed to go online.

• Approving terminals and generating accounts

  When a terminal that has no account configured or does not match any account generation rule attempts to access the network, a to-be-approved terminal list is generated. After an administrator approves the terminal, the terminal can go online after sending packets again. If the administrator rejects the terminal, the authentication requests of the terminal are rejected. This method is often used when a small number of new devices or guest terminals need to access the network.

How Does Smart Access Ensure Secure Network Access for Terminals?

After smart access is enabled, terminals can access the network if their MAC addresses are verified successfully. In scenarios requiring high security, terminals can access the network only if their MAC addresses, access locations, and IP addresses are verified successfully.

The following check items can be specified:

• Port: A terminal is allowed to go online only when its source MAC address and access port match binding entries.
• IP: A terminal is allowed to go online only when its source MAC address and source IP address match binding entries.
• Port+IP: A terminal is allowed to go online only when its source MAC address, source IP address, and access port match binding entries.

As shown in the following figure, if an administrator specifies port binding check, a terminal is not allowed to go online after its access port is changed. If the administrator specifies IP binding check, the terminal is not allowed to go online after its IP address is changed.

Binding check for smart access