DocsICP FilingConsole
官方文档
首页

Network access best practices

更新时间：
复制 MD 格式
产品详情
我的收藏

In a digital office environment, network admission control is a key component of enterprise network security, as enterprises increasingly demand both security and convenience. SASE (Secure Access Service Edge) integrates a RADIUS (Remote Authentication Dial-In User Service) component to support the 802.1X protocol and the portal access method. This delivers secure, flexible, and efficient network admission control, ensuring compliant device and user access while improving management efficiency and the user experience.

Use case 1: Configure wireless network access

SASE ensures secure network access through an 802.1X authentication solution and improves employee efficiency with a one-click network access process. Employees can use the SASE client to quickly and securely access the corporate network from any location covered by the office network. You must complete the required configurations in the SASE management console and on the local wireless controller.

Note

This article uses H3C devices as an example for wireless controller and switch configurations.

Step 1: Configure the authentication server (RADIUS)

RADIUS is a network protocol that provides centralized Authentication, Authorization, and Accounting (AAA) services. SASE provides a Cloud Authentication Server and also allows you to flexibly configure your own authentication server.

  1. Log on to the Secure Access Service Edge console.

  2. In the left-side navigation pane, choose Network Access Control > Basic Configurations.

  3. On the Authentication Server tab, view information about the Cloud Authentication Server or add a new Add Authentication Server.

    • View the Cloud Authentication Server

      1. In the upper-right corner of the page, click Cloud Authentication Server.

      2. In the Cloud Authentication Server pane, view the details of the cloud authentication server provided by SASE.

    • Add an authentication server

      1. Click Add Authentication Server.

      2. In the Add Authentication Server pane, configure the Authentication Server Name and the server's IP Address, and then click Save.

        Note

        The default User Wi-Fi Authentication Interface is 1812, and the default User Wi-Fi Billing Interface is 1813.

      3. On the Deployment and Installation tab, view the Recommended Server Specifications and Server Deployment Commands for RADIUS deployment.

      4. Copy the Server Deployment Commands and run them on your server to deploy RADIUS.

      5. After the deployment is complete, check the deployment status in the list.

        A successfully deployed authentication server has a status of Online.

Step 2: Configure network devices

A wireless controller is a network device that centrally manages and controls wireless access points (APs). It lets you uniformly configure, monitor, and optimize your wireless network. You need to configure your wireless controller.

  1. On the Network Device tab, click Add Network Device.

  2. In the Add Network Device dialog box, configure the following parameters and click OK.

    Parameter

    Description

    Device Name

    Enter a name for the device.

    Device Brand

    Select the brand of your wireless controller.

    Device Type

    Select wireless controller.

    IP Address

    Enter the IP address or IP address range of the wireless controller.

    MAC Address

    Enter the MAC address of the wireless controller.

    CoA Port

    Enter the CoA Port of the wireless controller.

Step 3: Configure Wi-Fi management

  1. On the Wi-Fi Management tab, click Create Network Instance.

  2. In the Enterprise Wireless Network Configuration dialog box, configure the Network SSID and Authentication Mode (currently, only EAP-TLS is supported), and then click OK.

Step 4: Configure certificate management

After users connect to the enterprise office network through SASE, the system automatically provides the SASE App with a SASE CA certificate and a network access certificate. Only devices with these certificates installed can access internal enterprise applications over the enterprise wireless network. If the automatically issued certificates do not meet your business requirements, you can customize the installation scope, validity period, or organization name.

  1. Click the Certificate Management tab.

  2. On the Certificate Management tab, configure Network Access Certificate Configuration, CA Certificate Configuration, and Global Settings.

Step 5: Configure the on-premises wireless controller (H3C)

You need to configure a RADIUS scheme, ISP domain, and 802.1X wireless authentication in your wireless controller's console.

Configure RADIUS

  1. Log on to the console of your H3C wireless controller.

  2. At the bottom of the page, select Network. In the left-side navigation pane, choose .

  3. On the RADIUS tab, click the add icon image to create a RADIUS scheme.

  4. On the Add RADIUS Scheme page, configure the RADIUS settings and click OK.

    Parameter

    Description

    Example value

    Scheme Name

    Enter a custom name for the RADIUS scheme.

    sase-r1

    Authentication Server

    Configure the primary authentication server. If you have multiple authentication servers, you can add them as backup servers.

    You can find the required information on the Network Access Control > Basic Configurations > Authentication Server tab in the SASE console. This tab contains information about the Cloud Authentication Server or any Add Authentication Server you have added.

    On this tab, you can view the server's Name, Server Status, IP address, and key.

    • VRF: Default Public Network

    • Type: IP Address

    • IP address: 121.40.*.*

    • Port: 1812

    • Shared Key: Enter the key.

    • Status: Active

    Accounting Server

    • Configure the accounting server. If you have multiple accounting servers, you can add them as backup servers.

    • The accounting server uses the same IP address and shared key as the authentication server but uses port 1813.

    • VRF: Default Public Network

    • Type: IP Address

    • IP address: 121.40.*.* (same as the authentication server)

    • Port: 1813

    • Shared Key: Enter the key (same as the authentication server).

    • Status: Active

    Advanced Settings

    Click Show Advanced Settings and set Real-time Accounting Interval to 60 seconds.

    60

Configure the ISP domain

  1. In the left-side navigation pane, choose . On the ISP Domain tab, click the add icon image to create an ISP domain.

  2. On the Add ISP Domain page, configure the ISP domain with the following parameters and click OK.

    Set Domain Name to a custom name, such as sase-dm1. Set Status to Active. For Access Mode, select LAN Access. In the LAN Access AAA Scheme section, set Authentication to RADIUS and select the RADIUS scheme that you created. Set Authorization and Accounting to RADIUS and select the same scheme.

Configure the wireless network (802.1X authentication)

  1. In the left-side navigation pane, choose .

  2. On the Wireless Network tab, click the add icon image to create a wireless network.

  3. On the Add Wireless Service page, configure the Wireless Service Name, SSID, and Default VLAN, and enable Wireless Service. After you complete the configuration, click OK and Go to Advanced Settings.

    In the Security Authentication section, set Authentication Mode to 802.1X Authentication (Unencrypted) and Authentication Location to Central AC.

    Note

    You can find the SSID of your configured network instance on the Network Access Control > Basic Configurations > Wi-Fi Management tab in the SASE console.

  4. On the Link Layer Authentication tab, set Authentication Mode to 802.1X Authentication and select the ISP domain you configured for Domain Name. Keep the default values for other settings. Then, click OK.

  5. On the Binding tab, select the AP to bind and click OK.

  6. In the left-side navigation pane, choose .

  7. In the upper-right corner of the page, click the settings icon image. On the 802.1X page, click the configuration option next to Authentication Method, select EAP from the drop-down list, and then click OK.

Step 6: Enable dynamic authorization (CoA)

CoA is implemented based on the RADIUS protocol. It works by sending RADIUS CoA-Request messages to trigger authorization changes. When the wireless controller receives a request, it updates the user's session parameters and returns a CoA-ACK (acknowledgment) or CoA-NAK (negative acknowledgment) message to the RADIUS server.

  1. Connect to the wireless controller (AC) by using a console cable.

  2. Run the following commands to enable CoA:

    [AC] radius dynamic-author server
[ac-radius-da-server] client ip <RADIUS_SERVER_IP> key simple <SHARED_KEY>

    Replace <RADIUS_SERVER_IP> with the IP address of your RADIUS server and replace <SHARED_KEY> with the device's shared key.

    Note

    You can find the RADIUS server IP address and shared key on the Network Access Control > Basic Configurations > Authentication Server tab in the SASE console.

Step 7: Configure a network access policy

When users access the enterprise network through SASE, you can configure network access permission policies to implement fine-grained isolation and control over user and device access. This enhances network security and management efficiency.

  1. Log on to the Secure Access Service Edge console.

  2. In the left-side navigation pane, choose Network Access Control > Office Network.

  3. On the Network Access Permissions tab, click Create Policy.

  4. In the Create Policy pane, configure the following parameters and click OK.

    Parameter

    Description

    Policy Name

    Enter a name for the policy.

    Effective Scope

    For Effective Scope, select Applicable User.

    Based on your business needs, click Select to refine the scope by All Users, Specific User Group, Specific Device, or Specific Device Tag.

    VLAN ID

    Specify the VLAN ID that is configured on your wireless controller. The value can range from 1 to 4094.

    ACL ID

    Specify the ACL ID that is configured on your wireless controller. The valid value range depends on the brand and model of your network device.

    Terminal Type

    Select the terminal types to which the policy applies.

    Network Permissions

    Select a wireless network.

    Wi-Fi Network Scope

    Select All Wi-Fi Networks or Specific Wi-Fi Networks based on your requirements.

    Priority

    Set the policy priority. A smaller value indicates a higher priority.

    Policy Status

    Enable the policy.

    Advanced Settings

    Specify the Authentication Server and Network Device for Access Control to which the policy applies.

Step 8: Install and log on to the SASE client

You must install and log on to the SASE App on an Internet-connected endpoint. To learn what to do after you log on, see Install and log on to the SASE App.

Step 9: View authentication and access records

After you complete the preceding steps, you can view network access history and user authentication logs in the SASE console.

  • View user authentication logs

    1. In the left-side navigation pane, choose Log Analysis > Log Audit.

    2. On the Access Logs > User Authentication Logs tab, view the user authentication status.

  • View network access history

    1. Log on to the Secure Access Service Edge console.

    2. In the left-side navigation pane, choose Network Access Control > Office Network.

    3. On the Network Access History tab, view the network access status of users. You can also perform Disable and Enable actions.

Use case 2: Employee wired network access

This topic describes how to configure 802.1X authentication for a wired network to enable network access. You need to configure settings on both the SASE management console and the local switch.

Step 1: Configure the authentication server (RADIUS)

RADIUS is a network protocol that provides centralized Authentication, Authorization, and Accounting (AAA) services. SASE provides a Cloud Authentication Server and also allows you to flexibly configure your own authentication server.

  1. Log on to the Secure Access Service Edge console.

  2. In the left-side navigation pane, choose Network Access Control > Basic Configurations.

  3. On the Authentication Server tab, view information about the Cloud Authentication Server or add a new Add Authentication Server.

    • View the Cloud Authentication Server

      1. In the upper-right corner of the page, click Cloud Authentication Server.

      2. In the Cloud Authentication Server pane, view the details of the cloud authentication server provided by SASE.

    • Add an authentication server

      1. Click Add Authentication Server.

      2. In the Add Authentication Server pane, configure the Authentication Server Name and the server's IP Address, and then click Save.

        Note

        The default User Wi-Fi Authentication Interface is 1812, and the default User Wi-Fi Billing Interface is 1813.

      3. On the Deployment and Installation tab, view the Recommended Server Specifications and Server Deployment Commands for RADIUS deployment.

      4. Copy the Server Deployment Commands and run them on your server to deploy RADIUS.

      5. After the deployment is complete, check the deployment status in the list.

        A successfully deployed authentication server has a status of Online.

Step 2: Configure network device information

You need to enter the information for your on-premises switch.

  1. On the Network Device tab, click Add Network Device.

  2. In the Add Network Device dialog box, configure the following parameters and click OK.

    Parameter

    Description

    Device Name

    Enter a name for the device.

    Device Brand

    Select the brand of your switch.

    Device Type

    Select Wired Switch.

    IP Address

    Enter the IP address or IP address range of the switch.

    MAC Address

    Enter the MAC address of the switch.

    CoA Port

    Configure the CoA port of the switch.

Step 3: Configure certificate management

After users connect to the enterprise office network through SASE, the system automatically issues the SASE CA certificate and a network access certificate to the SASE App. Only devices with these certificates installed can access internal enterprise applications over the wired network. If the automatically issued certificates do not meet your business requirements, you can customize the installation scope, validity period, or organization name.

  1. Click the Certificate Management tab.

  2. On the Certificate Management tab, perform Network Access Certificate Configuration, CA Certificate Configuration, and Global Settings.

Step 4: Configure the on-premises switch (H3C example)

Configure the RADIUS scheme, ISP domain, and wired 802.1X authentication on your local console.

Configure RADIUS

  1. Log on to the console of the H3C wireless controller.

  2. At the bottom of the page, select Network. In the left-side navigation pane, choose .

  3. On the RADIUS tab, click the add icon image to create a RADIUS scheme.

  4. On the Add RADIUS Scheme page, configure the RADIUS settings and click OK.

    Parameter

    Description

    Example

    Scheme Name

    Enter a custom name for the RADIUS scheme.

    sase-r1

    Authentication Server

    Configure the information for the primary authentication server. If you have multiple authentication servers, you can add them as backup servers.

    You can find the required information on the Network Access Control > Basic Configurations > Authentication Server tab on the SASE console. This tab provides details for the Cloud Authentication Server and any Add Authentication Server you have added.

    On this tab, you can view the server's Name, Server Status, IP Address, and Key.

    • VRF: Default Public Network

    • Type: Default IP Address

    • IP Address: 121.40.*.*

    • Port: 1812

    • Shared Key: Enter the key.

    • Status: Active

    Accounting Server

    • Configure the accounting server.

    • The IP address and shared key of the accounting server are the same as those of the authentication server, but the port is 1813.

    • VRF: Default Public Network

    • Type: Default IP Address

    • IP Address: 121.40.*.* (same as the authentication server)

    • Port: 1813

    • Shared Key: Enter the key (same as the authentication server).

    • Status: Active

    Advanced Settings

    Click Show Advanced Settings and set Real-time Accounting Interval to 60 seconds.

    60

Configure ISP domain

  1. In the left-side navigation pane, choose . On the ISP Domains tab, click the add icon image to create an ISP domain.

  2. On the Add ISP Domain page, configure the ISP domain and click OK.

    Configure the following parameters: Set Domain Name to a custom name, such as sase-dm1. Set Status to Active. For Access Mode, select LAN Access. In the LAN Access AAA Scheme section, set Authentication to RADIUS and select the RADIUS scheme that you created. Set Authorization and Accounting to RADIUS and select the same scheme.

Configure switch port (802.1X authentication)

  1. In the left-side navigation pane, choose .

  2. On the 802.1X page, select GE1/0/3 (port-based authentication), and then click OK.

  3. Click Advanced Settings. On the Advanced Settings page, configure the Mandatory ISP Domain of the Port, and then click OK.

    Set Mandatory ISP Domain of the Port to the name of the ISP domain that you created, such as sase-dm1. Keep the default values for other settings.

  4. In the upper-right corner of the page, click the settings icon image. On the 802.1X page, click the configuration option next to Authentication Method, select EAP from the drop-down list, and then click OK.

Step 5: Enable dynamic authorization (CoA)

CoA is typically implemented based on the RADIUS protocol by sending RADIUS CoA-Request messages to trigger authorization changes. When a network device receives such a request, it updates the user session parameters based on the request and returns a CoA-ACK (acknowledgment) or CoA-NAK (negative acknowledgment) message to the RADIUS server.

  1. Connect to the access controller (AC) by using a console cable.

  2. Run the following commands to enable CoA:

    [AC] radius dynamic-author server
[ac-radius-da-server] client ip <Radius-Server-IP> key simple <Shared-Secret>

    Here, {Radius_ip} is the IP address of the Radius server, and {secret} is the shared key for the corresponding device.

    Note

    You can find the RADIUS server IP address and shared key on the Network Access Control > Basic Configurations > Authentication Server tab in the SASE console.

Step 6: Configure a network access policy

When accessing the enterprise network through SASE, you can configure network access permission policies to implement fine-grained isolation and control over employee and device access. This enhances network security and management efficiency.

  1. Log on to the Secure Access Service Edge (SASE) console.

  2. In the left-side navigation pane, choose Network Access Control > Office Network.

  3. On the Network Access Permissions tab, click Create Policy.

  4. In the Create Policy pane, configure the following parameters and click OK.

    Parameter

    Description

    Policy Name

    Enter a name for the policy.

    Effective Scope

    For Effective Scope, select Applicable User.

    Based on your business needs, click Select to refine the scope by All Users, Specific User Group, Specific Device, or Specific Device Tag.

    VLAN ID

    Specify the VLAN ID that is configured on your switch. The value can be an integer from 1 to 4,094.

    ACL ID

    Specify the ACL ID that is configured on your switch. The valid value range depends on the brand and model of your network device.

    Terminal Type

    Select the terminal types to which the policy applies.

    Network Permissions

    Select Wired Network.

    Priority

    Set the policy priority. A smaller value indicates a higher priority.

    Policy Status

    Enable the policy.

    Advanced Settings

    Specify the Authentication Server and Network Device for Access Control to which the policy applies.

Step 7: Install and log in to the SASE App

You must install and log on to the SASE App on an internet-connected endpoint. For subsequent steps, refer to Install and Log On to the SASE App.

Step 8: View authentication and network access records

You can now view network access records or employee authentication logs on the SASE console.

  • View user authentication logs

    1. In the left-side navigation pane, choose Log Analysis > Log Audit.

    2. On the Access Logs > User Authentication Logs tab, view the user authentication status.

  • View network access history

    1. Log on to the Secure Access Service Edge console.

    2. In the left-side navigation pane, choose Network Access Control > Office Network.

    3. On the Network Access History tab, view the network access status of users. You can also perform Disable and Enable actions.

Use case 3: Configure guest wireless access

SASE provides enterprises with a secure and convenient network access solution for visitors. It ensures network security and optimizes the visitor internet experience by using separate SSIDs for employees and visitors. You can configure network access for both employees and visitors at the same time by setting different SSIDs and backend policies. Currently, when visitors connect to the SASE visitor Wi-Fi, the only supported authentication method is through an SMS verification code on a Portal page.

Step 1: Configure portal authentication

  1. Log on to the Secure Access Service Edge console.

  2. In the left-side navigation pane, choose Network Access Control > Guest Network.

  3. In the upper-right corner of the page, click Authentication Configuration.

  4. On the Authentication Configuration page, configure Authentication Portal Settings and Custom Settings on Authentication Page. For more information, see Authentication Configuration.

Step 2: Configure authentication server (RADIUS)

RADIUS (Remote Authentication Dial-In User Service) is a network protocol that provides centralized Authentication, Authorization, and Accounting (AAA) services. With SASE, you can flexibly configure your own authentication server.

  1. Log on to the Secure Access Service Edge console.

  2. In the left-side navigation pane, choose Network Access Control > Basic Configurations.

  3. On the Authentication Server tab, click Add Authentication Server.

  4. In the Add Authentication Server pane, configure the Authentication Server Name and the server's IP Address, and then click Save.

    Note

    The default User Wi-Fi Authentication Interface is 1812, and the default User Wi-Fi Billing Interface is 1813.

  5. On the Deployment and Installation tab, view the Recommended Server Specifications and Server Deployment Commands.

  6. Copy the Server Deployment Commands and run them on your server to deploy RADIUS.

  7. After deployment, check the status in the list.

    A successfully deployed authentication server has a status of Online.

Step 3: Configure Wi-Fi management

  1. On the Wi-Fi Management tab, click Create Network Instance.

  2. In the Enterprise Wireless Network Configuration dialog box, configure the Network SSID and Authentication Mode for guest access, and then click OK.

Step 4: Configure local wireless controller (H3C example)

Configure RADIUS

  1. Log on to the H3C wireless controller console.

  2. At the bottom of the page, select Network, and in the left-side navigation pane, choose .

  3. On the RADIUS tab, click image to add a RADIUS scheme.

  4. On the Add RADIUS Scheme page, configure the RADIUS settings and click OK.

    Parameter

    Description

    Example value

    Scheme Name

    Enter a custom name for the RADIUS scheme.

    sase-r1

    Authentication Server

    Configure the primary authentication server information. If you have multiple authentication servers, you can add them as backup servers.

    For information about authentication servers, you can find details about Add Authentication Server on the Network Access Control > Basic Configurations > Authentication Server tab in the SASE console.

    On this tab, you can view the server Name, Status, IP address, and Key.

    • VRF: Default public network

    • Type: Default IP address

    • IP address: 121.40.. (same as the authentication server)

    • Port: 2000

    • shared key: Enter the key (same as the authentication server).

    • Status: Active

    Advanced Settings

    Click Show Advanced Settings and use the following settings. Keep the default values for other parameters.

    • Source IPv4 Address for Sending RADIUS Messages: Set this to the IPv4 address of the access device that is registered on the RADIUS server. This is typically the management IP address of the AC.

    • Username Format Sent to RADIUS Server: Excludes domain.

    • Source IPv4 Address for Sending RADIUS Messages: 121.40..

    • Username Format Sent to RADIUS Server: Excludes domain.

Configure ISP domain

  1. In the left-side navigation pane, choose . On the ISP Domain tab, click image to add an ISP domain.

  2. On the Add ISP Domain page, configure the ISP domain and click OK.

    Configure the following parameters. Set Domain Name to a custom name, such as sase-dm1, and set Status to Active. For Access Mode, select LAN Access. In the LAN Access AAA Scheme section, set Authentication to RADIUS and select the RADIUS scheme that you created. Then, set Authorization and Accounting to RADIUS and select the corresponding scheme.

Configure portal authentication server

  1. In the left-side navigation pane, choose .

  2. On the Portal tab, click Portal Authentication Server.

  3. On the Portal page, click image to add a portal authentication server.

  4. On the Create Portal Authentication Server page, use the following settings, keep the default values for other parameters, and then click OK.

    Parameter

    Description

    Example value

    Server Name

    Set a name for the portal authentication server.

    sase-newptv4

    IP address

    Set the IP address of the RADIUS server.

    121.40..

    Server Reachability Detection

    Enable the detection feature and set Detection Duration and Action.

    • Detection Duration: 60 seconds

    • Action: Select Log.

Configure portal web server

  1. In the left-side navigation pane, choose .

  2. On the Portal tab, click Local Portal Web Server.

  3. On the Portal page, click image to add a portal web server.

  4. On the Create Local Portal Web Server page, use the following settings and click OK.

    Parameter

    Description

    Example value

    Server Name

    Enter a name for the server.

    sase-newptv4

    URL

    Enter the server address.

    121.40..

    URL Parameters

    1. Select User's IP Address, enter a parameter name in the URL Parameter Name field, and then click Add.

    2. Select User's MAC Address, enter a parameter name in the URL Parameter Name field, and then click Add.

    • User's IP Address: userip

    • User's MAC Address: usermac

Configure wireless service

  1. In the left-side navigation pane, choose .

  2. On the Wireless Network tab, click image to add a wireless network.

  3. On the Add Wireless Service page, configure the Wireless Service Name, SSID, and Default VLAN, and enable Wireless Service. Then, click Apply and Configure Advanced Settings.

    In the Security Authentication section, set Authentication Mode to 802.1X Authentication (No Encryption) and Authentication Location to Central AC.

    Note

    You can find the SSID of your configured network instance on the Network Access Control > Basic Configurations > Wi-Fi Management tab in the SASE console.

  4. On the Link Layer Authentication tab, set Authentication Mode to IPv4 Portal Authentication, select the Domain Name that matches your ISP domain, select the Web Server Name, and configure the BAS-IP. Keep the default values for other settings and click OK.

  5. On the Binding tab, select the AP to bind and click OK.

Additional configurations

Connect to the AC with a console cable and run the following commands.

# Enable the wireless portal roaming feature.
[AC] portal roaming enable
# Disable ARP entry pinning for wireless portal clients.
[AC] undo portal refresh arp enable
# Enable the wireless portal client validity check feature.
[AC] portal host-check enable
# Set the portal authentication server type to CMCC.
[AC] portal server sase-newptv4
[AC-portal-server-newpt] server-type cmcc
[AC-portal-server-newpt] quit
# Configure the portal web server.
[AC] portal web-server sase-newptv4
[AC-portal-websvr-newpt] url http://192.168.XX.XX:8080/portal
# Configure the URL of the portal web server that is redirected to users to include the ssid and vlan parameters, whose values are the SSID and VLAN of the AP.
[AC-portal-websvr-newpt] url-parameter ssid ssid
[AC-portal-websvr-newpt] url-parameter vlan vlan
[AC-portal-websvr-newpt]  url-parameter acip value  <Actual IP address of the AC> 
# Set the portal web server type to CMCC.
[AC-portal-websvr-newpt] server-type cmcc
# Configure iOS captive-bypass adaptation.
[AC-portal-websvr-newpt] captive-bypass ios optimize enable
[AC-portal-websvr-newpt] quit
# Enable the RADIUS session control feature.
[AC] radius session-control enable
# Configure the RADIUS CoA feature.
[AC] radius dynamic-author server
[AC-radius-da-server] client ip <RADIUS Server IP> key simple <SharedSecret>
Note

You can find the RADIUS server IP address and shared key on the Network Access Control > Basic Configurations > Authentication Server tab in the SASE console.

Step 5: Guest login

After connecting to the guest Wi-Fi on your device, you are automatically redirected to the portal authentication page. You must enter your phone number, enter the SMS verification code that you receive, and then click Log On. You can access internal enterprise applications only after you are authenticated.

Step 6: View guest logs

  1. Log on to the Secure Access Service Edge console.

  2. In the left-side navigation pane, choose Log Analysis > Log Audit.

  3. On the Access Logs > Guest Authentication Logs tab, view the authentication status of guests.

Use case 4: Dumb terminal network access

Dumb terminals can access the enterprise office environment through a wired or wireless network. You must first add the dumb terminals in the SASE console, then configure network access on the local switch.

Step 1: Add a dumb terminal

  1. Log on to the Secure Access Service Edge console.

  2. In the left-side navigation pane, choose Endpoint Management > Terminals.

  3. In the list on the left, select Dumb Terminal. Click Add Terminal or Import Devices.

    • Add Terminal: In the Add Terminal pane, enter the terminal's MAC Address, MAC Address Mask, Device Vendor, Device Name, and Device Type, then click OK.

    • Import Devices: In the Import Devices dialog box, click Download Import Template. After you fill in the required device information, click Upload Local File. When the upload is complete, click OK.

Step 2: Access configuration

The network access configuration depends on whether the terminal uses a wired or wireless network.

Note

You do not need to configure certificate management or install the SASE client for dumb terminals. You can skip these steps.

Step 3: View dumb terminal authentication logs

  1. In the left-side navigation pane, choose Log Analysis > Log Audit.

  2. On the Access Logs > Dumb Terminal Authentication Logs tab, view the authentication status of the dumb terminals.

Previous：Manage SASE with CloudMonitorNext：Best practices for agentless private access