User Access Manager Help >> Operation Guide >> User Access Policy >> Access Service

Access Service

Access service defines how an end user can use the network. A service is a set of predefined network features, including basic information and access policy information. Services provide complete access policies for the end users. After a user applies for a service, the user can access the network according to the predefined service attributes.
An access device group is a policy used to control access of a specific user that connects to the network from a specific access device group. With access device group policies configured in a service, the access policy for a user using the service is as follows:

Item	Access Policy	Security Policy	Proprietary Attribute Assignment Policy	Charging Plan	Internet Access Configuration
The user's access condition completely matches the access condition information of the access policy	The one specified in the access policy takes effect	The one specified in the access policy takes effect	The one specified in the access policy takes effect	The one in the service takes effect	The one specified in the access policy takes effect
The user's access condition does not completely matches the access condition information of the access policy	The default access policy in the service	The default security policy in the service	The default security policy in the service	The charging plan in the service	The default Internet access policy in the service

References: Access Device Group, Endpoint IP Group, SSID Group, Endpoint MAC Group, AD Group, Auth Type, Access Method, Access Period Policy.

Functions

• Add/Modify Access Service
• Deleted Access Service

Parameters

Basic Information

• Service Name: Uniquely identifies a service in the access service.
• Status: The status of a service determines whether the service can be applied for. A service can be in Available, Unavailable, or Invalid.
• Service Suffix: Used in authentication to identify services that the user has applied for. If service suffix is set for the service that the user has applied for, the pair "username+service suffix" must be used as the login name for authentication. For an authentication, the service suffix must be the same with the domain name of the access device, and the device must upload the domain name. The following table shows the relationship between service suffix, username used for authentication connection, device domain, and command in RADIUS scheme view of the device:

Username used for authentication connection	Domain used for device authentication	Command in RADIUS scheme view of the device	Service suffix in INC
X@Y	Y	user-name-format with-domain	Y
		user-name-format without-domain	No suffix.
X	Default domain specified for the device.	user-name-format with-domain	Default domain
		user-name-format without-domain	No suffix.

• Description: Briefly describes the service.
• Daily Max. Online Duration: Total duration in a day that an account can access the network by using the service. When the limit is reached, the account is forced offline and is unable to access the network in the day. This parameter is an integer in the range of 0 to 1440 minutes. A value of 0 means not limited.
• Default Security Policy: If a user using the service does not match an access device group when the user accesses the network, the system checks and monitors the security status of the user PC according to the configuration of the default security policy. This option appears only when the EAD component is installed.
• Default Internet Access Policy: If the access condition of the user does not match the access condition of the service, the user is controlled by the default Internet access configuration.
• Default Access Policy: If the access condition of the user does not match the access condition of the service, the user is controlled by the default access policy.
• Default Proprietary Attribute Assignment Policy: If a user using the service does not match an access device group when the user accesses the network, the system deploys proprietary attributes to the access device according to the configuration of the default proprietary attribute assignment policy.
• UAM checks the maximum number of bound endpoint devices for a single account in the following order:
  1.Matched access scenario: Checks the number of bound endpoint devices against the maximum number limit specified in the scenario. If the number reaches the limit, UAM denies the user authentication.
  2.Scenarios in all services: Checks the number of bound endpoint devices in scenarios of all assigned services for the account. If the number reaches the value of Max. Devices for Single Account specified in user endpoint settings, UAM denies the user authentication.
• Max. Number of Online Endpoints: Specifies the maximum number of endpoints that can be simultaneously used for network access by the access user in the access scenario. The value range is 0 to 999. The value of 0 indicates that the number of online endpoints is not limited. When the specified value is reached, no more endpoints can be used for simultaneous network access by the access user in that access scenario.
• Default Max. Number of Online Endpoints: Specifies the maximum number of endpoints that can be simultaneously used for network access by the access user when the user's access scenario matches none of the access scenarios in the service assigned to the user.
• Charging Plan: When a user gets online and uses this service, the system will use this plan for charging. This option appears only when the CAMS component is installed.
• Billing Term Start Type and Start Date: These options appear only when the CAMS is installed and a periodic account policy is used. If you use the user-defined billing term, you must set the start type to Auto, and the start date to Unlimited. The following table describes the combinations of Billing Term Start Type settings and Start Date settings.

Start Type	Start Date	Billing Term	Charging	Applicable to	Example
Auto	Unlimited.	The billing term start time and end time vary with the user access behavior.	In this case, a user can use the network for a whole billing term.	Users who access the network irregularly and sometimes do not use the network at all, such as users who often travel on business and students who enjoy summer and winter holidays.	Suppose that an administrator assigns a service to the user on June 2nd. The billing term of the service is 1 month and the fixed fee is 20 dollars. If the user uses the service for the first time on June 20th, the first billing term is from June 20th to July 20th, and the system deducts the fixed fee of 20 dollars from the account of the user when the user starts to use the service. If the user does not use the service from July 20th to August 10th and gets online on August 11th, no charge is made during the idle period and the new billing term will start from August 11th.
	A day of the month in the range 1 to 27.	Both the start time and end time are fixed.	The fixed fee is deducted when the user gets online during a billing term. If the service is never used during a billing term, the user is not charged for the billing term.	Users that access the network regularly and occasionally stop accessing the network.	Suppose that an administrator assigns a service to the user on June 2nd. The billing term of the service is 1 month, the fixed fee is 20 dollars, and the billing term start date is the 3rd day of a month. If the user uses the service for the first time on June 20th, the first billing period is from June 3rd to July 3rd, and the system deducts the fixed fee of 20 dollars from the account of the user when the user starts to use the service. If the user does not use the service from July 3rd to August 3rd, there will be no charge for the billing term. If the user gets online on August 11th, the user will be charged the fixed fee for the billing term from August 3rd to September 3rd.
Date	A day of the month in the range 1 to 27.	Both the start time and end time are fixed.	This type facilitates charging and billing.	Users who use the network regularly and seldom stop using the network.	Suppose that an administrator assigns a service to the user on June 2nd. The billing term of the service is 1 month and the fixed fee is 20 dollars. If the billing term start date is the 3rd day of a month, the billing term will be from the 3rd day of each month to the 3rd day of the next, and the system will deduct the fixed fee of 20 dollars from the account on the 3rd day of each month.
Open date	A day of the month in the range 1 to 27.	Both the start time and end time are fixed. The start time is set when the service is assigned to the user.	This type facilitates charging and billing.	Users who use the network regularly and seldom stop using the network.	Suppose that an administrator assigns a service to the user on June 15th. The billing term of the service is 1 month and the fixed fee is 20 dollars. The start date of the billing period is every 15th of the month. If the service is assigned on any date from 28 to 31, the start date of the billing period is every 27th of the month. The user is charged 20 dollars for every billing term regardless of whether or not the user gets online through the service in that term.

 

• Adaptive consecutive deduction: Once a user starts to use the service, the system will deduct the fixed fee from the account every billing term regardless of whether the user continues to use the service or not, until the balance of the account is less than the fixed fee. This option appears only when the CAMS component is installed.
• Charge Whole Term in Initial Term, Charge by Day in Initial Term, No Charge for Initial Term: These options appear only when the CAMS component is installed, and are available only when the start date of the billing term is in the range 1 to 27. The following table describes these options.

First billing term	Fixed fee for the first billing term	Example
Charge Whole Term in Initial Term	As long as a user starts to use the service, the system charges the user the fixed fee regardless of the actual start date.	Suppose that the start date of the billing term is the 1st day of every month and the fixed fee is 30 dollars. If a user applies for the service on April 10th, the first billing term is from April 1st to May 1st. Even if the user uses the service for the first time on April 11th, the system still charges 30 dollars for the first billing term.
Charge by Day in Initial Term	For the first billing term, the system charges a user of the service by day. This is to protect the benefits of users.	Suppose that the start date of the billing term is the 1st day of every month and the fixed fee is 30 dollars. If a user applies for the service on April 10th, the first billing term is from April 1st to May 1st. If the user uses the service for the first time on April 11th, the system will charge the user 20 dollars because the remaining time of the billing term is 20 days.
No Charge for Initial Term	The first billing term is free of charge, and charging will be made from the second billing term on.	Suppose that the start date of the billing term is the 1st day of every month and the fixed fee is 30 dollars. If a user applies for the service on April 10th, the first billing term is from April 1st to May 1st, and this term is free of charge.

 

• Available: Selecting the check box means that the service can be applied for. When you enable applying for service by user group, if a service has been assigned to a user group, the access users belonging to the user group apply for the service no matter whether the service is in available state or not.
• LDAP Priority: Determines the priority of the service applied by an LDAP user account. On the LDAP server, when the server type is configured as Microsoft AD and the service sync type is configured as Based On Active Directory, a user may belong to several groups, each of which is configured with a service. In this case, the system determines which service the user uses according to the LDAP priority. A smaller value indicates a higher priority. The maximum LDAP priority value is the total number of access services.
• Service Group:Select a service group for the service. The service group ensures privilege management of the service. The administrators and maintainers can add the service to one of the service groups to which they have the management privilege.
• Transparent Authentication: Select this option to enable transparent authentication for the access service. When an endpoint user first passes authentication by entering the correct username and password, the RADIUS server binds the endpoint MAC address with the access user account. Next time the user attempts the network access, the RADIUS server automatically authenticates the user by matching the MAC address to the bound account, without user intervention. Transparent authentication includes transparent portal authentication and transparent MAC authentication. In transparent portal authentication, the access service is also bound with the MAC address and user account, and must be matched for subsequent user authentication.
  To enable a portal gateway to perform transparent authentication on an endpoint:
  1. Configure the portal gateway to support transparent authentication at the CLI. Specify the IP address and port number of the portal server to process packets for transparent authentication. The default port number is 50100.
  2. Select Supported for Transparent Authentication on the User > User Access Policy > Portal Service > Device > Configure Port Group > Add Port Group page.
  3. Select Enable for Transparent Authentication on the User > User Access Policy > Service Parameters > System Settings > User Endpoint Settings page.
  To implement transparent MAC authentication, you must complete the following configuration:
  1. Configure the access device to support transparent authentication at the CLI.
  2. Select Enable for  Transparent Authentication on the User > User Access Policy > Service  Parameters > System Settings > User Endpoint Settings page.
  
  You can view bindings for the endpoint MAC address, access user account, and access service on the User > User Endpoint > Endpoint Management page.
  When Transparent Authentication is selected for an access service, the Bind User MAC option of the service does not take effect on users who pass transparent authentication.

Access Scenario List

If the access condition of the user completely matches the access condition on the access policy list, the user determines the security policy, proprietary attribute assignment policy, and access policy used according to the access policy configuration during the authentication. Otherwise, the user uses the default security policy, the default proprietary attribute assignment policy, and the default access policy in the service. The Security Policy appears only after the EAD security policy component is installed. The following example illustrates the access policy in details:

Access Scenario

Access Period Policy

Access Location Group

SSID Group

Endpoint IP Group

Endpoint MAC Group

AP Group

Phone Number Group

IMSI Group

AD Group

Access Policy

Set security policy

Proprietary Attribute Assignment Policy

Internet Access Configuration

Priority

Access scenario A

Access period policy A

Access location group A

SSID group A

Endpoint IP group A

Endpoint MAC group A

AP group A

Phone number A

IMSI group A

AD group A

Access policy A

Set security policy A

Proprietary attribute assignment policy A

Internet access configuration A

1

Access scenario B

Access period policy B

Unlimited

SSID group B

Endpoint IP group B

Endpoint MAC group B

AP group B

Phone number B

IMSI group B

AD group B

Access policy B

Set security policy B

Proprietary attribute assignment policy B

Internet access configuration B

2




1) If the access condition of the user matches access condition A, the user uses access policy A, security policy A, proprietary attribute assignment policy A, and Internet access condition A for authentication..
2) If the access condition of the user matches access condition A and access condition B at the same time, because the priority of access condition A is higher than access condition B, the user uses access policy A, security policy A, proprietary attribute assignment policy A, and Internet access condition A for authentication.
3) If the access condition of the user does not match any access condition, the user uses the default access policy, the default security policy, the default proprietary attribute assignment policy, and the default Internet access condition for authentication.
4) The access scenario can include an access period policy. If the access time matches an access-allowed period in the policy, the access scenario is matched. If the access time matches an access-forbidden period, the access scenario is not matched.


• User Group That Applies for the Service: If you enable applying for service by user group, you can specify user groups that must applying for a specific service, or configure the service that must be applied for by a user group on the page for adding or modifying a user group.

Related Topics

• Access Device Group
• Endpoint IP Group
• SSID Group
• Endpoint MAC Group,
• Access Period Policy
• Access Condition
• AD Group