CITES Networking: How does UIUCnet QuickConnect work?

Introduction

CITES is using a UIUC-customized version of the NoCat technology, along with firewalls and Bluestem authentication of users' Network IDs, to create a simple web-based method of authenticating users who are eligible to connect to the campus network via UIUCnet Wireless and UIUCnet Walkup.

The UIUCnet Wireless and UIUCnet Walkup subnetworks are isolated from the rest of the UIUCnet network by firewalls. Both UIUCnet QuickConnect and the VPN server act as gateways to permit wireless and walkup users to connect to the rest of UIUCnet and the Internet.

Quick summary: How it works

UIUCnet QuickConnect uses asynchronous identification, which means that you don't need a constantly active connection in order to remain identified.

On the user's end, when you log in, an authentication cookie is placed on your system and an automatic renewal popup window will reauthenticate you once every hour while you're using the network. (If you close the window, you'll need to log in again at the end of the hour.)

On the UIUCnet end, the QuickConnect gateway identifies the computer from which you've logged in and remembers that computer for an hour, even if you move around, reboot, or travel through an area where there's no wireless signal. You'll be able to reconnect the next time you stop in a wireless-covered area within that hour. (However, if you move far enough to reconnect in a different section of the wireless network, you may encounter DHCP lease issues, as explained below.)

Renewing your login automatically

While both your authentication cookie and the QuickConnect identification of the computer are valid, you can navigate commonly-used parts of the campus network and Internet without needing to log in again. (See QuickConnect and Security for an explanation of exceptions.)

If you continue using the network and keep the renewal window open, at the end of the first hour, QuickConnect will automatically renew you for another hour of network use.

When you'll need to click to log in

If either the user identification or the QuickConnect identification of the computer are lost, you will eventually have to open a browser window and log in again.

If you close the renewal window or it's blocked by a pop-up blocker, your user identification will be lost at the end of the hour and you'll need to log in again to authenticate.

QuickConnect's computer identification can be lost if you move from one section of campus to another, if the QuickConnect system is restarted, or if a certain amount of time passes without network activity from your computer.

Hibernation or no-signal areas

For UIUCnet Wireless users:

Unlike the VPN system, where your computer must maintain a constant active connection to the server, QuickConnect is much more tolerant of fluctuations in network use and wireless signals. As long as your browser window is open, whether or not you're actively using the network, the ability to pick up where you left off (without logging in again) will remain active an hour at a time and can be automatically renewed. As long as you use the system again within an hour, QuickConnect identification will last through putting your laptop in standby or hibernation mode (with a browser open), wandering the halls of a building, and waking your laptop again.

Of course, you have to be in an area where your wireless card can receive enough of a signal to communicate in order to keep networking. If you stop in an area without enough wireless signal, the network itself will be slow or nonfunctional -- but your authentication through QuickConnect will remain in place until an hour passes, and when you move to an area with better signal, your network speeds will also improve without another login.

Implications for use

Some of the implications of this signal-independent identification method are:

You can close all your browser windows and continue networking for an hour, whether or not the renewal window is open. However, at the end of the hour, you'll need to log in again if the renewal window has been closed.

You can reboot your system and your computer's identity may still be remembered; however, your own identity will not last past the end of the hour without the renewal window. So when the time's up, you'll need to use your Network ID to log in again.

If you walk down the hall and move your computer through an area that isn't covered by wireless signals, you would be disconnected from the VPN server; however, QuickConnect doesn't mind, because it doesn't require a constant, active signal. (This is why it may remember your computer across reboots.) If you kept a browser window open and can receive a signal from UIUCnet Wireless at the place you stop, even if your computer went into standby or hibernation, then you can pick up your browsing or email without having to log in again.

If you walk a long distance, such as from one part of campus to another -- regardless of whether your computer is active or shut down -- you may be in a different section of the wireless or walkup networks at your new location. You may need to take special actions beyond rebooting in order to be able to connect again, because the QuickConnect system may remember your system's old location despite a reboot for the reasons explained above. See also Moving around campus and Releasing and renewing your DHCP-based IP address.

Logging in vs. Network ID authentication

As mentioned above, there are two different parts to the identification used in the UIUCnet QuickConnect system:

User identification
(where users provide their Network ID and Active Directory password to the Bluestem server)

Computer identification
(where the QuickConnect firewalls identify the computer which is being used to connect to the network)

Therefore, it's possible that you may need to provide your Network ID even when your computer is still recognized on the network. Or you may need to re-identify your computer for the network while your Network ID is still remembered.

If you try to visit a http:// URL and are instead presented with the UIUCnet Connect login window, the first step is to click the Login button. After that, you may or may not be presented with a Network ID prompt from the Bluestem server which provides authentication for campus users.

Login screen followed by Network ID prompt

If you click the Login button and are taken to a window which prompts for your Network ID and Active Directory password, then your user identification has expired and you'll need to reauthenticate yourself in order to continue using UIUCnet QuickConnect.

Login screen not followed by Network ID prompt

If you click the Login button and are not taken to a Network ID screen, instead continuing either to a "thank you for logging in" message or to the URL you originally typed, then your user identification is still current but UIUCnet QuickConnect needed to confirm the identity of the computer you are using.