Configure Passive Authentication for VMS

For supported software information, click here.

Versa Messaging Service (VMS) is a services platform that enhances the scalability of Versa services and applications. VMS is built by leveraging state-of-the-art open source technologies such as Kubernetes and Docker.

The following are some of the main features of VMS:

• Handles data such as critical network performance information, security updates, and passive authentication data such as user-to-IP address mapping
• Manages highly dynamic data that is streamed to each Versa Operating System™ (VOS™) device to keep it updated
• Processes a high volume and a large scale of data

VMS is a component of the Versa headend as shown in the following figure.

VOS devices use VMS to support passive authentication, using it to check and confirm user identity without requiring any specific action to authenticate users. For passive authentication, VMS handles high volumes of streamed data and disseminates this data to VOS devices deployed across a network. 

VMS circulates user–IP address mappings to VOS devices over two channels:

• Real-time channel—Streams data in near real-time from VMS servers to VOS devices that are configured to receive the user–IP address mappings.
• Bulk update channel—Creates a snapshot of the current user–IP address mappings available to VOS devices at a configurable interval. VOS devices use the bulk update channel to synchronize the user–IP mappings when the real-time channel is not available.

VMS includes the following components:

• Database—The database receives the user–IP address bindings from the Microsoft Active Directory (AD) server using a Windows Management Instrumentation (WMI) agent. If the full set of user–IP address mappings is requested, the response is received as a bulk update. The WMI Agent subscribes only to certain AD events.
• Messaging server—Publishes real-time user–IP address mappings to devices that subscribe to receive incremental updates for the version installed on the device. Incremental updates are published only if the incremental update is greater than the full update version.
• Package builder—Provisions the update for devices and informs Versa Director about the availability of a new full update of the user–IP address mappings database.
• WMI agent—Receives and passes on notifications from AD to VMS to update VMS entries, and learns about new events. The WMI agent publishes incremental updates to the real-time messaging server. For more information, see Install and Configure the WMI Agent.
• VOS devices—Search for user–IP address mapping in the local VOS database. If a VOS device receives the traffic from a user whose IP address is present in its user–IP address mapping, the configured user or group policies are evaluated and policies are applied. To authenticate users who are not authenticated using passive authentication (for example, WiFi users and guest users), you must configure VOS with active authentication using SAML or Kerberos. VMS supports user–IP address mappings for IPv6 addresses. Currently, however, Versa Networks does not support IPv6 as a transport from VMS to VOS devices.