CCNA Wireless
Waves, Frequencies, and RF
Waves – Wireless starts and ends with waves, specifically
radio waves. There are different modulation techniques to encode data onto a
carrier wave signal. These techniques differ between the 3 (now 4 with N)
flavors of wireless, A, B, and G. DSSS (Direct Sequence Spread Spectrum)
is the modulation technique used by 802.11b, which uses “chipping codes” to
send redundant data to allow for interference. OFDM (Orthogonal Frequency
Division Multiplexing) is the modulation technique used by 802.11a and
802.11g. This technique divides a channel into multiple subcarriers, similar to
how a T1 is divided up. Data is sent simultaneously over these subchannels to
achieve redundancy and a combined higher data rate. MIMO (Multiple-Input
Multiple-Output) is the modulation technique used by 802.11n and allows a
device to use more than 1 antenna for sending data and 1 antenna for receiving
data. This is the main thing that helps N products achieve such higher data
rates than a and b/g, along with many other advances in how signals are
processed.
Frequencies – All wireless devices use unlicensed frequencies, meaning
that you do not have to apply for a license from the FCC to use them and they
are subject to interference from other devices. Within the frequencies assigned
to a and b/g there are also “channels,” which are the portion of the frequency
that an individual device can use. This is less important for 802.11a devices as
AP’s using 802.11a will automatically sense and choose a channel that is less
likely to conflict with the AP’s around it. A also has a lot more
non-overlapping channels to choose from – 23 within the 5GHz range of
802.11a. 802.11b only has 3 non-overlapping channels to choose from within
the 2.4Ghz range 802.11b uses. If 2 AP’s next to each other are
transmitting at on the same channel, the signal to noise ratio will rise and
the bandwidth available will decrease.
RF – Radio Frequency waves behave like light waves or
any other waves. They are subject to many issues that can degrade performance
of a wireless network. Surveying before deploying a network and periodically
helps mitigate these issues. Absorbtion describes how waves are blocked
by walls or dampened by carpet. This is similar to how sound waves are
absorbed. Scattering is how waves are reflected by something in the air,
like heavy rain. Refraction describes how a wave’s path is altered by
passing through something, such as think glass. This is similar to what happens
to light waves as they pass through a prism. Reflection describes how
waves bounce off of shiny or reflective objects, which can cause more noise as
wireless frames arrive out of order, causing a “multipath issue” where signals
can become out of phase and cancel each other out. Line of Sight can
become an issue in wireless WAN deployments as the curvature of the earth
itself can become an obstacle, making taller towers necessary. Signal-to-Noise
Ratio is a measurement of how strong a signal is compared to all the
surrounding noise. This can be helpful when diagnosing issues with RF coverage
or deciding how to place AP’s.
Topologies
WPAN, WLAN, WMAN, and WWAN – A WPAN (Wireless
Personal Area network) is limited to 20ft and is primarily for peripheral
devices (mice, Bluetooth devices, etc), operates on the unlicensed 2.4GHz
spectrum and is generally limited to 8 active devices. It can also be called a
“piconet.” A WLAN (Wireless Local Area Network) operates on the 2.4 or 5
GHz spectrum, spans about 100 meters from AP to client, and is more flexible to
allow more than 8 devices. WLANs and their clients are dual-band, supporting
different transmission methods in different areas. A WMAN (Wireless
Metropolitan Area Network) is slower than a WLAN, but covers more distance with
speeds closer to broadband. Also includes WiMAX. Speeds decrease with distance.
A WWAN (Wireless Wide Area Network) is essentially a wireless WAN
connection with low rates, high cost and a licensed frequency.
802.11 Topologies – Originally, there were 2
modes for 802.11 networks – Ad Hoc and Infrastructure. Ad hoc networks
are made by wireless clients without a central device controlling them, like an
AP. These are also called IBSS (Independent Basic Service Set) and are
frowned upon for enterprise use for a number of issues, many of them security
related. Network Infrastructure Mode is the one most commonly used in
enterprises. When there is only 1 AP, it is called a BSA or Basic
Service Area or wireless cell, if more than 1 AP is connected, then it is
called a ESA or Extended Service Area.
SSID’s – Service Set Identifiers (SSIDs) are mapped to a
MAC address on the AP that you are connecting to. The MAC address can be the
MAC address of the wireless radio on the AP or a virtual one it generates. If
an AP has only 1 SSID, it is called a BSSID or Basic Service Set
Identifier. If an AP has more than one SSID, it is called a MBSSID (Multiple
Basic Service Set Identifier.
Bridges – Cisco offers 2 types of
workgroup bridges, which help extend a wired network to an area you can’t run
cable to. They are point-to-point wireless connections. Autonomous Workgroup
Bridge (aWGB) and Universal Workgroup Bridge (uWGB).
Repeaters – A repeater extends the
reach of a WLAN and does not require a wired connection. Regular Cisco AP’s can
act as repeaters, but there is a performance hit with each hop.
Outdoor Wireless Bridges – These
connect wired LANs together in either a point-to-point connection or
point-to-multipoint connection, like from building to building. Aironet 1300
bridges and Aironet 1400 bridges can do this. A 1300 series will also connect
clients and uses the 2.4 GHz range. The 1400 uses the 5 GHz range.
Outdoor Mesh Networks – This allows a bunch of
AP’s to form a mesh network. Requires controllers.
Antennas
Polarization – RF waves are
electro-magnetic waves, so like a magnet, they have polarization. This is a
bigger issue for outdoor deployments than indoor, but is one of the reasons to
be careful how you position an antenna.
Diversity – The use of 2 antennas for
each radio to increase the odds of getting a good signal.
Antenna Types:
Omnidirectional – Across the Horizontal
plane or Azimuth, the signal spreads fairly evenly. In the veritical plane or
Elevation plane, signal propagates mainly downward, meaning that an AP on the
ceiling will not bleed so much to the floor above. These are generally the most
common.
2.2-dBi Dipole – Similar propagation to
an omnidirectional, but with a doughnut shape in that on the Elevation plane there
are some gaps in the middle. These look like short plastic poles and usually
have a hinge where they can be bent.
Directional Antennas – Give more control over
RF propagation, such as parabolic dishes and on walls.
8.5-dBi Patch, Wall Mount – Most signal
is focused forward, with a little allowed to bleed back.
13.5 Yagi Antenna – Very directed, focused
RF pattern, such as a straight shot down a hallway.
21-dBi Parabolic Dish – Very, very narrow
path…must be calibrated correctly. Most allow you to change polarity to make
them easier to mount.
Antenna Connectors and Hardware:
Attenuators – reduces signal between
the radio and antenna to comply with FCC regs.
Amplifiers – Adds gain to strengthen a
signal between the AP and antenna.
Lightning Arrestors – Prevents surges from
lightning strikes from traveling from an antenna to a LAN and damaging
equipment. Does not stop direct strikes.
802.11 Protocols
Original 802.11 Protocol – RF tech:
FHSS (Frequency Hopping Spread Spectrum) and DSSS (Direct Sequence Spread
Spectrum), Coding: Barker 11, Not used today because it only yields 1 to 2
Mbps.
802.11b Protocol – RF tech: DSSS, 2.4GHz
spectrum, Coding: Barker 11 and CCK (Complementary Code Keying), Modulation:
DQPSK (Differential Quadrature Phase-Shift Keying). Gives data rates of
1,2,5.5, and 11 Mbps and has 3 non-overlapping channels of 1, 6, 11. Backwards
compatible with original 802.11.
802.11g Protocol – RF tech: DSSS and OFDM
(Orthogonal Frequency Division Multiplexing), 2.4 GHz spectrum, Coding: Barker
11 and CCK, Data rates of 1, 2, 5.5, 11 Mbps with DSSS and 6, 9, 12, 18, 24,
36, 48, and 54 Mbps with OFDM and has the same 3 non-overlapping channels as b.
Backwards compatible with original 802.11 and b.
802.11a Protocol – Not compatible with
original 802.11, b, or g. uses 5GHz spectrum, RF tech: OFDM, Coding:
Convolution Coding, Modulation: BPSK, QPSK, and 16 or 64-QAM. Data Rates are 6,
9, 12, 18, 24, 36, 48, and 54 Mbps with OFDM. Multiple non-overlapping channels
– AP’s automatically choose a channel not in use by adjacent AP’s.
802.11n Protocol – Backward compatible with
ALL 802.11 protocols. Uses MIMO (Multiple-Input, Multiple-Output) to achieve
higher data rates even for a, b, and g clients, Less harmed by interference and
reflection. Up to 32 data rates.
Wireless Frame Transmission
Frame Types:
Management Frames – Used for association and
anything else to do with leaving or joining a BSA.
Control Frames – ACK’s for when data
frames are received.
Data Frames – Duh…they contain data.
Sending Frames:
Wireless LANs use CSMA/CA (Carrier Sense Multiple Access Collision
Avoidance). This means they listen to the network and wait a designated time
before attempting to send data. This period is called the IFS (Interframe
Space) and can vary according to the type of client or data.
SIFS (Short Interframe Space) – Higher
priority. Used for ACKs and others
PIFS (Point-coordination Interframe Space) – Used when
an AP is going to control the network
DIFS (Distributed-coordination Interframe Space) – The normal
spacing between frames. Used for data frames.
A client starts counting down a random timer. If it hears nothing during that
timer, it sends frames. If it does, it adds 45 to it’s current count and
continues counting down until it hears nothing, then sends. The total time it
has to wait is called a Contention Window.
Wireless Frame Headers:
A Wireless Frame Header can have up to 3 MAC addresses in it. The Source
and Destination MAC addresses and a BSSID, which is also a MAC address.
Wireless frames are larger than Ethernet frames and often have to be fragmented
before bridged to the wired network.
RTS/CTS – If a AP is controlling
the network, the client will send a RTS or “Request to Send” to see if it is
allowed to take a turn sending frames. If it is, the AP will respond with a CTS
or “Clear To Send” response telling the client to proceed.
Other Wireless and How They Mess Your WLAN Up!
Cordless Phones – Not too common anymore,
but they do interfere with wireless since they operate either at 2.4GHz or
5.8GHz. They use TDMA (Time Division Multiple Access) or FDMA (Frequency
Division Multiple Access) to allow several devices to use the same frequency at
the same time on different “channels.”
Bluetooth – Interfers with b/g WLANs
as it operates at 2.4GHz, but has limited range. Uses FHSS (Frequency Hopping
Spread Spectrum) so it will jump to a different frequency within that range to
minimize interference. Considered a piconet or WPAN. Connects multiple slave
devices to one master device for its topology.
ZigBee – Another WPAN technology, mostly used for
monitoring devices. Has a funky topology with stars and clusters with some full
function devices and some coordinators or reduced function devices.
WiMAX – Doesn’t interfere with WLAN’s, but is basically a
wireless broadband solution for WAN links to the internet.
Other Culprits of Interference – Leaky
Microwaves (huge problem in real life!), Wireless X11 cameras, Radar Systems, Motion
Sensors, Fluorescent Lighting, Game Controllers and adapters.
How Packets Get To and From a Wireless Network From
a Wired Network
Association – A client either passively
scans a network to see what SSID’s are being broadcast by a beacon from the AP
or actively scans sending a probe request for a specific SSID that may or may
not be being broadcast. If the client hears a beacon or receives a probe
response, the client sends an authentication request to the AP for the desired
SSID. The AP should respond with an authentication response. If this is
successful, the client sends an association request that includes client info
like data rates and the AP responds with an association response that contains
the AP’s info like data rates. The client chooses a data rate based on the RSSI
(Received Signal Strength Indicator) and the SNR (Signal-to-Noise Ratio). The
client is now associated.
Sending to a Host on Another Subnet – 1. Client
decides to send traffic to another host. 2. Client determines that the other host
is not on their subnet. 3. Client decides to send the traffic to its default
gateway. 4. Client looks up gateway in ARP, but it’s not there. 5. Client sends
an ARP request to the AP for the gateway. 6. The AP sends the ARP request to
its controller using the LWAPP (Lightweight Wireless Access Point Protocol)
across the wired network, encapsulating it into a 6 byte header for the trip.
7. The Controller opens the LWAPP frame and reads the ARP request and rewrites
the ARP request into an Ethernet frame and sends that across the wired network
as a broadcast. All the switches that receive this broadcast flood it out all
ports except the one it was received on. 8. A layer 3 device receives the ARP
request broadcast and responds with a unicast ARP response which is received by
the WLAN controller. 9. The controller rewrites the Ethernet frame into a
802.11 frame and adds a LWAPP header and sends it to the AP. 10. The AP removes
the LWAPP header and exposes the 802.11 frame which contains the ARP response.
11. The AP buffers the frame and starts a backoff timer and goes through the
usual process of waiting for a free moment to send. It then sends the frame to
the client.
Vlans – In order for multiple SSID’s to be able to be
used on an AP, a logical Vlan must be assigned to the SSID, which allows
different SSID’s to have different subnets. APs using multiple Vlans and SSID’s
need to have trunk ports between them and the switch they are connected to.
Configuring Vlan’s is covered in the CCNA, but suffice it to say an SSID is
mapped to one logical subnet and one logical Vlan.
Cisco Unified Wireless LANs
CUWN (Cisco Unified Wireless LAN) – Cisco’s
Lightweight wireless infrastructure which moves some tasks from the Access
Point (AP) to the Wireless LAN Controller (WLC) using what they call the “Split
MAC Architecture.” AP’s send information to and from the WLC using LWAPP
(Lightweight Wireless Access Point Protocol) and the WLC can make decisions
boosting or weakening AP signal strength to provide better coverage, boosting
the power of AP’s around an AP that has failed, containing rogue AP’s, etc. A
WLC can manage from 6-300 AP’s. WCS (Wireless Control System) can then control
multiple controllers.
Cisco Controllers and AP’s:
The AP Handles – Frame exchange,
beaconing, buffering and transmitting frames, responds to probe requests,
forwards notifications of receive probe requests to WLC, provides RRM (Radio
Resource Management) information regarding quality to WLC, monitors all
channels for noise and interference.
The WLC handles – Association,
Reassociation when roaming occurs, Authentication, Frame Translation and
Bridging.
LWAPP Modes:
Layer 2 LWAPP Mode – Being deprecated by
Cisco. WLC has to be in the same subnet as the AP’s it controls.
Layer 3 LWAPP – Cisco’s preferred mode.
LWAPP travels across subnets and the WLC can be in a different subnet than the
AP’s.
Multiple Networks
WLC’s can support up to 512 Vlan’s. All data regardless of the SSID/Vlan is
sent in 1 tunnel from the AP to the WLC via LWAPP. The WLC can only have 16
SSID’s per each AP, though.
CUWN Architecture
Clients – Aironet Client Devices,
Cisco-compatible client devices, Cisco Secure Services Client
AP’s:
1130AG – Can operate as autonomous or lightweight and
H-REAP (Hybrid Remote Edge AP). Designed for Indoor use. Supports 802.11a/b/g
1240AG – Has same features as
1130’s but only uses external antennas.
1250 Series – Supports 802.11a/b/g/n.
Designed for rugged environments, uses 2×3 MIMO technology with external
antennas.
1300 Series AP/Bridge – Outdoor AP or Bridge.
Does not have a 5GHz radio, so only supports 802.11b/g. Can be purchased with
integrated antennas or connectors for external antennas. Has a special power
supply.
1400 Wireless Bridge – Can only operate as a
bridge and cannot connect clients. Does not support LWAPP and is autonomous
only. Designed for outdoor environments and can be purchased with an internal
antenna or connectors for an external antenna. Supports 802.11a/b/g.
WLC’s:
4400 Series WLC – Supports 12, 25, 50, or
100 AP’s depending on model. Can support up to 5,000 MAC addresses in database.
AP and controller must run the same code version, but the controller will
upgrade or downgrade the AP.
3750-G WLC – A WLC integrated into a
small switch with the swich and WLC sharing a backplace. Saves space and ports.
Cisco WiSM (Wireless Services Module) – Blade that
installs in a 6500 or 7600 chassis, sharing a backplane. WiSM supports up to
300 Ap’s or 150 AP’s per controller with each blade having 2 controllers.
Allows clustering of AP’s into a mobility domain.
Cisco 2106 WLC – Same form factor as ASA
5505’s. Small branch controller with 2 PoE switchports. Supports up to 6 AP’s.
Cisco WLCM – Another small branch
controller designed to be added to an ISR router as a module. Supports 8 or 12
Ap’s, depending on model.
WCS Flavors
Runs on Windows or Linux Red Hat servers. Manages up to 3,000
lightweight AP’s and 1250 Autonomous AP’s. If you add WCS Navigator, it scales
above 3,000 AP’s by letting you navigate between several WCS servers. Also
works with Wireless Location Application to track RFID tags.
Controller Discovery and Association
LWAPP Layer 2 Transport Mode – Again, not
preferred by Cisco, AP and WLC must be on the same Subnet. All LWAPP
communication is in Ethernet encapsulated frames, not IP packets.
LWAPP Layer 3 Transport Mode – Preferred
due to scalability. Frames are encapsulated in UDP. You need to make sure any
firewalls between the AP’s and the controller allow UDP port 12222 for LWAPP
data messages and UDP port 12223 for LWAPP control messages. A 1500 MTU is
assumed, but can be changed.
LWAPP AP Controller Discovery
1. Discovery Mode – An AP boots and enters
Discovery Mode. It sends a layer 2 broadcast Discovery Request message. If this
fails (unless we have a LWAPP layer 2 transport mode in use, it will), it goes
to step 2.
2. The AP moves to layer 3 by checking its config
for an IP address. If it doesn’t have one, it uses Dhcp to get one.
3. The AP gets an IP address from the dhcp server.
If the dhcp server has DHCP option 43 configured to give the AP an IP address
for a controller, the AP now uses that to try to contact one.
4. If no IP address for a WLC was configured on the
dhcp server and no WLC has responded to the layer 2 Discovery Request
broadcast, the AP reverts back to layer2 broadcasts and tries again.
IOS-Based AP’s only do a Layer 3 Discovery, as
Follows:
1. AP does a subnet broadcast to see if a controller
is operating in Layer 3 mode on its subnet.
2. The AP does an OTAP (Over-the-air-Provisioning)
3. When other AP’s exist and are in a joined state
with a WLC, they send messages to the WLC that have the IP address of the controller
in them. The AP that is trying to discover the WLC can overhear these and get
the WLC IP address from them and send a directed Discovery Message to it.
4. After an AP has associated with at least 1 WLC,
the AP gets a list of other controllers from the WLC that it can associate
with. This gets stored in NVRAM and can be used to skip straight to a directed
Discovery Message the next time the AP reboots. This is called AP Priming.
***You can also use DNS to set an entry for CISCO-LWAPP-Controller for
the IP address of a WLC management interface. The AP can use this address to
send a unicast query.
Choosing a Controller
1. The AP chooses the primary controller if it has
been primed.
2. The AP chooses the secondary controller, then the
tertiary controller if it has been primed.
3. If no information is available, it looks for a
master controller. Each mobility group should have 1.
4. If all the above fail, the AP looks for the
least-loaded AP-Manager interface based on the number of AP’s being managed.
5. The AP sends the WLC it has chosen a Join
Message. The WLC should respond with a Join Reply message which includes the
result code, allowing them to talk, it’s certificate, and a test payload to see
if jumbo frames will work. This completes the Join Request Phase.
Receiving a Configuration
If the AP is not running the correct software version, the controller
upgrades or downgrades it at this point. If this is necessary, the AP reboots
and discovers and rejoins the WLC. Once the software versions match, the AP
prompts the WLC for a config by sending a LWAPP config request message that
contains what is already set and what can be configured. When the WLC gets this
request, it send a configure response message with the values. The AP applies
the config in RAM…it is never stored in flash as on an autonomous AP.
Redundancy for APs and WLC’s
N+1 – Provides a single backup for multiple
controllers. This strategy fails if more than 1 controller goes down.
N+N – Each Controller backs up another controller .
Load balancing is important here.
N+N+1 – Most redundant design with every controller
acting as a backup to another and an extra backup designated as the tertiary.
$$$
AP Modes
Local Mode – usual AP mode serving
clients. Can also be used for site surveys
Monitor Mode – Passive and cannot send
traffic or associate clients. Used for finding rogue AP’s, troubleshooting,
surveying, or IDS matches. Can be used with location appliance to increase
accuracy.
Sniffer Mode – Cannot send traffic or
associate clients. Works with 3rd party sniffer software to capture data for
troubleshooting and forensics.
Rogue Detection Mode – Radios are turned off
and cannot associate clients or send traffic. Listens for ARP messages on the
wired network and sends information about rogue AP and client MAC list to
controller for controller to issue alarms.
H-REAP Mode – Allows you to have
lightweight AP’s across a WAN link from their controller. Link must be faster
than 128kbps and latency must be less than 100ms roundtrip. Connected mode
means the AP can reach the controller. If the WAN link fails, the AP goes into
Standalone mode and all client requests are serviced based on a config that is
local to the AP (basically, it reverts back to autonomous).
Bridge Mode – Allow point-to-point or
multi-point links. Mainly used in Mesh networks.
Roaming…no Buffalo…just Roaming
Mobility Groups – A group of controllers
that share information about clients that are roaming. Think a group of
controllers in one building on a campus. A client does not need to reassociate
when moving between AP’s on different controllers in a mobility group and keeps
the same IP even if the AP it roams to is in a different subnet.
Mobility Domain – A group of mobility
groups or controllers in different mobility groups that share information
regarding their clients. Think of two buildings connected in a campus…this
might be 2 different mobility groups, but 1 mobility domain. Users roaming
between AP’s on different controllers in different mobility groups that are in
the same mobility domain do not need to reassociate, but they do have to get a
new IP address. Users who roam from an AP on a controller in one mobility
domain to a controller in a completely different mobility domain do have to
reassociate completely as if connecting for the first time and will lose
connection.
Roaming Requirements – All controllers have to
be in the same mobility domain. All WLC’s must be on the same code version. All
WLC’s have to operate in the same LWAPP mode. ACL’s (Access Control Lists) in
the network must be the same. The SSID must be the same.
Layer 2 Versus Layer 3 Roaming – Layer 2
roaming takes place when a client roams from 1 AP to another that are both in
the same network and the client keeps the same IP address. Layer 3 roaming
happens when a client roams from one AP on one subnet to another AP on a
completely different subnet where both AP’s have the same SSID. The client
keeps the same IP address in both cases and no data is lost as they roam.
Asymmetric Tunneling – Traffic from the client
is routed to the destination, regardless of its source address, and the new
traffic is sent to its original controller, called and anchor and is tunneled
to the new controller.
Symmetric Tunneling – All traffic is tunneled
from the client to the anchor controller, sent to the destination, returned to
the anchor controller, and then tunneled back to the client via the foreign
controller.
Mobility Anchors – Also called guest tunneling
or anchor mobility. All the traffic that belongs to a WLAN is tunneled to a
predefined WLC or set of WLC’s. This is particularly good to anchor guest
devices to a WLC in the DMZ for security. This is done on a per WLAN (SSID)
basis.
Controller Terminology
WLAN = SSID and all its parameters
Port – Ties together a VLAN and SSIDs.
Static Interfaces:
Management Interface – The “IP Address” of the
controller. AP’s use this IP to discover the controller and mobility groups
exchange information using it.
AP Manager Interface – This address is the
source address for LWAPP communication between the WLC and the AP. It has to be
unique, but can be in the same subnet as the management address.
Virtual Interface – Controls the Layer 3
security and mobility manager communications for all the physical ports of the
WLC. This interface also has the DNS gateway hostname used by Layer 3 security
and mobility managers to verify certificates. If you configure users to have to
log in to a web page to authenticate to use the network (like for guest
access), this is the IP address they will be redirected to.
Service Port – Out of Band management,
system recovery, and maintenance purposes. This is the only port on the
controller that is active in boot mode. It does not auto-sense.
Migrating Standalone (Autonomous) AP’s to LWAPP
The IOS to LWAPP Conversion Utility – Software
that runs in windows. Will upgrade Ap’s running version 12.3(7)JA or above for
WLC’s running version 3.1 or later. Uses a .txt file with information about the
AP’s you wish to upgrade and a tftp server to send image files to them.
Cisco Mobility Express
Small Business Communication System – Designed
to be able to grow with a small business, the hardware does not work with their
enterprise systems. Allows for the management advantages fo the CUWN without as
much cost or equipment. Only supports growth up to 12 AP’s total.
Includes:
Cisco Unified Communication 500 Series for Small
Businesses – Long name,
but it includes a dhcp server and can support up to 48 users.
Cisco Unified IP Phones
Cisco Monitor Director
Cisco Mobility Solution, Including:
Cisco 526 Wireless Express Controller – Each
controller can support up to 6 AP’s with 2 controllers supported. Provides
guest access, Voice-over-WLAN, LWAPP, Same authentication architectures as
enterprise, wired/wireless network virtualization, and management with CCA.
(Cisco Configuration Assistant).
Cisco 521 Wireless Express Access Point – Can only
communicate with the 526 Wireless Express Controller, so it cannot be used in
an enterprise environment, only supports 802.11b/g, otherwise similar to 1130AG
AP’s.
Wireless Clients
Microsoft Windows Zero Configuration Utility (WZC) – Probably
the least preferred, least secure, and most troublesome way to connect. This
one is fairly familiar to anyone who has set up a windows PC for wireless. A
major security hole is that, if unable to join a broadcasting network, it will
automatically attempt to create its own ad hoc network and allow others to
connect to it, in the background, with no notification to the user that this is
happening. It will also automatically connect to any ad hoc network it finds if
it cannot connect to an infrastructure network.
Apple AirPort Extreme – This GUI is actually
pretty nice, with very intuitive settings. No glaringly obvious security holes.
Linux NetworkManager – GUI tool available in
many different Linux distros…similar to tools for Macs and PC’s and not tested
for the CCNA-Wireless
Cisco Aironet Desktop Utility (ADU) – Cisco
offers cardbus and PCI card WLAN NICs and this is the utility used to manage
them on a PC. It also has a utility for the system tray called the Aironet
System Tray Utility. It’s better than the WZC, but I prefer other utilities
when I have the chance. A few advantages it has though are the ability to give
a SNR (Signal-to-Noise Ratio) reading from the client and the ability to do
basic site surveying with it. You can use the Aironet Configuration
Administration Utility (ACAU) to automate the creation of client profiles
if you have a lot of these cards in your enterprise.
Cisco Secure Services Client (SSC) – Cisco’s
alternative to the WZC for those with Wireless NICs from other vendors.
Requires a license for the client and has a utility as well to create client
profiles for distribution called the SSCAU (Secure Services Client
Administration Utility).
CCX (Cisco Client Extension) Program – basically certifies
that devices will work with Cisco AP’s and infrastructure. On the AP side,
using all CCX compatible clients means the AP can change some settings on the
client side and gives you more control over how they connect.
Wireless Security
Threats Unique to WLAN’s:
Ad Hoc Networks – This allows 2 or more
clients to connect to each other bypassing corporate security policies. An
attacker could form an ad hoc network and trick users to connect to that
network and steal data or use their connection to the corporate network as a
way to then gain access.
Rogue AP’s – An AP outside the
corporate infrastructure that could be friendly or malicious. You have to track
them down to determine if they are just a neighboring office building’s network
or something that has been brought in from home, or part of a malicious attack.
Attackers try to get users to connect to the rogue and gain access or steal
data from them. A user may unwittingly attach an AP to the corporate network,
allowing an attacker to bypass corporate security policies and gain access to
the network.
Client Misassociation – An attacker spoofs the
SSID of a network a client device has already connected to and the client
utilities use the cached information about that SSID to automatically connect
to the spoofed SSID, sometimes without the client’s knowledge. This can be done
by sending false beacon messages or management frame spoofing.
Management Frame Protection (MFP) – This helps
prevent a client misassociation attack. Each management frame gets a MIC
(Message Integrity Check) added to it before the FCS (Frame Check Sequence).
Each WLAN (SSID) gets a unique key sent to each radio on the AP. If anyone
tries to spoof the frames or mess with the contents and does not have this key,
it invalidates the message. Client MFP can be used with CCX (Cisco Compatible
Extensions) 5 or better on the client. Here the client can talk to the AP and
find out what the MIC is and it can also verify that the management frames it
receives match this MIC. This will also keep a neighboring AP from attacking
your network with deauthentication messages (essentially trying to contain your
AP as if it were a rogue) since clients will know that these deauth messages
did not come from your AP.
Attacks Used on Both Wired and Wireless Networks:
Reconnaissance Attacks – An attacker tries to
gain info about your network (port scanning, etc.)
Access Attacks – An attacker tries to get
access to data, devices, or the network. (Includes trying to crack pre-shared
keys, etc.)
DoS (Denial of Service) Attacks – An
attacker tries to prevent users from getting services they need. An example
might be someone putting AP’s at the edge of your property and then trying to
contain your AP’s as if they were rogues.
Authentication Schemes:
Open – Suitable only for guest access to a network.
Pretty much no authentication. These users should only be given internet
access.
PSK (Pre-shared Key) with WEP (Wired Equivalent
Privacy) – Actually
considered less secure than Open authentication. Keys are easily broken and
then the attacker has access. Uses RC4 encryption method, which is weak. Key
sizes are 40bit, 104bit, and 128bit, but Windows will not support the 128 bit.
All sizes are easily cracked. MAC Address filtering helps little because MACs
are easily spoofed.
EAP (Extensible Authentication Protocol)/ 802.1x – Much
better authentication and encryption. This has a 3-way handshake to
authenticate and requires an external AAA server (Radius).
EAP-TLS – Requires PKI (Public Key
Infrastructure) certificates on the supplicant (client) and the authentication
server. Considered most secure and an encrypted tunnel protects the user
certificate.
EAP-FAST – Does not require PKI
certificates, but uses a strong shared secret key called a PAC (Protected
Access Credential) that is unique on every client. Is considered the successor
to Cisco LEAP (Lightweight Extensible Authentication Protocol).
PEAP(Protected EAP) – Only a server-side
certificate is needed, which is used to create an encrypted tunnel where the
real authentication takes place. PEAP uses MS-CHAPv2 or GTC (Generic Token
Card) to authenticate users
LEAP – Vulnerable to an offline exploit, being
deprecated.
Encryption Methods:
WPA – Uses TKIP (Temporal Key Integrity Protocol) to
automatically change keys. Can support AES (Advanced Encryption Standard)
optionally. Uses stronger encryption (TKIP vs. RC4) than WEP and a larger IV
(initialization vector). 2 Modes offered – Enterprise mode (requires a Radius
server and uses TKIP with AES available) Personal – Uses PSK (preshared keys)
vs. RADIUS, so it is weaker, but more friendly to home environments.
WPA2 – Mandates AES, TKIP is not available. Only allows
the AES/CCMP (Advanced Encryption Standard-Cipher Block Chaining Message
Authentication Code Protocol) version of AES. Key Management allows keys to be
cached to allow for faster connections. Considered best.
WCS (Wireless Control System)
WCS Requirements:
Linux – Will support 3,000 AP’s and 250 Controllers with
Red Hat ES/AS Linux Release 4 or better, Intel Xeon Quad 3.15-GHz CPU or
better, and 8Gig RAM or better, and a 200Gig HD.
Windows – Will support 2,000 AP’s
and 150 controllers with Windows Server 2003 or better, Pentium 4/2.06 GHz or
better, 2G RAM, and a 30G HD or better.
Licenses – There are 2 license
options here – Base and Base with Location which allows you to use a Location
appliance for RFID tag tracking.
Features:
Templates – Allow for faster, more uniform
configuration of controllers
Auto Provisioning – Allows a new,
unconfigured controller to automatically grab a configuration from the WCS
server.
Heat Maps – Can be used for a basic
RF prediction (Not always as accurate as a site survey), and once deployed,
show real-time RF info and location and status of AP’s.
DCE (Data Communication Equipment)
