Day 6: Wireless Security

A network administrator shoudl implement the following security features on a WLAN during initial setup (mind you they're easily avoided):

• Disable SSID broadcast.
• Change default settings.
• Enable MAC address filtering.

We can implement authentication for the WLAN (by username or password). This will occur before MAC filtering and there are three types of wireless authentication:

1. Open authentication: all clients can connect to the WLAN.
2. Preshared keys (PSK): both AP and client are configured with the same key. This is a one-way authentication because the AP doesn't authenticate with the host (user doesn't have to authenticate).
3. Extensible Authentication Protocol (EAP): the EAP software on the client communicates with an authentication server as RADIUS which maintains a database of users separate from the AP. 802.1x can also provide AP security through user authentication (EAP).

Its obvious that we need to protect transmission by using some form of WLAN encryption:

• Wired Equivalent Privacy - WEP key is 64 to 256 bits but all devices (including AP) must have the same manually configured static key to understand transmissions. This is easily avoided nowadays with hacking software.
• Wi-Fi Protected Access (WPA) is also 64 to 256 but has a more secure encryption because it rotates keys. WPA uses TKIP (temporal key integrity protocol) to generate new keys for clients and rotate them at a configurable interval, both client and AP have the key. Remember that WPA dynamically generates a different key with each client communication with the AP.
• 802.11i/WPA2 is a better version that uses advanced encryption standard (AES) technology.

WPA is a more powerful security technology for Wi-Fi networks than WEP. It provides strong data protection by using encryption as well as strong access controls and user authentication. WPA utilizes 128-bit encryption keys and dynamic session keys to ensure your wireless network's privacy and enterprise security. There are two basic forms of WPA: WPA Enterprise (requires a Radius server) and WPA Personal (also known as WPA-PSK). Either can use TKIP or AES for encryption. Not all WPA hardware supports AES. WPA-PSK is basically an authentication mechanism in which users provide some form of credentials to verify that they should be allowed access to a network. This requires a single password entered into each WLAN node. As long as the passwords match, a client will be granted access to a WLAN. Encryption mechanisms used for WPA and WPA-PSK are the same. The only difference between the two is in WPA-PSK, authentication is reduced to a simple common password, instead of user-specific credentials. The Pre-Shared Key (PSK) mode of WPA is considered vulnerable to the same risks as any other shared password system - dictionary attacks for example. Another issue may be key management difficulties such as removing a user once access has been granted when the key is shared among multiple users, not likely in a home environment.

Consider these points when planning/troubleshooting a WLAN:

• Signal: 802.11b/g/n have a larger coverage area than 802.11a. Generally speaking: the more data rates the lower the coverage area. There's also interference and reflection (RF waves bounce off metal or glass surfaces).
• Standards: be careful with backward-compatibility, some AP's don't support the 5 GHz frequency (802.11a).
• Bandwith: all users share the same bandwith on a BSS.
• Association: make sure that the SSID is correct on clients and AP.
• Total cost of ownership (TCO).
• Channels and correct placing.
• Authentication/security.

Day 7: Wireless Standards

Wireless devices use electromagnetic waves as the physical media for data transmission. Infrared (IR)  transmits over short distances, radio frequency (RF) waves can be used for "real networking". The Industrial, Scientific and Medical (ISM) bands are free to use by unlicensed devices for communication:

• 900 MHz (902 to 928 MHz) supports devices such as wireless headphones and cordless phones.
• 2.4 GHz (2.400 to 2.4835) supports lower-speed, short-range Bluetooth as well as wireless LAN technologies compliant with IEEE 802.11 standards.
• 5 GHz (5.725 to 5.850) supports IEEE 802.11 standards at a higher power level, providing a wider range and increased speeds.

Unfortunately Wireless LANs can interfere with each other. Reduced cost and increased mobility are major advantages.

We can define wireless networks in three categories:

• WPAN - wireless personal-area network: these include PDAs, mice, keyboards and other short-range IR or Bluetooth devices.
• WLAN - wireless local-area network: typically the wireless portion of a LAN that uses RF technology and IEEE 802.11 standards. An access point (AP) usually provides connectivity fro the wireless clients to the wired Ethernet network.
• WWAN - wireless wide-area network: networks that can use cell phone technologies such as Global System for Mobile Communication (GSM) or Code Division Multiple Access (CDMA) to cover large geographic areas.

The Wireless Fidelity (Wi-Fi) Alliance tests wireless devices from different manufacturers and ensures that each device meets standards and will function with devices using the same standards. So its a global, nonprofit industry trade assocation devoted to promoting the growth and acceptance of wireless LANs. The IEEE 802.11 standard governs implementations of WLANs.

IEEE 802.11 Wireless LAN Standards

• 802.11: This original standard was released in 1997 and supports a 2 Mbps data rate over the 2.4 GHz frequency. A maximum range is undefined.
• 802.11a: This amendment was released in 1999 and supports a 54 Mbps data rate over the 5 GHz frequency. The maximum range is estimated at about 50 meters. Interesting sidenote is that this didn't make due to shortage of material at the time, so 802.11b made it.
• 802.11b: released at the same time as 802.11a and made it despite supporting an 11 Mbps data rate over the 2.4 GHz frequency. Maximum range is estimated at about 100 meters.
• 802.11g: This amendment was released in 2003 and supports a 54 Mbps data rate over the 2.4 GHz frequency. Maximum range is estimated at about 100 meters. 802.11g is backwards compatible with 802.11b!
• 802.11n: This is a recent amendment (october 2009) and adds multiple-input and multiple output (MIMO). 802.11n is backwards compatible with 802.11a, 802.11b and 802.11g!

A wireless networks consists of the following components:

• Wireless clients or wireless stations (STA) are devices that participate in a wireless network.
• Wireless access point (AP) provides connectivity between a wired and wireless network by converting Ethernet frames into 802.11-compliant frames or vice versa. APs support connectivity in a basic service set (BSS) or limited area.
• Wireless bridge provides connectivity between two wired networks with a wireless link - typically a long-range ppp connection over RF frequencies.
• Wireless antenna can be a directional antenna that concentrates the signal in one direction or an omnidirectional antenna that increases the signal in all directions. Antennas increase signal strength or gain an can increase distances.

A WLAN is located with a Service Set Identifier (SSID). This is a 32-character, case-sensitive, alphanumeric string located in the header of WLAN frames. WLANs can be set up in od-hoc or infrastructure mode:

• Ad-hoc: Independent basic service set (IBSS) in which devices communicate with each other and are not part of a network. This is a simple peer-to-peer connection among clients to exchange files and data without an access point.
• Infrastructure: BSS in which a group of devices are connnected to an AP. Devices cannot communicate directly; connectivity is centralized, controlle and directed by an access point.

Multiple BSS access points can be connected by a distribution system (DS) to form an extended service set (ESS). To create it, each BSS AP's range must overlap by 10 to 15 percent! This allows a client to move through the ESS without a loss of signal. The ability to shift data rates allows a client to communicate while moving!
Another important aspect is to use different channels for efficient communicatino. Multiple AP's can overlap in range and divide the available RF spectrum by using separate channels (for example 1-6-11).

Wireless networks use an access method called Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA). These points define this process and how a client can reserve a channel:

• A device on a BSS asks permission from the AP to communicate in the form of a request to send (RTS).
• If the channel's available, the AP responds with a clear to send (CTS) message.
• The CTS is broadcast to all devices on the BSS so that all devices know that the channel is in use or that a reservation is in place on the channel.
• When the communication is complete, the sending device sends an acknowledgement (ACK)  to the AP, saying that the channel can be released. This ACK is also broadcast to all devices on the BSS to indicate that the channel is available.

The following common parameters must be configured on a wireless access point to provide connectivity:

• Wireless or network mode: can be 802.11a , 802.11b, 802.11g, 802.11n or mixed mode.
• SSID or network name: all devices connected to the WLAN must have the same SSID. It may be a good idea to disable broadcast of the SSID.
• Wireless channel: you can manually configure a channel that doesn't overlap with nearby BSSs or you can allow the AP to automatically find the best channel.