Presentation is loading. Please wait.

Presentation is loading. Please wait.

3Com Secure Converged Network ( Wireless LAN ) December 2005 >>Mr. Anusit Ratchadalertnarong

Similar presentations


Presentation on theme: "3Com Secure Converged Network ( Wireless LAN ) December 2005 >>Mr. Anusit Ratchadalertnarong"— Presentation transcript:

1 3Com Secure Converged Network ( Wireless LAN ) December 2005 >>Mr. Anusit Ratchadalertnarong

2 2 Technology Forces  Miniaturization, portability, mobile power  Increasing bandwidth, wired and wireless  Convergence – data, voice, video, …  Connection and connection-less models  Virtualization – compute, storage, network  Service oriented architectures – integration

3 3 Broadband Wireless Access Evolution EDGE HSUPA CDMA 1x EV-DO CDMA 1x EV-DV GSMGPRS CDMA IS-95A CDMA xRTT g802.11b802.11a e802.16a Flash OFDM / Flarion MC-CDMA / Navini TD-CDMA / UMTS-TDD UMTS/ WCDMA TDMA/FDMA/SDMA / iBurst HSDPA EDGE Ph2 Mass-productionProductionPilotsConcept ETSI IEEE Proprietary

4 4 What is WiMAX? WiMAX = Worldwide Interoperability for Microwave Access  Refers to wireless technologies based on standard  Standard designed to provide cost-effective fixed, portable, and eventually mobile broadband connectivity at speeds as fast or faster than cable/DSL for residential and T1/E1 for businesses  Fixed WiMAX applications —Residential and business connectivity where cable/DSL or fiber not available —Rural and suburban areas of developed countries and developing countries  Mobile WiMAX applications —“Personal broadband” experience for consumer —Urban areas become “MetroZones” for broadband access everywhere

5 5 Broadband Wireless “Sweet Spot”

6 6 WiMAX Network Models & Time Frames Fixed Outdoor Backhaul Wi-Fi Hotspot Access 2005Portable 2006Mobile 2007/8+ Metrozone Enterprise Campus Piconet Fixed Indoor Mobile

7 7 Measuring points: Very good radio reception +/-0 to -85 dBm Sufficient radio reception -85 to -100 dBm Poor or no radio reception < -100 dBm 1 km 0,5 km 1 km 1,7 km WiMAX Technology Overview

8 8 Broadband Wireless Access Evolution EDGE HSUPA CDMA 1x EV-DO CDMA 1x EV-DV GSMGPRS CDMA IS-95A CDMA xRTT g802.11b802.11a e802.16a Flash OFDM / Flarion MC-CDMA / Navini TD-CDMA / UMTS-TDD UMTS/ WCDMA TDMA/FDMA/SDMA / iBurst HSDPA EDGE Ph2 Mass-productionProductionPilotsConcept ETSI IEEE Proprietary

9 9 Choose Your Flavor with No Limit to Your Security Preference a802.11b802.11g Standard Ratified Radio Band 5GHz2.4GHz Data Rates Up to 54MbpsUp to 11MbpsUp to 54Mbps Coverage Area Up to 50 MetersUp to 100 Meters Pros  Less potential for interference  Good support for multimedia apps and densely populated user environments  Large installed base  Compatible with b  High data rates and broad coverage area Cons  Requires hardware upgrade  Less coverage area  Slower data rate  Interference in 2.4GHz band

10 10 More Channels Avoids Interference b/g a/g nd Ring 1 st Ring Distance to Center Cell: —16 non-overlapping channels and 408.5MHz of spectrum at 2.4 and 5GHz makes it possible to set up networks without co-channel interference for enterprises, public hot spots, and other large installations —3 non-overlapping channels and 83.5MHz of spectrum at 2.4GHz make co-channel interference and performance degradation inevitable rd Ring

11 X Standards WLAN Systems  a5GHz System, 54 Mbps  b2.4GHz System, 11 Mbps  g2.4GHz System, 54 Mbps WLAN Enhancements  cMAC Routing (moved to 802.1c)  dCountry compatibility (roaming) for b  eEnhanced MAC for QoS  fInter Access Point Protocol  hChannel Selection and Transmit Power for a  iSecure MAC  jChannel Selection for Japan  kClient feedback  nHigh speed  rRoaming  sDefines a MAC and PHY for meshed networks  802.1XAuthentication

12 12 WLAN Deployment Considerations  Site planning —Coverage and Capacity  Mobility —Roaming & User management  RF Management —Rogue detection —Power & Channel management  Security —Authentication & Encryption  Network Management  Network Extension

13 13 3Com Secure Converge Network 3Com Router 3Com Switch 7750/8800 3Com SuperStack 3 Switch 3Com VCX System Wi-Fi Phone Wi-Fi PDA Mobile User Video Server Multicast User Mobile User 3Com TippingPoint 3Com AP 8250/7250 3Com AP Com AP 3750 Wireless Switch Corporate Network a/b/g Antenna Encryption Mobile IP, IPSec, Certs 802.1X, TKIP, e, f, h Site SurveysPer-user Firewall Self-HealingRF Management Rogue Wireless Protection ‘Fit’ APs More Managed Wireless Solutions Corporate Network Layer 2 Switch a/b/g Mobile IP, IPSec, Certs 802.1X, TKIP, e, f, h Antenna Encryption ‘Fat’ APs TraditionalWireless Switching Lower Cost APs

14 14 Site Planning

15 15 3Com Secure Converge Network 3Com Router 3Com Switch 7750/8800 3Com SuperStack 3 Switch 3Com VCX System Wi-Fi Phone Wi-Fi PDA Mobile User Video Server Multicast User Mobile User 3Com Wireless Switch Manager 3Com TippingPoint 3Com AP 8250/7250 3Com AP Com AP Com Wireless Switch

16 16 Easy and Powerful Site Planning  Plan and Configure —Enter building plans, including walls & wall materials —Result:  AP location recommendations for coverage pattern —Predictive modeling capabilities allow user to try different scenarios  Deploy and Manage —Install APs as described in the deployment plan —Management software will sweep the environment and adjust channel and power settings to optimize the network 3Com’s Wireless Switch Manager Deployment Software Tool

17 17 Mobility

18 18 3Com Secure Converge Network 3Com Router 3Com Switch 7750/8800 3Com SuperStack 3 Switch 3Com VCX System Wi-Fi PDA Mobile User Video Server Multicast User Mobile User 3Com Wireless Switch Manager 3Com TippingPoint 3Com AP 8250/7250 3Com AP Com AP Com Wireless Switch Wi-Fi Phone Wireless Roaming Wi-Fi Multimedia ( WMM)

19 19 RF Management

20 20 RF Management: Centralized Control of AP Environment  Dynamic real time control of RF environment  Centralized control of AP radios, including —Channel selection and amplification —Automatic channel assignment —Load balancing based on # of users and traffic to optimize throughput —Adjust radio power to eliminate coverage gaps, even on large networks  Allows direct control of RF optimization —Control of all radio channels & gain 3Com Wireless Switch

21 21 3Com Secure Converge Network 3Com Router 3Com Switch 7750/8800 3Com SuperStack 3 Switch Wi-Fi Phone Wi-Fi PDA Mobile User Video Server Multicast User Mobile User 3Com Wireless Switch Manager 3Com TippingPoint 3Com AP 8250/7250 3Com AP Com AP Com Wireless Switch Rogue AP

22 22 Intrusion Detection System ( IDS )  RF Management —Listen to all communication —Correlate Data  Identify —Rogue APs —Users of rogue APs —Ad hoc user groups  Locate —Triangulation —Improves with density  Active Scan —Utilization of all radios all the time RF Management

23 23 3Com Secure Converge Network 3Com Router 3Com Switch 7750/8800 3Com SuperStack 3 Switch Wi-Fi Phone Wi-Fi PDA Mobile User Video Server Multicast User Mobile User 3Com Wireless Switch Manager 3Com TippingPoint 3Com AP 8250/7250 3Com AP Com AP Com Wireless Switch Rogue AP Rogue Detection and Containment

24 24 Security

25 25 Two Key Elements in Security Protection: Authentication & Encryption  Authentication Authentication —Is this a valid user of your network? —Is this user who you think he is? —Verify with password control & access lists  Encryption Encryption —Wireless data is by nature broadcast —Scramble data to safeguard the data & network —Need sophisticated algorithms for best protection Valid User??? Safeguard Data Broadcast Safeguard Data Broadcast Need both Authentication & Encryption for Protection

26 26 What Types of Authentication are There?  Authenticate to prove user identity — Authentication  Shared key based (password)  Happens before Access Point association  Open system (no authentication)  MAC address filtering (aka: local MAC authentication)  Shared key (encrypted challenge with WEP key) —802.1X Authentication  Certificate based  Happens after Access Point association  Uses Extended Authentication Protocol (EAP)  Offers full suite of secure authentication protocols –LEAP, PEAP, EAP-TLS, EAP-TTLS,  Much better than authentication

27 27 Auto VLAN and QoS Assignment using 802.1X Red VLAN User ID: ? Pwd: ? User ID: Bule User ID: Bule Valid User VLAN ID: Bule VLAN QoS Profile: LowP, Web LowP, Student Records Server HighP Bule VLAN

28 28 Auto VLAN Assignment using 802.1X with Wireless Access Points Red VLAN Bule VLAN User ID: ? Pwd: ? User ID: Bule User ID: Bule Valid User VLAN ID: Bule VLAN

29 29 3Com Secure Converge Network 3Com Router 3Com Switch 7750/8800 3Com SuperStack 3 Switch 3Com VCX System Wi-Fi Phone Wi-Fi PDA Video Server Multicast User 3Com Wireless Switch Manager 3Com TippingPoint 3Com AP 8250/7250 3Com AP Com AP Com Wireless Switch Mobile User IEEE 802.1x ( User name + Password ) & Radius Authenticated Devices Access ( RADA)

30 30 Radius Authenticated Devices Access ( RADA ) Red VLAN User ID: ? Pwd: ? User ID: MAC Address PWD: MAC Address User ID: MAC Address PWD: MAC Address Valid User VLAN ID: Bule VLAN QoS Profile: LowP, Web LowP, Student Records Server HighP Bule VLAN

31 31 What Types of Wireless Security Options Do I Have?  OPEN —No authentication —CRC message checking —No encryption  WEP/WEP2 —Optional MAC address filtering (aka: local MAC authentication) —CRC message checking —Static shared key encryption (password)  40/104-bit RC4 cipher key  WEP2 adds a rotating key (e.g.: DSL or LEAP)  WPA (ratified July 2003) —802.1X authentication (requires EAP) —MIC/CRC message checking —TKIP (128-bit RC4 cipher rotating, 128-bit AES optional)  i (ratified June 2004) —802.1X authentication (requires EAP) —MIC/CRC message checking —TKIP or AES (256-bit AES is mandatory) Remember •Authenticate •Message Integrity Check •Encrypt Stronger Security

32 32 WarChalking

33 33 Wireless Tools  Types of Monitoring tools —Stumbling —Sniffing —Handheld  Hacking tools —WEP Cracking —ARP Spoofing

34 34 Netstumbler — Free — Window based — Very simple GUI — GPS capable

35 35 Wellenreiter — Free — Linux based — Supports many wireless cards — GPS capable

36 36 AirMagnet — Pocket PC based

37 37 WEP Cracking Tools > WEPCrack > AirSnort > BSD-Tools dweputils

38 38 New i Security  Addresses the main problems of WEP and Shared-Key Authentication —Temporal Key Integrity Protocol (TKIP) —Message Integrity Control ~ Michael —AES Encryption replacement for RC4 —Robust Security Network (RSN)  Require new wireless hardware  Ratification ~ YE 2004

39 39 Information Security Hype Cycle Less than two years Two to five years Five to 10 years More than 10 years Obsolete before Plateau Key: Time to Plateau Technology Trigger Peak of Inflated Expectations Trough of Disillusionment Slope of Enlightenment Plateau of Productivity Maturity Visibility Acronym Key VPNvirtual private network WPAWi-Fi Protected Access As of June 2004 All-in-One Security Appliances Biometrics Compliance Tools Data-at-Rest Encryption Appliances Deep Packet Inspection Firewalls Digital Rights Management (enterprise) Federated Identity Identity Management Instant Messaging Security Intrusion Detection Systems Managed Security Service Providers Patch Management Personal Intrusion Prevention Public Key Operations/ Soft Tokens Reduced Sign-On Scan and Block Secure Sockets Layer VPNs Secure Sockets Layer/Trusted Link Security Security Platforms Security Smart Cards Spam Filtering Trusted Computing Group Vulnerability Management Web Services Security Standards WPA Security Hardware Tokens

40 40 3Com Secure Converge Network 3Com Router 3Com Switch 7750/8800 3Com SuperStack 3 Switch 3Com VCX System Wi-Fi Phone Wi-Fi PDA Mobile User Video Server Multicast User Mobile User 3Com Wireless Switch Manager 3Com TippingPoint 3Com AP 8250/7250 3Com AP Com AP Com Wireless Switch

41 41 3Com IPS’ Primary Function – Block Malicious Traffic TippingPoint blocks malicious traffic in the network before it damages your company’s information assets DNSFTPHTTP SNMPSMBTelnet Web Services DMZ IBM DB2MS SQL Applications Operating Systems Wireless Infrastructure External Attackers • Industrial Spies • Gov’t Spies • Terrorists • Cyber Thieves • Pranksters Internal Attackers •Disgruntled Employees •Dishonest Employees Valid User & Application Traffic Good traffic passes through The IPS blocks malicious traffic based on filters settings. Cisco IOS

42 42 3Com TippingPoint Quarantine Service Secure Converged Networks  TippingPoint Intrusion Protection Systems works with 3Com switches for Quarantine Protection  Quarantine protects endpoints and enforces policy  Requires no software client or agent  Protection is flexible, automatic and fast Switch 7750/5500

43 43 3Com Wireless Enterprise Solution

44 44 3Com Wireless Switch Solution •Enterprise WLAN controller •4 Gigabit-port switch •3.6Gbps throughput •24-96 MAPs 3Com Wireless LAN Controller WX4400 •Enterprise/SMB WLAN Switch •2-port 10/100Mbps x 6-port 10/100Mbps PoE switch •200Mbps throughput •12 MAPs 3Com Wireless LAN Switch WX1200 Access Point 2750/3750 3Com Wireless Switch Manger 3CWXM Access Point 7250 & Access Point 8250 •Remote Office WLAN Switch •2-port 10/100Mbps •3 MAPs 3Com Wireless LAN Switch WXR100

45 45 Security Management System TippingPoint Product Line 50 Mbps 1x10/100/1000 Copper 100 Mbps 1x10/100/1000 Copper 200 Mbps 2x10/100/1000 Copper 400 Mbps 4x10/100/1000 Copper/Fiber 1.2 Gbps 4x10/100/1000 Copper/Fiber 2.0 Gbps 4x10/100/1000 Copper/Fiber 5.0 Gbps 4x10/100/1000 Copper/Fiber Wire Speed IPS

46 46 3Com Client  a/b/g PC Card & PCI  XJACK ® dual band antenna (PC Card) —Power management build into XJACK  USB Adapter  Wireless 11g Travel Router  Wireless Print Server PC Card PCI Card USB Adapter OC 11g Travel Router OC 11g Print server


Download ppt "3Com Secure Converged Network ( Wireless LAN ) December 2005 >>Mr. Anusit Ratchadalertnarong"

Similar presentations


Ads by Google