Presentation on theme: "Wireless Technology. Similarities Between WLAN and LAN A wireless LAN is an 802 LAN. Transmits data using RF carriers vs. data over the wire Looks like."— Presentation transcript:
Similarities Between WLAN and LAN A wireless LAN is an 802 LAN. Transmits data using RF carriers vs. data over the wire Looks like a wired network to the user Defines physical and data link layer Uses MAC addresses The same protocols/applications run over both WLANs and LANs. IP (network layer) IPSec VPNs (IP-based) Web, FTP, SNMP (applications)
Current Standards – a,b,g a Up to 54 Mbps 5 GHz Not compatible with either b or g b Up to 11 Mbps 2.4 GHz g Up to 54 Mbps 2.4 GHz n, the newest protocol, utilizes both 2.4-GHz and 5-GHz bands. 860 Kbps 900 MHz 1 and 2 Mbps 2.4 GHz Proprietary Ratified a,b Ratified and 2 Mbps2.4 GHz11 Mbps 54 Mbps Standards-based 5 GHz Radio Network Speed IEEE Begins Drafting g is backwards compatible with b n is backward compatible with existing a/b/g g Ratified
Radio Frequency Issues As signal strength decreases, so will the transmission rate. An b client’s speed may drop from 11 Mbps to 5.5 Mbps, to 2 Mbps, or even 1 Mbps. This can all be associated with a combination of factors including: 1. Distance 2. Line of Sight 3. Obstructions 4. Reflection 5. Multpath Reflection 6. Refraction (partially blocked by obstruction) 7. Diffraction (bending of signal) 8. Noise and Interference
Wireless Access Points An access point (AP) is a WLAN device that can act as the center point of a stand-alone wireless network. An AP can also be used as the connection point between wireless and wired networks. In large installations, the roaming functionality provided by multiple APs allows wireless users to move freely throughout the facility, while maintaining seamless, uninterrupted access to the network. Cisco APs come in several models. The 1100 Series supports IEEE b. The 1200 Series, supports a and b in the same unit. It also supports inline power injection, to save on AC wiring costs, and both RJ45 and 10/100 Ethernet connectors
Wireless Bridges The Cisco Aironet 1300 Series Wireless Bridge is designed to connect two or more networks that are typically located in different buildings. It delivers high data rates and superior throughput for data- intensive, line-of-sight applications. The bridges connect hard-to-wire sites, noncontiguous floors, satellite offices, school or corporate campus settings, temporary networks, and warehouses. They can be configured for point- to-point or point-to-multipoint applications.
Wireless Workgroup Bridges The Cisco 1300 Series Wireless Bridge is designed to connect two or more networks that are typically located in different buildings. It delivers high data rates and superior throughput for data- intensive, line-of-sight applications. The bridges connect hard-to-wire sites, noncontiguous floors, satellite offices, school or corporate campus settings, temporary networks, and warehouses. They can be configured for point- to-point or point-to-multipoint applications.
Service Set Identifier (SSID) SSID is used to logically separate WLANs. The SSID must match on client and access point. Access point can broadcast SSID in beacon. Client can be configured without SSID.
WiFi (802.11) Media Access Control WiFi is often referred to as wireless Ethernet, as it is a development of the Ethernet standard. Within a WiFi network, all devices are connected using the same RF frequency to a common Access Point (AP). All communication between the PCs is via the AP. As all the devices in the network share the same frequency, then they cannot all transmit at the same time as their signals will interfere. Therefore, WiFi networks operate in half-duplex, using an access method similar called CSMA/CA. Access Point
Local area networks (LAN) Adding an AP is also a way to add wireless devices and extend the range of an existing wired system. If a single cell does not provide enough coverage, any number of cells can be added to extend the range. It is recommended that adjacent BSS cells have a 10 to 15 percent overlap b/g Channels a Channels
A wireless repeater is simply an access point that is not connected to the wired backbone. This setup requires a 50% overlap of the AP on the backbone and the wireless repeater. (So they can reach each other). The user can set up a chain of several repeater access points, however, the throughput for client devices at the end of the repeater chain will be quite low, as each repeater must receive and re-transmit each frame. For each repeater added to the chain, throughput is cut in half - it is recommended that not more than two hops be used. Not covered by standards 50% overlap Wireless repeater
Cisco WLAN Implementation Distributed WLAN solution Autonomous AP Wireless LAN Solution Engine (WLSE) Centralized WLAN solution Lightweight AP Wireless LAN Controller (WLC) Cisco offers 2 “flavors” of wireless solutions:
Comparison of the WLAN Solutions Autonomous WLAN: Autonomous access point Configuration of each access point Independent operation Management via CiscoWorks WLSE and WDS Access point redundancy Lightweight WLAN: Lightweight access point Configuration via Cisco Wireless LAN Controller Dependent on Cisco Wireless LAN Controller Management via Cisco Wireless LAN Controller Cisco Wireless LAN Controller redundancy
Why Lightweight APs? A WLAN controller system is used to create and enforce policies across many different lightweight access points. With centralized intelligence, functions essential to WLAN operations such as security, mobility, and quality of service (QoS), can be efficiently managed across an entire wireless enterprise. Splitting functions between the access point and the controller, simplifies management, improves performance, and increases security of large WLANs.
Cisco Centralized WLAN Model The control traffic between the access point and the controller is encapsulated by Lightweight Access Point Protocol (LWAPP). And encrypted via the Advanced Encryption Standard (AES). The data traffic between the access point and controller is also encapsulated with LWAPP, but not encrypted.
Wireless Mesh Networking Each access point runs the Cisco Adaptive Wireless Path protocol (AWP). AWP allows access points to communicate with each other to determine the best path back to the wired network. After the optimal path is established, AWP continues to run in the background to establish alternative routes back to the roof-top access point (RAP) if the topology changes or conditions cause the link strength to diminish.
Wireless LAN Security Threats
Wireless Security Protocols Today, the standard that should be followed in most enterprise networks is the i standard. This is similar to the Wi-Fi Alliance WPA2 standard. For enterprises, WPA2 includes a connection to a Remote Authentication Dial In User Service (RADIUS) database.
Layer-2 LWAPP Architecture Access Points don’t require IP addressing Controllers need to be on EVERY subnet on which APs reside L2 LWAPP was the first step in the evolution of the architecture; many current products do not support this functionality
Access Points require IP addressing APs can communicate w/ WLC across routed boundaries L3 LWAPP is more flexible than L2 LWAPP and all products support this LWAPP operational ‘flavor’ Layer-3 LWAPP Architecture
Identification and protection against attacks, DoS AES strong encryption Authentication Dynamic key management Evolution of Wireless LAN Security No strong authentication Static, breakable keys Not scalable Initial (1997) Encryption (WEP) Interim (2001) 802.1x EAP Dynamic keys Improved encryption User authentication 802.1x EAP (LEAP, PEAP) RADIUS Interim (2003) Wi-Fi Protected Access (WPA) Standardized Improved encryption Strong, user authentication (e.g., LEAP, PEAP, EAP-FAST) Present Wireless IDS IEEE i WPA2 (2004)
WPA and WPA2 Authentication
WPA and WPA2 Encryption
Wi-Fi Protected Access What are WPA and WPA2? Authentication and encryption standards for Wi-Fi clients and APs 802.1x authentication WPA uses TKIP encryption WPA2 uses AES block cipher encryption Which should I use? Gold, for supporting NIC/OSs Silver, if you have legacy clients Lead, if you absolutely have no other choice. Gold WPA2/802.11i EAP-Fast AES Silver WPA EAP-Fast TKIP Lead Dynamic WEP EAP-Fast/LEAP VLANs + ACLs
WLAN Security Summary Open Access No Encryption, Basic Authentication Public “Hotspots” Basic Security 40-bit or 128-bit Static WEP Encryption, WPA Home Use Enhanced Security 802.1x, TKIP Encryption, Mutual Authentication, Scalable Key Mgmt., Etc. Enterprise Remote Access Virtual Private Network (VPN) Business Traveler, Telecommuter