1. CAEN Wireless Network College of Engineering University of Michigan October 16, 2003 Dan Maletta

2. CAEN Wireless Design Goals Make system interoperable –Support for multiple platforms: Linux (Intel), Windows, MacOS. PDAs? –If you have any wireless network card, it will work!! Provide seamless wireless coverage Provide an authentication mechanism for entire University Community that doesn’t require registration of NIC Provide a secure mechanism for transporting data within wireless network

3. CAEN Wireless Design Goals (cont.) Provide easy-use procedure for University community Make system scalable Provide separate solutions for conference rooms that allows for easy and fast network access Treat wireless and security separately.

4. CAEN Wireless Network System Supports the above goals Coverage now in 11 Buildings (~100APs) Authentication and data security provided by a Virtual Private Network (VPN) System currently supports up to 50Mb/s of sustained throughput and 1500 simultaneous users. Users can access wireless for 1 st time 24 hours a day. Conference room setup being tested in LEC Supports TCP/IP only. No IPX or AppleTalk

5. Overview of Authentication and Security Setup VPN server provides authentication and data security services –Server acts as a gateway to “wired” network –Users install an IPSec client (software) to access VPN server –Users then authenticate to VPN server with Kerberos ID –Data from client machine to server is encrypted (3DES) IPSec VPN different than Windows and MacOS built-in PPTP VPN client. –Exploring options for how to allow those clients

6. Wireless system (Diagram) Wireless Network 10.213.120.x UofM Network Internet Border Router VPN Server Web Server Wireless Access Point Auth. Servers

7. User Associates with Network Wireless Network 10.213.120.x SSID: CAEN Wireless UofM Network Internet Border Router VPN Server Web Server Wireless Access Point You are now associated with network CAEN Wireless Auth. Servers

8. User Get An IP address from Server Wireless Network 10.213.120.x UofM Network Internet Border Router VPN Server Web/IP Server Wireless Access Point IP address 10.213.120.52 Auth. Servers

9. User Tries to open a Web Page User is re-directed to Wireless Network Web server –CAEN web page tells user how to gain access to wired network. –CAEN web page contains software and instructions for connecting and installing VPN client. –After trying to use wireless, user installs software and reboots computer. –Wireless network is now available to user with VPN software.

10. User Starts VPN Connection and Authenticates with server Wireless Network 10.213.120.x UofM Network Internet Border Router VPN Server Web/IP Server Wireless Access Point IP address 10.213.120.52 uniqname & Password Tunnel IP address Auth. Servers

11. Tunnel is now Established and User can now communicate on Internet Wireless Network 10.213.120.x UofM Network Internet Border Router VPN Server Web/IP Server Wireless Access Point IP address :10.213.120.52 Tunnel Addr: 141.213.120.87 Secure Encrypted Tunnel Auth. Servers

12. Support The CAEN Hotline is answering questions as users have them Web site has an FAQ where we list common problems Hotline has laptops running all 3 OS flavors and Wireless cards from 7 vendors!!! Access Points have identical configurations so low overhead on configuration issues We have redundant servers to handle single machine failures

13. What We’ve Seen So Far We’re average about 500 sessions per day for the last two months. Our peak over that time has been ~110 simultaneous connections No complaints about lack of support for MacOS 8 and 9. A real demand for PDA support

14. Wireless deployment costs Access Points $600.00 Antennas: $100.00-200.00 Cable to Access Points from Closets (2 cables): $250.00 Conduit from cable tray to access point location: $400.00-1500.00

15. Wireless build-out model for CoE CAEN/CoE is currently covering a number of computing labs and public spaces CAEN/CoE is doing a limited departmental rollout to cover some classrooms, conference rooms. Departments are responsible for purchasing equipment to cover areas within their department. CAEN/CoE performs installation and supports installed equipment.

16. What’s worked well Windows boxes with Cisco client work well together VPN server is able to keep up and generate good stats. Easy to add access points to the system

17. What hasn’t been great Handhelds Open BSD Wireless gateways –Security vs. perceived ease of use Guest Access solutions

18. Guest Access Still working on a good guest access solution Come to Hotline (2320 Media Union) –Must be accompanied by person representing them. Must provide contact information –Expiration is set for one business week at start of every week –Instant access (5 minutes) If affiliated with the University, access will be available at Reference desk on a weekly checkout basis

19. Future Plans Continue deployment in buildings ~30-40 APs in next 3 months Movian Client support for PDAs (Both Palm and PocketPC) –How are people licensing Conversion from 3DES encryption to AES Support for Native windows VPN protocols?? 802.11g deployment WebVPN (SSL-based VPN) SSH pass-through to login machines

20. Discussion Items 802.1x –Is anybody looking to use it? –Microsoft’s announcement of proprietary replacement SSL-based VPNs 802.11a vs. 802.11g Wireless for home use –Is anyone making recommendation to people –VPNs or secure access for broadband connections

21. Check out our wireless site http://www.engin.umich.edu/caen/network /wirelesshttp://www.engin.umich.edu/caen/network /wireless