Showcase

Wireless LAN Deployment at Microsoft Supporting the Mobile Knowledge Worker Published January 2002

Agenda Wireless Local Area Network (WLAN) Description Wireless Local Area Network (WLAN) Description Information Technology Group (ITG) WLAN Deployment Project Information Technology Group (ITG) WLAN Deployment Project Drivers Drivers Schedule and tasks Schedule and tasks Requirements Requirements Piloting Piloting Results Results Engineering Considerations Engineering Considerations Security Considerations Security Considerations Installation Approach – Concealed System Installation Approach – Concealed System Lessons Learned Lessons Learned Reference Information Reference Information

What is Wireless LAN (WLAN)? Personal Area Bluetooth Infrared Data Association (IrDA) Local Area Wireless LAN (WLAN) Wide Area & Metro Area Cellular-based mobile data (CDPD/ GPRS) Fixed Microwave Wireless (LMDS/MMDS) Wireless Local Loop (WLL) Global & Universal Area Satellite Data Networks

ITG WLAN Deployment Project Drivers Executive Call to Action Executive Call to Action Microsoft is Developing Software for Wireless Environments Microsoft is Developing Software for Wireless Environments Multiple User Requests for WLAN Technology Deployment to Increase User Mobility Multiple User Requests for WLAN Technology Deployment to Increase User Mobility Standardization and Interoperability Standardization and Interoperability Pilot Pilot Puget Sound area buildings Puget Sound area buildings Deploy to worldwide subsidiary offices as budget and local regulations permit Deploy to worldwide subsidiary offices as budget and local regulations permit

ITG WLAN Deployment Project Schedule and Tasks 150 user proof of concept (3 months) 150 user proof of concept (3 months) Submitted RFI for b products (1 month) Submitted RFI for b products (1 month) Two RFI finalists selected and lab tested both. Two RFI finalists selected and lab tested both. Pilot: four buildings, more than 600 users (2 months) Pilot: four buildings, more than 600 users (2 months) Completed Engineering & Operations Standard design documentation (1 month) Completed Engineering & Operations Standard design documentation (1 month) 63 building campus wireless deployment (8 months) 63 building campus wireless deployment (8 months) Access Points (APs) Access Points (APs) Worldwide wireless deployments (on-going) Worldwide wireless deployments (on-going) APs APs 802.1x enhanced wireless security deployment (1 month) 802.1x enhanced wireless security deployment (1 month) Covered 70 buildings in Puget Sound area and 23 remote locations Covered 70 buildings in Puget Sound area and 23 remote locations

ITG WLAN RFI Infrastructure Requirements Network Administration of APs Network Administration of APs Full support for Full support for Simple Network Management Protocol (SNMP)-II Management Information Base (MIB) Simple Network Management Protocol (SNMP)-II Management Information Base (MIB) extended MIBs extended MIBs HP Openview integration HP Openview integration Scalable, scripted AP firmware and configuration updates Scalable, scripted AP firmware and configuration updates Little to no user account administration, but secured Little to no user account administration, but secured Enterprise Installation Considerations Enterprise Installation Considerations Low cost for all hardware Low cost for all hardware Power supply configuration options Power supply configuration options Inexpensive plenum installation Inexpensive plenum installation Variety of antenna solutions to increase or direct Radio Frequency (RF) coverage Variety of antenna solutions to increase or direct Radio Frequency (RF) coverage Security Security Encryption and authentication of the wireless link Encryption and authentication of the wireless link Secured administrative access to wireless APs Secured administrative access to wireless APs No removable cards from APs No removable cards from APs

ITG WLAN RFI Infrastructure Requirements b Installation with an Infrastructure Migration Path to a b Installation with an Infrastructure Migration Path to a Troubleshooting Tools for End User and Infrastructure Troubleshooting Tools for End User and Infrastructure Windows® Hardware Quality Labs (WHQL)-certified Driver Support Windows® Hardware Quality Labs (WHQL)-certified Driver Support Windows XP and Windows.NET Server Windows XP and Windows.NET Server Windows CE 2.11 and Pocket PC Windows CE 2.11 and Pocket PC Windows NT® 4 and Windows 2000 Windows NT® 4 and Windows 2000 Windows 98 and Windows 98 SE Windows 98 and Windows 98 SE Adapter Types Adapter Types PC Card (primary choice) PC Card (primary choice) PCI and USB PCI and USB Mini-PCI or other integration in laptops Mini-PCI or other integration in laptops

ITG WLAN RFI Infrastructure Requirements Health and Safety Issues Health and Safety Issues FCC approved FCC approved Support to address health and safety issues Support to address health and safety issues Documentation, Web sites, Q&A sessions, contact information Documentation, Web sites, Q&A sessions, contact information Wireless Home LAN Hardware Solution Wireless Home LAN Hardware Solution Under $250 Under $250 Easy to use and support Easy to use and support Must promote security – Wired Equivalent Privacy (WEP) Must promote security – Wired Equivalent Privacy (WEP) Provides Network Address Translation (NAT)/Dynamic Host Configuration Protocol (DHCP) function Provides Network Address Translation (NAT)/Dynamic Host Configuration Protocol (DHCP) function Variety of products and accessories – hubs, routers, external antennas, and wireless repeating Variety of products and accessories – hubs, routers, external antennas, and wireless repeating Robust support for home users provided by vendor Robust support for home users provided by vendor

ITG WLAN RFI Infrastructure Requirements Installation Considerations Installation Considerations Power supply configuration options Power supply configuration options Inexpensive plenum installation support Inexpensive plenum installation support Flexible antenna solutions to increase coverage area Flexible antenna solutions to increase coverage area Worldwide Deployment Worldwide Deployment Worldwide certification and support Worldwide certification and support Manage differing RF and security requirements across different countries Manage differing RF and security requirements across different countries

ITG Aironet/Cisco Pilot Pilot WLAN in Three Buildings and One Cafeteria Pilot WLAN in Three Buildings and One Cafeteria More than 600 users participated More than 600 users participated PC Card adapters only PC Card adapters only 112 Aironet 4800B b APs 112 Aironet 4800B b APs 11 megabits per second (Mbps) shared connection 11 megabits per second (Mbps) shared connection 128-bit shared WEP key 128-bit shared WEP key Installed APs using existing wall power and network connections Installed APs using existing wall power and network connections Surveyed Users at the End of the Pilot Surveyed Users at the End of the Pilot Greater than 50% response rate Greater than 50% response rate

WLAN Pilot Survey Results 50% saved hours per day due to their WLAN connection 50% saved hours per day due to their WLAN connection 10% used Windows CE devices 10% used Windows CE devices 18% wanted PCI desktop support for testing, demos, home networking 18% wanted PCI desktop support for testing, demos, home networking 24% used WLAN for more than six hours per day 24% used WLAN for more than six hours per day 93% used their computer in new locations 93% used their computer in new locations In conference rooms, hallways, or in other employee offices In conference rooms, hallways, or in other employee offices 72% could work without a wired connection 72% could work without a wired connection 88% were interested in purchasing WLAN equipment for use at home 88% were interested in purchasing WLAN equipment for use at home 66% felt they could run any application or installation over the WLAN connection 66% felt they could run any application or installation over the WLAN connection

WLAN Pilot Operational Recommendations Require concealed installations Require concealed installations Reduces user RF health and safety concerns Reduces user RF health and safety concerns Require multicast application support Require multicast application support Require client and infrastructure troubleshooting tools Require client and infrastructure troubleshooting tools

WLAN Engineering Recommendations AP Placement (to minimize user/AP ratio) AP Placement (to minimize user/AP ratio) Decrease cell size (to 10 meter radius) Decrease cell size (to 10 meter radius) Increase cell density Increase cell density Overlapping cells via channel configuration Overlapping cells via channel configuration Force Mbps connections only Force Mbps connections only Mitigate possible Bluetooth interference Mitigate possible Bluetooth interference Create a migration path to a Create a migration path to a Single Broadcast Service Set Identifier (SSID) Single Broadcast Service Set Identifier (SSID) Enhanced usability with Windows XP Zero Configuration wireless client Enhanced usability with Windows XP Zero Configuration wireless client Client and Helpdesk Troubleshooting Tools Client and Helpdesk Troubleshooting Tools AP Monitor in Windows XP AP Monitor in Windows XP

WLAN Engineering Recommendations Each Separate Building Has a Dedicated DHCP Subnet for WLAN Each Separate Building Has a Dedicated DHCP Subnet for WLAN Enables seamless roaming within building Enables seamless roaming within building Reduces collision domain Reduces collision domain Restricts NetBIOS access to that building segment Restricts NetBIOS access to that building segment Utilize Windows 2000, Windows XP automatic DHCP when changing subnets Utilize Windows 2000, Windows XP automatic DHCP when changing subnets Enhances security Enhances security Low Voltage Wiring or Inline Power Low Voltage Wiring or Inline Power To enable cold booting of APs from a centralized or remote location To enable cold booting of APs from a centralized or remote location Easy Client Setup – Plug and Play Easy Client Setup – Plug and Play AP Load Balancing AP Load Balancing

802.11b Security Concerns WEP WEP Unique key required across enterprise Unique key required across enterprise b standard is only 40-bit b standard is only 40-bit 128-bit is proprietary 128-bit is proprietary WEP keys are not dynamically changed and therefore vulnerable to attack WEP keys are not dynamically changed and therefore vulnerable to attack Using a PC-based tool and b antenna, a 128-bit WEP key can be hacked within two hours, and a 40-bit key within 40 minutes Using a PC-based tool and b antenna, a 128-bit WEP key can be hacked within two hours, and a 40-bit key within 40 minutes Difficult to change or administer Difficult to change or administer Media Access Control (MAC) Address Filtering Media Access Control (MAC) Address Filtering Not scalable Not scalable Exception list must be administrated and propagated to all APs Exception list must be administrated and propagated to all APs The list may have a size limit The list may have a size limit MAC address must be associated to a user name MAC address must be associated to a user name User could neglect to report a lost or stolen card User could neglect to report a lost or stolen card User could change the MAC address User could change the MAC address

The 802.1x Solution Client network access (link layer) is controlled by the AP based on domain user and/or machine account authentication Client network access (link layer) is controlled by the AP based on domain user and/or machine account authentication Authentication process is secured via standard Public Key Infrastructure (PKI) protocols available in Windows XP Authentication process is secured via standard Public Key Infrastructure (PKI) protocols available in Windows XP Extensible Authentication Protocol over LAN (EAPoL) Extensible Authentication Protocol over LAN (EAPoL) Transport Layer Security (TLS) Transport Layer Security (TLS) Public / private keys, X.509 Certificates Public / private keys, X.509 Certificates Uses two factor authentication Uses two factor authentication Client user and computers negotiate authentication against Internet Authentication Server (IAS). Client user and computers negotiate authentication against Internet Authentication Server (IAS). IAS proxies authentication requests to Active Directory and Certificate Authority IAS proxies authentication requests to Active Directory and Certificate Authority IAS is the Microsoft implementation of the IETF Remote Authentication Dial-In User Service (RADIUS) standard IAS is the Microsoft implementation of the IETF Remote Authentication Dial-In User Service (RADIUS) standard WEP keys are dynamic WEP keys are dynamic They are changed with each new connection session, when roaming, or within a preset time interval They are changed with each new connection session, when roaming, or within a preset time interval

802.1x Security The 802.1x solution /.1X Access Point Domain User Certificate Laptop Controlled Port Uncontrolled Port RADIUS (IAS) Domain Controller Certificate Authority DHCP Exchange FilePeers Domain Controller used to log onto domain after obtaining an IP address from DHCP EAP/TLS Connection

802.1x Deployment Challenges Operational Support Operational Support Requires improved troubleshooting tools for both client and infrastructure Requires improved troubleshooting tools for both client and infrastructure Integration of disparate support organizations for end-to-end support Integration of disparate support organizations for end-to-end support Certificate Server, RADIUS server, Active Directory™, AP, and client Certificate Server, RADIUS server, Active Directory™, AP, and client

802.1x Technical Challenges Certificates Issues Certificates Issues Required to build a secure, Web-based tool to validate and / or obtain computer / user certificates Required to build a secure, Web-based tool to validate and / or obtain computer / user certificates Certificate Revocation List (CRL) expiration issues must be managed Certificate Revocation List (CRL) expiration issues must be managed Active Directory Active Directory If Active Directory becomes overloaded; 802.1x authentication is affected If Active Directory becomes overloaded; 802.1x authentication is affected Client DHCP Response Timeouts Client DHCP Response Timeouts Inconsistent across domains and platforms Inconsistent across domains and platforms Poor RADIUS Server Failover Support in APs Poor RADIUS Server Failover Support in APs Can cause clients to fail authentication and lose connectivity Can cause clients to fail authentication and lose connectivity Authentication Mechanisms Stresses Infrastructure Authentication Mechanisms Stresses Infrastructure Reauthentication required when roaming and at timeout Reauthentication required when roaming and at timeout Cross-forest and multi-domain authentication required Cross-forest and multi-domain authentication required

Concealed System Installation Best Practices Pre-installation Pre-installation Develop AP location plan based on design guidelines Develop AP location plan based on design guidelines Field verify proposed AP locations to check for physical interferences Field verify proposed AP locations to check for physical interferences Present final locations for approval prior to starting construction Present final locations for approval prior to starting construction Installation Installation Enclose AP units and antennas within “plenum-rated” enclosures to meet building fire code requirements Enclose AP units and antennas within “plenum-rated” enclosures to meet building fire code requirements Central, low voltage power supply on uninterruptible power supply (UPS) Central, low voltage power supply on uninterruptible power supply (UPS) Delivery Delivery Spot check AP installation for conformance with commissioning checklist Spot check AP installation for conformance with commissioning checklist Check RF coverage and network connectivity of each AP Check RF coverage and network connectivity of each AP Deliver “as-built” documents Deliver “as-built” documents

Sample Installation Architecture

Lessons Learned Costs are Concentrated in Labor and Materials for Building Infrastructure Installation and Construction Costs are Concentrated in Labor and Materials for Building Infrastructure Installation and Construction AP installations should be concealed within the plenum AP installations should be concealed within the plenum Using Standardized Equipment Does Not Ensure Interoperability Using Standardized Equipment Does Not Ensure Interoperability Involve IT Operations and Help Desk Early Involve IT Operations and Help Desk Early Offer educational seminars and engineering reviews Offer educational seminars and engineering reviews Develop and Communicate Security Policies Around “Rogue” Wireless Implementations Develop and Communicate Security Policies Around “Rogue” Wireless Implementations User Health and Safety Concerns Must Be Addressed Appropriately User Health and Safety Concerns Must Be Addressed Appropriately Involve vendor and internal Risk Management and Human Resource organizations Involve vendor and internal Risk Management and Human Resource organizations

Reference Information Microsoft Corporation Microsoft Corporation Enterprise Deployment of IEEE Using Windows XP and Windows 2000 Internet Authentication Service Enterprise Deployment of IEEE Using Windows XP and Windows 2000 Internet Authentication Service x (TechNet) 802.1x (TechNet) x Authentication 802.1x Authentication Wireless Network Security within 802.1x Wireless Network Security within 802.1x Set up 802.1x Authentication on Windows XP Client Set up 802.1x Authentication on Windows XP Client Securing Wireless Networks Security Bulletin Securing Wireless Networks Security Bulletin Wireless LAN Association Wireless LAN Association IEEE & 802.1x IEEE & 802.1x OSHA Health and Safety OSHA Health and Safety Cisco Systems Cisco Systems

For More Information Additional IT Showcase white papers, case studies, and presentations on ITG deployments and best practices can be found on Additional IT Showcase white papers, case studies, and presentations on ITG deployments and best practices can be found on Microsoft TechNet Microsoft TechNet

The Future of WLAN Technology a a New physical layer using 5 GHz band utilizing Orthogonal Frequency- Division Multiplexing (OFDM) to provide speeds up to 54 Mbps New physical layer using 5 GHz band utilizing Orthogonal Frequency- Division Multiplexing (OFDM) to provide speeds up to 54 Mbps Lower range and higher power requirements Lower range and higher power requirements b b Existing implementation using 2.4 GHz band to provide speeds up to 11 Mbps Existing implementation using 2.4 GHz band to provide speeds up to 11 Mbps High range and low power requirements High range and low power requirements d d AP specifies a client profile which includes channel set and power AP specifies a client profile which includes channel set and power Allows for single AP and client product which would self-configure to meet local RF regulations Allows for single AP and client product which would self-configure to meet local RF regulations International roaming – “World Mode” International roaming – “World Mode” e e Quality of Service (QoS) support Quality of Service (QoS) support Coupled with 802.1p (Class of Service) and 802.1q Coupled with 802.1p (Class of Service) and 802.1q Support for real-time applications like voice and streaming media Support for real-time applications like voice and streaming media Dynamically-plumbed WEP keys Dynamically-plumbed WEP keys

The Future of WLAN Technology g g New physical layer using 2.4 GHz band utilizing OFDM New physical layer using 2.4 GHz band utilizing OFDM Max speed 22 Mbps, but cannot coexist with b Max speed 22 Mbps, but cannot coexist with b h h Enhancement to MAC to support EU power and RF requirements Enhancement to MAC to support EU power and RF requirements Recommended feature for any future implementations Recommended feature for any future implementations i i Enhanced Security Enhanced Security Advanced Encryption Standard (AES) strong contender for replacing WEP Advanced Encryption Standard (AES) strong contender for replacing WEP May be used with 802.1x May be used with 802.1x 802.1q 802.1q Virtual LAN (VLAN) tagging Virtual LAN (VLAN) tagging

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is provided for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT.  2002 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, Where to you want to go today?, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other product and company names mentioned herein may be the trademarks of their respective owners.