Optimizing Converged Cisco Networks (ONT)<br />Module 6: Implement Wireless Scalability<br />
Module 6: Implement Wireless Scalability<br />Lesson 6.1: Implementing WLAN QoS<br />
Objectives<br />Describe why WLANs need to support QoS policies in enterprise networks.<br />Explain the issues with imple...
The Need for QoS in Wireless LANs <br />WLANs use collision avoidance rather than collision detection, which is used by Et...
WLAN QoS Queuing Overview<br />
WLAN QoS RF Backoff Timing<br />
Lightweight Access Point—Split MAC Architecture<br />
QoS WLAN Deployment Challenges<br />Facts:<br />Wireless RF (802.11e or WMM) uses Layer 2 marking.<br />End-to-end QoS use...
Overcoming the Challenge<br />WLAN data is tunneled between the access point and WLAN controller via LWAPP.<br />QoS setti...
QoS Implementation Overview<br />2<br />1<br />LWAPP Tunnels<br />Si<br />Si<br />4<br />3<br />
Si<br />Si<br />WLAN QoS Implementation Step 1: Ethernet Switch to Controller and Into the LWAPP Tunnel<br />1<br />Create...
QoS Packet-Marking Translations<br />
WLAN QoS Implementation Step 2: Out of the Tunnel and Through the Access Point to the Wireless Client<br />2<br />Map the ...
WLAN QoS Implementation Step 3: From Client to Access Point and Into the Tunnel <br />LWAPP Tunnels<br />Police the 802.11...
Mapping Traffic from Access Point to Controller<br />The access point will not send tagged packets on a nontrunk port dest...
WLAN QoS Implementation Step 4: Out of the Tunnel Though the Controller to the Ethernet Switch<br />LWAPP Tunnels<br />Map...
802.1p and DSCP Packet Tagging <br />802.1p or DSCP-tagged packets received from LAN:<br />Tag is propagated to LWAPP fram...
802.11e Packet Tagging <br />802.11e QoS packets received from WLAN:<br />Tag is propagated to LWAPP frame.<br />WLAN ID-c...
Cisco Unified Wireless Network Solution <br />Cisco WLAN Controller<br />Network<br />CLI Console<br />Cisco WCS GUI or CL...
QoS Configuration: Per User bandwidth Contracts <br />Each level has a configurable per-bandwidth contract rate:<br />Per-...
QoS Configuration: Over the Air QoS<br />Each level has configurable “over the air” QoS rates:<br />Maximum RF usage per a...
QoS Configuration: Editing QoS Profiles <br />The 802.1p tag is applied to the wired side to allow proper precedence to be...
Configuring WLAN IDs for QoS<br />
Summary<br />With the expansion of WLANs into enterprise and vertical (retail, finance, education) markets, WLANs are now ...
Module 6: Implement Wireless Scalability<br />Lesson 6.2: Introducing Wireless Security<br />
Objectives<br />Describe the need for WLAN security.<br />Describe the evolution of WLAN security methods.<br />Identify c...
The Need for WLAN Security<br />Vulnerabilities:<br />War driving<br />Non-secret SSID<br />MAC filtering<br />Automatic D...
Evolution of WLAN Security<br />
802.11 WEP<br />keystream<br />RC4<br />IV + key<br />0<br />1<br />0<br />1<br />1<br />1<br />0<br />0<br />1<br />0<br ...
802.11 Open Authentication<br />Client sends probe request. <br />Access points (A/B) send probe response. Client evaluate...
802.11 Shared Key Authentication<br />Access Point A<br />Access Point B<br />Steps 1-3 are the same as with open authenti...
Cisco Enhanced 802.11 WEP Security<br />Cisco prestandard enhancements<br />Implemented in 2001 and 2002<br />Authenticati...
Enhanced 802.11 Security<br />Authentication:<br />802.1x and Extensible Authentication Protocol (EAP) protocols<br />User...
Encryption—TKIP and MIC<br />TKIP:<br />Key hashing for unique seed values per packet to protect against WEP initializatio...
WPA2 and AES<br />WPA2 offers the following:<br />Authenticated key management<br />Key validation mechanisms for unicast ...
802.1x Authentication Overview<br />The wireless client must be authenticated before it gains access to the network<br />E...
802.1x Authentication Key Benefits<br />Mutual authentication between client and authentication (RADIUS) server<br />Encry...
802.1x and EAP Authentication Protocols<br />LEAP—EAP Cisco Wireless<br />EAP-FAST<br />EAP-TLS<br />PEAP:<br />PEAP-GTC<b...
Components Required for 802.1x Authentication<br />Authentication server is an EAP-capable RADIUS server:<br />Cisco Secur...
Cisco LEAP<br />Client support:<br />Windows 98-XP-Vista, Windows CE, Macintosh OS 9.X or 10.X, and Linux Kernel 2.2 or 2....
Cisco LEAP Authentication<br />
EAP-FAST: Flexible Authentication via Secure Tunneling<br />Considered in three phases: <br />Protected access credential ...
EAP-FAST Authentication<br />
EAP-TLS<br />Client support:<br />Windows 2000, XP, and Windows CE (natively supported)<br />Non-Windows platforms: Third-...
EAP-TLS Authentication<br />
EAP-PEAP<br />Hybrid authentication method:<br />Server-side authentication with TLS<br />Client-side authentication with ...
EAP-PEAP Authentication<br />
Wi-Fi Protected Access<br />WPA introduced in late 2003<br />Prestandard implementation of IEEE 802.11i WLAN security<br /...
802.11i and WPA Authentication and Key Management Overview<br />
WPA Issues<br />WPA uses TKIP, which uses the same base encryption algorithm, RC4, as WEP.<br />WPA cannot entirely avoid ...
IEEE 802.11i—WPA2<br />802.11i:<br />Ratified in June 2004<br />Standardizes:<br />802.1x for authentication<br />AES encr...
Wireless Intrusion Detection Systems<br />Address RF-related vulnerabilities:<br />Detect, locate, and mitigate rogue devi...
WPA and WPA2 Modes<br />
WPA2 Issues<br />Client (supplicant) must have a WPA2 driver that supports EAP.<br />RADIUS server must understand EAP.<br...
Summary<br />With increased reliance on WLANs, businesses are becoming more concerned about network security. Network mana...
Module 6: Implement Wireless Scalability<br />Lesson 6.3: Managing WLANs<br />
Objectives<br />Identify the components of Wireless LAN networks.<br />Describe the differences between distributed and ce...
Cisco Unified Wireless Network<br />
Cisco Unified Wireless Network (Cont.)<br />
Cisco WLAN Implementation<br />Cisco offers 2 “flavors” of wireless solutions:<br />Distributed WLAN solution<br />Autonom...
Wireless LAN Solution Components<br />
Comparison of the WLAN Solutions<br />Autonomous WLAN:<br />Autonomous access point<br />Configuration of each access poin...
CiscoWorks WLSE Software Features<br />CiscoWorks WLSE is a solution for managing the Cisco autonomous access point infras...
<ul><li>Improved WLAN security
Simplified access point deployment
RF visibility
Dynamic RF management
Simplified operations</li></ul>CiscoWorks WLSE Key Benefits<br />
CiscoWorks WLSE and CiscoWorks WLSE Express<br />Both offer centralized management appliance for autonomous access point s...
Simplified CiscoWorks WLSE Express Setup<br />Setup options:<br />Automatic configuration download from DHCP server:<br />...
CiscoWorks WLSE Configuration Template<br />
CiscoWorks WLSE Benefits<br />
Cisco Wireless Control System (WCS) Features<br />Solution for managing Cisco lightweight access point infrastructure<br /...
Cisco WCS Versions<br />
Cisco WCS Base Software Features<br />Autodiscovery of access points<br />Autodiscovery of rogue access points<br />Map-ba...
Cisco WCS Location Software Features<br />All Cisco WCS Base software features<br />On-demand location of rogue access poi...
Cisco WCS System Requirements<br />Runs as a normal application or a service on:<br />Microsoft Windows 2000<br />Microsof...
Cisco WCS Network Summary Page<br />All reporting is available for a seven day rolling window to allow detailed trending r...
Cisco WCS Controller Summary Page<br />Cisco WCS can support  50 Cisco Wireless Controllers and 1500 access points.<br />
Cisco Wireless Location Appliance Overview<br />Cisco 2710 Series Wireless Location Appliances combine the features of a C...
Cisco Wireless Location Appliance Architecture<br />
Cisco Wireless Location Appliance Applications<br />Visibility and tracking of 1500 mobile devices for 30 days<br />Work-f...
Summary<br />The Cisco Unified Wireless Network is an end-to-end unified wired and wireless network that cost-effectively ...
Module 6: Implement Wireless Scalability<br />Lesson 6.4: Deploying Cisco WCS<br />
Objectives<br />Describe how to add and configure a WLAN controller using WCS.<br />Describe how to add and configure a ac...
Cisco WCS Server Login<br />A default username “root” and password “public” are predefined.<br />The default access is the...
Cisco WCS Network Summary<br />Horizontal Menus<br />Vertical Menus<br />
Adding a Controller<br />The Cisco WCS instance is initially empty and needs to be populated using the Select a command dr...
Configure > Controller > Add Controller > OK<br />
Configure > Access Points<br />After adding a controller, associated access points are automatically added.<br />
Monitor > Maps > New Campus > OK<br />
Monitor > Maps > New Campus > OK (Cont.)<br />Maps can start at either a campus or building, but only a campus will provid...
Adding a New Building<br />
Detecting and Locating Rogue Access Points<br />An alarm indicator appears in Cisco WCS showing 93 rogue access points det...
Rogue Access Points Alarms<br />
Rogue Access Points Location<br />
Summary<br />The Cisco Wireless LAN Controller (WCS) provides a summary of the Cisco WLAN solution, including reported cov...
Module 6: Implement Wireless Scalability<br />Lesson 6.5: Configuring Encryption and Authentication on Lightweight Access ...
Objectives<br />Describe how to use the WLAN controller to configure WLAN security options:<br />Open authentication<br />...
WLAN Controllers<br />
 WLAN Controller Topology and Network Connections<br />WLAN Controller<br />
Configuring Open Authentication<br />
Configuring Static WEP Key Authentication <br />
Configuring WPA Preshared Key<br />This example shows WPApreshared key.<br />
Web Authentication<br />Users authenticate via a web browser interface.<br />Clients using HTTP are automatically directed...
Configuring Web Authentication <br />
Customizing the Web Login Page<br />
802.1x Authentication<br />Microsoft Windows XP clients support only 40-bit or 104-bit dynamic WEP keys.<br />
Upcoming SlideShare
Loading in …5
×

Ont mod 6

1,562 views

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,562
On SlideShare
0
From Embeds
0
Number of Embeds
4
Actions
Shares
0
Downloads
63
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Ont mod 6

  1. 1. Optimizing Converged Cisco Networks (ONT)<br />Module 6: Implement Wireless Scalability<br />
  2. 2. Module 6: Implement Wireless Scalability<br />Lesson 6.1: Implementing WLAN QoS<br />
  3. 3. Objectives<br />Describe why WLANs need to support QoS policies in enterprise networks.<br />Explain the issues with implementing QoS in a WLAN.<br />Describe the technologies used to support QoS in the WLAN.<br />Describe the configuration parameters available in the Cisco Wireless Control System (WCS) to support QoS in the WLAN.<br />
  4. 4. The Need for QoS in Wireless LANs <br />WLANs use collision avoidance rather than collision detection, which is used by Ethernet LANs.<br />Wired LANs use DSCP or 802.1p to provide QoS. These do not work in a WLAN.<br />802.11e is an extension of 802.11 that provides more consistent, quality RF transmission for voice and video.<br />
  5. 5. WLAN QoS Queuing Overview<br />
  6. 6. WLAN QoS RF Backoff Timing<br />
  7. 7. Lightweight Access Point—Split MAC Architecture<br />
  8. 8. QoS WLAN Deployment Challenges<br />Facts:<br />Wireless RF (802.11e or WMM) uses Layer 2 marking.<br />End-to-end QoS uses Layer 3 DSCP packet marking.<br />Traffic destined for access points does not contain 802.1p QoS tag information because the access points connect to Cisco Catalyst switches via access ports rather than trunks. <br />Consequence: <br />Layer 2 marking and QoS information is lost in end-to-end transit.<br />The Challenge: <br />The goal is to use the Layer 3 DSCP information to preserve end-to-end QoS in the absence of Layer 2 QoS information.<br />
  9. 9. Overcoming the Challenge<br />WLAN data is tunneled between the access point and WLAN controller via LWAPP.<br />QoS settings of the encapsulated data packet are mapped to the Layer 2 (802.1p) and Layer 3 (IP DSCP) fields of the outer tunnel packet.<br />
  10. 10. QoS Implementation Overview<br />2<br />1<br />LWAPP Tunnels<br />Si<br />Si<br />4<br />3<br />
  11. 11. Si<br />Si<br />WLAN QoS Implementation Step 1: Ethernet Switch to Controller and Into the LWAPP Tunnel<br />1<br />Create the outer header of the LWAPP packet with a copy of the DSCP value of the incoming packet, and a translation of the DSCP value into a 802.1p value.<br />LWAPP Tunnels<br />
  12. 12. QoS Packet-Marking Translations<br />
  13. 13. WLAN QoS Implementation Step 2: Out of the Tunnel and Through the Access Point to the Wireless Client<br />2<br />Map the DSCP value of the incoming LWAPP packet to the 802.11e priority value. Place in the 802.11 tX queue appropriate for that 802.11e/WMM value.<br />Si<br />Si<br />LWAPP Tunnels<br />The original DSCP value is preserved.<br />
  14. 14. WLAN QoS Implementation Step 3: From Client to Access Point and Into the Tunnel <br />LWAPP Tunnels<br />Police the 802.11e priority value, then map the value to the DSCP value.<br />Si<br />Si<br />3<br />
  15. 15. Mapping Traffic from Access Point to Controller<br />The access point will not send tagged packets on a nontrunk port destined for the controller; therefore, the access point will not copy the 802.11e client incoming priority value to the 802.1p (outer) that is destined for the switch.<br />
  16. 16. WLAN QoS Implementation Step 4: Out of the Tunnel Though the Controller to the Ethernet Switch<br />LWAPP Tunnels<br />Map the DSCP value of the original packet to the 802.1p value.<br />The original DSCP value is preserved.<br />Si<br />Si<br />4<br />
  17. 17. 802.1p and DSCP Packet Tagging <br />802.1p or DSCP-tagged packets received from LAN:<br />Tag is propagated to LWAPP frame.<br />WLAN ID-configured QoS takes priority for assigned access category; if tag is lower than configured QoS, access point will queue packet at lower access category.<br />AAA override can be applied to Cisco IBNS WLAN clients.<br />Untagged packets received from LAN:<br />WLAN ID-configured QoS will be applied for access category.<br />AAA override can be applied to Cisco IBNS WLAN clients.<br />
  18. 18. 802.11e Packet Tagging <br />802.11e QoS packets received from WLAN:<br />Tag is propagated to LWAPP frame.<br />WLAN ID-configured QoS takes priority for assigned 802.1p tag; if 802.11e access category is lower than configured QoS, lower 802.1p tag will be applied.<br />802.11e QoS packets received from WLAN will be802.1p-tagged when transmitted on the LAN by the controller.<br />Non-QoS packets received from WLAN will be best effort (default silver) when transmitted on the LAN by the controller.<br />
  19. 19. Cisco Unified Wireless Network Solution <br />Cisco WLAN Controller<br />Network<br />CLI Console<br />Cisco WCS GUI or CLI<br />Location Appliance (Optional)<br />Access Points<br />
  20. 20. QoS Configuration: Per User bandwidth Contracts <br />Each level has a configurable per-bandwidth contract rate:<br />Per-user data bandwidth contract—Configurable peak and average data rate enforcement for non-UDP traffic<br />Per-user real-time bandwidth contract—Configurable peak and average data rate enforcement for UDP traffic<br />
  21. 21. QoS Configuration: Over the Air QoS<br />Each level has configurable “over the air” QoS rates:<br />Maximum RF usage per access point (%)—Defined maximum percentage of air bandwidth given to an access category<br />Queue depth—Defined depth of queue for a particular user level that will cause packets in excess of the defined value to be dropped<br />
  22. 22. QoS Configuration: Editing QoS Profiles <br />The 802.1p tag is applied to the wired side to allow proper precedence to be applied to traffic across the entire network infrastructure.<br />
  23. 23. Configuring WLAN IDs for QoS<br />
  24. 24. Summary<br />With the expansion of WLANs into enterprise and vertical (retail, finance, education) markets, WLANs are now used to transport high-bandwidth, intensive data applications in conjunction with time-sensitive multimedia applications. This requirement has led to the necessity for wireless QoS.<br />The lightweight access point WLAN solution enhances the way access points use Layer 3 information to ensure that packets receive the correct over-the-air prioritization when the packets are transmitted from the access point to the wireless client.<br />QoS protocols used on the WLAN and wired network media must be mapped to one another while traffic transits the boundary between the two media. <br />
  25. 25. Module 6: Implement Wireless Scalability<br />Lesson 6.2: Introducing Wireless Security<br />
  26. 26. Objectives<br />Describe the need for WLAN security.<br />Describe the evolution of WLAN security methods.<br />Identify common authentication and encryption technologies used in WLANs.<br />Explain the benefits and weaknesses of the common security methods used in WLANs.<br />
  27. 27. The Need for WLAN Security<br />Vulnerabilities:<br />War driving<br />Non-secret SSID<br />MAC filtering<br />Automatic DHCP<br />Man-in-the middle attacks<br />Cracking WEP<br />Initialization Vector attacks<br />Password Cracking<br />DoS attacks<br />WLAN Security requires:<br />Authentication: Proves the user belongs on the network<br />Encryption: Protects the data traversing the network<br />
  28. 28. Evolution of WLAN Security<br />
  29. 29. 802.11 WEP<br />keystream<br />RC4<br />IV + key<br />0<br />1<br />0<br />1<br />1<br />1<br />0<br />0<br />1<br />0<br />0<br />1<br />seed<br />Plain text<br />Cipher text<br />WEP aims at providing Wired Equivalent Privacy<br />WEP is an optional IEEE standard for encryption<br />Keys can be static and shared among many clients<br />Uses RC4 algorithm—known vulnerabilities<br />Keys can be dynamic and unique for each client(as with 802.1x) per session<br />
  30. 30. 802.11 Open Authentication<br />Client sends probe request. <br />Access points (A/B) send probe response. Client evaluates access point response and selects the best access point.<br />Client sends authentication request to selected access point (A).<br />Access point A confirms authentication and registers client.<br />Client sends association request to selected access point (A).<br />Access point A confirms association and registers client.<br />Access Point A<br />Access Point B<br />
  31. 31. 802.11 Shared Key Authentication<br />Access Point A<br />Access Point B<br />Steps 1-3 are the same as with open authentication.<br />Access point A sends authentication response containing the unencrypted challenge text.<br />Client encrypts the challenge text using one of its WEP keys and sends it to access point (A).<br />Access point A compares the encrypted challenge text to its copy of the encrypted challenge text. If the text is the same, access point A will allow the client onto the WLAN.<br />
  32. 32. Cisco Enhanced 802.11 WEP Security<br />Cisco prestandard enhancements<br />Implemented in 2001 and 2002<br />Authentication:<br />802.1x and Extensible Authentication Protocol (EAP) protocols<br />User, token, and machine credentials<br />Dynamic encryption key generation<br />Encryption:<br />CKIP<br />CMIC<br />
  33. 33. Enhanced 802.11 Security<br />Authentication:<br />802.1x and Extensible Authentication Protocol (EAP) protocols<br />User, token, and machine credentials<br />Dynamic encryption key generation<br />IEEE 802.11i<br />Encryption:<br />TKIP and MIC<br />Wi-Fi Protected Access (WPA)—TKIP encryption<br />WPA2—Advanced Encryption Standard (AES)<br />
  34. 34. Encryption—TKIP and MIC<br />TKIP:<br />Key hashing for unique seed values per packet to protect against WEP initialization vector vulnerabilities<br />MIC from Michael algorithm<br />Broadcast key rotation <br />MIC:<br />Provides more protection than Integrity Check Value (ICV) by protecting the header and the payload<br />Protects against man-in-the-middle or replay attacks<br />
  35. 35. WPA2 and AES<br />WPA2 offers the following:<br />Authenticated key management<br />Key validation mechanisms for unicast and broadcast keys<br />TKIP is used, which for WPA includes both per-packet keying and MIC<br />Expanded IV (defeats AirSnort)<br />Broadcast key rotation<br />AES Encryption: <br />128-bit block cipher—cryptographically more robustthan RC4<br />Requires new radio cards on clients and access points because more CPU power is required<br />
  36. 36. 802.1x Authentication Overview<br />The wireless client must be authenticated before it gains access to the network<br />Extensible and interoperable supports:<br />Different EAP authentication methods or types<br />May be used with multiple encryption algorithms<br />Depends on client capability<br />Supported by Cisco since December 2000<br />
  37. 37. 802.1x Authentication Key Benefits<br />Mutual authentication between client and authentication (RADIUS) server<br />Encryption keys derived after authentication<br />Centralized policy control<br />
  38. 38. 802.1x and EAP Authentication Protocols<br />LEAP—EAP Cisco Wireless<br />EAP-FAST<br />EAP-TLS<br />PEAP:<br />PEAP-GTC<br />PEAP-MSCHAPv2<br />
  39. 39. Components Required for 802.1x Authentication<br />Authentication server is an EAP-capable RADIUS server:<br />Cisco Secure ACS, Microsoft IAS, Meetinghouse Aegis<br />Local authentication service on Cisco IOS access point<br />May use either local RADIUS database or an external database server such as Microsoft Active Directory or RSA SecurID<br />Authenticator is an 802.1x-capable access point.<br />Supplicant is an EAP-capable client:<br />Requires 802.1x-capable driver<br />Requires an EAP supplicant—either available with client card, native in operating system, or from third-party software<br />
  40. 40. Cisco LEAP<br />Client support:<br />Windows 98-XP-Vista, Windows CE, Macintosh OS 9.X or 10.X, and Linux Kernel 2.2 or 2.4<br />Cisco Compatible Extensions Clients (CCXv1)<br />RADIUS server:<br />Cisco Secure ACS and Cisco Access Registrar<br />Meetinghouse Aegis<br />Interlink Merit<br />Microsoft domain or Active Directory (optional) for back-end authentication (must be Microsoft format database)<br />Device support:<br />Cisco autonomous access points and bridges<br />Cisco lightweight access points and WLAN controllers<br />Cisco Unified Wireless IP Phone 7920 (VoIP) handset<br />
  41. 41. Cisco LEAP Authentication<br />
  42. 42. EAP-FAST: Flexible Authentication via Secure Tunneling<br />Considered in three phases: <br />Protected access credential is generated in Phase 0 (Dynamic PAC provisioning):<br />Unique shared credential used to mutually authenticate client and server<br />Associated with a specific user ID and an authority ID<br />Removes the need for PKI<br />A secure tunnel is established in Phase 1.<br />Client is authenticated via the secure tunnel in Phase 2.<br />
  43. 43. EAP-FAST Authentication<br />
  44. 44. EAP-TLS<br />Client support:<br />Windows 2000, XP, and Windows CE (natively supported)<br />Non-Windows platforms: Third-party supplicants (Meetinghouse)<br />User certificate required for each client<br />Infrastructure requirements:<br />EAP-TLS-supported RADIUS server<br />Cisco Secure ACS, Cisco Access Registrar, Microsoft IAS, Aegis, Interlink<br />RADIUS server requires a server certificate<br />Certificate authority server (PKI)<br />Certificate management:<br />Both client and RADIUS server certificates to be managed<br />
  45. 45. EAP-TLS Authentication<br />
  46. 46. EAP-PEAP<br />Hybrid authentication method:<br />Server-side authentication with TLS<br />Client-side authentication with EAP authentication types<br />EAP-GTC<br />EAP-MSCHAPv2<br />Clients do not require certificates.<br />RADIUS server requires a server certificate:<br />RADIUS server has self-issuing certificate capability.<br />Purchase a server certificate per server from PKI entity.<br />Set up a simple PKI server to issue server certificates.<br />Allows for one-way authentication types to be used:<br />One-time passwords<br />Proxy to LDAP, Unix, Microsoft Windows NT and Active Directory, Kerberos<br />
  47. 47. EAP-PEAP Authentication<br />
  48. 48. Wi-Fi Protected Access<br />WPA introduced in late 2003<br />Prestandard implementation of IEEE 802.11i WLAN security<br />Addresses currently known security problems with WEP <br />Allows software upgrade on deployed 802.11 equipment to improve security<br />Components of WPA:<br />Authenticated key management using 802.1x: EAP authentication and preshared key authentication<br />Unicast and broadcast key management<br />Standardized TKIP per-packet keying and MIC protocol<br />Initialization vector space expansion: 48-bit initialization vectors<br />Migration mode—coexistence of WPA and non-WPA devices (optional implementation that is not required for WPA certification)<br />
  49. 49. 802.11i and WPA Authentication and Key Management Overview<br />
  50. 50. WPA Issues<br />WPA uses TKIP, which uses the same base encryption algorithm, RC4, as WEP.<br />WPA cannot entirely avoid the design flaws of WEP.<br />WPA is a compromise solution.<br />Software upgrade is required for clients and access points, which gives no guarantee that all vendors will support the solution.<br />Operating system support or a supplicant client is required.<br />WPA is susceptible to a new type of DoS attack.<br />WPA is susceptible to a recently discovered weakness when preshared keys are used.<br />
  51. 51. IEEE 802.11i—WPA2<br />802.11i:<br />Ratified in June 2004<br />Standardizes:<br />802.1x for authentication<br />AES encryption—Facilitates U.S. government FIPS 140-2 compliance <br />Key management<br />WPA2:<br />Supplement to WPA “version 1”—Wi-Fi Alliance interoperable implementation of 802.11i<br />Provides for AES encryption to be used<br />Proactive Key Caching<br />Third-party testing and certification for WLAN device compatibility<br />
  52. 52. Wireless Intrusion Detection Systems<br />Address RF-related vulnerabilities:<br />Detect, locate, and mitigate rogue devices<br />Detect and manage RF interference<br />Detect reconnaissance if possible<br />Address standards-based vulnerabilities:<br />Detect management frame and hijacking-style attacks<br />Enforce security configuration policies<br />Complementary functionality:<br />Forensic analysis<br />Compliance reporting<br />
  53. 53. WPA and WPA2 Modes<br />
  54. 54. WPA2 Issues<br />Client (supplicant) must have a WPA2 driver that supports EAP.<br />RADIUS server must understand EAP.<br />PEAP carries EAP types within a channel secured by TLS and so requires a server certificate.<br />WPA2 is more computationally intensive with optional AES encryption.<br />WPA2 may require new WLAN hardware to support AES encryption.<br />
  55. 55. Summary<br />With increased reliance on WLANs, businesses are becoming more concerned about network security. Network managers need to provide end users with freedom and mobility without offering intruders access to the WLAN or the information sent and received on the wireless network. <br />Authentication and encryption are the two primary facilities for securing the WLAN. While encryption using static WEP keys is very vulnerable, WLANs can now be configured to support EAP and the 802.1x standards including LEAP, EAP-FAST, EAP-TLS, PEAP, WPA, and WPA2.<br />
  56. 56. Module 6: Implement Wireless Scalability<br />Lesson 6.3: Managing WLANs<br />
  57. 57. Objectives<br />Identify the components of Wireless LAN networks.<br />Describe the differences between distributed and centralized WLANs.<br />Describe the purpose and features of the CiscoWorks Wireless LAN Solution Engine.<br />Describe the purpose and features of the Cisco Wireless Control System.<br />Explain how the Cisco Location device can be used in WLANs.<br />
  58. 58. Cisco Unified Wireless Network<br />
  59. 59. Cisco Unified Wireless Network (Cont.)<br />
  60. 60. Cisco WLAN Implementation<br />Cisco offers 2 “flavors” of wireless solutions:<br />Distributed WLAN solution<br />Autonomous AP<br />Wireless LAN Solution Engine (WLSE)<br />Centralized WLAN solution<br />Lightweight AP<br />Wireless LAN Controller (WLC)<br />
  61. 61. Wireless LAN Solution Components<br />
  62. 62. Comparison of the WLAN Solutions<br />Autonomous WLAN:<br />Autonomous access point<br />Configuration of each access point<br />Independent operation<br />Management via CiscoWorks WLSE and WDS<br />Access point redundancy<br />Lightweight WLAN:<br />Lightweight access point<br />Configuration via Cisco Wireless LAN Controller <br />Dependent on Cisco Wireless LAN Controller <br />Management via Cisco Wireless LAN Controller <br />Cisco Wireless LAN Controller redundancy<br />
  63. 63. CiscoWorks WLSE Software Features<br />CiscoWorks WLSE is a solution for managing the Cisco autonomous access point infrastructure:<br />Configuration of access points<br />Fault and policy monitoring<br />Reporting<br />Firmware upgrade on access points and bridges<br />Radio management<br />CiscoWorks WLSE administration<br />Deployment wizard for access points<br />
  64. 64. <ul><li>Improved WLAN security
  65. 65. Simplified access point deployment
  66. 66. RF visibility
  67. 67. Dynamic RF management
  68. 68. Simplified operations</li></ul>CiscoWorks WLSE Key Benefits<br />
  69. 69. CiscoWorks WLSE and CiscoWorks WLSE Express<br />Both offer centralized management appliance for autonomous access point solutions<br />CiscoWorks WLSE Express:<br />Used for SMB, commercial, and branch offices (up to 100)<br />AAA server included<br />CiscoWorks WLSE:<br />Used for medium-to-large enterprises (up to 2500)<br />Requires external AAA server<br />CiscoWorks WLSE<br />CiscoWorks WLSE Express<br />
  70. 70. Simplified CiscoWorks WLSE Express Setup<br />Setup options:<br />Automatic configuration download from DHCP server:<br />DHCP enabled by default<br />Options 66 and 67 provide TFTP IP address and filename<br />Use setup command to configure CiscoWorks WLSE Express <br />
  71. 71. CiscoWorks WLSE Configuration Template<br />
  72. 72. CiscoWorks WLSE Benefits<br />
  73. 73. Cisco Wireless Control System (WCS) Features<br />Solution for managing Cisco lightweight access point infrastructure<br />Flexible and secure network management tool:<br />Intuitive GUI<br />Browser accessible via HTTPS<br />Device management via SNMP(supports SNMPv1, SNMPv2, and SNMPv3)<br />Ease of system maintenance<br />Three versions of Cisco WCS:<br />Cisco WCS Base<br />Cisco WCS Location<br />Cisco WCS Location + Cisco 2700 Series Wireless Location Appliance<br />
  74. 74. Cisco WCS Versions<br />
  75. 75. Cisco WCS Base Software Features<br />Autodiscovery of access points<br />Autodiscovery of rogue access points<br />Map-based organization of access point coverage areas<br />User-supplied campus, building, and floor plan graphics<br />System-wide control of streamlined network, controller, and managed APs:<br />Configuration with customer-defined templates <br />Status and alarm monitoring <br />Automated and manual data client monitoring and control <br />Automated monitoring of rogue APs, coverage holes, security violations, controllers, and APs<br />Full event logs <br />Automatic channel and power level assignment <br />User-defined automatic controller status audits, missed trap polling, configuration backups, and policy cleanups<br />
  76. 76. Cisco WCS Location Software Features<br />All Cisco WCS Base software features<br />On-demand location of rogue access points to within 33 feet(10 meters)<br />On-demand location of clients to within 33 feet<br />Ability to use Cisco Wireless Location Appliances<br />
  77. 77. Cisco WCS System Requirements<br />Runs as a normal application or a service on:<br />Microsoft Windows 2000<br />Microsoft Windows 2003<br />Red Hat Enterprise Linux ES<br />Configures and monitors one or more WLAN controllers and associated access points.<br />
  78. 78. Cisco WCS Network Summary Page<br />All reporting is available for a seven day rolling window to allow detailed trending reports.<br />
  79. 79. Cisco WCS Controller Summary Page<br />Cisco WCS can support 50 Cisco Wireless Controllers and 1500 access points.<br />
  80. 80. Cisco Wireless Location Appliance Overview<br />Cisco 2710 Series Wireless Location Appliances combine the features of a Cisco WCS server and a stand alone chassis to:<br />Compute historical location data<br />Collect historical location data<br />Store historical location data<br />Configuration and operation uses Cisco WCS with an easy-to-use GUI.<br />Uses a CLI console session for initial configuration before using the GUI.<br />
  81. 81. Cisco Wireless Location Appliance Architecture<br />
  82. 82. Cisco Wireless Location Appliance Applications<br />Visibility and tracking of 1500 mobile devices for 30 days<br />Work-flow automation and people tracking<br />Telemetry<br />WLAN security and network control<br />RF capacity management and visibility<br />
  83. 83. Summary<br />The Cisco Unified Wireless Network is an end-to-end unified wired and wireless network that cost-effectively addresses WLAN security, deployment, management, and control issues.<br />The distributed WLAN solution is based on autonomous access points and uses the Wireless LAN Solution Engine (WLSE) for management. The centralized WLAN solution is based on lightweight access points and wireless LAN controllers.<br />The Cisco Wireless Location Appliance uses advanced RF fingerprinting technology to track thousands of 802.11 wireless devices simultaneously from directly within a WLAN infrastructure.<br />
  84. 84. Module 6: Implement Wireless Scalability<br />Lesson 6.4: Deploying Cisco WCS<br />
  85. 85. Objectives<br />Describe how to add and configure a WLAN controller using WCS.<br />Describe how to add and configure a access point using WCS.<br />Describe how to add and manage maps in WCS.<br />Describe how to detect and locate rogue access points in WCS.<br />
  86. 86. Cisco WCS Server Login<br />A default username “root” and password “public” are predefined.<br />The default access is the IP address of the server as the URL and HTTPS as the access method, which may also require a designated port.<br />
  87. 87. Cisco WCS Network Summary<br />Horizontal Menus<br />Vertical Menus<br />
  88. 88. Adding a Controller<br />The Cisco WCS instance is initially empty and needs to be populated using the Select a command drop-down list.<br />Cisco WCS has search criteria, such as networks, controller name, or IP address.<br />
  89. 89. Configure > Controller > Add Controller > OK<br />
  90. 90. Configure > Access Points<br />After adding a controller, associated access points are automatically added.<br />
  91. 91. Monitor > Maps > New Campus > OK<br />
  92. 92. Monitor > Maps > New Campus > OK (Cont.)<br />Maps can start at either a campus or building, but only a campus will provide an outdoor coverage area.<br />A building can be added as a single entity or as part of a campus.<br />
  93. 93. Adding a New Building<br />
  94. 94. Detecting and Locating Rogue Access Points<br />An alarm indicator appears in Cisco WCS showing 93 rogue access points detected.<br />Select the alarm for more information.<br />
  95. 95. Rogue Access Points Alarms<br />
  96. 96. Rogue Access Points Location<br />
  97. 97. Summary<br />The Cisco Wireless LAN Controller (WCS) provides a summary of the Cisco WLAN solution, including reported coverage holes, access point operational data, the most recently detected rogue access points, and client distribution over time.<br />WCS is used to manage and configure controllers and access points in a graphical user interface.<br />WCS alarms provide a visual indication of the current fault or state of an element that needs attention<br />
  98. 98. Module 6: Implement Wireless Scalability<br />Lesson 6.5: Configuring Encryption and Authentication on Lightweight Access Points<br />
  99. 99. Objectives<br />Describe how to use the WLAN controller to configure WLAN security options:<br />Open authentication<br />WEP key authentication<br />WPA preshared key<br />Web authentication<br />802.1x<br />WPA2<br />
  100. 100. WLAN Controllers<br />
  101. 101. WLAN Controller Topology and Network Connections<br />WLAN Controller<br />
  102. 102. Configuring Open Authentication<br />
  103. 103. Configuring Static WEP Key Authentication <br />
  104. 104. Configuring WPA Preshared Key<br />This example shows WPApreshared key.<br />
  105. 105. Web Authentication<br />Users authenticate via a web browser interface.<br />Clients using HTTP are automatically directed to alogin page:<br />Customizable for logos and text<br />Maximum simultaneous authentication requests—21<br />Maximum local web authentication users—2500<br />Generally used for guest access:<br />Data is not secure between the access point and the client.<br />
  106. 106. Configuring Web Authentication <br />
  107. 107. Customizing the Web Login Page<br />
  108. 108. 802.1x Authentication<br />Microsoft Windows XP clients support only 40-bit or 104-bit dynamic WEP keys.<br />
  109. 109. Configuring WPA with 802.1x<br />This example shows WPA with dynamic keys.<br />
  110. 110. WPA2<br />This example shows WPA2 with dynamic keys.<br />
  111. 111. Summary<br />Authentication and encryption are the two primary facilities for securing the WLAN. While encryption using static WEP keys is very vulnerable, WLANs can now be configured to support EAP and the 802.1x standards including LEAP, EAP-FAST, EAP-TLS, PEAP, WPA, and WPA2.<br />

×