WLANs have a flexible architecture. You can easily extendthe range and allow seamless roaming between APs. Thepreferred setup method for roaming within the officeenvironment is to install multiple APs with the same ServiceSet Identifier (SSID) and security settings, however witheach on a unique channel. 802.11 has three truly uniquechannels: 1, 6 and 11. You can spread out the APs in anoverlapping channel layout as shown below:
Like installing locks and keys on a door to control entry, wirelessLAN security is designed to control which users can access thewireless LAN. The following table provides a summary of various WLAN security protocols and techniques.
Table 3. Security Types available for 802.11
WEPWired Equivalency Privacy
, the original security standard forwireless LANs, easily exploited by software that can break theencryption after capturing traffic and recognizing encryption patterns.
is the IEEE standard for wired and wireless LAN accesscontrol. It provides a means of authenticating and authorizing devicesattached to a LAN. 802.1X defines the
Extensible AuthenticationProtocol (EAP)
. EAP uses a central authentication server toauthenticate each network user. EAP also has some vulnerabilities.
LEAPLightweight Extensible Authentication Protocol
,developed by Cisco, is based on the 802.1X authentication frameworkbut addresses several weaknesses using dynamic WEP andsophisticated key management. LEAP also adds MAC addressauthentication.
PEAPProtected Extensible Authentication Protocol (PEAP)
providessecure transport of authentication data, including passwords andencryption keys. With PEAP, wireless clients can be authenticatedwithout certificates, simplifying the secure wireless LAN architecture.
WPAWi-Fi Protected Access (WPA)
is a subset of the 802.11i securitystandard and is expected to replace WEP. WPA combines TemporalKey Integrity Protocol (TKIP) and 802.1X for dynamic key encryptionand mutual authentication.
TKIPTemporal Key Integrity Protocol (TKIP)
is part of the IEEE 802.11iencryption standard. TKIP provides per-packet key mixing, amessage integrity check, and a re-keying mechanism, fixing the flawsof WEP.
is second generation WPA, providing Wi-Fi users a high levelof assurance that only authorized users can access their wirelessnetworks. WPA2 is based on the final IEEE 802.11i amendment to the802.11 standard.
To provide basic authentication, most APs support simple MACaddress filtering. Default security values are built-in and, in mostcases, the AP implements these values on power up. However, youmay want to make changes. Typically the following threeparameters are configurable:
– The Service Set Identifier will normally default to themanufacturer's name. You can set it to any word or phrase you like.
– Normally the channel setting will default to channel 6.However, if a nearby neighbor is also using an access point and it isset to channel 6, there can be interference. Choose any otherchannel between 1 and 11. An easy way to see if your neighborshave access points is to use the search feature that comes with yourwireless card.
– WEP is disabled by default. To turn it on you mustenter a WEP key and turn on 128-bit encryption.
WEP is the original security protocol for WLANs, defined in the802.11 standard. WEP was the only encryption available on early802.11 devices and is not an industrial security algorithm.Although simple to implement, WEP is easily hacked. Significantsecurity improvements can be made simply by implementing twooptions built in to the Access Point: MAC address filtering andhiding the SSID. These measures will stop unwanted traffic fromaccidental intrusion and casual hackers, but are not sufficient forsensitive data or mission-critical networks.
LEAP is a proprietary authentication solution that is based on802.1X but adds proprietary elements of security. The standard wasdeveloped by Cisco and, although implementation is simple, itshares some weaknesses with WEP and should not be used if highsecurity is required for your configuration.LEAP helps eliminatesecurity vulnerabilities through the use of the following techniques
– The client must authenticate the network and the network needs to authenticate the client.
– LEAP eliminates the possibility of an unauthorized user access the network through a preauthorizedpiece of equipment by the use of usernames and passwords.\
Dynamic WEP Keys
– LEAP uses 802.1X to continually generateunique WEP keys for each user.
Figure 5. Extending Range