WIFITECHBLOG: 2014

WiNG How-To Guide Wireless Filters - Configuration

Admin Sunday, February 16, 2014 7:12 AM 0 nhận xét

WiNG How-To Guide Wireless Filters - Overview

Admin 6:48 AM 0 nhận xét

WiNG How-To Guide 3G WAN - Configuration

Admin Saturday, February 15, 2014 9:11 PM 0 nhận xét

Requirements:

The following requirements must be met prior to attempting this configuration:

One RFS4000 or RFS6000 WLAN Switch Controllers are installed and operational on the network.
A wireline Internet service is connected to the RFS4000 or RFS6000 WLAN Switch Controller and NAT and Firewall rules applied.
A supported Express 3G WAN card is activated and installed in the WLAN Switch Controller.
A Windows XP workstation is available with Microsoft Internet Explorer or Mozilla Firefox to perform Web UI or CLI configuration.
The reader has read the Motorola RFS Series Wireless LAN Switches - WiNG System Reference Guide.

Components Used:

The information in this document is based on the following Motorola hardware and software versions:

1 x RFS4000 running Version 4.2.0.0-024R.
1 x AT&T GT Ultra Express 3G Card.
1 x ADSL Wireline Internet Service.

Configuration:

The following section outlines the configuration steps required to obtain a feature license key and install it on an RF Switch:

1) AT&T 3G Card Installation [Section 3.1]:

2) Verizon 3G Card Installation [Section 3.2]:

3) Network Address Translation [Section 3.3]:

4) Firewall Policies [Section 3.4]:

Figure 3.0 provides a detailed topology of the hardware and software components highlighted in section 2.2 used to create this guide.

AT&T 3G Card Installation:

The following section provides a step-by-step configuration example for enabling an Option Wireless GT Ultra Express 3G card on a WLAN Switch Controller using the Web-UI and CLI:

1. Using the Web-UI click Switch > Ports > Wireless Wan Interface Card. Enter the following information

1) Access Port Name: isp.cingular

2) User Name: isp@cingulargprs.com

3) Password: cingular1

Set the Activation Mode to Enable then click Apply.

RFS4000(config)# wwan username isp@cingulargprs.com

RFS4000(config)# wwan password 0 cingular1

RFS4000(config)# wwan apn isp.cingular

RFS4000(config)# wwan auth-type chap

RFS4000(config)# wwan enable

2. Once the Option Wireless GT Ultra Express 3G card has been activated, the 3G card will connect to the 3G network and the service providers DNS Server IP addresses will be displayed.

RFS4000# show wwan dns-server

Preferred DNS server : 209.183.35.23;

Alternate DNS server : 209.183.33.23;

Verizon 3G Card Installation:

The following section provides a step-by-step configuration example for enabling a Verizon WirelessV740 Express 3G card on a WLAN Switch Controller using the Web-UI and CLI:

1. Using the Web-UI click Switch > Ports > Wireless Wan Interface Card. Enter the following information

1) Access Port Name: vzw3g

2) User Name: <verizon-telephone-number>@vzw3g.com

3) Password: vzw

Set the Activation Mode to Enable then click Apply.

RFS4000(config)# wwan username <verizon-phone-number>@vzw3g.com

RFS4000(config)# wwan password 0 vzw

RFS4000(config)# wwan apn vzw3g

RFS4000(config)# wwan auth-type chap

RFS4000(config)# wwan enable

2. Once the Verizon Wireless V740 Express 3G card has been activated, the 3G card will connect to the 3G network and the service providers DNS Server IP addresses will be displayed.

RFS4000# show wwan dns-server

Preferred DNS server : 209.183.35.23;

Alternate DNS server : 209.183.33.23;

WiNG How-To Guide 3G WAN

Admin 9:00 PM 0 nhận xét

Introduction:

3G or 3rd Generation is a family of standards for mobile telecommunications defined by the International Telecommunication Union which includes GSM, UMTS, CDMA as well as DECT and WiMAX. Compared with 2G or 2.5G, 3G offers simultaneous speech and data services and improved data rates allowing network operators to offer a wider range of advanced services to subscribers while achieving greater network capacity through improved spectral efficiency.

3G Applications:

3G WAN support is available on the RFS4000/RFS6000 WLAN Switch Controllers running WiNG 4.1.0.1 and above and can be deployed to provide primary Internet access at a remote site or Internet failover in the event of a primary wireline Internet service failure.

Primary Internet Access:

For primary Internet access the 3G WAN card provides the primary outbound path for the site to the public Internet. Once connected the 3G card interface will receives network addressing from the service providers DHCP server and the WLAN Switch Controller will use the service provider’s upstream router as its default route.

For primary Internet access a NAT rule must be defined that translates internal private addresses to the Public IP address assigned to the 3G interface. Note that unlike virtual IP interfaces, the 3G interface is automatically designated as a NAT outside interface.

Internet Failover:

For Internet failover the 3G WAN card provides a backup Internet path to a wireline Internet service directly connected to the WLAN Switch Controller. During normal operation the WLAN Switch Controller will use the wireline Internet service and all outbound Internet traffic will be forwarded to the wireline service provider’s router. The wireline service provider’s router is dynamically or statically defined as the WLAN Switch Controller’s default router.

To detect a wireline Internet service failure the WLAN Switch Controller monitors the state of the default router will failover to the 3G interface if the default router becomes unreachable. Outbound Internet will failover to the 3G interface if:

1) The physical port that the default router is connected through goes down.

2) The default router is no longer reachable by the WLAN Switch Controller.

If the wireline service provider’s router becomes unreachable, the WLAN Switch Controller will dynamically update the NAT rule to use the 3G interface as well as dynamically update the routing table so that the 3G WAN service provider’s upstream router becomes the default gateway for the WLAN Switch Controller. All outbound traffic destined to the public Internet will then be forwarded via the 3G interface.

3G WAN Express Card Support:

3G WAN Express cards are available from a number of service providers in each region and each card will require a data service plan from a service provider. The available data service plans vary by region and service provider and can ether permit unlimited data transfer or limited data transfer over the service providers 3G network. Service provides may also apply overage fees when a specific amount of traffic has been exceed.

The following table provides a list of supported 3G WAN Express cards supported by the RFS4000/RFS6000 WLAN Switch Controllers available by region and service provider. Before selecting a3G Express card it is recommended that you reference the latest release notes for the latest list of supported cards as new models are being continuously introduced into the market.

3G Bandwidth:

The amount of throughput available over a 3G service provider’s network will vary depending on the 3G technology and each service provider’s implementation. The current generations of 3G access technologies are fully capable of providing comparable throughput to wireline based Internet services, however the radio technologies, backbone and Internet capacity core will ultimately determine the actual amount of throughput that is available at each branch site.

The following table lists the theoretical peak uplink and downlink throughputs that are for each 3G wireless access technology. The actual throughput and performance at a branch site will vary based on the distance of the 3G card from the cellular base station, interference and each service provider’s specific 3G implementation.

3G Performance:

3G WAN performance at a site will also be impacted by number of physical factors including the antenna orientation, distance between the antenna and cellular base station, physical obstructions and external radio frequency (RF) interference.

The 3G Express card will be physically installed in the RFS4000/RFS6000 WLAN Switch Controller and thus the coverage will vary at the site depending on where the RFS4000/RFS6000 WLAN Switch Controller is physically installed at the site.Prior to deployment it is strongly recommended that a walkthrough of the site be performed with the 3G Express card installed in a notebook PC to determine if adequate 3G signal strength is available where the RFS4000/RFS6000 WLAN Switch Controller is to be installed. If the 3G signal is low, the RFS4000/RFS6000 WLAN Switch Controller may need to be moved to an alternative location where the 3G signal is improved.The following table provides a coverage estimate based on signal strength in decibels per milliwatt (dBm).

WiNG How-To Guide 802.11i - Configuration

Admin 7:53 PM 0 nhận xét

WiNG How-To Guide 802.11i - Overview

Admin 7:46 PM 0 nhận xét

The IEEE 802.11i standard ratified in 2004 provides enhanced security for WLANs and supersedes the initial 802.11 security specification Wired Equivalent Privacy (WEP) which was shown to have severe security weaknesses. The 802.11i standard improves WLAN security by implementing Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES) for encryption and data integrity. In addition the 802.11i amends the original 802.11 standard by mandating authentication ether using 802.1X authentication or pre-shared keys.

The Wi-Fi Alliance that is an organization that created the “Wi-Fi” brand. The Wi-Fi Alliance promotes and certifies inter-operability WLAN products and promotes them as the global WLAN standard across all market segments. The Wi-Fi Alliance has instituted a test suite that defines how member products are tested to certify that they are interoperable with other Wi-Fi Certified products.

During the 802.11i standard ratification the Wi-Fi alliance introduced Wi-Fi Protected Access (WPA) as an intermediate solution to address WEP vulnerabilities. WPA uses TKIP for encryption and dynamic encryption key generation. WPA was also designed to be supported on existing WLAN infrastructure without requiring hardware upgrades.

Wi-Fi Protected Access 2 (WPA2) is the next generation of Wi-Fi security based on the final 802.11i standard supporting AES. The new AES encryption mechanism introduced in 802.11i generally requires a hardware upgrade from earlier versions of WLAN clients and APs, however all current shipping MotorolaRF Switches and Access Ports / Access Points support WPA2.

Applications:

802.11i with AES should be considered for all new WLAN applications as it represents the strongest encryption scheme available today for data privacy. 802.11i with AES encryption is supported by all new WLAN client devices including workstations, handhelds and voice handsets.For legacy deployments which include devices that cannot support AES, it is recommended that TKIP with 802.1x or pre-shared-keys be utilized. TKIP is supported by most (but not all) legacy devices via a software update provided by the device manufacturer.For legacy devices cannot support AES or TKIP, dynamic WEP or VPN should be considered. Static WEP should only be considered when no other encryption options are available and should be augmented with firewalls to reduce the attack footprint.

Restrictions:

WPA/802.11i provides support for pre-shared-keys as an alternative to 802.1x. A pre-shared-key is typically entered as an 8 - 63 character passphrase on the WLAN infrastructure which the client must know before being permitted access to the WLAN.WPA and 802.11i pre-shared-key implementations are potentially susceptible to dictionary attacks when short or weak passphrases are utilized. This vulnerability is not the fault of WPA/802.11i and can be thwarted by implementing strong passphrases utilizing 20 or more random alphanumerical and special characters. Random passphrase generators are available on the World Wide Web which can generate strong random passphrases of varying complexity.

Attacks can also be thwarted by implementing Mobile Unit Intrusion Detection on the RF Switch which can alert administrators of excessive authentication failures and provide automatic mitigation against attacking devices.

Finally as a general best practice it is also recommended to frequently refresh passphrases. The frequency of the refresh will depend on each specific environment as the passphrases will also need to be updated on the client devices.

WiNG How-To Guide Digital Certificates - Configuration

Admin 6:55 PM 0 nhận xét

WiNG How-To Guide Digital Certificates - Overview

Admin 6:53 PM 0 nhận xét

Security in 802.11 systems relies on digital certificates to provide mutual authentication and encryption. Mutual authentication or trust is provided by leveraging Public Key Infrastructure (PKI) which allows all parties in the security exchange to verify and validate digital certificates on each party. Authentication and encryption is provided using standard public key and private key algorithms to protect credentials exchanged over the air as well as exchange credentials.

Certification Authority:

To verify that a digital certificate is not forged, you need a mechanism to validate it which is provided by a certification authority (CA). The CA is a trusted third party that can be a private secure server deployed in an enterprise data center or a public server from a specialized company offering certificates such as Entrust, Go Daddy or, VeriSign.

The CA is charged with signing all user and server certificates and signs a certificate by running a hash of the certificate contents, encrypting the hash with its Private Key (creating a digital signature), then appending this signature to the end of the certificate. The CA also has a certificate of its own called a CA certificate or root certificate. The root certificate contains the CA’s Public Key and can be freely distributed any party. Anyone that has the CA’s root certificate installed can validate certificates issued from the CA.

Most operating systems include root certificates issued from top public certificate providers allowing secure transactions to be made on-line without having to manually install root certificates.

Using a CA to sign user and server certificates and validate them is the simplest form of Public Key Infrastructure (PKI). A certificate chain includes information about the CA or CA’s involved in issuing certificates and the user or server certificates themselves. There are other PKI functions such as certificate revocation lists, cross-certification and certificate chaining that are used but are beyond the scope of a guide.

Trustpoints:

Server and CA certificates are installed in pairs on the RF Switch into trustpoints which are assigned to the local RADIUS and HTTPS services. Each service on the RF Switch supports a single trustpoint allowing separate server certificates to be used for RADIUS and HTTPS services.

WiNG provides a default trustpoint which includes a self-signed server certificate which is assigned to the local RADIUS and HTTPS services. However as the default server certificate is self-signed, no mutual authentication can be provided as no Certificate Authority (CA) root certificate exists to allow the end users to trust the self-signed certificate.

To provide mutual authentication and trust for management, EAP and Hotspot services a trustpoint needs to be created on the RF Switch and a certificate request generated to a public or enterprise CA. Once the certificate request has been signed by the CA, the server and CA certificate can be installed on the RF Switch. Once installed the RF Switch mutual authentication can occur between all parties with certificates issued from the CA.

Server Certificates:

Server certificates are digital identifications containing information about a server, service or organization. Server certificates contain a public key which is used to create a secure TLS connection between the service and end user device. In WLAN environments server certificates are used to provide secure encrypted HTTPS management connections to RF Switches and Access Points as well as protect credentials over the air for Hotspot and EAP authentication.Server certificates are required for all external RADIUS servers providing EAP authentication as well as the RF Switches providing RADIUS, Hotspot or secure web based management. The RF Switch supports a single server certificate for local RADIUS services and a single server certificate to provide Hotspot and secure web based management.

Root Certificates:

A root certificate is a self-signed certificate or an unsigned public key certificate which forms the foundation of a public key infrastructure (PKI). A root certificate is the top-most certificate in the Certificate Authority (CA) tree, and its private key is used sign all certificates issued from the CA.

Root certificates are installed on end user devices to identify and verify digital certificates issued from CAs. Root certificates for common public CAs such as Entrust and VeriSign are typically pre-installed on most operating systems allowing the end user devices to automatically trust servers and applications using digital certificates issued from these CAs. However in enterprise environments, a private CA is often deployed and CA certificates are automatically or manually distributed to end user devices before certificate verification and trust can occur.It’s not mandatory that a CA root certificate be installed on the end user device for WLAN authentication as web browsers and 802.1X supplicants can establish a secure connection to a peer without a CA certificate being present. However in WLAN deployments it is strongly recommended that a CA root be installed as the CA certificate provides the only mechanism for the end device to verify the identity of the presented digital certificate prior to credentials being exchanged. Without a CA certificate being installed, the device is susceptible to man-in-the-middle (MIN) attacks.

Applications:

Digital certificates are required to enable the following services on the RF Switch:

1) Secure Web UI Management – Provides secure remote web based management of the RF Switch. When enabled all web management configuration transactions are encrypted using Transactional Layered Services (TLS). In addition PKI allows the remote management station to verify the identity of the RF Switch prior to submitting management credentials.

2) EAP Authentication – When using the integrated RADIUS server, PKI allows the RF Switch to authenticate users using PEAP, EAP-TLS and EAP-TTLS. These EAP methods provide mutual authentication between the RF Switch and 802.1X supplicant as well as a secure TLS tunnel to exchange credentials over the air.

3) Hotspot Authentication – Provides web based authentication for users. When users authenticate to the RF Switch by presenting a username and password which is encrypted over the air using TLS. In addition PKI provides the ability to allow the end user to verify the identity of the RF Switch prior to submitting credentials.

1.3 Restrictions:

At this time only a single trustpoint can be assigned to the HTTPS service which is shared for both secure Web-UI management and Hotspot services.

If Hotspot authentication is required, Motorola recommends that the hostname for the CN field in the server certificate be defined to resolve to the IP address assigned to the Hotspot virtual interface. This will ensure compatibility with Mozilla Firefox and Microsoft Internet Explorer which uses the CN field to detect phishing attacks.