User's Manual

APPENDIXD
SECURITY
Revised: 27 Jun 16 APX D-3 ESTeem Horizon Series
MasqueradeModes

WhentheESTeemHorizonisconfiguredineithertheAccessPointMasqueradeortheClientMasquerademodes,thewireless
modem functions as a network firewall.If access to the wired network is the greatest concern, place the ESTeem in the
Masquerademodeandthewirelessnetworkwillbecompletelyisolatedfromthewi
redEthernetnetwork.


IncreasingNetworkSecurity

Thefollowingareafewsuggestionstohelpimprov e theoverallsecurityofyourwirelessnetwork:

1. Enablethesecurity.Ifyouresearchallofthearticlesregardinghackers,theyhavegottenintotheuser’snetworkduetothe
securitynotbeingenabled.

2. SettheACL filtertoincludeonl
ythoseMACaddressofthewireless Ethernetdevicebeingusedonthenetwork.

3. Makesurethekeysarenotreusedinyourcompany,sincereuseincreasesthestatisticallikelihoodthatsomeonecanfigure
thekeyoutandchangethedefaultpassword onyouraccesspointorwirelessrouter

4. Asanetworka
dministrator,youshouldperiodicallysurveyyourcompanyusingatoollikeNetStumblertoseeifany"rogue"
accesspointspopupwithinyourcompanywithoutauthorization.Allofyourhardworkto"harden"yourwirelessnetwork
couldbewastedifarogueAPwaspluggedintoyournetworkbehindthefi
rewall .

5. ManyaccesspointsallowyoutocontrolaccessbasedontheMACaddressoftheNICattemptingtoassociatewithit.Ifthe
MACaddressofyourNICisn'tinthetableoftheaccesspoint,youwon'tassociatewithit.Andwhileit'str
uethatthereare
waysofspoofingaMACaddressthat'sbeensniffedoutoftheair,ittakesanadditionallevelofsophisticationtospoofaMAC
address.Thedownside ofdeployingMACaddresstablesisthatifyouhavealotofaccesspoints,maintainingthetablesin
eachaccesspointcouldbetimeconsuming.Somehigher‐end,enterpri
se‐levelaccesspointshavemechanismsforupdating
thesetablesacrossmultipleaccesspointsofthesamebrand.

6. Considerusinganadditionallevelofauthentication,suchasRemoteAccessDailinUserService(RADIUS),beforeyoupermit
anassociationwithyouraccesspointsth
roughWPAandWPA2Enterprise.

7. Ifyou'redeployingawirelessrouter,thinkaboutassigningstaticIPaddressesforyourwirelessNICsandturnoffDynamic
Host Configuration Protocol (DHCP) .If you're using a wireless router and have decided to turn off DHCP, also consider
changingtheIPsubnet.Manyw
irelessroutersdefaulttothe192.168.1.0networkanduse192.168.1.1asthedefaultrouter.

8. Only purchase Access Points that haveflashable firm wa r e.There area number of security enhancements that are being
developed,andyouwanttobesurethatyoucanupgradeyouraccesspoint.

9. Asi
mplesecuritytechniqueusedbythemilitaryistohavetheadministratorperiodicallychangethekeyforthesystemi.e.
weekly,monthly,etc.

