User's Manual

:LUHOHVV6HWWLQJV
WPS Setup
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE 71

REVIEW DRAFT Version 2—CISCO CONFIDENTIAL
PIN Control
A client may also enroll with a registrar by using a PIN. For example, the AP
administrator may start an enrollment transaction for a particular VAP by entering
the PIN of a client. When the client detects the WPS-enabled device, its user can
then supply its PIN to the AP to continue the enrollment process. After the WPS
protocol has completed, the client securely joins the network. The client can also
initiate this process.
As with the PBC method, if the AP begins the enrollment transaction and no client
attempts to enroll after 120 seconds, the AP terminates the pending transaction.
2SWLRQDO8VHRI,QWHUQDO5HJLVWUDU
Although the AP supports an internal registrar for WPS, its use is optional. After an
external registrar has configured the AP, the AP acts as a proxy for that external
registrar, regardless of whether the AP’s internal registrar is enabled (it is enabled
by default).
/RFNGRZQ&DSDELOLW\
Each AP stores a WPS-compatible device PIN in nonvolatile RAM. WPS requires
this PIN if an administrator wants to allow an unconfigured AP (that is, one with
only factory defaults, including WPS being enabled on a VAP) to join a network. In
this "out-of-box" scenario, the administrator obtains the PIN value from the UI of the
AP.
The administrator may wish to change the PIN if network integrity has been
compromised in some way. The AP provides a method for generating a new PIN
and storing this value in NVRAM. In the event that the value in NVRAM is corrupted,
erased, or missing, a new PIN is generated by the AP and stored in NVRAM.
The PIN method of enrollment is potentially vulnerable by way of "brute force"
attacks. A network intruder could, in theory, try to pose as an external registrar on
the wireless LAN and attempt to derive the AP's PIN value by exhaustively
applying WPS-compliant PINs. To address this vulnerability, in the event that a
registrar fails to supply a correct PIN in three attempts within 60 seconds, the AP
prohibits any further attempts by an external registrar to register the AP on the
WPS-enabled VAP for 60 seconds. However, wireless client stations may enroll
with the AP's internal registrar, if enabled, during this “lockdown” period. The AP
also continues to provide proxy services for enrollment requests to external
registrars.
The AP adds an additional security mechanism for protecting its device PIN. Once
the AP has completed registration with an external registrar, and the resulting WPS
transaction has concluded, the device PIN is automatically regenerated.