Access/One™ Network User Guide
ACCESS/ONE™ NETWORK User Guide Part Number: 210-0007-01 Revision A, September 2003 All rights reserved. This document may not be reproduced or disclosed in whole or in part by any means without the written consent of Strix Systems, Inc. Strix Systems, Inc. 310 N. Westlake Blvd., Suite 150 • Westlake Village, CA 91362 USA Tel 805.777.7911 • Fax 805.777.7916 http://www.strixsystems.
FCC Notice The enclosed wireless network device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference. 2. This device must accept any interference received, including interference that may cause undesired operation. This wireless network device has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules.
The Access/One™ Network contains a Lithium battery in the BME base module which is NOT replaceable by the user CAUTION: Discard used batteries according to manufacturer's instructions. ATTENTION: Mettre au rebut les batteries usagées conformément aux instructions du fabricant. VORSICHT: Entsorgung gebrauchter Batterian nach Angaben des Herstellers. Installation Warning Warning Read the installation instructions before you connect the wireless network device to its power source.
Table of Contents INTRODUCTION....................................1 INSTALLATION .....................................2 ASSEMBLY AND SELF IDENTIFICATION ...2 MANAGER/ONE..........................................2 HOST NETWORK REQUIREMENTS ...........9 USER SECURITY CONSIDERATIONS .......11 MANAGEMENT ...................................13 LOAD IMAGE ...........................................16 REBOOT NETWORK ................................17 UPDATE NAMES.......................................
U S E R G U I D E Introduction T his User Guide describes the Strix Access/One Network and its elements. Access/One Network is a wireless LAN infrastructure that is designed to be simple and secure. This guide follows the same approach. It is comprised and written as a series of short, simple and largely independent sections that can be read in any order. This user guide covers wireless network installation, configuration, security and management.
U S E R G U I D E Installation T his chapter provides instructions on how to assemble the Nodes and to install and use Manager/One utility. It also lists the services/servers which Access/One Network expects to be present in the host wired network infrastructure. ASSEMBLY AND SELF IDENTIFICATION Each Network Node arrives in its own well-marked box that contains its disassembled and individually wrapped constituent modules.
U S E R G U I D E To install Manager/One, follow these simple steps: 1- Download the Manager/One plug-in file (.zip) from http://www.strixsystems.com 2- Open the zip file and run the setup.exe file. The following window will appear: 3- After a few seconds the following window will appear. When it does, click on the ‘Next’ button.
U S E R G U I D E 4- When the following window appears, read the Software License, select “I accept the terms in the license agreement” and click the ‘Next’ button. If you select “I do not accept the terms in the license agreement” the installation will terminate. 5- When the following window appears, enter your User Name and your Organization, and select who the application will be installed for (“all users” or “me”). Click the ‘Next’ button when ready.
U S E R G U I D E 6- When the following window appears, select “Complete” as the setup type and click the ‘Next’ button. 7- When the following window appears, click the ‘Install’ button.
U S E R G U I D E 8- The following window will then appear. The installation process can be cancelled at any moment by clicking the ‘Cancel’ button. 9- When the following window appears, click the ‘Finish’ button to complete the installation process.
U S E R G U I D E 10- The next time you launch your Web browser, a Manager/One icon will be placed in the top menu, similar to the figure below.
U S E R G U I D E You can now select (double-click) any Node in the list to expand it, and right-click on the selected module to page, ping, or Telnet into it as shown in the figure below: To manage Access/One Network click on any listed Network Server, which you will see when you expand a Node that contains one. A login window (shown below) will appear and the Manager/One utility window will close.
U S E R G U I D E Enter the administrator User Name – “Admin” and a Password. The default password is “Admin” but we strongly recommend that you to change it immediately after logging into the Manager/One application. Click the ‘OK’ button to login to Manager/One. An initial network view page will appear. Refer to the Management and Configuration section for more information about how to use Manager/One to configure and manage your network.
U S E R G U I D E FTP server – is required to transfer firmware and configuration from distribution media to Access/One Network modules. Software distribution via an FTP server relies on user accounts to maintain security. Access/One Network modules are capable of specifying a user name and password (including anonymous) to log into an FTP server. Directory access may be configurable based on the FTP server software, so Access/One Network related files may be available only to Access/One Network modules.
U S E R G U I D E USER SECURITY CONSIDERATIONS The topic of security may be split into two categories: network-level security (inter-Network Node) and user security (station/user device to Network Node). Network-level security is an integral part of the Access/One Network and requires no external resources.
U S E R G U I D E Local Authentication – The Access/One Network is responsible for determining whether the user device/station has network privileges. Since most access points don’t have a user database, there is typically very little information for a system like Access/One Network. One mechanism to determine user privileges is an Access Control List, which disallows (or allows) any user based on their MAC address. However, MAC addresses can be spoofed so this method is not secure.
U S E R G U I D E Management M Anagement of the Access/One Network has been designed to be as simple as possible. This chapter describes the network views, naming conventions and rules to include and associate a newly installed Network Node as part of your Access/One Network. Visual cues are provided that indicate network ‘health’, along with the presence of unattached or rogue Node/devices. Explanations of other management windows are also provided, such as the Node detail and status windows.
U S E R G U I D E Click anywhere within the frame in order to enter the cloud (IP subnet) and view the details. In the below example, notice that some of the Network Nodes are sky blue in color and some are dark grey in color. The Nodes that are sky blue have yet to be included as part of the new Access/One Network that was named in the previous step and are still associated to the default network name (AccessOne), as listed below each Node.
U S E R G U I D E As shown below, if the screen displays Nodes that are red in color but that do not have a lock symbol on them, these are nodes that are in alert status which should be investigated further. The white box below each Node is a label provided for Node identification purposes, and is set as the Base Module’s serial number in the default configuration. This label can be changed to be more meaningful, e.g. Room123.
U S E R G U I D E LOAD IMAGE Click on the ‘Load Image’ command in the ‘Manage’ sub menu to send the command to load a new image to each of the modules in all of the Nodes within the network. The parameters of the FTP location where the new software image resides should be set via the ‘Configure’ tab (use the ‘Firmware FTP’ command in the submenu) before attempting to load a new image to the network.
U S E R G U I D E REBOOT NETWORK The ‘Reboot Network’ command will reboot each of the modules in all of the Nodes within the Access/One Network. This is required when network-level configuration changes are made or a new image is loaded. The Network Server will generate the request in stages in order to monitor the progress of the network reboot.
U S E R G U I D E UPDATE MEMBERSHIP The cloud display indicates all of the Network Nodes in the network (including rogue Strix Nodes). Nodes which belong to the Network Server cloud name are dark grey in color and have a checkbox that is checked. Nodes which are sky blue in color and have an unchecked checkbox are not part of the cloud but may be admitted. Nodes which have no checkbox or are red with a lock symbol may not be admitted to the cloud.
U S E R G U I D E Status results of commands issued to an Access/One Network module: Running: there are no pending commands against this module and it is communicating with the Network Server Link Lost: Manager/One has lost contact with this module for more than a minute Command Started: Manager/One is attempting the command Command Sent Successfully: the command was received by the module Command Sent: the module replied that it was received Command Executed Successfully: the command was executed on the
U S E R G U I D E NODE STATUS Selecting any Node listed on the network view will update a frame on the left side of the window showing the Node’s status and its components. You may close this frame at any time by selecting the “<<” button on the line separating the frames. This frame shows all the Node components, their roles, IP addresses and status.
U S E R G U I D E The Monitor frame in the main network window presents a summary of the network health. Nodes under heavy load or losing management connectivity are considered less stable and will not be counted as a stable Node in the Access/One Network.
U S E R G U I D E Configuration U se information in this chapter to configure all or any subset of Access/One Network Nodes simultaneously. Individual modules within the Nodes will present similar configuration screens if and when you drill down to the module-level configuration screens. Module-level configuration is described in Appendix 1. SYSTEM CONFIGURATION The system configuration allows the following changes to be made: DNS settings, administrator password, or outdoor environment selection.
U S E R G U I D E Note: When using wireless uplinks between Network Nodes, the Access/One Network self tuning process requires that a default gateway and/or DNS be specified to determine delays to the host Ethernet. If DHCP is used throughout the network (default setting), specifying both of these as part of the options will satisfy this requirement. Otherwise, if static IP addresses are configured, the default gateway must also be configured to allow correct operation of the self tuning feature.
U S E R G U I D E • IP Address: Enter the IP address of a Network Server Module on another subnet. • Subnet Mask: Enter the subnet mask of the Network Server Module on another subnet. Click the ‘Update’ button to save any changes made to the settings in this page. The listed Network Server will be added to the internal list as a Network Server that is available on another subnet, and the IP Address field will clear. Multiple Network Server IP addresses can be added.
U S E R G U I D E • Suppress SSID: Select ‘Yes’ if you want to prevent the broadcast of the SSID in beacons from all Wireless Modules in the Access/One Network (recommended). • Enabling 802.11a Turbo Mode: Clicking on the ‘enable 802.11a Turbo mode’ checkbox will configure all 802.11a Wireless Modules in the Access/One Network to operate in Turbo Mode. In this mode the 802.11a Wireless Modules will operate with data rates at speeds up to 108 Mbps.
U S E R G U I D E ADVANCED WIFI Advanced Wi-Fi network settings are configurable from this window. • Country Code: The Regulatory Domain for all Access/One Network Node is preconfigured in manufacturing and can not be changed by the user. The Node will ship with a default country setting, which may not be the country in which you reside. It is important that you set the Country Code in order to abide by the wireless laws within your country.
U S E R G U I D E • Data Rate: Select a data transmission rate from the drop-down menu. The ‘best’ selection will adapt the rate to the best available. Alternately, the user has the option of selecting a fixed data rate, but if that data rate is unachievable no connection will be made. The default value is ‘best’. The Wireless Modules will adjust the data rate automatically based on the noise conditions, distance to the connected user device, etc. so Strix does not recommend changing this parameter.
U S E R • G U I D E Protection Mode: 802.11b and 802.11g networks may occupy the same frequency range, but they don’t speak the same language (802.11b uses CCK while 802.11g uses OFDM). To co-exist within the same space, 802.11g must make allowances for 802.11b by using CCK for a short period of time (RTS or Request To Send). Selecting ‘Auto’ detects the presence of 802.11b and automatically begins protection. Selecting ‘None’ will not provide protection under any circumstances.
U S E R G U I D E BLUETOOTH This window defines the network settings for Bluetooth. • Mobile Device Start IP Address: Enter the starting IP address for mobile Bluetooth devices. This is the beginning address of the address pool from which all user device IP addresses will be assigned. The mobile device IP address pool consists of the next twenty (20) IP addresses starting from the Start IP address. Other Bluetooth devices should not use this pool of 20 IP addresses.
U S E R G U I D E FIRMWARE FTP This window is where FTP parameters are set at the network level in order for software updates to be made to the Access/One Network. • Host Name: FTP server host name. • User Name: FTP server user name. • Password: FTP server password. • Path: Identify any accessible directory for downloading an image. Note: The downloaded file will always be ‘accessone.bin’ when configured via Manager/One.
U S E R G U I D E Security WIFI SECURITY This window is where Wi-Fi network Security parameters are set for Access/One Network. • Authentication Mode: This option selects the authentication type that will be used. o Open: Local authentication. o Shared Key: A static shard WEP key will be used for authentication. This option is not recommended since all users will be using the same key. o Dynamic Key: The authentication server (RADIUS) will give a key to each user for unicast traffic.
U S E R G U I D E • Encryption Mode: This option selects the type of encryption used. o Clear: Available for Open or Dynamic authentication. Messages will be sent unencrypted between user devices and the Access/One Network Nodes. o WEP: Wired Equivalency Privacy (WEP) is a security protocol for WLAN. It encrypts data using an RC4 stream cipher with a seed of 64, 128 or 152 bits.
U S E R G U I D E The user can enter RADIUS (Remote Authentication Dial In User Service) Server parameters here or on the next tab (Security Server). For dynamic encryption, the Access/One Network Nodes communicate with an authentication server to obtain encryption keys to use. • RADIUS Server: Specify the Host name or IP address of the RADIUS Server. • RADIUS Port: Specify the RADIUS port number. • RADIUS Secret: Specify the RADIUS Server’s shared secret.
U S E R G U I D E WIFI ACL This window configures an Access Control List (ACL) determining which user devices (stations) are allowed to connect to Access/One Network. • Access Control List: Enables you to enable or deny network access based on the MAC address of a user device (station). o Disable: All stations can request association with a Network Node in the Access/One Network. This means that the ACL will not be checked when a station attempts to authenticate.
U S E R G U I D E • Click the ‘Add New Station’ button to configure the following: • MAC Address: Enter the MAC address of a user device/station. • ACL Type: Select the permission level for this user device/station. • Unique Key: Optionally, enter a unique key which will be used for unicast messages. Click the ‘Add to list’ button to add the new user device to the ACL. To remove a user device from the ACL, click the corresponding ‘Delete’ button (shown in the previous window).
U S E R G U I D E BLUETOOTH SECURITY This window configures the Bluetooth Security options at the network-level. • BLUETOOTH SECURITY: Select ‘none’ if you want the Bluetooth Modules to accept connections from any Bluetooth-enabled mobile device. Select ‘high (mode 3)’ if you want to enforce link-level Bluetooth security on Access/One Network. • System PassKey: If you selected ‘high’ Bluetooth security in the previous step, you must enter a System PassKey.
U S E R • G U I D E USER AUTHENTICATION: Select ‘on’ or ‘off’ to enable or disable user authentication. When enabled (on) all users are required to enter a user name and password to authenticate. RADIUS Server parameters can be set via this window. If these parameters were previously set in the WiFi Security screen, then they will automatically be displayed here and do not need to be reentered.
U S E R G U I D E Inventory T his tab provides administrator with an inventory view of the Access/One Network. The inventory list consists of Module serial numbers, Module types, Module status and IP addresses assigned. Apply Configuration T his tab is used to apply any changes that have been made at either the network (cloud) or subnet (sub-cloud) level. Once this tab has been clicked, the changes are propagated and applied to all Network Nodes and modules within the Access/One Network.
U S E R G U I D E Appendix 1: Module / Device Management DEVICE The ‘Device’ tab has two submenu items. The ‘About’ submenu provides information about the selected module, such as code version, serial number, MAC address, etc. The ‘Reboot’ submenu is used when a reboot needs to be performed on just this module, and is immediate.
U S E R G U I D E CONFIGURE The ‘Configure’ tab enables the module-level configuration to be performed. Click the ‘Update’ button at the bottom of the page for any changes to be saved. A ‘Reboot’ button will appear after clicking ‘Update’ as it is necessary to reboot the module after changes are made. The ‘Module’ submenu (shown below) is used to configure basic module-level details, such as name, network assignment, static IP address, static DNS and management password.
U S E R G U I D E The ‘WiFi Radio’ submenu (shown below) is used to configure module-level Wi-Fi settings, such as module role (Client Connect, Network Connect), SSID, RF type, etc. The ‘Advanced WiFi’ submenu (shown below) is used to configure advanced module-level WiFi settings, such as country code, data rate, transmit power, etc.
U S E R G U I D E The ‘Script’ submenu (shown below) is used to configure an individual module with a text script. The ‘Firmware FTP’ submenu (shown below) is used to configure module-level FTP settings, such as host name, user name, password, file path, file name, etc.
U S E R G U I D E The ‘Factory Default’ submenu (shown below) is used to reset the module back to its factory default configuration. SECURITY The ‘Security’ tab enables the module-level security configuration to be performed. Click the ‘Update’ button at the bottom of the page for any changes to be saved. A ‘Reboot’ button will appear after clicking ‘Update’ as it is necessary to reboot the module after changes are made.
U S E R G U I D E The ‘WiFi ACL’ submenu (shown below) is used to configure module-level Wi-Fi Access Control List (ACL) settings, such as ACL mode, add/remove stations, etc. MONITOR The ‘Monitor’ tab provides module-level monitoring functions. The ‘Radio Statistics’ submenu (shown below) is used to view module-level details and statistics, such as status, authentication / deauthentication / association / disassociation attempts, receive/transmit packet statistics, error statistics, etc.
U S E R G U I D E The ‘Station List’ submenu (shown below) is used to view a list of devices/stations that are attached to the specific module being managed. Each station’s ID, MAC address and state are provided. Any station’s MAC address can be clicked on for more detailed statistics summary for that station.
Appendix 2: Specifications T His chapter lists the basic protocols and features supported by the Access/One Network and its Network Nodes. It also includes the environmental and regulatory characteristics of the hardware. For more up-to-date information, please refer to the Strix Access/One Network data sheets. PHYSICAL ATTRIBUTES Module Description User Interfaces Size BME0 Base Module with no RJ-45 18V DC input 5.0” x 3.65” x 1.
USER COVERAGE RANGES FOR BLUETOOTH, 802.11A, 802.11B, & 802.11G Exact range calculations for each of the technologies cannot be provided as many factors impact the range and coverage area. These factors include; physical environment configuration, interfering factors (such as walls, cubicles, desks, elevators, etc), and use of external versus internal antennas, to name just a few.
Appendix 3: CLI Commands T his chapter lists the Command Line Interface (CLI) commands available through every Access/One Network module. A Telnet session can be started by ‘right-clicking’ on the module displayed in the Manager/One window of your browser. The term ‘cloud’ used in the commands is refers to the Access/One Network as a whole, while ‘sub-cloud’ denotes an IP subnet or other arbitrary grouping of the Access/One Network Nodes.
ftransfer params set … - Set ftp parameters hostname username password path filename ftransfer params get - Get ftp parameters ftransfer download image - Download image file ftransfer download configuration - Download configuration file ftransfer restore image - Restore previous image ftransfer restore configuration - Restore previous configuration ftransfer upload image current - Upload current image f
get ipmask - Display IP Subnet Mask get login - Display Login User Name get nameaddr - Display IP address of name server get cloudname - Display Cloud Name get subcloudname - Display Subcloud Name get stackid - Display Stack Id get outdoorenviron - Display outdoor environment get radiusname - Display RADIUS server name or IP address get radiusport - Display RADIUS port number get snmp - Display SNMP Community Name get sntpserver - Display SNTP/NTP Server IP address get syslog settings
quit - Logoff rawftp - Software update via FTP reboot - Reboot Access/One remotenc add - Add remote network server IP address remotenc remove - Remove remote network server IP address remotenc show - Show remote network server IP address run - Run command file set cloudname - Set cloud name set dhcp disable - Disable DHCP set dhcp enable - Enable DHCP set domainsuffix - Set Domain Name Server suffix set factorydefault - Restore to default factory settings set snmp getcmnty - Set SNM
set pager off - Module LED returns to current state set pager on - Module LED repeats Red, Green, Orange sequence set password - Modify Password set radiusname - Set RADIUS name or IP address set radiusport - Set RADIUS port number set radiussecret - Set RADIUS shared secret set sntpserver - Set SNTP/NTP Server IP Address set syslog server - Syslog server configuration set syslog console - Syslog console configuration set syslog file - Syslog file configuration set syslog help - Syslog
bc shownodes bc showdevices bc sendcfg cloud bc sendcfg subcloud bc imageload cloud bc imageload subcloud bc pagerenable cloud bc pagerenable subcloud bc pagerdisable cloud bc pagerdisable subcloud bc reboot cloud bc reboot subcloud bc setview cloud bc setview subcloud bc setview device bc include all bc include devices bc exclude all bc exclude devices bc changestname bc help -Show nodes in cloud -Show devices in cloud -Send cloud co
Appendix 4: Frequently Asked Questions NETWORK ELEMENTS QWhat are the elements that make up the Strix Systems product? A- Access/One Network is a modular system with several categories of building blocks that perform specific roles within the system. These categories are Client Connect, Network Connect, Wireless Workgroup, and Network Server. Each of these categories contains a choice of modules which are individually selected and assembled to form a single network element called a Network Node.
PRODUCT ASSEMBLY AND SETUP QWhat order should I assemble the modules out of the box? A- All Access/One Network Nodes are shipped as unassembled modules in a single box. The modules are arranged in the box in the order they should be stacked to form a Network Node. However, the user should not assume that this is always the case as some boxes may have been opened by customs, for example, and the modules could be rearranged.
Q- Which modules can be used for wireless Network Connect. A- Both the WM11A and WM11G Wireless Modules can function as either Network Connect (wireless uplink) or a Client Connect (for user connectivity). The exact function of a WM11A or WM11G Module is determined automatically by the Access/One Network based on needs of the Node. If a 10/100 Ethernet cable is not plugged-in to the Base Module of the Node, one of the Wireless Modules in the Node must function as a Network Connect.
PRODUCT PERFORMANCE QWhat bandwidth can I expect? A- Actual data throughput is approximately one-half the link rate at these ranges for 802.11 technology, which is standard for these types of products. Bluetooth throughput is relatively consistent across the supported range. Q- What Bluetooth profile(s) do you implement? A- The LAN Access Profile is the first Bluetooth profile that is supported for the initial Access/One Network release.
The management category of features provides the tools and facilities to monitor, diagnose, configure, meter usage, and extend Access/One Network services so that administration of the wireless network is minimal (occurs automatically), intuitive, flexible and secure. These tools include configuration management, usage metering and SNMP monitoring.
SECURITY QWhat are the security features and the default security settings? A- The Access/One Network supports standards-based security features for each radio technology, as defined in the below table: 802.11a 802.11b 802.11g Bluetooth Encryption Encryption Encryption Security Mode 1 (non-secure) • • • • • WEP (40/128-bit) Dynamic WEP WPA & TKIP* AES 802.11i* • • • • • • • • • • WEP (40/128-bit) Dynamic WEP WPA & TKIP* AES 802.11i* WEP (40/128-bit) Dynamic WEP WPA & TKIP* AES 802.
SYSTEM MANAGEMENT QIs your system SNMP-manageable? From what platforms? A- Each Access/One Network Wireless Module and Network Server contains an SNMP Agent that allows them to be managed by any Network Management Platform via standard MIB variables and Strix’ private MIB extensions. An example of typical Management Platform is HP OpenView. Q- Describe the management GUI.
INSTALLATION CONSIDERATIONS Q- How do I mount Strix Network Nodes and Network Servers? A- There are several mounting options for the Access/One Network. The system is designed to be placed on a desktop, an office cubicle or the wall/ceiling. As a desktop or cubicle product, the Access/One Network Node has no specific mounting requirements and it simply rests on the unit’s rubber feet. Mounting brackets are available from Strix for the Network Node to be attached to a wall or the ceiling.
Q- Can the Nodes be configured as long range point-to-point bridges? A- The Antenna Modules are designed for typical indoor wireless coverage and as such are not suitable for long range point-to-point coverage. However, Strix offers a variety of external antennas that can be connected to the Access/One Network Node for increased wireless coverage.
Q- Can I readily add another Network Node after the initial system has already been installed? A- Yes. Should you need to add a Network Node – or Network Server – at any time, you just plug it in, and the Node will configure itself. Q- Can I add a Network Server to any Network Node? A- Yes. This is as simple as unplugging the Network Node from the power source, placing the physical Network Server Module within the Node, and reapplying power to the Node.
Appendix 5: Security Overview W ireless network security is challenging for several reasons. First, the problem is very different from the wired network security because the boundaries have changed. In addition, initial attempts at wireless security (e.g., 802.11b) were seriously flawed, but commercially successful. Solutions that hope to capitalize on these markets must compensate for their flaws while remaining compatible.
AUTHENTICATION The authentication process begins with one of two local authentication procedures and may optionally include a remote authentication for additional security. A pre-authentication MAC address filter (Access Control List) can be used to prevent devices from authentication attempts, but is difficult to manage scale and MAC address substitution is supported on almost all wireless network interface cards (NICs). Local authentication choices are open or shared key.
Variations on the EAP theme MD5: The MD5 protocol is essentially CHAP (RFC 1994) over EAP. When the identification request is made to the user device (supplicant), the user name is sent to the RADIUS server. The RADIUS server sends a challenge to the supplicant, which the supplicant responds to with a one-way hash based on its known password. The server compares the challenge response with its version of a one-way hash based on what it knows as the password.
TTLS: Tunneled TLS uses a TLS tunnel to create a secure connection between the device and the AP before user credentials are exchanged. The TLS tunnel is created using a server based certificate only. Once the TLS tunnel exists, the supplicant authenticates with the server with CHAP or MSCHAP. The credentials can even use clear text because the traffic is protected.
Unique Key: The unique key slot is supported by some NICs and allows a more robust static key operation by assigning a specific key to each device based on the MAC address. The unique key is used to encrypt unicast packets, as the default session key is still necessary for broadcast packets. SOME ATTACK TYPES Wireless attacks can be categorized into two types: passive and active. Passive attacks involve sniffing the wireless network to acquire as much information as possible about the network.
WI-FI AND WPA REQUIREMENTS WPA is a subset of the 802.11i standard and boosts the original static WEP security by mandating 802.1x remote authentication procedures and the advent of Temporal Key Integrity Protocol (TKIP) which is comprised of the following improvements: Longer IV: The initialization vector for WEP is 24 bits long and is subject to reuse after a short period. The new IV is 48 bits long, making it less susceptible to reuse.
Glossary 802.11: An IEEE specification that defines wireless LAN (WLAN) data link and physical layers. The specification includes data link layer media access control (MAC) sub-layer, and two sublayers of the physical (PHY) layer—a frequency-hopping spread-spectrum (FHSS) and a directsequence spread-spectrum (DSSS). 802.11a: A supplement to the IEEE 802.
AP: access point. A physical edge device that allows wireless user devices to access network resources. Sometimes it is referred to as a base station or a Node. ARP: address resolution protocol. A TCP/IP protocol that binds logical (IP) addresses to physical (MAC) addresses. authentication: The process that a station, device, or user employs to announce its identify to the network which validates it. IEEE 802.11 specifies two forms of authentication: open system and shared key.
DHCP: dynamic host configuration protocol. A method for dynamically assigning IP addresses to devices on a network. Issues IP addresses automatically within a specified range to devices such as PCs when they are first powered up. The device retains the use of the IP address for a specific license period defined by the system administrator. DSSS: direct sequence spread spectrum.
FTP: file transfer protocol. A TCP/IP based protocol for file transfer. FTP is defined by RFC 959. GMK: group master key. A cryptographic key used to derive a group transient key (GTK) for the Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES). GTK: group transient key. A cryptographic key used to encrypt broadcast and multicast packets for transmissions using the Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES).
Odyssey: An 802.1X security and access control application for wireless LANs (WLANs), developed by Funk Software, Inc. OFDM: orthogonal frequency division multiplexing. A technique that splits a wide frequency band into a number of narrow frequency bands and sends data across the sub-channels. The 802.11a and 802.11g standards are based on OFDM. open system authentication: The IEEE 802.11 default authentication method.
plenum: A compartment or chamber to which one or more air ducts are connected. plenum-rated cable: A type of cable approved by an independent test laboratory for installation in ducts, plenums, and other air-handling spaces. PMK: pair-wise master key. A code derived from a master secret and used as an encryption key for IEEE 802.11 encryption algorithms. A PMK is also used to derive a pair-wise transient key (PTK) for IEEE 802.11i robust security. PoE: Power over Ethernet.
RA: registration authority. Network software that verifies a user (client) request for a digital certificate and instructs the certificate authority (CA) to issue the certificate. Registration authorities are part of a public-key infrastructure (PKI), which enables secure exchanges of information over a network. The digital certificate contains a public key for encrypting and decrypting messages and digital signatures.
TLS: transport layer security protocol. An authentication and encryption protocol that is the successor to the Secure Sockets Layer (SSL) protocol for private transmission over the Internet. Defined in RFC 2246, TLS provides mutual authentication with non-repudiation, encryption, algorithm negotiation, secure key derivation, and message integrity checking. TLS has been adapted for use in wireless LANs (WLANs) and is used widely in IEEE 802.1X authentication.
WEP: wired equivalent privacy. An optional IEEE 802.11 function that offers frame transmission privacy similar to a wired network. The Wired Equivalent Privacy generates secret shared encryption keys that both source and destination stations can use to alter frame bits to avoid disclosure to eavesdroppers. Wi-Fi Alliance: a nonprofit international association formed in 1999 to certify interoperability of wireless Local Area Network products based on IEEE 802.11 specification.
