User manual

Managing System and Station Security
Rev 1.1.0 User Manual 67
Introducing IEEE 802.11 and WS410 Security Concepts
IEEE 802.11 security is supported by the WS410 in two modes; Non-VLAN and VLAN.
In Non-VLAN mode, all associated stations share the same wireless media and therefore
have a single broadcast domain. When a client associates to the SSID, security credentials
are checked and encryption keys (both unicast and broadcast keys) are assigned. All security
modes are supported through the SSID; see Security Modes: Authentication and Encryption
Methods
In VLAN mode, the shared wireless media is divided into various groups or Virtual LANs. All
members of a single group can communicate with members of the same group, but cannot
communicate with members of any other group; they exist in different broadcast domains.
Each group has independent security credentials and encryption keys. As in the Non-VLAN
mode, the SSID handles the security used in both Unicast and Broadcast transmissions
according to the keys maintained in the VLAN. This is a straightforward pairing of information
when there is a single VLAN per SSID. In the event that multiple VLANs (which can only be
assigned by a RADIUS server) are on a single SSID, the SSID uses the appropriate VLAN key
when communicating to a particular associated station. This insures that both unicast and
broadcast transmissions are VLAN specific. As in the Non-VLAN mode, all authentication and
encryption methods are supported.
Security Modes: Authentication and Encryption Methods
The following are the different combinations of security modes.
Security
Mode
Authentication Mode Encryption Mode
None Open system None
WEP
• Open system
• Shared key
• Open system + Shared
key
• WEP/40
• WEP/104
WPA
• PSK (Pre-shared key)
• Radius
• PSK + Radius
• TKIP
• TKIP+WEP/40
• TKIP+WEP/104