User manual SMC 2888W-M

[. . . ] EliteConnectTM Universal 2. 4GHz/5GHz Wireless Dual-Band Outdoor Access Point/Bridge The easy way to make all your network connections 38 Tesla Irvine, CA 92618 Phone: (949) 679-8000 May 2005 Revision Number: R01 F1. 1. 2. 5 Copyright Information furnished by SMC Networks, Inc. (SMC) is believed to be accurate and reliable. However, no responsibility is assumed by SMC for its use, nor for any infringements of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent or patent rights of SMC. [. . . ] To enter WEP keys, use the key command, and then set one key as the transmit key using the transmit-key 6-69 System Configuration command. To view the current security settings, use the show interface wireless a command. AP(config)#interface wireless a Enter Wireless configuration commands, one per line. AP(if-wireless a)#encryption wep 128 AP(if-wireless a)#key wep 1 128 ascii abcdeabcdeabc AP(if-wireless a)#transmit-key 1 AP(if-wireless a)#exit AP#show interface wireless a Wireless Interface Information =========================================================== ----------------Identification----------------------------Description : Enterprise 802. 11a Wireless Outdoor Bridge/AP Service Type : WDS Bridge SSID : DualBandOutdoor Turbo Mode : OFF Channel : 36 Status : Disable ----------------802. 11 Parameters-------------------------Transmit Power : FULL (15 dBm) Max Station Data Rate : 54Mbps Fragmentation Threshold : 2346 bytes RTS Threshold : 2347 bytes Beacon Interval : 100 TUs DTIM Interval : 2 beacons Maximum Association : 64 stations ----------------Security----------------------------------Encryption : 128-BIT WEP ENCRYPTION WEP Key type : Alphanumeric Default Transmit Key :1 Static Keys : Key 1: ***** Key 2: EMPTY Key 3: EMPTY Key 4: EMPTY =========================================================== AP# 7-99 7-110 7-112 7-113 7-120 Note: The index and length values used in the key command must be the same values used in the encryption and transmit-key commands. 6-70 Radio Interface CLI Commands for AES Security ­ From the 802. 11a interface configuration mode, use the encryption command to enable AES encryption. To view the current security settings, use the show interface wireless a command. AP(config)#interface wireless a Enter Wireless configuration commands, one per line. AP(if-wireless a)#encryption wdsaes alphanumeric AP(if-wireless a)#key wdsaes 1 agoodsecretkey AP(if-wireless a)#exit AP#show interface wireless a Wireless Interface Information =========================================================== ----------------Identification----------------------------Description : Enterprise 802. 11a Wireless Outdoor Bridge/AP Service Type : WDS Bridge SSID : DualBandOutdoor Turbo Mode : OFF Channel : 36 Status : Disable ----------------802. 11 Parameters-------------------------Transmit Power : FULL (15 dBm) Max Station Data Rate : 54Mbps Fragmentation Threshold : 2346 bytes RTS Threshold : 2347 bytes Beacon Interval : 100 TUs DTIM Interval : 2 beacons Maximum Association : 64 stations ----------------Security----------------------------------Encryption : 128-BIT AES ENCRYPTION AES Key type : Alphanumeric =========================================================== AP# 7-99 7-110 7-112 7-120 Note: The key type value entered using the key command must be the same as the type specified in the encryption command. 6-71 System Configuration Security (Access Point Mode) A radio band set to access point mode is configured by default as an "open system, " which broadcasts a beacon signal including the configured SSID. Wireless clients can read the SSID from the beacon, and automatically reset their SSID to allow immediate connection to the access point. To improve wireless network security for access point operation, you have to implement two main functions: · · Authentication: It must be verified that clients attempting to connect to the network are authorized users. Traffic Encryption: Data passing between the access point and clients must be protected from interception and evesdropping. For a more secure network, the access point can implement one or a combination of the following security mechanisms: · · · · Wired Equivalent Privacy (WEP)page 6-66 IEEE 802. 1Xpage 6-19 Wireless MAC address filteringpage 6-19 Wi-Fi Protected Access (WPA)page 6-80 The security mechanisms that may be employed depend on the level of security required, the network and management resources available, and the software support provided on 6-72 Radio Interface wireless clients. A summary of wireless security considerations is listed in the following table. Security Client Support Mechanism WEP Built-in support on all 802. 11a and 802. 11g devices Implementation Considerations · Provides only weak security · Requires manual key management WEP over 802. 1X Requires 802. 1X client · Provides dynamic key rotation for improved WEP security support in system or by add-in software · Requires configured RADIUS server (support provided in · 802. 1X EAP type may require Windows 2000 SP3 or management of digital later and Windows XP) certificates for clients and server Uses the MAC address of client network card · Provides only weak user authentication · Management of authorized MAC addresses · Can be combined with other methods for improved security · Optionally configured RADIUS server MAC Address Filtering WPA over 802. 1X Mode Requires · Provides robust security in WPA-only mode (i. e. , WPA WPA-enabled system clients only) and network card · Offers support for legacy WEP driver clients, but with increased (native support security risk (i. e. , WEP provided in Windows authentication keys disabled) XP) · Requires configured RADIUS server · 802. 1X EAP type may require management of digital certificates for clients and server Requires · Provides good security in small networks WPA-enabled system and network card · Requires manual management of pre-shared key driver (native support provided in Windows XP) WPA PSK Mode 6-73 System Configuration Note: Although a WEP static key is not needed for WEP over 802. 1X, WPA over 802. 1X, and WPA PSK modes, you must enable WEP encryption through the web or CLI in order to enable all types of encryption in the access point. Wired Equivalent Privacy (WEP) WEP provides a basic level of security, preventing unauthorized access to the network and encrypting data transmitted between wireless clients and the access point. WEP uses static shared keys (fixed-length hexadecimal or alphanumeric strings) that are manually distributed to all clients that want to use the network. WEP is the security protocol initially specified in the IEEE 802. 11 standard for wireless communications. Unfortunately, WEP has been found to be seriously flawed and cannot be recommended for a high level of network security. For more robust wireless security, the access point provides Wi-Fi Protected Access (WPA) for improved data encryption and user authentication. Setting up shared keys enables the basic IEEE 802. 11 Wired Equivalent Privacy (WEP) on the access point to prevent unauthorized access to the network. If you choose to use WEP shared keys instead of an open system, be sure to define at least one static WEP key for user 6-74 Radio Interface authentication and data encryption. Also, be sure that the WEP shared keys are the same for each client in the wireless network. Authentication Type Setup ­ Sets the access point to communicate as an open system that accepts network access attempts from any client, or with clients using pre-configured static shared keys. · Open System: Select this option if you plan to use WPA or 802. 1X as a security mechanism. If you don't set up any other security mechanism on the access point, the network has no protection and is open to all users. Shared Key: Sets the access point to use WEP shared keys. If this option is selected, you must configure at least one key on the access point and all clients. · Note: To use 802. 1X on wireless clients requires a network card driver and 802. 1X client software that supports the EAP authentication type that you want to use. Windows 2000 SP3 or later and Windows XP provide 802. 1X client support. Windows XP also provides native WPA support. [. . . ] Ethernet A popular local area data communications network, which accepts transmission from computers and terminals. Glossary-2 Glossary File Transfer Protocol (FTP) A TCP/IP protocol used for file transfer. Hypertext Transfer Protocol (HTTP) HTTP is a standard used to transmit and receive all data over the World Wide Web. Internet Control Message Protocol (ICMP) A network layer protocol that reports errors in processing IP packets. ICMP is also used by routers to feed back information about better routing choices. [. . . ]