User manual ZYXEL G-360 V2 V1.0

[. . . ] ZyXEL G-162/G-360 User's Guide ZyXEL G-162/G-360 (Hardware Revision v2) 802. 11b/g Wireless LAN Adapter User's Guide Version 1. 0 May 2005 ZyXEL G-162/G-360 User's Guide Copyright Copyright ©2005 by ZyXEL Communications Corporation The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patents' rights of others. [. . . ] · Automatic WEP key generation based on a "password phrase" called a passphrase. You must use the same passphrase for all WLAN adapters with this feature in the same WLAN. For WLAN adapters without the passphrase feature, you can still take advantage of this feature by writing down the four automatically generated WEP keys from the Security Settings screen of the ZyXEL Utility and entering them manually as the WEP keys in the other WLAN adapter(s). · Enter the WEP keys manually. Your ZyXEL G-162/G-360 allows you to configure up to four 64-bit, 128-bit or 256-bit4 WEP keys and only one key is used as the default key at any one time. 2. 2. 2 WPA-PSK and WPA2-PSK Application Example A WPA-PSK/WPA-PSK2 application looks as follows. First enter identical passwords into the AP and all wireless clients. The Pre-Shared Key (PSK) must consist of between 8 and 63 ASCII characters (including spaces and symbols). The AP checks each client's password and (only) allows it to join the network if it matches its password. The AP derives and distributes keys to the wireless clients. The AP and wireless clients use the TKIP encryption process to encrypt data exchanged between them. 4 256-bit WEP shall be complied with your AP/Router's WEP setting. 2-19 WLAN Networking ZyXEL G-162/G-360 User's Guide Figure 2-6 WPA-PSK/WPA2-PSK Authentication 2. 2. 3 WPA and WPA2 with RADIUS Application Example You need the IP address of the RADIUS server, its port number (default is 1812), and the RADIUS shared secret. A WPA/WPA2 application example with an external RADIUS server looks as follows. "DS" is the distribution system. The AP passes the wireless client's authentication request to the RADIUS server. The RADIUS server then checks the user's identification against its database and grants or denies network access accordingly. The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up a key hierarchy and management system, using the pair-wise key to dynamically generate unique data encryption keys to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients. 2-20 WLAN Networking ZyXEL G-162/G-360 User's Guide Figure 2-7 WPA/WPA2 with RADIUS Application Example 2. 2. 4 IEEE 802. 1x The IEEE 802. 1x standard outlines enhanced security methods for both the authentication of wireless stations and encryption key management. Authentication can be done using an external RADIUS server. EAP Authentication EAP (Extensible Authentication Protocol) is an authentication protocol that runs on top of the IEEE802. 1x transport mechanism in order to support multiple types of user authentication. By using EAP to interact with an EAP-compatible RADIUS server, an access point helps a wireless station and a RADIUS server perform authentication. The type of authentication you use depends on the RADIUS server and an intermediary AP(s) that supports IEEE802. 1x. The ZyXEL G-162/G-360 supports EAP-TLS, EAP-TTLS and EAP-PEAP. For EAP-TLS authentication type, you must first have a wired connection to the network and obtain the certificate(s) from a certificate authority (CA). A certificate (also called digital IDs) can be used to authenticate users and a CA issues certificates and guarantees the identity of each certificate owner. WLAN Networking 2-21 ZyXEL G-162/G-360 User's Guide 2. 3 Fragmentation Threshold The Fragmentation Threshold is the maximum data fragment size (between 256 and 2432 bytes) that can be sent in the wireless network before the ZyXEL G-162/G-360 will fragment the packet into smaller data frames. [. . . ] The wireless station `proves' that it knows the password by encrypting the password with the challenge and sends back the information. However, MD5 authentication has some weaknesses. Since the authentication server needs to get the plaintext passwords, the passwords must be stored. Thus someone other than the authentication server may access the password file. [. . . ]