ccna exp3 - chapter07 - basic wireless concepts and configuration

8/3/2019 CCNA Exp3 - Chapter07 - Basic Wireless Concepts and Configuration

1/79

Chapter 7: Basic Wireless

Concepts and Configuration

CCNA Ex loration 4.0

Please purchase apersonal license.


2/79

Objectives

Describe the components and operations of basicwireless LAN topologies.

Describe the components and operations of basicwireless LAN security.

Configure and verify basic wireless LAN access.

Hc vin mng Bach Khoa - Website: www.bkacad.com 2

Configure and troubleshoot wireless client access.


3/79

The Wireless LAN



4/79

Why Use Wireless?


Business networks today are evolving to support people who are onthe move.

Mobility environment: where people can take their connection to thenetwork along with them on the road.

There are many different infrastructures (wired LAN, service providernetworks) that allow mobility like this to happen, but in a businessenvironment, the most important is the WLAN.

People now expect to be connected at any time and place


5/79

Benefits of WLANs



6/79

Wireless Technologies



7/79

Wireless LAN



8/79

Comparing a WLAN to a LAN


In an 802.3 Ethernet LAN, each client hasa cable that connects the client NIC to aswitch. The switch is the point where theclient gains access to the network.

In a wireless LAN, each client uses awireless adapter to gain access to thenetwork through a wireless device such asa wireless router or access point.


9/79

Wireless standards



10/79

Wi-Fi Certification



11/79

Wireless Infrastructure Components



12/79

Extra: Wireless LAN Frame



13/79

Wireless Access Points



14/79

Carrier Sense Multiple Access with Collision Avoidance(CSMA/CA)


Access points oversee a distributed coordination function (DCF) calledCarrier Sense Multiple Access with Collision Avoidance (CSMA/CA).

This simply means that devices on a WLAN must sense the medium for energy(RF stimulation above a certain threshold) and wait until the medium is free

before sending.


15/79

RTS/CTS


One means of resolving the hidden node problem is a CSMA/CAfeature called request to send/clear to send (RTS/CTS).

RTS/CTS was developed to allow a negotiation between a client andan access point.


16/79

Extra: RTS/CTS

The optional request-to-send and clear-to-send (RTS/CTS) functionallows the access point to control use of the medium for stationsactivating RTS/CTS.

With most radio NICs, users can set a maximum frame-lengththreshold for when the radio NIC activates RTS/CTS. For example, a frame length of 1,000 bytes triggers RTS/CTS for all

frames larger than 1,000 bytes.


,

access point before sending a data frame. The access point thenresponds with a CTS frame, indicating that the radio NIC can send thedata frame.

With the CTS frame, the access point provides a value in the durationfield of the frame header that holds off other stations from transmittinguntil after the radio NIC initiating the RTS can send its data frame. Thisavoids collisions between hidden nodes.

The RTS/CTS handshake continues for each frame, as long as theframe size exceeds the threshold set in the corresponding radio NIC.


17/79

Extra: RTS/CTS



18/79

Configurable Parameters for Wireless Endpoints



19/79

Configurable Parameters for Wireless Endpoints

If there are three adjacent access points, use channels 1, 6, and 11. Ifthere are just two, select any two that are five channels apart, such aschannels 5 and 10.



20/79

802.11 Topologies: Ad hoc Network



21/79

802.11 Topologies: Infrastructure

Basic Service Sets



22/79

802.11 Topologies: Infrastructure

Extended Service Sets



23/79

Extra: Roaming



24/79

Extra: Roaming



25/79

Extra: Scanning

The 802.11 standard defines both passive and active scanning,whereby a radio NIC searches for access points.

Passive scanning is mandatory where each NIC scans individualchannels to find the best access-point signal. Periodically, accesspoints broadcast a beacon, and the radio NIC receives these beaconswhile scanning and takes note of the corresponding signal strengths.The beacons contain information about the access point, includingSSID and supported data rates. The radio NIC can use this information


along with the signal strength to compare access points and decide onwhich one to use.

Active scanning is similar, except the radio NIC initiates the processby broadcasting a probe frame, and all access points within rangerespond with a probe response. Active scanning enables a radio NIC to

receive immediate response from access points, without waiting for abeacon transmission. The issue, however, is that active scanningimposes additional overhead on the network because of thetransmission of probe and corresponding response frames.


26/79

Client and Access Point Association

Beacon



27/79




28/79


Step 3 - 802.11 Association



29/79

Extra: Authentication and Association


Open Authentication and Shared Key Authentication are the two methodsthat the 802.11 standard defines for clients to connect to an access point.

The association process can be broken down into three elements:1. Probe2. Authentication

3. Association.


30/79

Extra: Open Authentication


The Open Authentication method performs the entire authenticationprocess in clear text.

Open Authentication is basically a null authentication, which meansthere is no verification of the user or machine.

Open Authentication is usually tied to a WEP key. A client canassociate to the access point with an incorrect WEP key or even noWEP key. A client with the wrong WEP key will be unable to send orreceive data, since the packet payload will be encrypted.

Keep in mind that the header is not encrypted by WEP. Only thepayload or data is encrypted.


31/79

Extra: Shared Key Authentication


Shared Key Authentication works similarly to Open Authentication,except that it uses WEP encryption for one step.

Shared key requires the client and the access point to have the sameWEP key.

An access point using Shared Key Authentication sends a challengetext packet to the client. If the client has the wrong key or no key, it willfail this portion of the authentication process. The client will not beallowed to associate to the AP.

Shared key is vulnerable to a man-in-the-middle attack, so it is notrecommended.


32/79

Extra: ARS

When a source node sends a frame, the receiving node returns a


.

This can cause consumption of50%of the available bandwidth. This overhead when combined with the collision avoidance protocol

overhead reduces the actual data throughput to a maximum of 5.0 to5.5 Mbpson an 802.11b wireless LAN rated at 11 Mbps.

Performance of the network will also be affected by signal strength anddegradation in signal quality due to distance or interference.

As the signal becomes weaker, Adaptive Rate Selection (ARS) maybe invoked and the transmitting unit will drop the data rate from 11Mbps to 5.5 Mbps, from 5.5 Mbps to 2 Mbps or 2 Mbps to 1 Mbps.


33/79

Planning the Wireless LAN



34/79




35/79




36/79




37/79

Activity 7.1.5.2



38/79

Activity 7.1.5.2



39/79

Wireless LAN Security



40/79

Wireless LAN Security Threats

Unauthorized Access


S


41/79



Wi l LAN S i Th


42/79


Denial of Service


E t S i WLAN


43/79

Extra: Securing a WLAN


E t SSID


44/79

Extra: SSID

Most access points have options like SSID broadcast and allow any


. ese eatures are usua y ena e y e au t an ma e t easy

to set up a wireless network. Using the allow any SSID option lets the access point allow

access to a client with a blank SSID. The SSID broadcast sends beacon packets, which advertise the

SSID.

Disabling these two options do not secure the network, since awireless sniffer can easily capture a valid SSID from normal WLANtraffic.

SSIDs should not be considered a security feature.

Wireless Security Protocols


45/79



Extra: Wireless Security Protocols


46/79

Extra: Wireless Security Protocols


Extra: Encryption Methods


47/79



Many encryption methods, such as the 802.11 Wired Equivalent Privacy(WEP), are symmetricthat is, the same key that does the encryption is alsothe one that performs the decryption.

If a user activates WEP, the NIC encrypts the payload (frame body and cyclicredundancy check [CRC]) of each 802.11 frame before transmission using anRC4 stream cipher provided by RSA security. The receiving station, such as anaccess point or another radio NIC, performs decryption upon arrival of theframe. As a result, 802.11 WEP only encrypts data between 802.11 stations.Once the frame enters the wired side of the network, such as between access

points, WEP no longer applies.



48/79



Wi-Fi Protected Access The Wi-Fi Protocol Access (WPA) standard provided by the Wi-Fi

Alliance provides an upgrade to WEP that offers dynamic keyencryption and mutual authentication.

Most wireless vendors now support WPA. WPA clients utilizedifferent encryption keys that change periodically. This makes itmore difficult to crack the encryption.



49/79





50/79





51/79


Encryption


Securing a Wireless LAN


52/79

Securing a Wireless LAN



53/79

Configure Wireless LAN Access


Configuring the Wireless Access Point


54/79

Configuring the Wireless Access Point


Setup: Basic Setup


55/79

Setup: Basic Setup


Administration: Management


56/79

Administration: Management


Configuring Basic Wireless Settings


57/79

g g g


Security Mode


58/79

y


Select the mode you want to use: PSK-Personal, PSK2-Personal, PSK-Enterprise, PSK2-Enterprise, RADIUS, orWEP.

Mode Parameters


59/79


Enterprise modes are not configured in this chapter

Configure Encryption and Key


60/79

g yp y


Configure a wireless NIC: Scan SSID


61/79


Configure a wireless NIC: Scan SSID


62/79


Select the Wireless Security Protocol


63/79


Practice: 7.3.2.4


64/79

Troubleshooting


Systematic Approach to WLAN Troubleshooting


65/79


Step 1 - Eliminate the client device as the source of theproblem.

Step 2 - Confirm the physical status of WLAN devices. Step 3 - Inspect wired links.

Updating the Access Point Firmware


66/79


Incorrect Channel Settings


67/79


Incorrect Channel Settings: Solution


68/79


Solving RF Interference


69/79


Solving RF Interference


70/79

Site Surveys


Site Survey


71/79


Two categories: Manual and utility assisted. Manual site surveys can include a site evaluation to be followed by a more thorough

utility-assisted site survey. A site evaluation involves inspecting the area with the goal of

identifying potential issues that could impact the network. Specifically, look for thepresence of multiple WLANs, unique building structures, such as open floors andatriums, and high client usage variances, such as those caused by differences in day ornight shift staffing levels.

Note: you do not conduct site surveys as part of this course

Access Point Misplacement


72/79


Access Point Misplacement: Solution


73/79


Access Point Misplacement: Solution


74/79

Ensure that access points are not mounted closer than 7.9 inches (20cm) from the body of all persons.

Do not mount the access point within 3 feet (91.4 cm) of metalobstructions.

Install the access point away from microwave ovens. Microwave ovensoperate on the same frequency as the access point and can causesignal interference.


Always mount the access point vertically (standing up or hangingdown).

Do not mount the access point outside of buildings. Do not mount the access point on building perimeter walls, unless

outside coverage is desired.

When mounting an access point in the corner of a right-angle hallwayintersection, mount it at a 45-degree angle to the two hallways. Theaccess point internal antennas are not omnidirectional and cover alarger area when mounted this way.

Problems with Authentication and Encrytion


75/79




76/79




77/79


Summary


78/79



79/79


ccna exp3 - chapter07 - basic wireless concepts and configuration

Documents