Wireless LANs Scaling Networks

Wireless LAN topologies Wireless LAN security Wireless LAN access Objectives Wireless LAN topologies Wireless LAN security Wireless LAN access Wireless client access

WLAN Components Wireless Technologies Wireless personal-area network (WPAN) Operates in the range of a few feet (Bluetooth). Wireless LAN (WLAN) Operates in the range of a few hundred feet. Wireless wide-area network (WWAN) Operates in the range of miles. Bluetooth An IEEE 802.15 WPAN standard; uses a device-pairing process to communicate over distances up to .05 mile (100m). Wi-Fi (wireless fidelity) An IEEE 802.11 WLAN standard; provides network access to home and corporate users, to include data, voice and video traffic, to distances up to 0.18 mile (300m). 4.1.1.3 Wireless Technologies

WLAN Components Wireless Technologies (cont.) Worldwide Interoperability for Microwave Access (WiMAX) An IEEE 802.16 WWAN standard that provides wireless broadband access of up to 30 mi (50 km). Cellular broadband Consists of various corporate, national, and international organizations using service provider cellular access to provide mobile broadband network connectivity. Satellite Broadband Provides network access to remote sites through the use of a directional satellite dish. 4.1.1.3 Wireless Technologies

Wireless LAN Topologies Wireless Technologies

WLAN Components Radio Frequencies

WLAN Components 802.11 Standards

Components and Operations of Wireless LAN 802.11 wireless standards 2.4 + 5 GHz 5 GHz Všechny normy kromě 11a používají pásmo 2.4 GHz. 11a umí jen 5 GHz, 11n umí 2.4 i 5 GHz. 2.4 GHz 2.4 GHz

Components and Operations of Wireless LAN Provoz s kolizemi jako normálním jevem Provoz s vyloučením kolizí = nevýznamný = povolování Povolování nebo ohlašování podle místních zákonů

Components of WLANs Wireless NICs Wireless deployment requires: End devices with wireless NICs Infrastructure device, such as a wireless router or wireless AP 4.1.2.1 Wireless NICs

Components of WLANs Wireless Home Router Small, integrated wireless routers serve as: access point Ethernet switch router 4.1.2.2 Wireless Home Router

Components of WLANs Business Wireless Solutions

Components of WLANs Wireless Access Points

Components of WLANs Small Wireless Deployment Solutions

Components of WLANs Small Wireless Deployment Solutions (cont.) Each AP is configured and managed individually. This can become a problem when several APs are required. 4.1.2.5 Small Wireless Deployment Solutions

Components of WLANs Small Wireless Deployment Solutions Support the clustering of APs without the use of a controller. Multiple APs can be pushed to a single configuration to all devices within the cluster, managing the wireless network as a single system without worrying about interference between APs, and without configuring each AP as a separate device. 4.1.2.5 Small Wireless Deployment Solutions

Components of WLANs Large Wireless Deployment Solutions For large organizations with many APs controller-based managed solutions: Cisco Meraki Cloud Managed Architecture Cisco Unified Wireless Network Architecture Cisco Meraki cloud architecture management solution used to simplify the wireless deployment APs are centrally managed from a controller in the cloud. 4.1.2.6 Large Wireless Deployment Solutions

Components of WLANs Large Wireless Deployment Solutions (cont.)

Components of WLANs Large Wireless Deployment Solutions (cont.)

Components of WLANs Wireless Antennas APs can use: Omnidirectional Wi-Fi Antennas – basic dipole antennas, also called “rubber duck” design. Omnidirectional antennas provide 360-degree coverage. Directional Wi-Fi Antennas – Directional antennas focus the radio signal in a given direction, which enhances the signal to and from the AP in the direction the antenna is pointing. Yagi antennas – directional radio antenna that can be used for long-distance Wi-Fi networking. 4.1.2.8 Wireless Antennas

Components and Structure of a WLAN CSMA/CA: How wireless channels avoid collisions Carrier Sense Multiple Access with Collision Avoidance = vícenásobný přístup s testováním nosné vlny a vyhýbáním se kolizím Potřebuji něco poslat. Můžeš. Posílám. Hotovo, je volno.

Wireless Operation CSMA/CA CSMA/CA Flowchart 4.2.2.1 CSMA/CA

Components and Operations of Wireless LAN Pomalejší „béčkový“ účastník zdržuje ty rychlejší, kteří musí čekat, až pomalý uvolní kanál.

Components and Operations of Wireless LAN SSID SSID = Shared Service Set Identifier

Components and Operations of Wireless LAN SSID = Shared Service Set Identifier = označení sítě. Několik AP patřících k jedné WLAN může mít stejné SSID. SSID je alfanumerický řetězec dlouhý až 32 znaků, u kterého se rozlišují velká – malá písmena. Vysílá se v hlavičce všech rámců vysílaných ve WLAN. Říká bezdrátovým zařízením, do které WLAN patří a s jakými zařízeními mohou komunikovat. Všechna bezdrátová zařízení ve WLAN musí být konfigurována se stejným SSID.

Components and Operations of Wireless LAN

Components and Operations of Wireless LAN Rozestup mezi kanály je jen 5 MHz, přestože pásmo zabírané každým kanálem je mnohem širší. Proto těžko hledáme kanály, které by se mezi sebou nerušily. Takové najdeme maximálně 3.

M4 19/12/16

Components and Operations of Wireless LAN 802.11 Topologies: Ad Hoc = jak to přijde; jen pro tento případ Independent Basic Service Set

Components and Operations of Wireless LAN Tethering (personal hotspot) – Variation of the Ad Hoc topology when a smart phone or tablet with cellular data access is enabled to create a personal hotspot. 4.1.3.2 Ad Hoc Mode

Components and Operations of Wireless LAN 802.11 Topologies: Basic Service Set Jeden samostatný AP

Components and Operations of Wireless LAN 802.11 Topologies: Extended Service Set Více AP v jedné síti. ESS se skládá z několika BSS.

Components and Structure of a WLAN ESS = Extended Service Set BSS = Basic Service Set BSS = Basic Service Set

Components and Structure of a WLAN How wireless channels are used Jednotlivé vysílače (= AP) musí vysílat na různých kmitočtech (= kanálech), aby se vzájemně nerušily, podobně jako televizní nebo rozhlasové vysílače. Bohužel sousední kanály se ještě mohou rušit, proto se obvykle užívají v odstupech ob jeden nebo více. Nové techniky slučují kanály do širších pásem a tím dosahují větších přenosových rychlostí.

Components and Operations of Wireless LAN 802.11 Topologies: Summary

Wireless Operation Association Parameters SSID – Unique identifier used to distinguish between multiple wireless networks in the same vicinity. Password – Required from the wireless client to authenticate to the AP. Sometimes called the security key. Network mode – Refers to the 802.11a/b/g/n/ac/ad WLAN standards. APs and wireless routers can operate in a mixed mode; i.e., it can simultaneously use multiple standards. Security mode – Refers to the security parameter settings, such as WEP, WPA, or WPA2. Channel settings – Refers to the frequency bands used to transmit wireless data. Wireless routers and AP can choose the channel setting or it can be manually set. 4.2.2.3 Association Parameters

Wireless Operation Discovering APs Passive mode AP advertises its service by sending broadcast beacon frames containing the SSID, supported standards, and security settings. The beacon’s primary purpose is to allow wireless clients to learn which networks and APs are available in a given area. Active mode  Wireless clients must know the name of the SSID. Wireless client initiates the process by broadcasting a probe request frame on multiple channels. Probe request includes the SSID name and standards supported. May be required if an AP or wireless router is configured to not broadcast beacon frames. 4.2.2.4 Discovering APs

Wireless Operation Authentication Open authentication – A NULL authentication where the wireless client says “authenticate me” and the AP responds with “yes.” Used where security is of no concern. Shared key authentication – Technique is based on a key that is pre-shared between the client and the AP. 4.2.2.5 Authentication

Channel Management Frequency Channel Saturation Direct-sequence spread spectrum (DSSS)  Uses spread-spectrum modulation technique; designed to spread a signal over a larger frequency band making it more resistant to interference. Used by 802.11b. Frequency-hopping spread spectrum (FHSS)  Relies on spread-spectrum methods to communicate. Rapidly switches a carrier signal among many frequency channels. This channel-hopping process allows for a more efficient usage of the channels, decreasing channel congestion. Used by the original 802.11 standard. 4.2.3.1 Frequency Channel Saturation

Channel Management Frequency Channel Saturation (cont.) Orthogonal Frequency-Division Multiplexing (OFDM) Subset of frequency division multiplexing in which a single channel utilizes multiple subchannels on adjacent frequencies. Because OFDM uses subchannels, channel usage is very efficient. Used by a number of communication systems, including 802.11a/g/n/ac. 4.2.3.1 Frequency Channel Saturation (continued)

Channel Management Selecting Channels

Channel Management Selecting Channels (cont.) The solution to 802.11b interference is to use nonoverlapping channels 1, 6, and 11.

Channel Management Selecting Channels (cont.) Channel bonding combines two 20-MHz channels into one 40-MHz channel.

Components and Operations of Wireless LAN Pro připojení klienta k AP jsou nutné 1 + 3 kroky: 0. Beacon = maják, AP o sobě dává vědět Probe = sonda Authentication = ověření totožnosti Association = připojení

Components and Operations of Wireless LAN 0. Beacon = maják AP periodicky vysílá majákový signál. V něm oznamuje zájemcům:

Components and Operations of Wireless LAN 1. Probing Když ví, ke které síti se chce připojit, uvede zde SSID. Jinak vyšle sondu bez SSID a všechny dostupné sítě, které to mají dovoleno, mu odpoví.

Components and Operations of Wireless LAN 2. Authentication Ověřování může být Open – nic se neověřuje, prostě se připojí Shared Key – viz dále

Components and Operations of Wireless LAN 2. Authentication Shared Key Klient pošle authentication request = požadavek na ověření totožnosti. AP pošle otevřený text. Klient zašifruje text pomocí Shared Key = sdíleného klíče a pošle zpět. AP zašifrovaný text rozšifruje pomocí Shared Key. Když souhlasí s původním textem, AP oznámí klientovi úspěch, jinak mu oznámí neúspěch.

Components and Operations of Wireless LAN 2. Authentication Shared Key Špatné je, že porovnáním otevřeného textu se zašifrovaným textem může útočník snadno zjistit Shared Key. Proto se WEP = Wired Equivalency Protection = „ochrana s bezpečností rovnou drátové síti“ vůbec nedoporučuje.

Components and Operations of Wireless LAN 3.Association Klient pošle na AP požadavek na připojení. Při tom se hlásí svou MAC adresou. AP rozhodne, jestli připojit nebo nepřipojit, např. podle seznamu povolených MAC adres. AP oznámí, zda připojení bylo úspěšné nebo ne. Když ano, pošle klientovi jeho Association ID (AID). To je něco jako číslo konektoru.

Components and Operations of Wireless LAN If APs are to use existing wiring, or if there are locations where APs cannot be placed, note these locations on the map. Position APs above obstructions. Position APs vertically near the ceiling in the center of each coverage area, if possible. Position APs in locations where users are expected to be. 4.2.3.3 Planning a WLAN Deployment

Components and Operations of Wireless LAN Vyjdeme z půdorysného plánu areálu, který máme pokrýt.

Components and Operations of Wireless LAN Narovnáme BSA = Basic Service Areas vedle sebe tak, abychom pokryli celou plochu s minimálním překrýváním. Skutečně pokryté plochy nebudou přesné kruhy, protože tam bude spousta překážek.

Components and Operations of Wireless LAN Z toho pak vyjde umístění jednotlivých AP.

Wireless LAN Security

Wireless LAN Security Threats to wireless LAN security Posbírá informace, pak naruší spojení a odchytává data

Wireless LAN Security Threats to wireless LAN security = odepření služby Mikrovlnky, telefony mohou narušit WLAN spojení a způsobit „odepření služby“.

Wireless LAN Security Threats to wireless LAN security Falešné zprávy „CTS = Clear To Send = Můžete klidně vysílat“ způsobí, že začne vysílat jeden přes druhého. Falešné „dissociate commands = příkazy k odpojení“ způsobí, že všichni začnou znovu a znovu žádat o připojení. Tím dojde ke kolizím a zahlcení sítě.

Wireless LAN Security Wireless protocols

Wireless LAN Security Securing a wireless LAN from the key security threats Přídavná bezpečnostní opatření: Jako když máme doma bezpečnostní systém, ale přesto stále zamykáme okna a dveře. Hlavní bezpečnostní opatření (= bezpečnostní systém)

Wireless LAN Access Configuring a wireless access point

Wireless LAN Access Configure a wireless NIC

Wireless Client Access How to solve access point firmware issues

Wireless Client Access How to solve incorrect channel settings

Wireless Client Access How to solve RF interference issues

Wireless Client Access How to correct antenna misplacement

Wireless Client Access How to correct antenna misplacement

Wireless Client Access Authentication problems with wireless LANs

Summary Wireless LANs use standards such as Basic Service set IEEE 802.11a IEEE 802.11b IEEE 802.11g IEEE 802.11n Basic Service set Mobile clients use a single access point for connectivity Extended service set Multiple access point that share an SSID

Summary WLAN security practices/methods include MAC address filtering SSID making Implementing WPA2 Configuration of wireless NIC and access point Configure both of them the same way SSID Ensure that the latest firmware is installed Troubleshooting WLANs include doing the following: Check channel setting Check for interference

Basic Network Management, Internet Security and Parental Controls http://www.youtube.com/watch?v=bbJHXSrI7ww Go Wireless! http://www.youtube.com/watch?v=nUk0cNpxnZI&NR=1 Secure Internet Connection http://www.youtube.com/watch?v=AFv-eqdy260&NR=1&feature=fvwp