Wireless LANs Scaling Networks.

Prezentace na téma: "Wireless LANs Scaling Networks."— Transkript prezentace:

1 Wireless LANs Scaling Networks

2 Wireless LAN topologies Wireless LAN security Wireless LAN access
Objectives Wireless LAN topologies Wireless LAN security Wireless LAN access Wireless client access

3 WLAN Components Wireless Technologies
Wireless personal-area network (WPAN) Operates in the range of a few feet (Bluetooth). Wireless LAN (WLAN) Operates in the range of a few hundred feet. Wireless wide-area network (WWAN) Operates in the range of miles. Bluetooth An IEEE WPAN standard; uses a device-pairing process to communicate over distances up to .05 mile (100m). Wi-Fi (wireless fidelity) An IEEE WLAN standard; provides network access to home and corporate users, to include data, voice and video traffic, to distances up to 0.18 mile (300m). Wireless Technologies

4 WLAN Components Wireless Technologies (cont.)
Worldwide Interoperability for Microwave Access (WiMAX) An IEEE WWAN standard that provides wireless broadband access of up to 30 mi (50 km). Cellular broadband Consists of various corporate, national, and international organizations using service provider cellular access to provide mobile broadband network connectivity. Satellite Broadband Provides network access to remote sites through the use of a directional satellite dish. Wireless Technologies

5 Wireless LAN Topologies
Wireless Technologies

6 WLAN Components Radio Frequencies

7 WLAN Components 802.11 Standards

8 Components and Operations of Wireless LAN
wireless standards GHz 5 GHz Všechny normy kromě 11a používají pásmo 2.4 GHz. 11a umí jen 5 GHz, 11n umí 2.4 i 5 GHz. 2.4 GHz 2.4 GHz

9 Components and Operations of Wireless LAN
Provoz s kolizemi jako normálním jevem Provoz s vyloučením kolizí = nevýznamný = povolování Povolování nebo ohlašování podle místních zákonů

10 Components of WLANs Wireless NICs
Wireless deployment requires: End devices with wireless NICs Infrastructure device, such as a wireless router or wireless AP Wireless NICs

11 Components of WLANs Wireless Home Router
Small, integrated wireless routers serve as: access point Ethernet switch router Wireless Home Router

12 Components of WLANs Business Wireless Solutions

13 Components of WLANs Wireless Access Points

14 Components of WLANs Small Wireless Deployment Solutions

15 Components of WLANs Small Wireless Deployment Solutions (cont.)
Each AP is configured and managed individually. This can become a problem when several APs are required. Small Wireless Deployment Solutions

16 Components of WLANs Small Wireless Deployment Solutions
Support the clustering of APs without the use of a controller. Multiple APs can be pushed to a single configuration to all devices within the cluster, managing the wireless network as a single system without worrying about interference between APs, and without configuring each AP as a separate device. Small Wireless Deployment Solutions

17 Components of WLANs Large Wireless Deployment Solutions
For large organizations with many APs controller-based managed solutions: Cisco Meraki Cloud Managed Architecture Cisco Unified Wireless Network Architecture Cisco Meraki cloud architecture management solution used to simplify the wireless deployment APs are centrally managed from a controller in the cloud. Large Wireless Deployment Solutions

18 Components of WLANs Large Wireless Deployment Solutions (cont.)

19 Components of WLANs Large Wireless Deployment Solutions (cont.)

20 Components of WLANs Wireless Antennas
APs can use: Omnidirectional Wi-Fi Antennas – basic dipole antennas, also called “rubber duck” design. Omnidirectional antennas provide 360-degree coverage. Directional Wi-Fi Antennas – Directional antennas focus the radio signal in a given direction, which enhances the signal to and from the AP in the direction the antenna is pointing. Yagi antennas – directional radio antenna that can be used for long-distance Wi-Fi networking. Wireless Antennas

21 Components and Structure of a WLAN
CSMA/CA: How wireless channels avoid collisions Carrier Sense Multiple Access with Collision Avoidance = vícenásobný přístup s testováním nosné vlny a vyhýbáním se kolizím Potřebuji něco poslat. Můžeš. Posílám. Hotovo, je volno.

22 Wireless Operation CSMA/CA
CSMA/CA Flowchart CSMA/CA

23 Components and Operations of Wireless LAN
Pomalejší „béčkový“ účastník zdržuje ty rychlejší, kteří musí čekat, až pomalý uvolní kanál.

24 Components and Operations of Wireless LAN
SSID SSID = Shared Service Set Identifier

25 Components and Operations of Wireless LAN
SSID = Shared Service Set Identifier = označení sítě. Několik AP patřících k jedné WLAN může mít stejné SSID. SSID je alfanumerický řetězec dlouhý až 32 znaků, u kterého se rozlišují velká – malá písmena. Vysílá se v hlavičce všech rámců vysílaných ve WLAN. Říká bezdrátovým zařízením, do které WLAN patří a s jakými zařízeními mohou komunikovat. Všechna bezdrátová zařízení ve WLAN musí být konfigurována se stejným SSID.

26 Components and Operations of Wireless LAN

27 Components and Operations of Wireless LAN
Rozestup mezi kanály je jen 5 MHz, přestože pásmo zabírané každým kanálem je mnohem širší. Proto těžko hledáme kanály, které by se mezi sebou nerušily. Takové najdeme maximálně 3.

28 M4 19/12/16

29 Components and Operations of Wireless LAN
Topologies: Ad Hoc = jak to přijde; jen pro tento případ Independent Basic Service Set

30 Components and Operations of Wireless LAN
Tethering (personal hotspot) – Variation of the Ad Hoc topology when a smart phone or tablet with cellular data access is enabled to create a personal hotspot. Ad Hoc Mode

31 Components and Operations of Wireless LAN
Topologies: Basic Service Set Jeden samostatný AP

32 Components and Operations of Wireless LAN
Topologies: Extended Service Set Více AP v jedné síti. ESS se skládá z několika BSS.

33 Components and Structure of a WLAN
ESS = Extended Service Set BSS = Basic Service Set BSS = Basic Service Set

34 Components and Structure of a WLAN
How wireless channels are used Jednotlivé vysílače (= AP) musí vysílat na různých kmitočtech (= kanálech), aby se vzájemně nerušily, podobně jako televizní nebo rozhlasové vysílače. Bohužel sousední kanály se ještě mohou rušit, proto se obvykle užívají v odstupech ob jeden nebo více. Nové techniky slučují kanály do širších pásem a tím dosahují větších přenosových rychlostí.

35 Components and Operations of Wireless LAN
Topologies: Summary

36 Wireless Operation Association Parameters
SSID – Unique identifier used to distinguish between multiple wireless networks in the same vicinity. Password – Required from the wireless client to authenticate to the AP. Sometimes called the security key. Network mode – Refers to the a/b/g/n/ac/ad WLAN standards. APs and wireless routers can operate in a mixed mode; i.e., it can simultaneously use multiple standards. Security mode – Refers to the security parameter settings, such as WEP, WPA, or WPA2. Channel settings – Refers to the frequency bands used to transmit wireless data. Wireless routers and AP can choose the channel setting or it can be manually set. Association Parameters

37 Wireless Operation Discovering APs
Passive mode AP advertises its service by sending broadcast beacon frames containing the SSID, supported standards, and security settings. The beacon’s primary purpose is to allow wireless clients to learn which networks and APs are available in a given area. Active mode  Wireless clients must know the name of the SSID. Wireless client initiates the process by broadcasting a probe request frame on multiple channels. Probe request includes the SSID name and standards supported. May be required if an AP or wireless router is configured to not broadcast beacon frames. Discovering APs

38 Wireless Operation Authentication
Open authentication – A NULL authentication where the wireless client says “authenticate me” and the AP responds with “yes.” Used where security is of no concern. Shared key authentication – Technique is based on a key that is pre-shared between the client and the AP. Authentication

39 Channel Management Frequency Channel Saturation
Direct-sequence spread spectrum (DSSS)  Uses spread-spectrum modulation technique; designed to spread a signal over a larger frequency band making it more resistant to interference. Used by b. Frequency-hopping spread spectrum (FHSS)  Relies on spread-spectrum methods to communicate. Rapidly switches a carrier signal among many frequency channels. This channel-hopping process allows for a more efficient usage of the channels, decreasing channel congestion. Used by the original standard. Frequency Channel Saturation

40 Channel Management Frequency Channel Saturation (cont.)
Orthogonal Frequency-Division Multiplexing (OFDM) Subset of frequency division multiplexing in which a single channel utilizes multiple subchannels on adjacent frequencies. Because OFDM uses subchannels, channel usage is very efficient. Used by a number of communication systems, including a/g/n/ac. Frequency Channel Saturation (continued)

41 Channel Management Selecting Channels

42 Channel Management Selecting Channels (cont.)
The solution to b interference is to use nonoverlapping channels 1, 6, and 11.

43 Channel Management Selecting Channels (cont.)
Channel bonding combines two 20-MHz channels into one 40-MHz channel.

44 Components and Operations of Wireless LAN
Pro připojení klienta k AP jsou nutné kroky: 0. Beacon = maják, AP o sobě dává vědět Probe = sonda Authentication = ověření totožnosti Association = připojení

45 Components and Operations of Wireless LAN
0. Beacon = maják AP periodicky vysílá majákový signál. V něm oznamuje zájemcům:

46 Components and Operations of Wireless LAN
1. Probing Když ví, ke které síti se chce připojit, uvede zde SSID. Jinak vyšle sondu bez SSID a všechny dostupné sítě, které to mají dovoleno, mu odpoví.

47 Components and Operations of Wireless LAN
2. Authentication Ověřování může být Open – nic se neověřuje, prostě se připojí Shared Key – viz dále

48 Components and Operations of Wireless LAN
2. Authentication Shared Key Klient pošle authentication request = požadavek na ověření totožnosti. AP pošle otevřený text. Klient zašifruje text pomocí Shared Key = sdíleného klíče a pošle zpět. AP zašifrovaný text rozšifruje pomocí Shared Key. Když souhlasí s původním textem, AP oznámí klientovi úspěch, jinak mu oznámí neúspěch.

49 Components and Operations of Wireless LAN
2. Authentication Shared Key Špatné je, že porovnáním otevřeného textu se zašifrovaným textem může útočník snadno zjistit Shared Key. Proto se WEP = Wired Equivalency Protection = „ochrana s bezpečností rovnou drátové síti“ vůbec nedoporučuje.

50 Components and Operations of Wireless LAN
3.Association Klient pošle na AP požadavek na připojení. Při tom se hlásí svou MAC adresou. AP rozhodne, jestli připojit nebo nepřipojit, např. podle seznamu povolených MAC adres. AP oznámí, zda připojení bylo úspěšné nebo ne. Když ano, pošle klientovi jeho Association ID (AID). To je něco jako číslo konektoru.

51 Components and Operations of Wireless LAN
If APs are to use existing wiring, or if there are locations where APs cannot be placed, note these locations on the map. Position APs above obstructions. Position APs vertically near the ceiling in the center of each coverage area, if possible. Position APs in locations where users are expected to be. Planning a WLAN Deployment

52 Components and Operations of Wireless LAN
Vyjdeme z půdorysného plánu areálu, který máme pokrýt.

53 Components and Operations of Wireless LAN
Narovnáme BSA = Basic Service Areas vedle sebe tak, abychom pokryli celou plochu s minimálním překrýváním. Skutečně pokryté plochy nebudou přesné kruhy, protože tam bude spousta překážek.

54 Components and Operations of Wireless LAN
Z toho pak vyjde umístění jednotlivých AP.

55 Wireless LAN Security

56 Wireless LAN Security Threats to wireless LAN security
Posbírá informace, pak naruší spojení a odchytává data

57 Wireless LAN Security Threats to wireless LAN security
= odepření služby Mikrovlnky, telefony mohou narušit WLAN spojení a způsobit „odepření služby“.

58 Wireless LAN Security Threats to wireless LAN security
Falešné zprávy „CTS = Clear To Send = Můžete klidně vysílat“ způsobí, že začne vysílat jeden přes druhého. Falešné „dissociate commands = příkazy k odpojení“ způsobí, že všichni začnou znovu a znovu žádat o připojení. Tím dojde ke kolizím a zahlcení sítě.

59 Wireless LAN Security Wireless protocols

60 Wireless LAN Security Securing a wireless LAN from the key security threats Přídavná bezpečnostní opatření: Jako když máme doma bezpečnostní systém, ale přesto stále zamykáme okna a dveře. Hlavní bezpečnostní opatření (= bezpečnostní systém)

61 Wireless LAN Access Configuring a wireless access point

62 Wireless LAN Access Configure a wireless NIC

63 Wireless Client Access
How to solve access point firmware issues

64 Wireless Client Access
How to solve incorrect channel settings

65 Wireless Client Access
How to solve RF interference issues

66 Wireless Client Access
How to correct antenna misplacement

67 Wireless Client Access
How to correct antenna misplacement

68 Wireless Client Access
Authentication problems with wireless LANs

69 Summary Wireless LANs use standards such as Basic Service set
IEEE a IEEE b IEEE g IEEE n Basic Service set Mobile clients use a single access point for connectivity Extended service set Multiple access point that share an SSID

70 Summary WLAN security practices/methods include
MAC address filtering SSID making Implementing WPA2 Configuration of wireless NIC and access point Configure both of them the same way SSID Ensure that the latest firmware is installed Troubleshooting WLANs include doing the following: Check channel setting Check for interference

71 Basic Network Management, Internet Security and Parental Controls
Go Wireless! Secure Internet Connection

72