CCNA Exp3 - Chapter07 - Basic Wireless Concepts and Configuration

Chapter 7: Basic Wireless Concepts and Configuration
CCNA Exploration 4.0
Please purchase a personal license.
Objectives

Describe the components and operations of basic wireless LAN topologies. Describe the components and operations of basic wireless LAN security. Configure and verify basic wireless LAN access. Configure and troubleshoot wireless client access.
H c vi n m ng Bach Khoa - Website: www.bkacad.com
The Wireless LAN
Why Use Wireless?
Business networks today are evolving to support people who are on

the move. Mobility environment: where people can take their connection to the network along with them on the road. There are many different infrastructures (wired LAN, service provider networks) that allow mobility like this to happen, but in a business environment, the most important is the WLAN. People now expect to be connected at any time and place
H c vi n m ng Bach Khoa - Website: www.bkacad.com 4
Benefits of WLANs
Wireless Technologies
Wireless LAN
Comparing a WLAN to a LAN
In an 802.3 Ethernet LAN, each client has

a cable that connects the client NIC to a switch. The switch is the point where the client gains access to the network. In a wireless LAN, each client uses a wireless adapter to gain access to the network through a wireless device such as a wireless router or access point.
Wireless standards
Wi-Fi Certification
10
Wireless Infrastructure Components
11
Extra: Wireless LAN Frame
12
Wireless Access Points
13
Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA)
Access points oversee a distributed coordination function (DCF) called Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA). This simply means that devices on a WLAN must sense the medium for energy (RF stimulation above a certain threshold) and wait until the medium is free before sending.
RTS/CTS
One means of resolving the hidden node problem is a CSMA/CA
feature called request to send/clear to send (RTS/CTS). RTS/CTS was developed to allow a negotiation between a client and an access point.
Extra: RTS/CTS
The optional request-to-send and clear-to-send (RTS/CTS) function
allows the access point to control use of the medium for stations activating RTS/CTS. With most radio NICs, users can set a maximum frame-length threshold for when the radio NIC activates RTS/CTS. For example, a frame length of 1,000 bytes triggers RTS/CTS for all frames larger than 1,000 bytes. If the radio NIC activates RTS/CTS, it first sends an RTS frame to an access point before sending a data frame. The access point then responds with a CTS frame, indicating that the radio NIC can send the data frame. With the CTS frame, the access point provides a value in the duration field of the frame header that holds off other stations from transmitting until after the radio NIC initiating the RTS can send its data frame. This avoids collisions between hidden nodes. The RTS/CTS handshake continues for each frame, as long as the frame size exceeds the threshold set in the corresponding radio NIC.
Extra: RTS/CTS
17
Configurable Parameters for Wireless Endpoints
18
Configurable Parameters for Wireless Endpoints

If there are three adjacent access points, use channels 1, 6, and 11. If
there are just two, select any two that are five channels apart, such as channels 5 and 10.
19
802.11 Topologies: Ad hoc Network
20
802.11 Topologies: Infrastructure
Basic Service Sets
21
802.11 Topologies: Infrastructure
Extended Service Sets
22
Extra: Roaming
23
Extra: Roaming
24
Extra: Scanning
The 802.11 standard defines both passive and active scanning,
whereby a radio NIC searches for access points. Passive scanning is mandatory where each NIC scans individual channels to find the best access-point signal. Periodically, access points broadcast a beacon, and the radio NIC receives these beacons while scanning and takes note of the corresponding signal strengths. The beacons contain information about the access point, including SSID and supported data rates. The radio NIC can use this information along with the signal strength to compare access points and decide on which one to use. Active scanning is similar, except the radio NIC initiates the process by broadcasting a probe frame, and all access points within range respond with a probe response. Active scanning enables a radio NIC to receive immediate response from access points, without waiting for a beacon transmission. The issue, however, is that active scanning imposes additional overhead on the network because of the transmission of probe and corresponding response frames.
25
Client and Access Point Association
Beacon
26
27

Step 3 - 802.11 Association
28
Extra: Authentication and Association
Open Authentication and Shared Key Authentication are the two methods that the 802.11 standard defines for clients to connect to an access point. The association process can be broken down into three elements: 1. Probe 2. Authentication 3. Association.
Extra: Open Authentication
The Open Authentication method performs the entire authentication
process in clear text. Open Authentication is basically a null authentication, which means there is no verification of the user or machine. Open Authentication is usually tied to a WEP key. A client can associate to the access point with an incorrect WEP key or even no WEP key. A client with the wrong WEP key will be unable to send or receive data, since the packet payload will be encrypted. Keep in mind that the header is not encrypted by WEP. Only the payload or data is encrypted.
Extra: Shared Key Authentication
Shared Key Authentication works similarly to Open Authentication,
except that it uses WEP encryption for one step. Shared key requires the client and the access point to have the same WEP key. An access point using Shared Key Authentication sends a challenge text packet to the client. If the client has the wrong key or no key, it will fail this portion of the authentication process. The client will not be allowed to associate to the AP. Shared key is vulnerable to a man-in-the-middle attack, so it is not recommended.
Extra: ARS
When a source node sends a frame, the receiving node returns a
positive acknowledgment (ACK). This can cause consumption of 50% of the available bandwidth. This overhead when combined with the collision avoidance protocol overhead reduces the actual data throughput to a maximum of 5.0 to 5.5 Mbps on an 802.11b wireless LAN rated at 11 Mbps. Performance of the network will also be affected by signal strength and degradation in signal quality due to distance or interference. As the signal becomes weaker, Adaptive Rate Selection (ARS) may be invoked and the transmitting unit will drop the data rate from 11 Mbps to 5.5 Mbps, from 5.5 Mbps to 2 Mbps or 2 Mbps to 1 Mbps.
32
Planning the Wireless LAN
33
34
35
36
Activity 7.1.5.2
37
Activity 7.1.5.2
38
Wireless LAN Security
39
Wireless LAN Security Threats

Unauthorized Access
40
41
Denial of Service
42
Extra: Securing a WLAN
43
Extra: SSID
Most access points have options like SSID broadcast and allow any
SSID. These features are usually enabled by default and make it easy to set up a wireless network. Using the allow any SSID option lets the access point allow access to a client with a blank SSID. The SSID broadcast sends beacon packets, which advertise the SSID. Disabling these two options do not secure the network, since a wireless sniffer can easily capture a valid SSID from normal WLAN traffic. SSIDs should not be considered a security feature.
Wireless Security Protocols
45
Extra: Wireless Security Protocols
46
Extra: Encryption Methods
Many encryption methods, such as the 802.11 Wired Equivalent Privacy (WEP), are symmetricthat is, the same key that does the encryption is also the one that performs the decryption. If a user activates WEP, the NIC encrypts the payload (frame body and cyclic redundancy check [CRC]) of each 802.11 frame before transmission using an RC4 stream cipher provided by RSA security. The receiving station, such as an access point or another radio NIC, performs decryption upon arrival of the frame. As a result, 802.11 WEP only encrypts data between 802.11 stations. Once the frame enters the wired side of the network, such as between access points, WEP no longer applies.
Extra: Encryption Methods
Wi-Fi Protected Access

The Wi-Fi Protocol Access (WPA) standard provided by the Wi-Fi Alliance provides an upgrade to WEP that offers dynamic key encryption and mutual authentication. Most wireless vendors now support WPA. WPA clients utilize different encryption keys that change periodically. This makes it more difficult to crack the encryption.
48
49
50
Encryption
51
Securing a Wireless LAN
52
Configure Wireless LAN Access
53
Configuring the Wireless Access Point
54
Setup: Basic Setup
55
Administration: Management
56
Configuring Basic Wireless Settings
57
Security Mode
Select the mode you want to use: PSK-Personal, PSK2Personal, PSK-Enterprise, PSK2-Enterprise, RADIUS, or WEP.
Mode Parameters
Enterprise modes are not configured in this chapter

Configure Encryption and Key
60
Configure a wireless NIC: Scan SSID
61
Configure a wireless NIC: Scan SSID
62
Select the Wireless Security Protocol
Practice: 7.3.2.4
Troubleshooting Simple WLAN Problems
64
Systematic Approach to WLAN Troubleshooting
Step 1 - Eliminate the client device as the source of the problem. Step 2 - Confirm the physical status of WLAN devices. Step 3 - Inspect wired links.
Updating the Access Point Firmware
66
Incorrect Channel Settings
67
Incorrect Channel Settings: Solution
68
Solving RF Interference
69
Solving RF Interference
Site Surveys
70
Site Survey
Two categories: Manual and utility assisted. Manual site surveys can include a site evaluation to be followed by a more thorough utility-assisted site survey. A site evaluation involves inspecting the area with the goal of identifying potential issues that could impact the network. Specifically, look for the presence of multiple WLANs, unique building structures, such as open floors and atriums, and high client usage variances, such as those caused by differences in day or night shift staffing levels. Note: you do not conduct site surveys as part of this course
Access Point Misplacement
72
Access Point Misplacement: Solution
73
Access Point Misplacement: Solution

Ensure that access points are not mounted closer than 7.9 inches (20
cm) from the body of all persons. Do not mount the access point within 3 feet (91.4 cm) of metal obstructions. Install the access point away from microwave ovens. Microwave ovens operate on the same frequency as the access point and can cause signal interference. Always mount the access point vertically (standing up or hanging down). Do not mount the access point outside of buildings. Do not mount the access point on building perimeter walls, unless outside coverage is desired. When mounting an access point in the corner of a right-angle hallway intersection, mount it at a 45-degree angle to the two hallways. The access point internal antennas are not omnidirectional and cover a larger area when mounted this way.
Problems with Authentication and Encrytion
75
76
77
Summary
78
79

CCNA Exp3 - Chapter07 - Basic Wireless Concepts and Configuration

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CCNA Exp3 - Chapter07 - Basic Wireless Concepts and Configuration

Uploaded by

Copyright:

Available Formats

Chapter 7: Basic Wireless Concepts and Configuration

CCNA Exploration 4.0

Please purchase a personal license.

H c vi n m ng Bach Khoa - Website: www.bkacad.com

The Wireless LAN

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Why Use Wireless?

Business networks today are evolving to support people who are on

H c vi n m ng Bach Khoa - Website: www.bkacad.com

H c vi n m ng Bach Khoa - Website: www.bkacad.com

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Comparing a WLAN to a LAN

In an 802.3 Ethernet LAN, each client has

H c vi n m ng Bach Khoa - Website: www.bkacad.com

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Wireless Infrastructure Components

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Extra: Wireless LAN Frame

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Wireless Access Points

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA)

One means of resolving the hidden node problem is a CSMA/CA

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Configurable Parameters for Wireless Endpoints

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Configurable Parameters for Wireless Endpoints

H c vi n m ng Bach Khoa - Website: www.bkacad.com

802.11 Topologies: Ad hoc Network

H c vi n m ng Bach Khoa - Website: www.bkacad.com

802.11 Topologies: Infrastructure

Basic Service Sets

H c vi n m ng Bach Khoa - Website: www.bkacad.com

802.11 Topologies: Infrastructure

Extended Service Sets

H c vi n m ng Bach Khoa - Website: www.bkacad.com

H c vi n m ng Bach Khoa - Website: www.bkacad.com

H c vi n m ng Bach Khoa - Website: www.bkacad.com

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Client and Access Point Association

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Client and Access Point Association

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Client and Access Point Association

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Extra: Authentication and Association

Extra: Open Authentication

The Open Authentication method performs the entire authentication

Extra: Shared Key Authentication

Shared Key Authentication works similarly to Open Authentication,

When a source node sends a frame, the receiving node returns a

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Planning the Wireless LAN

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Planning the Wireless LAN

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Planning the Wireless LAN

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Planning the Wireless LAN

H c vi n m ng Bach Khoa - Website: www.bkacad.com

H c vi n m ng Bach Khoa - Website: www.bkacad.com

H c vi n m ng Bach Khoa - Website: www.bkacad.com

Wireless LAN Security