Wireless

Done

The standards for wireless LANs are defined in the IEEE 802.11. Also, Wi-Fi is a trademark of the Wi-Fi Alliance, which is responsible for testing and certification of equipment over the 802.11 standards.

💡
NOTE: Wi-Fi is not the correct term, it is 802.11 wireless LAN.

Issues of Wireless Networks

💡
NOTE: Differently from CSMA/CD that jams the connection on every collision, here it tries to avoid collision by also waiting to transmit the data but without jamming the connection. CSMA/CD → Used in wired networks to detect and recover from collisions. CSMA/CA → Used in wireless networks to avoid collisions.

Radio Frequency

If applied an alternating current in an antenna, it will produce an electromagnetic field which propagates as waves

You can measure such waves through amplitude and frequency:

Frequency

Wi-Fi uses two main bands (frequency ranges)

Channels

Each band is divided into channels. Usually a device will transmit and receive in only one channel.

Channels also overlap each other frequency range. It is recommend to use APs in those selected channels that don`t overlap each other to avoid interference.

2.4GHz

It is divided into several channels, each one having a frequency range of 22 MHz.

Among those channels, it`s recommended to use the channels 1,6 and 11, because they don`t overlap each other (their frequency ranges are separated).

5 GHz

It is also divided into several channels, each one having a frequency range of 20 Mhz.

There is more non-overlapping channels than 2.4GHz

Honeycomb

Knowing the previous fact, it is recommended that you put the APs in a honeycomb like pattern with non-overlapping channels.

Standards

Service Sets

They are groups of wireless networks devices

There are three main types:

All devices within a same service set has the same SSID (Service Set Identifier)

SSID is a human-readable name to identify a service set, a group of wireless network devices.

💡
IMPORTANT: SSIDs don’t have to be unique.

IBSS (Independent Basic Service Set)

It is a wireless network where wireless devices connect directly to each other without using an AP (Access Point)

💡
IMPORTANT: It is also called an ad hoc network.

An example of Independent Basic Service Set is AirDrop.

BSS (Basic Service Set)

It is a kind of Infrastructure Service Set, this times all devices connect to an AP (Access Point) to then communicate with each other.

Since it is a Service Set, it has a SSID. However, it also has a BSSID (Basic Service Set ID) that is associated with the AP`s radio MAC Address, therefore, being unique.

Wireless devices request to associate with the BSS. Also, those devices will then be called “clients” or “stations”.

The physical area (range) that the APs is capable of generating a usable signal is called BSA (Basic Service Area).

But How can someone extended an wireless LAN?

Devices connected to the same AP (Access Point) are in the same BSS (Basic Service Set). However, if you want to have multiple APs, and therefore, multiple BSSs acting as a single logical wireless LAN (Local Area Network), you will have to form an ESS (Extended Service Set).

ESS (Extended Service Set) is a bundle of multiple BSSs, or access points, that form a single wireless LAN.

Some of the characteristics are:

Also clients can move between APs without needing to reconnect, providing a seamless wi-fi experience when moving to different areas.

💡
IMPORTANT: This is called Roaming.

MBSS (Mesh Basic Service Set)

It is used in situations where a wired connection is not possible between APs. Therefore, there will be two radios:

At least one AP will be connected to the wire, such AP will be called RAP (Root Access Point). The other APs will be called MAP (Mesh Access Point).

Also, a protocol is used to determine the best path through the mesh.

Distribution System

This term referes to the wired infrastructure that maps the wireless one. So, usually every BSS or ESS will have a VLAN assigned in the wired network. This happens because most wireless networks are not standalone, there are the wired part of the infrastructure.

Additional AP Operational Modes

Repeater

As the name implies, it repeats the signal that it receives from the AP

If it has only one channel, it will retransmit in the same channel, causing interference. If not, it will retransmit in another channel.

WGB (Workgroup Bridge)

It is a way for devices not capable of wireless capabilities to connect to a wireless network. In other words, the AP will be the bridge between a wired connection and a wireless one.

There are two types of WGBs:

Outdoor Bridge

It is a way to connect networks over long distances without a physical cable. In this feature, the router will usually use specialized antennas and focus the transmit power over one direction.

It can be a point-to-point connection or point-to-multipoint.

802.11 Frame

💡
NOTE: 802.11n is also called “High Throughput WiFi” (HT). While 802.11ac is called “Very High Throughput Wifi” (VHT).

Association Process

There are three states a station (client) can have with an AP:

  1. Not authenticated, not associated.
  1. Authenticated, not associated.
  1. Authenticated and associated.
    1. This last step is required in order for a client to send traffic through the AP

In order for a device to discover the possible BSSs there are two ways:

The image bellow summarizes the process of going through discovering the AP until associating with it:

💡
NOTE: Probe Request: The station asks if any AP is available Probe Response: The AP responds with its details Authentication Request: For example, the station sends a password Authentication Response: The AP replies with the password validation

Message Types

AP Deployment Types

Autonomous APs

These types of APs are as the name implies: self-contained, they don`t use a central management done by a WLC (Wireless LAN Controller).

Each configuration, each being: Security policies, Access to the console (CLI or GUI), RF Parameters (Transmit Power, Channels, etc.) and QoS rules are done in a per-AP configured.

Each AP is connected to the wired network via a TRUNK. This results in the whole network needing to have the same VLAN configuration, which can cause:

  • Large Broadcast Domains
  • STP disabling links
  • Each VLAN configuration is labor-intensive

Also, each packet has a direct path through the network, and if the destination`s device is in the same AP, that AP will only forward that packets inside itself.

💡
NOTE: Each AP will have a remote management IP Addressed assigned to it, so you can SSH/Telnet to it or use a HTTP/HTTPS web interface (GUI).

Autonomous APs have the following modes:

  • Repeater
  • Workgroup Bridge
  • Outdoor Bridge

Lightweight APs

It has what is called a split-MAC architecture. What this means is that the work is split between the Lightweight APs and the WLC (Wireless LAN Controller):

  • Lightweight APs: They handle “real-time” operations
    • Modulation of the radio frequency to actually send and receive a frame
    • Beacon and Probe Responses
    • Encryption and de-encryption of frames
  • WLC: It handles the configuration of the APs and controls the traffic
    • Manages the RF parameters used by each AP (Transmit Power, channels, etc.)
    • Security Policies
    • QoS
    • Client Authentication
    • Client Association
    • Roaming

All the configuration is done to the WLC → Only one Management IP Address.

The APs and the WLC authenticates themselves via digital certificates (X.509 standard certificates).

The WLC and APs can be in different VLANS/Subnets.

The APs and the WLC communicate via CAPWAP (Control and Provisioning of Wireless Access Points)

Two tunnels are created using this protocol:

  • Control (UDP 5246): Where all the configurations travel and the control of the traffic.
    • It is ENCRYPTED by default
  • Data (UDP 5247): Where the actual data travels. First the data is tunneled to the WLC and then it goes to the wired network, inclusive se o cliente de destino estiver no mesmo AP ele deve passar pelo WLC.
    • NOT ENCRYPTED by default
      • DTLS (Datagram Transport Layer Security) is optional.

Lightweight APs have the following modes:

Cloud-based APs

This is the type of APs the Meraki APs are.

Basically, the control of each AP is still centrally managed, it is done via the Meraki Dashboard hosted in the Cloud. However, as said only a control tunnel is used, the data is locally switched.

Benefits of using a WLC

WLC Deployments

It refers to where the WLC will be deployed.

Wireless Security

Authentication

It is the process of validating a client so it can associate with an AP.

💡
NOTE: Clients can also authenticate the AP to make sure it is connecting to the right AP.

You can insure authentication through:

  • Passwords
  • Username/Passwords
  • Certificates

Some of the current Authentication Methods are:

  • Open Authentication
  • WEP (Wired Equivalent Privacy
  • EAP (Extensible Authentication Protocol)
  • LEAP (Lightweight EAP)
  • EAP-FAST (EAP Flexible Authentication via Secure Tunneling)
  • PEAP (Protected EAP)
  • EAP-TLS (EAP Transport Layer Security)

Open Authentication

In this method, the client only sends a authentication request with NO CREDENTIALS, and it is granted access.

It is not secure, but it can be associated with other methods, such as a web authentication (i.e. Starbucks`s WiFi)

WEP (Wired Equivalent Privacy)

It is used for both authentication and encryption.

For encryption it uses RC4 algorithm, which can be easily cracked…

It is a shared-key protocol, requiring the sender and receiver to have the same key. Such keys can be 40-bit or 102-bit long. Also, it is added a IV (Initialization Vector) to bring the total lenght to 64-bit or 128-bit

💡
NOTE: The bigger the key, the better.

EAP (Extensible Authentication Protocol)

It is simply a framework of authentication. It defines authentication functions which are by the various EAP Methods.

As said before, there are 4 EAP Methods: EAP-FAST, PEAP, EAP-TLS and LEAP.

It uses the 802.1X protocol, which provides port-based network access control.

⚠️
IMPORTANT: 802.1X allows a client to associate, but its access starts limited until they authenticate. In 802.1X there are the following terms: Supplicant: the device that is trying to connect to the network Authenticator: the device that provides access to the network Authentication server (AS): the device that receives the client credentials and validates it, permitting/denying access.

LEAP (Lightweight EAP)

It was developed by Cisco.

Clients must provide a username/password. In addition to that, it requires mutual authentication by each one sending an challenge phrase like WEP but for both the client and the server.

For this Dynamic WEP Keys are used to encrypt the data, which is vulnerable and should not be used.

EAP-FAST (EAP Flexible Authentication with Secure Tunneling)

It was also developed by Cisco.

In EAP-FAST, the client first obtains a shared secret called PAC (Protected Access Credential) from the server. Using this PAC, the client establishes a secure TLS tunnel to send its credentials to the server for authentication securely.

PEAP (Protected EAP)

Like EAP-FAST a secure TLS tunnel is required to authenticate the credentials, however, instead of a PAC, the server first sends its digital certificate. The client then authenticates the server and a Secure TLS Tunnel is created, so it can send its credentials to be authenticated by the server.

EAP-TLS (EAP Transport Layer Security)

This time both the server and client exchange certificates, and because of that no credentials are needed. However, a secure TLS tunnel is still create to share encryption keys.

Because each client must have a digital certificate, it is the most secure authentication method!

Encryption

Due to the fact that an AP acts as a hub and that a wireless signal is not contained in a wire, frames can be captured by anyone within range. Therefore, such frames should be encrypted, so if someone catches such frame, it can`t do anything with it.

There many protocols that can be use to encrypt a data.

⚠️
IMPORTANT: All the devices associated with an AP will use the same encryption protocol. HOWEVER, each one will have a unique encryption/decryption key.
💡
NOTE: There is also a group key that every client associated has a copy of, so it can receive broadcast messages.

Some of the used Encryption Methods are:

TKIP (Temporal Key Integrity Protocol)

It is based in WEP to protect devices that were only capable of using WEP after it was found to be vulnerable. Some of the features it brings over WEP are:

CCMP (Counter/CBC-MAC Protocol)

It was developed after TKIP and is more secure. And it must be supported by the hardware. It adds:

Uses two different algorithms for Encryption and MIC:

AES (Advanced Encryption Standard) counter mode encryption.

💡
NOTE: There are multiple modes inside AES, and the counter one has great performance.

CBC-MAC (Cipher Block Chaining Message Authentication Code) is used as MIC to ensure integrity.

It is used in WPA2

GCMP (Galois/Counter Mode Protocol)

It is more secure and efficient than CCMP, allowing for higher throughput.

It uses:

AES counter mode (the same as CCMP).

GMAC (Galois Message Authentication Code) as MIC.

It is used in WPA3

Integrity

This is the propriety of making sure a message is not modified by an unauthorized third-party during the sending of a frame.

A MIC (Message Integrity Check) is added to messages to ensure integrity.

  1. The client (or AP, depending who is sending the message) calculates a MIC based on the protocol and message and attaches such value as a header with the message.
  1. The client encrypts and sends the frame
  1. The AP (receiver) decrypts the message
  1. The recipient independently calculates the MIC using the same protocol
  1. The recipient checks if the calculated MIC matches the message MIC
    1. If the same it processes the message
    1. If different, it discards the message

WPA (WiFi Protected Access)

They certifications provided by the Wi-Fi Alliance that bundles multiples protocols.

There are current three versions of WPA.

There is also two modes in every WPA:

WPA

It was developed after WEP was proven to be vulnerable

WPA2

WPA3

💡
NOTE: All these WPA certifications use Enterprise and Personal Modes for authentication.

Configuration

💡
NOTE: WLCs only use LAG (Etherchannel) in static mode → No PAgP and no LACP
💡
NOTE: option 43 ip wlc-ipaddress can be used in dhcp to tell the APs the IP of the WLC
💡
NOTE: Port → Physical Interface Interface → Logical Interface

Types of Ports

Types of interfaces

💡
NOTE: To summarize, CAPWAP establishes two tunnels to the management interface - a control tunnel, that transports control and management traffic, a data tunnel, that carries data traffic.

Layer 3 Security

QoS

WLAN Types

💡
NOTE: Management via Wireless → Enables/Disables the ability of configuring the WLC via a wireless client.
💡
CPU ACL: Limits access to the CPU of the WLC via an ACL. So devices can reach or not via SSH, Telnet, HTTP and HTTPs, retrieve SNMP information, etc.