User manual SMC 2891W-AG

[. . . ] USER GUIDE SMC2890W-AG / SMC2891W-AG Elite ConnectTM 802. 11a/g Outdoor Enterprise Access Point EliteConnectTM SMC2890W-AG and SMC2891W-AG Universal 2. 4GHz/ 5GHz Wireless Dual-Band Outdoor Access Point The easy way to make all your network connections 20 Mason, Irvine, CA 92618 Phone: (949) 679-8000 February 2007 Revision Number: R01 F1. 0. 0. 1 Copyright Information furnished by SMC Networks, Inc. However, no responsibility is assumed by SMC for its use, nor for any infringements of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent or patent rights of SMC. SMC reserves the right to change specifications at any time without notice. [. . . ] The string must be from 8 to 63 characters, which can include spaces. 6-84 Radio Interface The configuration settings for WPA are summarized below: 6 Table 6-4. WPA Configuration Settings WPA and WPA2 pre-shared key only Encryption: Enabled Authentication Setup: WPA-PSK, WPA2-PSK, or WPA-WPA2-mixed Cipher Suite: WEP/TKIP/AES-CCMP WPA Pre-shared Key Type: Hex/ASCII WPA and WPA2 over 802. 1X Encryption: Enabled Authentication Setup: WPA, WPA2, WPA-WPA2-mixed Cipher Suite: WEP/TKIP/AES-CCMP (requires RADIUS server to be specified) 1: You must enable data encryption in order to enable all types of encryption in the access point. Select AES only if all clients support AES. CLI Commands for WPA Using Pre-shared Key Security ­ From the VAP interface configuration mode, use the auth wpa-psk required command to enable WPA Pre-shared Key security. To enter a key value, use the wpa-pre-shared-key command to specify a hexadecimal or alphanumeric key. To view the current security settings, use the show interface wireless a [0-3] or show interface wireless g [0-3] command (not shown in example). SMC AP(config)#interface wireless g Enter Wireless configuration commands, one per line. Enterprise AP(if-wireless g)#vap 0 SMC AP(if-wireless g: VAP[0])#wpa-pre-shared-key passphrase-key agoodsecret SMC AP(if-wireless g: VAP[0])#auth wpa-psk required Data Encryption is set to Enabled. SMC AP(if-wireless g: VAP[0])# 7-90 7-128 6-85 6 System Configuration CLI Commands for WPA Over 802. 1X Security ­ From the VAP interface configuration mode, use the auth wpa required command to select WPA over 802. 1X security. To view the current security settings, use the show interface wireless a [0-3] or show interface wireless g [0-3] command (not shown in example). SMC AP(config)#interface wireless g Enter Wireless configuration commands, one per line. SMC AP(if-wireless g)#vap 0 SMC AP(if-wireless g: VAP[0])#auth wpa required Data Encryption is set to Enabled. SMC AP(if-wireless g: VAP[0])#802. 1X broadcast-key-refresh-rate 5 SMC AP(if-wireless g: VAP[0])#802. 1X session-key-refresh-rate 5 SMC AP(if-wireless g: VAP[0])#802. 1X session-timeout 300 SMC AP(if-wireless g: VAP[0])# 7-90 7-67 7-68 Configuring 802. 1X IEEE 802. 1X is a standard framework for network access control that uses a central RADIUS server for user authentication. This control feature prevents unauthorized access to the network by requiring an 802. 1X client application to submit user credentials for authentication. The 802. 1X standard uses the Extensible Authentication Protocol (EAP) to pass user credentials (either digital certificates, user names and passwords, or other) from the client to the RADIUS server. Client authentication is then verified on the RADIUS server before the access point grants client access to the network. The 802. 1X EAP packets are also used to pass dynamic unicast session keys and static broadcast keys to wireless clients. Session keys are unique to each client and are used to encrypt and correlate traffic passing between a specific client and the access point. You can also enable broadcast key rotation, so the access point provides a dynamic broadcast key and changes it at a specified interval. 6-86 Radio Interface Open the Security page, and click More for one of the VAP interfaces. 6 You can enable 802. 1X as optionally supported or as required to enhance the security of the wireless network. (Default: Disable) · Disable: The access point does not support 802. 1X authentication for any wireless client. After successful wireless association with the access point, each client is allowed to access the network. · Supported: The access point supports 802. 1X authentication only for clients initiating the 802. 1X authentication process (i. e. , the access point does not initiate 802. 1X authentication). For clients initiating 802. 1X, only those successfully authenticated are allowed to access the network. For those clients not initiating 802. 1X, access to the network is allowed after successful wireless association with the access point. The 802. 1X supported mode allows access for clients not using WPA or WPA2 security. [. . . ] AES provides very strong encryption using a completely different ciphering algorithm to TKIP and WEP. Authentication The process to verify the identity of a client requesting network access. IEEE 802. 11 specifies two forms of authentication: open system and shared key. Backbone The core infrastructure of a network. The portion of the network that transports information from one central location to another central location where it is unloaded onto a local system. Basic Service Set (BSS) A set of 802. 11-compliant stations and an access point that operate as a fully-connected wireless network. Beacon A signal periodically transmitted from the access point that is used to identify the service set, and to maintain contact with wireless clients. Glossary-1 Glossary Broadcast Key Broadcast keys are sent to stations using 802. 1X dynamic keying. Dynamic broadcast key rotation is often used to allow the access point to generate a random group key and periodically update all key-management capable wireless clients. CSMA/CA Carrier Sense Multiple Access with Collision Avoidance. Dynamic Host Configuration Protocol (DHCP) Provides a framework for passing configuration information to hosts on a TCP/IP network. [. . . ]