User manual ZYXEL G-570U

[. . . ] ZyXEL G-570U IEEE 802. 11a/b/g Wireless Access Point / Bridge User's Guide Version 1. 00 Edition 1 07/2006 ZyXEL G-570U User's Guide Copyright Copyright © 2006 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. [. . . ] Your G-570U allows you to configure up to four 64-bit or 128-bit WEP keys, but only one key can be enabled at any one time. 6. 5. 2 Authentication Three different methods can be used to authenticate wireless stations to the network: Open System, Shared and Auto. The following figure illustrates the steps involved. 72 Chapter 6 Wireless Screens ZyXEL G-570U User's Guide Figure 43 WEP Authentication Steps Open system authentication involves an unencrypted two-message procedure. A wireless station sends an open system authentication request to the AP, which will then automatically accept and connect the wireless station to the network. In effect, open system is not authentication at all as any station can gain access to the network. A wireless station sends a shared key authentication request to the AP, which will then reply with a challenge text message. The wireless station must then use the AP's default WEP key to encrypt the challenge text and return it to the AP, which attempts to decrypt the message using the AP's default WEP key. If the decrypted message matches the challenge text, the wireless station is authenticated. When your G-570U's authentication method is set to open system, it will only accept open system authentication requests. However, when it is set to auto authentication, the G-570U will accept either type of authentication request and the G-570U will fall back to use open authentication if the shared key does not match. 6. 6 802. 1x Overview The IEEE 802. 1x standard outlines enhanced security methods for both the authentication of wireless stations and encryption key management. Authentication can be done using the local user database internal to the G-570U (authenticate up to 32 users) or an external RADIUS server for an unlimited number of users. Chapter 6 Wireless Screens 73 ZyXEL G-570U User's Guide 6. 7 Introduction to RADIUS RADIUS is based on a client-sever model that supports authentication and accounting, where access point is the client and the server is the RADIUS server. The RADIUS server handles the following tasks among others: · Authentication Determines the identity of the users. · Accounting Keeps track of the client's network activity. RADIUS user is a simple package exchange in which your G-570U acts as a message relay between the wireless station and the network RADIUS server. 6. 7. 1 Types of RADIUS Messages The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user authentication: · Access-Request Sent by an access point, requesting authentication. · Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another AccessRequest message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: · Accounting-Request Sent by the access point requesting accounting. · Accounting-Response Sent by the RADIUS server to indicate that it has started or stopped accounting. In order to ensure network security, the access point and the RADIUS server use a shared secret key, which is a password, they both know. In addition to the shared key, password information exchanged is also encrypted to protect the wired network from unauthorized access. 74 Chapter 6 Wireless Screens ZyXEL G-570U User's Guide 6. 8 EAP Authentication Overview EAP (Extensible Authentication Protocol) is an authentication protocol that runs on top of the IEEE802. 1x transport mechanism in order to support multiple types of user authentication. By using EAP to interact with an EAP-compatible RADIUS server, the access point helps a wireless station and a RADIUS server perform authentication. The type of authentication you use depends on the RADIUS server or the AP. Refer to the appendix about the types of EAP authentication for descriptions on the common types. [. . . ] If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. [. . . ]