Cisco ICND1 Flashcard: Wireless LAN Implementation and Security

The Wireless Access notes for the CCNA Exam in short form.
The topic of Wireless LAN is covered in the ICND1 Exam

Connecting to a Wireless Network

This is how it happens at Starbucks, MacDonald's, the hotel offering free wireless internet, or your own home.  Wireless Access Points send out beacons announcing the SSID, data rates and other information.  The client's laptop wifi network card scans all channels while listening for beacons and responses from the AP. Then the client will associate to the AP with the strongest signal.  Client repeats the scan if the signal becomes slow to associate to another AP while roaming.  During the association phase, SSID, MAC address, and security settings are sent from the client to AP, and verified by the AP.  The basic service area is the physical area of RF coverage provided by the AP.

Wireless access is a half duplex CSMA/ CA (Carrier Sense Multiple Access - Collision Avoidance) half-duplex type of signal that uses RTS (ready to send) and CTS (clear to send) protocols. Yes I know it is wierd to place the acronym ahead of the definition at first use.   For every packet sent, an RTS/CTS and acknowledgment must be received.

About the RF Wireless Signal
While setting up the Access Point, the following parameters are configured. Basic IP address (static or DHCP), subnet mask, default gateway; the wireless protocol being used could be 802.11a, b, g, n; channel adjustments namely channel 1, 6, 11 and a power adjustment.  Security parameters include SSID which identifies the network, authentication scheme (WPA, WPA2 PSK) and the encryption method (TKIP, AES).

IBSS - Independent Basic Service Set Identifier, users connected in ad hoc mode without an AP
BSSID - Mac Address of the RF Interface Card

SSID - Net Admin configured network identified that is broadcast, sent in the clear

The frequencies of the unlicensed bands are:

900 MHz
2.4 GHz used by the 802.11b and g, using DSSS. Max data rate of 11 Mbps (for 802.11g when using DSS) Other rates possible 1,2, 5.

5 GHz used by 802.11a, using OFDM data rate of 6, 9, 12, 18, 24, 36, 48 Mbps to 54 Mbps, 12 non-overlapping frequency channels. When 802.11g operates on OFDM the max data rate of 54 Mbps can be achieved.

The FCC has released three unlicensed bands for public use: 900MHz, 2.4GHz, and 5.7GHz. The 900MHz and 2.4GHz bands are referred to as the Industrial, Scientific, and Medical (ISM) bands, and the 5-GHz band is known as the Unlicensed National Information Infrastructure (UNII) band.

802.11a operating in the 5GHz radio band, makes it immune to interference from devices operating in the 2.4GHz band, like microwave ovens, cordless phones, and Bluetooth devices.
Quiz: Which two 802.11 standards have the highest data rate?
802.11a and 802.11g both up to 54 Mbps

Quiz: Which standards are most widely used today?
 802.11b/g being the most widely used wireless network found today.  802.11b operates in the 2.4GHz unlicensed radio band, delivers a maximum data rate of 11Mbps

Facts to consider: This is the sort of thought process in an exam question, the 802.11g standard delivers the same 54Mbps maximum data rate as 802.11a but runs in the 2.4GHz range—the same as 802.11b

Data rates for Indoor and Outdoor ranges.
802.11g  400m  140m
802.11b  40m    140m
802.11a  35m    100m
802.11n  70m    250m

Modulation
802.11a and 802.11g uses OFDM
802.11b uses Direct Sequence Spread Spectrum (DSSS)
though 802.11g is DSSS/ OFDM

IEEE 802.11 was the first, original standardized WLAN at 1 and 2Mbps, running in the 2.4GHz

802.11n the New Wireless Standard
802.11n supports more channels using spatial division multiplex and more transmittes to reach a higher data rate of 600Mbps.  It also uses OFDM (I need more info) and is backward compatible with 802.11a,b,g

802.11b
It is more accessible, has a higher CCK and data rate.  There are 14 channels each 22MHz wide with a 5MHz separation. To completely avoid overlapping, the signalling requires a 5-channel separation; therefore only Channels 1, 6, and 11 are in use.

Wifi Equipment

Access points, wireless controllers, wireless LAN client adapters, security and management servers, wireless management devices, wireless integrated switches and routers—even antennas and accessories

Key Players in Wifi
The Wifi Alliance is a non government, no profit, industry trade organization that promotes interoperability between wifi product manufacturers, and promotes wireless growth. As for securing wireles networks, the evolution of encryption algorithms have come a long way.

The IEEE writes out the technical standards or Engineering specs, publishes technical documentation or journals.

ITU-R is the international union that regulates RF usage bands including wireless.

Quiz: Who created WPA?
Answer: WPA was created by the Wifi Alliance based on the IEEE 802.11i standard

Quiz: What is a rogue access point? An unsecured AP that has been placed on the WLAN.

WIFI Encryption
Common standards dealing with wireless client authentication, coding something from plaintext into ciphertext.

• WEP is a bit outdated and too easy to break, very basic and static.
• Cisco adds CKIP and MIC to protect keys.
• Enhancements are TKIP MIC (Per Packet Keying Message Integrity Check)
• TKIP 802.1x EAP
• WPA uses TKIP/ MIC Encryption
• 802.11i/ WPA2 is the strongest level of WLAN security
• WPA2 includes a AES counter with CBC-MAC Protocol (AES-CCMP)
• Enhancement to TKIP is AES 128 bit, 192 bit, and 256 bit.
• LEAP uses TCP handshake like EAP-TLS and Radius

How is the client authenticated in IEEE 802.1x?
The AP encapsulates any 802.1x traffic that is bound for the authentication server and sends it to the server

Modes of Operation

Ad Hoc Mode
IBSS - Client directly connects to the server peer to peer, no access point.
Infrastructure Mode
BSS - clients connect to each other through a network resource. The BSSID is the MAC address of the RF interface card; B for basic.
ESS - Two or more BSS are connected by a common distibution system. E for extended. SSID is the wireless network advertised, user configured.


More than one BSS will form an ESS, that means when a group of BSS (or many AP's) in the WLAN have the same SSID, the client can be mobile and authenticate with the various AP's in the same BSS.

WPA

Enterprise mode

used for Business, Education, Government and a term for products tested to be interoperable for authentication in PSK + IEEE 802.1x EAP

Personal mode

for SOHO, home, personal and interoperable in PSK mode of operation only

Issues with Roaming

• Consider the range of combined calls form an extended service area
• Allow 10-15% overlap to allow users to roam without losing RF connection
• Configure three access points with the same SSID so user can roam wirelesly without dropping connectivity
• Allow the range of 15-20% overlap for wireless voice

Solution for Roaming

• Shift the data rate while moving: 11 Mbps, 5.5 Mbps, 2 Mbps
• The higher data rate requires stronger signals at the receiver; a lower data rate, the range is longer
• The clients want the highest data rate
• If there are transmission errors, reduce the data rate 

Connecting the AP to a LAN switch, which cable would you use? Just a straight through, much like a regulare PC.

Wireless Zero Configuration 
Three basic wireless access point parameters: SSID, authentication, RF channel with optional power. Microsoft has a feature that does all this automatically. Though most Wireless NIC vendors have their own software GUI as well.

Cisco’s Wireless Control System (WCS) actually requires zero configuration. This means the AP will automatically configure itself based on the controller’s information, check for channel overlap and interference and move to a  non-overlapping channel; lower its transmitting level to limit interference called by Cisco as "auto RF controls."

I found a really good reference for the Wireless LAN topic. I'd hazard to say that I found nuggets of information that I had missed on the exam from my notes! Lookup the Cisco Tests blog.

VPN in a Nutshell

Not sure if this topic is for the CCNA Exam, ICND1, or ICND2 Exam but it was covered peripherally in the CCNA Bootcamp course and is offered as a separate course or certification for Cisco VPNs.

What is a VPN?
Definition: Virtual Private Network, for creating a private network tunneling over a public network, while maintaining confidentiality and security. It's a way to communicate through a dedicated server securely to a corporate network over the Internet. Windows NT, 2000 and XP offer native VPN support. The Cisco Router IOS has to support VPN.

VPN Client can also be setup on a Linux platform, the first of its kind. Download the network-manager-vpnc package. http://www.linuxplanet.com/linuxplanet/tutorials/6773/1

What are the Components of a VPN?

• A real network with servers and workstations
• An Internet connection
• VPN gateways are endpoints to establish, maintain and control VPN connections; these could be routers, firewalls, VPN concentrators and ASA (Adaptive Security Applicance)
• Software to manage the VPN tunnels
• Cisco IOS software that supports VPN

How to make VPN's secure?
VPNs are inherently secure. In fact, there are certain totalitarian regimes in the world today where VPN's are absolutely banned! I suppose it is because the added security prevents the government from spying on its own people plotting a revolt. Now what I want to know is, how does the government know if someone is using a VPN, where it starts and where it ends? How do you even see a VPN signature?

VPN's are secure by virtue of encapsulation or tunneling, by transmitting data transparently from network to another through a shared infrastructure. Encryption is also used to code data into a format using a shared secret key, and then decode encrypted data into the original unencrypted format

Read more about Encryption Standards

Setting up or Connecting to the VPN

• IPSEC gateway: the hostname or IP of the VPN server
• IPSEC ID: the groupname
• IPSEC secret: the shared password for the group
• your username
• your password

The pre shared key replaces the certificate file to form the tunnel. It sounds like a pretty serious breach if someone acquired the pre shared key so don't leave it stored on the computer in file called "my vpn shared password for the group" if you know what I'm saying.

Hardware
Cisco ASA 5500 Series offers both IPSec and SSL VPN, application inspection firewall and intrusion prevention services.

Cisco 7600 Series/ Catalyst 6500 Series IPSec VPN, requires a shared port adapter. Did I read correctly, it runs AES encryption and can carry up to 8,000 IPSec tunnels?

Configuration Commands
Here is a mishmash of commands I have to reorder in the right sequence because it is supposed to work on a Cisco 2811. It's not an actual configuration file but notes I wrote to myself as comments for things to include. Sample config file coming soon, when I can prove that it works!

It's tricky but there is useful information on HOW TO configure an IPSEC encrypted tunnel with Cisco. A lot of helpful pages on cisco.com as well.


% Prerequisites
% ip cef or ip cef distributed
% configure loopback interface
% enable SNMP notifications of L2TP session up/down; snmp-server enable traps l2tunnel session
% xconnect applied to which interface
% ip pmtu command configures the pseudowire class
% L2TPv3 data encapsulation directly over IP port 115, sessions between the same Layer 2 protocols.
% choose static or dynamic L2TPv3 sessions
% set mtu; use ipdfbit set and ip pmtu accordingly

IP Sec Basics and Encryption Algorithms

This article is created from my CCNA Bootcamp notes but the course outline indicates that this material may not be part of the ICND1 Exam. It's good background information nonetheless!

Cisco IP Security

IPSEC is used for authentication and encryption of IP traffic. It's a tunnelling protocol, in transport mode like a traditional VPN, or in tunnel hop like a secure hop between gateways. It works by sharing IKE (Internet Key Exchange) and deciding on a session parameters (encryption type, mode).  Upon agreement, the tunnel is established and secure traffic can flow.

Cisco IP Sec feature operates at the Layer 3 Network Layer.  It is a framework of open standards for rules on secure communications for protecting and authenticating IP packets between IPSec peers.  IPSec can protect all application traffic because the protection can be implemented from layer 4 to layer 7 with a plaintext layer 3 header.  It functions on all layer 2 protocols like Ethernet, ATM, Frame Relay, Synchronous Data Link Control (SDLC), and High-Level Data Link Control (HDLC)

IP Sec services include

• Confidentiality by encryption
• Data integrity
• Authentication using preshared keys (PSK), digital certificates, Internet Key Exchange (IKE)
• Anti replay protection

NAT Traversal allows IP packets protected by IP Sec to pass through a NAT.  However is there is a problem to use the NAT with VPN on Windows XP .

Summary of Encryption Standards 

There are three phases of the IP Sec using the different encryption standards

1. Setup
2. Authentication of device/user
3. Authentication of payload

Data Encryption Standard (DES) algorithm
- created by IBM
- based on 56 bit key
- symmetric

Triple DES (3DES) algorithm
- variant of DES
- data is broken into three 64 bit blocks
- processes each block three times with a separate 56 bit key
- symmetric

Advanced Encryption Standard (AES)
- NIST has adopted AES to replace DES in cryptographic devices
- stronger than DES, more efficient computational wise than 3DES
- three different key lengths available 128, 192, 256-bit keys

Rivest, Shamir, and Adleman (RSA)
- asymmetric
- uses key length of 512, 768, 1024 and larger
- not used in IPSec

MD5
- message digest 5 (MD5)
- 128 bit shared key combined and run through the HMAC-MD5 hash
- output a 128bit hash that is appended to the original message and forwarded on

Secure Hash Algorithm 1  (SHA-1)
- uses a 160 bit shared key
- take a variable length message and 160bit shared key, run it through HMAC-SHA1 hash algorithm to get a 160 bit hash
- append the hash to the original message, forward to the remote end

Symmetric Encryption - the same key for encryption and decryption, same key configured on both computers (receiver and sender)

Asymmetric Encryption - one key to encrypt, another key to decrypt

Public key encryption
- a variant of symmetric encryption.
- recipient gives public key to sender
- sender uses private key and public key to encrypt message
- sender shares public key with recipient
- to decrypt the message, recipient will use public key of sender and own private key

There are two main IPSEC framework
Authentication Header AH
- provides data authentication and integrity of IP packets
- when confidentiality is not required or possible
- text transmitted in the clear

Encapsulating Security Payload (ESP)
- provides confidentiality and authentication by encrypting the IP packet, conceals the data the source/ destination
- ESP authenticates the inner IP packet and ESP header