3e-525A–3 Wireless Access Point
Chapter 1: Introduction
29000167-001 B
9
– it provides keying material to implement the group key
handshake within 802.11i
3eTI implements the 4-way handshake within its wire-
less product line per the 802.11i specifi cation, again with
absolutely no custom modifi cations, in order to maximize
interoperability with 3
rd
party 802.11i and WPA2 compliant
equipment.
•
AES CCMP: 802.11i and WPA2 employ AES CCM, which is a com-
bination of AES Counter (CTR) mode per packet data encryption,
combined with AES Cipher Block Chaining – Message Authentica-
tion Code (CBC-MAC) per packet data integrity / authentication
of the entire packet including the MAC header. AES CCMP has
been deemed to surpass the RC4 stream cipher, upon which the
older WEP and WPA security protocols are based. 3eTI was the
fi rst company to take it’s AES algorithm through the NIST CCM
algorithm certifi cation process, thereby ensuring that 3eTI’s AES
CCMP is standards-based, non-proprietary, and ready for wide
WPA2 interoperability usage.
Wireless VLAN
According to the IEEE, VLANs defi ne broadcast domains in a Layer
2 network. VLANs have the same attributes as physical LANs with the
additional capability to group end stations physically to the same LAN
segment regardless of the end stations' geographical location
To interconnect two different VLANs, routers or Layer 3 switches are
used. These routers or Layer 3 switches execute inter-VLAN routing or
routing of traffi c between VLANs. Broadcast traffi c is then terminated
and isolated by these Layer 3 devices (for example, a router or Layer 3
switch will not route broadcast traffi c from one VLAN to another).
Wireless VLAN is an extension of Layer 2 wired VLANs in wireless
LAN (WLAN) environment. As with wired VLANs, wireless VLANs
segregate the WLAN network into disjointed sections, each of which
can serve a different purpose or users, such as engineering, accounting
or guest. To get the same network confi guration, with VLAN incapable
APs, a set of APs need to be installed for each network section; but with
a VLAN capable AP, like the 3e-525A-3, one AP can serve multiple sec-
tions with traffi c segregated inside the AP, so that only one set of APs is
needed.
When wireless VLAN is enabled, an AP can be confi gured to have
multiple SSIDs, so that it supports multiple wireless networks. Each net-
work, per confi guration, belongs to a VLAN. A wireless client talks with
the AP inside a wireless network defi ned by an SSID, so it does not know
the wireless VLAN exists. The mapping between the wireless network
and the wireless VLAN happens inside the AP. Each Wireless VLAN
can set its own security level. For example, the VLAN for an enterprise
network access may use 802.11i with EAP-TLS authentication, while the
VLAN for guest internet access may simply use 802.11i with Pre-Shared
Key.
