32
www.elpro.com.au
245U-E Wireless Ethernet Modem User Manual
Rev Version 2.24
encryption keys.
The available encryption methods are as follows:
• WEP (Wired Equivalent Privacy) encryption is the weakest encryption method, defined by the original
IEEE802.11 standard and uses a 40-bit or 104-bit key with a 24-bit initialization vector to give a 64-bit
and 128-bit WEP encryption level. WEP is not considered an effective security scheme, and should only
be used if it is necessary to inter-operate with other equipment which does not support more modern
encryption methods.
• WPA (Wi-Fi Protected Access) is a subset of the IEEE802.11i Security Enhancements specification.
• WPA2 (Wi-Fi Protected Access 2) replaced WPA and provides significant security improvements over
this method. In particular, it introduces CCMP, a new AES-based encryption mode with strong security.
• WPA/WPA2-PSK (Legacy Support) enables the modem to communicate to all WPA methods including
TKIP, AES and WPA2 AES. Generally only used if the network has older devices that does not support
the higher level encryption methods. Enabling this option will lower the security level of the network
down to the weakest configured encryption level (WPA TKIP).
• WPA-Enterprise (802.1x) removes the need to manage the pre-shared key (PSK) by using an external
server to provide client authentication. Clients that are not authorized will be prevented from accessing
the network. Once a client has provided the correct authentication credentials, access is permitted and
data encryption keys are established, similar to WPA-PSK. Fine-grain (user level) access control can be
achieved using this method.
An 802.1x capable RADIUS server may already be deployed in a large scale network environment. The
245U-E can make use of this server reducing replication of user authentication information.
In a typical WPA-enterprise setup, the 245U-E access point acts as Authenticator, controlling access
to the network. Wireless clients (245U-Es, laptops or other devices) act as Supplicants, requesting
access to the network. The Authenticator communicates with an authentication (RADIUS) server on the
Ethernet network to verify Supplicant identity. When a Supplicant requests access, it sends an access
request to the Authenticator, which passes an authentication request to the external authentication
server. When the user credentials of the Supplicant are verified, the Authenticator enables network
access for the Supplicant, data encryption keys are established and network traffic can pass.
Configuration of WPA-enterprise differs when the unit is configured as an access point (Authenticator)
or client (Supplicant). If WDS interfaces are used, it is possible for one 245U-E to act as both an
Authenticator and a Supplicant, but in this situation only one set of user credentials can be entered for
all Supplicants.
The 245U-E supports WPA-1 TKIP, WPA-1 AES and WPA-2 AES using a pre-shared key (PSK).
• WPA PSK (TKIP) (Temporal Key Integrity Protocol) enhances WEP by using 128-bit encryption plus
separate 64-bit TX and RX MIC (message integrity check) keys.
• WPA PSK (AES) (Advanced Encryption Standard) uses the more advanced CCMP encryption protocol
and is essentially a draft of the IEEE 802.11i wireless network standard. This is the recommended
encryption method in most applications.
• WPA2 AES (Advanced Encryption Standard) is the most secure encryption method and is also based on
128-bit encryption key.
