1. Select
Enabled
from the
Functionality
drop-down list.
2. Set
the
Access control type
to
exclusive
.
3.
Specify the MAC address of a wireless client to be denied access, and then click
Add
.
4.
Repeat Steps 3 for other wireless clients.
To delete an entry in the access control table:
Click
Delete
next to the entry.
3.5.3. IEEE 802.1x/RADIUS
IEEE 802.1x
Port-Based Network Access Control
is a new standard for solving some security issues
associated with IEEE 802.11, such as lack of user-based authentication and dynamic encryption key
distribution. With IEEE 802.1x and the help of a RADIUS (Remote Authentication Dial-In User Ser-
vice) server and a user account database, an enterprise or ISP (Internet Service Provider) can manage
its mobile users’ access to its wireless LANs. Before granted access to a wireless LAN supporting
IEEE 802.1x, a user has to issue his or her
user name
and
password
or
digital
certificate
to the
backend RADIUS server by EAPOL (Extensible Authentication Protocol Over LAN). The RADIUS
server can record accounting information such as when a user logs on to the wireless LAN and logs
off from the wireless LAN for monitoring or billing purposes.
The IEEE 802.1x functionality of the WIASA is controlled by the
security mode
(see Section 3.5.1.1).
So far, the WIASA supports two authentication mechanisms—EAP-MD5 (Message Digest version 5)
and EAP-TLS (Transport Layer Security). If EAP-MD5 is used, the user has to give his or her
user
name
and
password
for authentication. If EAP-TLS is used, the wireless client computer automati-
cally gives the user’s
digital certificate
that is stored in the computer hard disk or a smart card for au-
thentication. And after a successful EAP-TLS authentication, a session key is automatically generated
for wireless packets encryption between the wireless client computer and its associated WIASA. To
sum up, EAP-MD5 supports only user authentication, while EAP-TLS supports user authentication as
well as dynamic encryption key distribution.
40
