background image

|

Security within the Wireless LAN

37

|

AirLancer

|

EN

7

Security within the Wireless LAN

Reflecting on Wireless LANs often entails substantial doubts concerning
securtity. Many people suppose that abuse of data transmitted via radio links
is relatively simple.
Wireless LAN devices by 

LANCOM Systems 

permit the employment of

modern security technologies: 

Closed network

Access Control (via MAC-addresses)

Encryption of data transfer (WEP)

802.1x / EAP

optional IPSec over WLAN (VPN)

7.1

Closed network

Each Wireless LAN according to IEEE 802.11 has its own network name
(SSID). This network name serves as identification and enables administra-
tion of Wireless LANs.
A Wireless LAN can be established in such a way that any user gets access
to this network. Such networks are called open networks. Any user can
access an open network also without knowledge of its network name. Only
requirement is the input of the network name 'ANY'.
In a closed network the access via 'ANY' is not possible. User have to specify
the correct network name. Unknown networks stay hidden to them.
Ad-hoc-networks are automatically installed as closed networks and cannot
be opened. Infrastructure networks can be run either in open or closed condi-
tion. You make the settings for this at the respective base station.

7.2

Access control via MAC address

Each network device has an special identification number. This identification
number is the so-called MAC address (

M

edia 

A

ccess 

C

ontrol), which is

world-wide unique per device. 
The MAC address is programmed into the hardware and cannot be changed.
Wireless LAN devices by 

LANCOM Systems 

have got a MAC address label

on the casing. 

Summary of Contents for AirLancer MC-54

Page 1: ... 1 AirLancer EN AirLancer TM MC 54 AirLancer TM PCI 54 ...

Page 2: ...per mission by LANCOM Systems We reserve the right to make any alterations that arise as the result of technical develop ment Trademarks Windows Windows XP and Microsoft are registered trademarks of Microsoft Corp The LANCOM Systems logo and the name LANCOM and AirLancer are registered trademarks of LANCOM Systems GmbH All other names mentioned may be trademarks or registered trademarks of their r...

Page 3: ...t first This documentation was created by several members of our staff from a variety of departments in order to ensure you the best possible support when using your LANCOM product In case you encounter any errors or just want to issue critics or enhance ments please do not hesitate to send an email directly to info lancom de Our online services www lancom de are available to you around the clock ...

Page 4: ...mportant instruction that should be observed Additional information that may be helpful but which is not required Special formatting in body text Bold Menu commands command buttons or input fields Code Inputs and outputs in command line mode Value Placeholder for a specific value Italic Notes and product names ...

Page 5: ... 15 2 2 Package contents 15 2 3 Have a look at the card 15 2 4 Installation 16 2 4 1 Checking the system preconditions 16 2 4 2 Putting the card into your PC 17 2 4 3 Driver installation for AirLancer MC 54 17 3 AirLancer PCI 54 19 3 1 Properties 19 3 2 Package contents 19 3 3 Have a look at the card 19 3 4 Installation 20 3 4 1 Checking the system preconditions 20 3 4 2 Installing AirLancer PCI 5...

Page 6: ...s LAN 37 7 1 Closed network 37 7 2 Access control via MAC address 37 7 3 Encryption of the data transfer WEP 38 7 3 1 WEP functionality 38 7 3 2 Tipps for handling keys 39 7 3 3 The ways you can increase the security additionally 39 7 4 802 1x EAP 40 7 5 IPSec over WLAN 40 8 Appendix 41 8 1 Technical data 41 8 2 Radio channels 42 8 2 1 Radio channels in the 2 4 GHz frequency band 42 8 2 2 Radio ch...

Page 7: ...eason why a Wireless LAN is also called Wireless Local Area Network WLAN All functions of a cable bound network are also available in a Wireless LAN access to files servers printers etc is as possible as the connection of indi vidual stations to an internal mail system or to the Internet access 1 2 What do you need for a Wireless LAN The obvious advantages of the Wireless LANs raise questions abou...

Page 8: ...ne hand the ad hoc network peer to peer on the other the infrastructure network access point 1 3 Operation modes We take now a separate look at both operation modes 1 3 1 Ad hoc network In ad hoc networks you connect two or more PCs with own wireless inter faces directly together to build a Wireless LAN All stations in this wireless LAN are able to communicate between each other without any furthe...

Page 9: ...structure network A Wireless LAN with one or more base stations is generally called a peer to LAN network In Wireless LAN terminology this network topology is referred to as an infrastructure network Depending on its product type LAN COM Wireless base stations contain integrated routers for the connection with ISDN or DSL Via the integrated routing function the linked stations get thus access to I...

Page 10: ... GHz with up to 54 Mbps maximum transfer rate The real throughput depends however on the distance and or on the quality of the connection With increasing distance and diminishing connect ing quality the transmission rate lowers to 48 Mbps afterwards to 36 Mbps etc up to a minimum of 6 Mbps The distance of transmission ranges from up to 125 m in open expanses in buildings typically up to 25 m The I...

Page 11: ... insensitive to narrow band disturbances then This procedure is also used in military range for increasing tap proof security IEEE 802 11g 54 Mbps The IEEE 802 11g standard works likewise with up to 54 Mbps data transmis sion rate in the 2 4 GHz frequency band Contrary to IEEE 802 11b the OFDM modulation is used for IEEE 802 11g like already introduced for IEEE 802 11a IEEE 802 11g contains a spec...

Page 12: ...al band PCI adapter according to IEEE 802 11a up to 54 Mbps data tranfer rate into 5 GHz frequency band or IEEE 802 11g up to 54 Mbps data tranfer rate into 2 4 GHz frequency band backward compatible to IEEE 802 11b for installation in a stationary desktop PC You find an external dual band antenna enclosed with the product 1 5 1 Encryption in three security steps Several countries regulate the ope...

Page 13: ...owing two chapters you will find detailed descriptions and installa tion instructions for the AirLancer variants Each AirLancer type has got its own chapter You may advance straight forward to your model s chapter AirLancer MC 54 chapter 2 on page 15 AirLancer PCI 54 chapter 3 on page 19 The remaining parts of the documentation from chapter 4 upwards are valid for all AirLancer again ...

Page 14: ...Introduction AirLancer 14 EN ...

Page 15: ...network with up to 54 Mbps can be made with the IEEE 802 11g or IEEE 802 11a standard while on journeys the compatibility to public hot spots is ensured with up to 11 Mbps transfer rate according to IEEE 802 11b AirLancer MC 54g complies to the IEEE 802 11g standard with up to 54 Mbps data transfer rate as well as to the 11 Mbps IEEE 802 11b standard 2 2 Package contents Please check the package c...

Page 16: ...s place in four steps a Check the system preconditions b Put the AirLancer MC 54 into your PC c Driver installation d Setting up for accessing the Wireless LAN you will find the instruction for this configuration step in chapter 4 The AirLancer Client Manager on page 23 2 4 1 Checking the system preconditions You should check before installing whether your device fulfills all necessary system prec...

Page 17: ...e with the series number label downwards 2 4 3 Driver installation for AirLancer MC 54 In the course of the plug play hardware identification of Windows ME Win dows 98 SE Windows XP and Windows 2000 you will see that your compu ter identifies the new hardware automatically just a short time after insertion of the card Please follow the instructions of the hardware installation wizard and point to ...

Page 18: ...AirLancer MC 54 AirLancer 18 EN ...

Page 19: ...ard with up to 54 Mbps in the 2 4 GHz frequency band AirLancer PCI 54ag is additionally backward compatible to the IEEE 802 11b standard Optimum transfer results are achieved due to the enclosed external antenna which is suitable for ope ration in 2 4 GHz as well as in 5 GHz bands 3 2 Package contents Please check the package contents for completeness before starting The package should contain the...

Page 20: ...kes place in five steps a Checking the system preconditions b Hardware installation of the AirLancer PCI 54 c Connection of the external antenna d Driver installation e Settings for access to the Wireless LAN you will find the instruction for this configuration in chapter 4 The AirLancer Client Manager on page 23 3 4 1 Checking the system preconditions You should check before installing whether yo...

Page 21: ...tal casing of the computer briefly Then pull out the power plug on the back of the PC casing c Loose the screws and lockings of the computer casing and remove the casing cover d One free PCI slot is needed for the AirLancer PCI 54 Remove the assem bly sheet of the slot before installing the card Avoid if possible installing the PCI card into the first PCI slot in case your PC is equipped with an A...

Page 22: ...ing systems will install automatically the necessary drivers for AirLancer PCI 54 after starting 3 4 3 Driver installation for AirLancer PCI 54 In the course of the plug play hardware identification of Windows ME Win dows 98 SE Windows XP and Windows 2000 you will see that your compu ter identifies the new hardware automatically Please follow the instructions of the hardware installation wizard an...

Page 23: ...en running the AirLancer Client Manager under Windows XP the integrated configuration software of the operating system has to be deactivated in any case To do so open under Settings Control Panel the Network connections Click with your right mouse button on Wireless network connection and select Properties Deactivate the software on the index card Wireless networks Under Windows 98 SE the WMI Inte...

Page 24: ...ms LANCOM AirLancer 54 Cli ent Tools The AirLancer Client Manager will appear on the task bar then To launch the AirLancer Client Manager or its help function just click with the right mouse botton on the AirLancer Client Manager quickstart icon and sel ect the desired function 4 2 Basic configuration The basic configuration will demonstrate you how to connect your AirLancer client adapter to your...

Page 25: ...es SSID The network name must correspond to all other devices of the same net work base stations or radio cards You can enter ANY as network name if you have a base station in reach with the Closed Network function switched off As a result the radio station will join the next available Wireless LAN You can find further information in section Closed net work on page 37 and in the documentation of y...

Page 26: ...cryption Select Pre Shared Keys for static WEP keys To define one or more keys select Configure Define first the entry method of the keys Key Entry Method Enter now one or more keys in your selected method ASCII or hexadecimal and select the kind of WEP WEP64 WEP128 or WEP152 in the field behind Select the key to use via the radio button in front Please notice that only one key at a time can be ac...

Page 27: ...es Changing to another profile 4 3 2 Configuration You can configure installed profiles in the AirLancer Client Manager under Profile Management and activate them with the command Activate For ad hoc networks you have to enter network name radio channel and WEP key Ad hoc networks are only possible in the 2 4 GHz frequency band using IEEE 802 11g and IEEE 802 11b Ad hoc networks are not available ...

Page 28: ...tion to the following gene ral information You have to use exactly matching keys between all involved devices All devices use a common key within ad hoc networks In infrastructure net works the key between base station and its radio stations must match Different key lengths cannot be used simultaneously on a base station In order to giving users with WEP64 devices encrypted access to a base sta ti...

Page 29: ...manufacturer which your AirLancer accepts without any problem In such a case it is advisable to use the key of the more inflexible device for the connection 4 4 3 Sliding key change For infrastructure networks you can enter up to four keys into the key list of a base station A simple exchange of the keys is facilitated this way In this case the base station accepts each one of the up to four enter...

Page 30: ...The AirLancer Client Manager AirLancer 30 EN ...

Page 31: ...Since they are out of the office most time anyway their new workplaces are not wired anymore Instead a Wireless LAN access point enables to access the corporate Intranet services e g LANCOM 3550 Wireless Since the sales representatives with their notebooks must have access to the network also in other departments of the company further base stations will be installed These ensure that a sales repr...

Page 32: ...e radio network It is registered in the AirLancer Client Manager You have the possibility to store own profiles for different Wireless LANs in the AirLancer Client Manager If you use your notebook both in the office and at home you could create two profiles a profile Work for the office and a profile Home for at home If you want to work in the evenings or during the weekend at home then just switc...

Page 33: ...tionally needed in Novell networks only Information regarding configuration of base stations can be found in the doc umentation of your LANCOM Wireless base station and in the electronical documentation of your CD Access to LAN After installing the radio network cards all functions and services are availa ble for the sales representatives with their notebooks which were also offe red to the deskto...

Page 34: ...Configuration example AirLancer 34 EN ...

Page 35: ...is possible to install a second radio cell for extension of the wireless net work for parallel operation of different radio standards simply by inserting a AirLancer MC 54 into the cardbus slot of a base station of the LANCOM 3000 Wireless series For example a single device can serve radio network clients with different standards simultaneously then Please ensure that your LANCOM 3000 Wireless bas...

Page 36: ... base station AirLancer 36 EN the it Remove now carefully the blind slide in module of the external cardbus slot Slip in now the AirLancer MC 54 card into the cardbus slot and restart your device by plugging the power supply cable in again ...

Page 37: ...ets access to this network Such networks are called open networks Any user can access an open network also without knowledge of its network name Only requirement is the input of the network name ANY In a closed network the access via ANY is not possible User have to specify the correct network name Unknown networks stay hidden to them Ad hoc networks are automatically installed as closed networks ...

Page 38: ...40 104 or 128 bit 7 3 1 WEP functionality WEP encrypts data frames on level 2 of the OSI model Thus data frames of higher protocols in particular IP packets are automatically protected by WEP WEP uses the well known RC4 algorithm of the american cryptography spe cialist RSA Data Security for encryption Several variants with different key lengths are available WEP64 The nominal key length is 64 bit...

Page 39: ...e networks you have the possibility to change keys smoothly see Sliding key change on page 29 Change a key immediately in case of suspicion It is time to change the key of the Wireless LAN if an employee with access to a key leaves your company The key should also be renewed in case of smallest suspicion of a leak 7 3 3 The ways you can increase the security additionally With WEP it will be diffic...

Page 40: ...es the protec tion efforts of WEP In Windows XP the IEEE 802 1x technology is already integrated by default For other operating systems 802 1x client software is available 7 5 IPSec over WLAN By means of IPSec over WLAN a radio network can be optimally secured in addition to the already introduced securing mechanisms In order to run IPSec over WLAN you have to upgrade the base stations of the LANC...

Page 41: ...llback to 48 36 24 18 12 9 6 Mbps or 11 Mbps fallback to 5 5 2 1 Mbps Transmission power up to 16 dBm with TPC Transmission Power Control Range Up to 25m in closed areas up to 125m with direct sight connection Transfer channels Up to 11 channels max 3 non overlapping 2 4 GHz band or up to 19 non overlapping channels 5 GHz band with DFS MC 54ag only Up to 11 channels max 3 non overlapping 2 4 GHz b...

Page 42: ...ing The following overview shows which channels are supported by the different regions EU WORLD Frequency range 2400 2500 MHz Channel No EU ETSI WORLD ETSI FCC 1 2412 2412 2 2417 2417 3 2422 2422 4 2427 2427 5 2432 2432 6 2437 2437 7 2442 2442 8 2447 2447 9 2452 2452 10 2457 2457 11 2462 2462 12 2467 13 2472 Bold values indicate the default setting of the AirLancer radio adapters when utilized in ...

Page 43: ...CC US 36 5 180 GHz yes yes 40 5 200 GHz yes yes 44 5 220 GHz yes yes 48 5 240 GHz yes yes 52 5 260 GHz yes yes 56 5 280 GHz yes yes 60 5 300 GHz yes yes 64 5 320 GHz yes yes 100 5 500 GHz yes no 104 5 520 GHz yes no 108 5 540 GHz yes no 112 5 560 GHz yes no 116 5 580 GHz yes no 120 5 600 GHz yes no 124 5 620 GHz yes no 128 5 640 GHz yes no 132 5 660 GHz yes no 136 5 680 GHz yes no 140 5 700 GHz ye...

Page 44: ...FS only the lower and the middle frequency range may be used in the 5 GHz band The use in open terrain is forbidden in both fre quency bands The use in the 2 4 GHz frequency band is subject to authoriza tion Detailed information under http www art telecom fr eng index htm Germany When using TPC and DFS all three frequency ranges may be used in the 5 GHz band Detailed information under http www reg...

Page 45: ...iled information under http www etat lu ILR content html Netherlands In the 5 GHz band all three frequency ranges may be used The use in the 2 4 GHz frequency band is permitted in closed environments but forbidden in free areas Detailed information under http www egentschaptelekom nl Norway When using TPC and DFS all three frequency ranges may be used in the 5 GHz band Detailed information under h...

Page 46: ...Lancer 46 EN 8 4 Declaration of conformity 8 4 1 European Union CE The CE declarations of conformity for AirLancer MC 54 and AirLancer PCI 54 are available for download on the LANCOM Systems web site www lan com de ...

Page 47: ... Appendix 47 AirLancer EN ...

Reviews: