LANCOM L
-
300 Access Point Serie
Chapter 4: Security settings
46
EN
4.1.2
Access control by MAC address
Every network device has a unique identification number. This identification
number is known as the MAC address (
M
edia
A
ccess
C
ontrol) and it is unique
worldwide.
The MAC address is programmed into the hardware. Wireless LAN devices
from LANCOM Systems display their MAC number on the housing.
Access to an infrastructure network can be limited to certain wireless LAN
devices by defining MAC addresses. The access points have filter lists in (ACL
– access control list) for storing authorized MAC addresses.
4.1.3
LANCOM Enhanced Passphrase Security
With LEPS (
L
ANCOM
E
nhanced
P
assphrase
S
ecurity), LANCOM Systems has
developed an efficient method that makes use of the simple configuration of
IEEE 802.11i with passphrase, but that avoids the potential error sources in
passphrase distribution. LEPS uses an additional column in the ACL to assign
an individual passphrase consisting of any 4 to 64 ASCII characters to each
MAC address. The connection to the access point and the subsequent encryp-
tion with IEEE 802.11i or WPA is only possible with the right combination of
passphrase and MAC address.
LEPS can be used locally in the device and can also be centrally managed with
the help of a RADIUS server, and it works with all WLAN client adapters cur-
rently available on the market without modification. Full compatibility to
third-party products is assured as LEPS only involves configuration in the
access point.
An additional security aspect: LEPS can also be used to secure single point-
to-point (P2P) connections with an individual passphrase. Even if an access
point in a P2P installation is stolen and the passphrase and MAC address
become known, all other WLAN connections secured by LEPS remain protec-
ted, particularly when the ACL is stored on a RADIUS server.
Guest access with LEPS:
LEPS can also be set up to allow access to
guests. To this end, all users of the internal WLAN network are given
individual passphrases. Guests can make use of their own dedicated
SSID and a global passphrase. To avoid abuse, the this global pass-
phrase can be changed on a regular basis—every few days, for
example.
