Copyright © 2004-2005, Vivato, Inc.
94
Recommendations
IEEE 802.1x mode is a better choice than Static WEP because keys are dynamically generated and
changed periodically. However, the encryption algorithm used is the same as that of Static WEP and is
therefore not as reliable as the more advanced encryption methods such as
) used
in
Wi-Fi Protected Access
Additionally, compatibility issues may be cumbersome because of the variety of authentication methods
supported and the lack of a standard implementation method.
Therefore, IEEE 802.1x mode is not as secure a solution as
Wi-Fi Protected Access
(
use
because some of your client stations do not have WPA, then a better solution than using IEEE
802.1x mode is to
use WPA with RADIUS mode instead and check the "Allow non-WPA IEEE 802.1x
clients" checkbox
to allow non-WPA clients. This way, you get the benefit of IEEE 802.1x key
management for non-WPA clients along with even better data protection of TKIP and CCMP (AES) key
management and encryption algorithms for your WPA clients.
If you have an external
RADIUS
server on your network, we recommend using it rather than the using the
embedded RADIUS server on the VA4200. An external RADIUS server will provide better security than the
local authentication server.
For information on how to configure IEEE 802.1x security mode, see “IEEE 802.1x” on page 102 under
“Configuring Security Settings” on page 97.
When to Use WPA with RADIUS
Wi-Fi Protected Access
(
) with
Remote Authentication Dial-In User Service
) is a Wi-Fi
Alliance subset of IEEE
, which includes
Temporal Key Integrity Protocol
),
Counter mode/
CBC-MAC Protocol
(
), and
Advanced Encryption Standard
(
) mechanisms. This mode requires
the use of a RADIUS server to authenticate users. WPA with RADIUS provides the best security available
for wireless networks.
Key Management
Encryption Algorithm
User Authentication
IEEE 802.1x provides dynamically-
generated keys that are periodically
refreshed.
There are different
keys for
each station.
An
stream cipher is used to
encrypt the frame body and
cyclic
redundancy checking
(CRC) of each
802.11 frame.
IEEE 802.1x mode supports a vari-
ety of authentication methods, like
certificates, Kerberos, and public
key authentication with a RADIUS
server.
You have a choice of using the
Vivato Wi-Fi AP/Bridge embedded
RADIUS server or an external
RADIUS server. The embedded
RADIUS server supports Protected
(PEAP) and MSCHAP V2.
