Cisco 7920 - Unified Wireless IP Phone VoIP, Руководство администратора

Страница: 47 / 238

2-13
Cisco Wireless IP Phone 7920 Administration Guide for Cisco CallManager Release 4.0 and 4.1
OL-7104-01
Chapter 2 An Overview of the Wireless Network
Components of the VoIP Wireless Network
Security Mechanisms in the Wireless Network
Before a wireless device can communicate on the network, it must authenticate
with the access point or the network by using an authentication method. The
Cisco Wireless IP Phone 7920 can use these authentication methods in the
WLAN:
•
Open Authentication—In an Open system, any wireless device can request
authentication. The access point that receives the request may grant
authentication to any requestor or only to requestors on a list of users.
Communication between the wireless device and access point could be
non-encrypted or devices can use WEP keys to provide security. Devices that
are using WEP only attempt to authenticate with an access point that is using
WEP.
• Shared Key Authentication—During shared key authentication, the access
point sends an unencrypted challenge text string to any device attempting to
communicate with the access point. The device that is requesting
authentication encrypts the challenge text using a pre-configured WEP key
and sends it back to the access point. If the challenge text is encrypted
correctly, the access point allows the requesting device to authenticate. A
device can authenticate only if its WEP keys match the WEP keys on the
access points.
Shared key authentication can be less secure than open authentication with
WEP because someone can monitor the challenges. An intruder can calculate
the WEP key by comparing the unencrypted and encrypted challenge text
strings.
•
WPA Pre-Shared Key (PSK) Authentication—The access point and the phone
are configured with the same authentication key. The pre-shared key (or
password phrase) is used to create unique pair-wise keys that are exchanged
between each phone and the access point. You can configure the password
phrase as a 64-character hexadecimal string or as an ASCII password of from
8 to 63 characters in length. Because the pre-shared key password is stored
on the phone, it can be compromised if the phone is lost or stolen.
•
LEAP Authentication—For maximum security, client devices can
authenticate to the network by using a Remote Authentication Dial-in User
Service (RADIUS) server such as the Cisco Access Control Server (ACS).