Cisco HWIC, Руководство по настройке

Страница: 91 / 188

6-3
Cisco Wireless ISR and HWIC Access Point Configuration Guide
OL-6415-04
Chapter 6 Configuring Authentication Types
Understand Authentication Types
Figure 6-1 Sequence for Open Authentication
Shared Key Authentication to Access Point
Cisco provides shared key authentication to comply with the IEEE 802.11b standard. However, because
of shared key’s security flaws, Cisco recommends that you avoid using it.
During shared key authentication, the access point sends an unencrypted challenge text string to any
device attempting to communicate with the access point. The device requesting authentication encrypts
the challenge text and sends it back to the access point. If the challenge text is encrypted correctly, the
access point allows the requesting device to authenticate. Both the unencrypted challenge and the
encrypted challenge can be monitored, however, which leaves the access point open to attack from an
intruder who calculates the WEP key by comparing the unencrypted and encrypted text strings. Because
of this weakness, shared key authentication can be less secure than open authentication. Like open
authentication, shared key authentication does not rely on a RADIUS server on your network.
Figure 6-2 shows the authentication sequence between a device trying to authenticate and an access point
using shared key authentication. In this example the device’s WEP key matches the access point’s key,
so it can authenticate and communicate.
Figure 6-2 Sequence for Shared Key Authentication
Acce ss point
or bridge
with WEP key = 12 3
Client device
with WEP key = 3 21
1. Authentication reque s t
2. Authentication re s pon s e
4. A ss ociation re s pon s e
6. Key mi s match, frame di s carded
3 . A ss ociation reque s t
5. WEP data frame to wired network
5458
3
Access point
or b ridge
Wired LAN
Client
device
Server
1. A u thentic a tion re qu est
2. A u thentic a tion s u ccess
3. Associ a tion re qu est
4. Associ a tion response
( b lock tr a ffic from client)
5. A u thentic a tion re qu est
6. S u ccess
7. Access point or b ridge u n b locks
tr a ffic from client
655
8
4