Motorola WiNG 5, Справочное руководство системы

Страница: 375 / 802

Wireless Configuration 6 - 27
6. Select OK when completed to update the WLAN’s WEP 128 encryption configuration. Select Reset to revert the screen
back to its last saved configuration.
WEP 128 and Keyguard Deployment Considerations

WEP 128 and KeyGuard
Before defining a WEP 128 supported configuration on a WLAN, refer to the following deployment guidelines to ensure
the configuration is optimally effective:
• Motorola Solutions Solutions recommends additional layers of security (beyond WEP) be enabled to minimize the
likelihood of data loss and security breaches. WEP enabled WLANs should be mapped to an isolated VLAN with
Firewall policies restricting access to hosts and suspicious network applications.
• WEP enabled WLANs should only be permitted access to resources required by legacy devices.
• KeyGuard is not supported on AP-6511 model access points.
• If WEP support is needed for WLAN legacy device support, 802.1X EAP authentication should be also configured in
order for the WLAN to provide authentication and dynamic key derivation and rotation.
6.1.3 Configuring WLAN Firewall Support

Wireless LANs
A Firewall is a mechanism enforcing access control, and is considered a first line of defense in protecting proprietary
information within an access point managed WLAN. The means by which this is accomplished varies, but in principle, a
Firewall can be thought of as mechanisms both blocking and permitting data traffic. For a Firewall overview, see
Wireless
Firewall on page 8-2 .
WLANs use Firewalls like Access Control Lists (ACLs) to filter/mark packets based on the WLAN from which they arrive,
as opposed to filtering packets on Layer 2 ports. An ACL contains an ordered list of Access Control Entries (ACEs). Each
ACE specifies an action and a set of conditions (rules) a packet must satisfy to match the ACE. The order of conditions in
the list is critical because the wireless controller stops testing conditions after the first match.
IP based Firewall rules are specific to source and destination IP addresses and the unique rules and precedence orders
assigned. Both IP and non-IP traffic on the same Layer 2 interface can be filtered by applying both an IP ACL and a MAC
A MAC Firewall rule uses source and destination MAC addresses for matching operations, where the result is a typical
allow, deny or mark designation to WLAN packet traffic.
Keep in mind IP and non-IP traffic on the same Layer 2 interface can be filtered by applying both an IP ACL and a MAC ACL
to the interface.
To review existing Firewall configurations, create a new Firewall configuration or edit the properties of a WLAN’s existing
Firewall:
1. Select Configuration > Wireless LANs > Wireless LANs to display a high-level display of the existing WLANs.
2. Select the Add button to create a new WLAN or Edit to modify the properties of an existing wireless controller WLAN.
3. Select Firewall from the WLAN options.