Security. Olga Torstensson Halmstad University. 2003, Cisco Systems, Inc. All rights reserved. FWL

Size: px

Start display at page:

Ira Waters
7 years ago
Views:

1 Security Olga Torstensson Halmstad University 2003, Cisco Systems, Inc. All rights reserved. FWL Key terms WEP TKIP MIC EAP 802.1X WPA CCKM RADIUS SSH Encryption RSA RC4 (WEP) DES, 3DES, AES Cipher BKR 2003, Cisco Systems, Inc. All rights reserved. FWL

2 Advanced Security Terms WEP Wired Equivalent Privacy EAP Extensible Authentication Protocol TKIP Temporal Key Integrity Protocol CKIP Cisco Key Integrity Protocol CMIC Cisco Message Integrity Check Broadcast Key Rotation Group Key Update WPA Wi-Fi Protected Access (WPA) 2003, Cisco Systems, Inc. All rights reserved. FWL Security Fundamentals Balancing Security and Access 2003, Cisco Systems, Inc. All rights reserved. FWL

3 Vulnerabilities Technology TCP/IP WEP and Broadcast SSID Association Process Wireless Interference Configuration Default passwords Unneeded Services enabled Few or no filters Poor device maintenance Policy Weak Security Policy No Security Policy Poorly enforced Policy Physical Access Poor or no monitoring 2003, Cisco Systems, Inc. All rights reserved. FWL Threats Internal External Structured Unstructured 2003, Cisco Systems, Inc. All rights reserved. FWL

5 WLAN Security Wheel Always have a good WLAN Security Policy in place. Secure the network based on the policy 2003, Cisco Systems, Inc. All rights reserved. FWL WLAN Security Considerations Authentication only authorized users and devices should be allowed. Encryption traffic should be protected from unauthorized access. Administration Security only authorized users should be able to access and configure the AP configuration interfaces. 2003, Cisco Systems, Inc. All rights reserved. FWL

6 Common Protocols which use Encryption When using a public network such as a WLAN, FTP, HTTP, POP3, and SMTP are insecure and should be avoided whenever possible. Utilize protocols with encryption. Traffic No Encryption Encryption Web Browsing HTTP HTTPS * File Transfer Remote Mgmt TFTP or FTP SCP POP3 or SMTP SPOP3 * Telnet SSH * SSL/TLS 2003, Cisco Systems, Inc. All rights reserved. FWL WLAN Security Hierarchy Open Access No Encryption, Basic Authentication Basic Security 40-bit or 128-bit Static WEP Encryption Enhanced Security 802.1x, TKIP/WPA Encryption, Mutual Authentication, Scalable Key Mgmt., etc. Public Hotspots Home Use Business Remote Access Virtual Private Network (VPN) Business Traveler, Telecommuter 2003, Cisco Systems, Inc. All rights reserved. FWL

7 Basic WLAN Security Admin Authentication on AP To prevent unauthorized access to the AP configuration interfaces: Configure a secret password for the privileged mode access. (good) Configure local usernames/passwords. (better) Configure AP to utilize a security server for user access. (best) 2003, Cisco Systems, Inc. All rights reserved. FWL User Manager 2003, Cisco Systems, Inc. All rights reserved. FWL

11 WEP WEP is a key. WEP scrambles communications between AP and client. AP and client must use same WEP keys. WEP keys encrypt unicast and multicast. WEP is easily attacked 2003, Cisco Systems, Inc. All rights reserved. FWL Supported Devices What can be a client? Client Non-Root bridge Repeater access point Workgroup Bridge Authenticator? Root access point Root bridge? 2003, Cisco Systems, Inc. All rights reserved. FWL

13 WEP Encryption Keys 2003, Cisco Systems, Inc. All rights reserved. FWL Enterprise WLAN Authentication Authentication Types Open Authentication to the Access Point Shared Key Authentication to the Access Point EAP Authentication to the Network MAC Address Authentication to the Network Combining MAC-Based, EAP, and Open Authentication Using CCKM for Authenticated Clients Using WPA Key Management 2003, Cisco Systems, Inc. All rights reserved. FWL

14 WLAN Security: 802.1X Authentication Mutual Authentication EAP-TLS EAP-Transport Layer Security Mutual Authentication implementation Used in WPA interoperability testing Radius Server LEAP Lightweight EAP Nearly all major OS s supported: WinXP/2K/NT/ME/98/95/CE, Linux, Mac, DOS PEAP Protected EAP Uses certificates or One Time Passwords (OTP) Supported by Cisco, Microsoft, & RSA GTC (Cisco) & MSCHAPv2 (Microsoft) versions AP Client 2003, Cisco Systems, Inc. All rights reserved. FWL EAP Extensible Authentication Protocol (802.1x authentication) Provides dynamic WEP keys to user devices. Dynamic is more secure, since it changes. Harder for intruders to hack by the time they have performed the calculation to learn the key, they key has changed! 2003, Cisco Systems, Inc. All rights reserved. FWL

15 Basic RADIUS Topology RADIUS can be implemented: Locally on an IOS AP Up to 50 users On a ACS Server 2003, Cisco Systems, Inc. All rights reserved. FWL Local Radius Server 2003, Cisco Systems, Inc. All rights reserved. FWL

17 ACS Server Options Cisco Secure ACS Software Cisco ACS Solution Engine 2003, Cisco Systems, Inc. All rights reserved. FWL Backup Security Server Manager 2003, Cisco Systems, Inc. All rights reserved. FWL

19 Cipher Suite Cipher suites are sets of encryption and integrity algorithms. Suites provide protection of WEP and allow use of authenticated key management. Suites with TKIP provide best security. Must use a cipher suite to enable: WPA Wi-Fi Protected Access CCKM Cisco Centralized Key Management 2003, Cisco Systems, Inc. All rights reserved. FWL Configuring the Suite Create WEP keys Enable Cipher Suite and WEP Configure Broadcast Key Rotation Follow the Rules 2003, Cisco Systems, Inc. All rights reserved. FWL

20 WEP Key Restrictions Security Configuration WEP Restriction CCKM or WPA key mgt. No WEP in slot 1 LEAP or EAP No WEP in slot 4 40-bit WEP No 128-bit key 128-bit WEP No 40-bit key TKIP No WEP keys TKIP and 40 or 128 WEP No WEP in slot 1 and 4 Static WEP w/mic or CMIC Broadcast key rotation WEP and slots must match on AP & client Keys in slots 2 & 3 overwritten 2003, Cisco Systems, Inc. All rights reserved. FWL Security Levels 2003, Cisco Systems, Inc. All rights reserved. FWL

21 Enterprise WLAN Security Evolution TKIP/WPA Successor to WEP Cisco s pre-standard TKIP has been shipping since Dec. 01 Cisco introduced TKIP into i committee i-standardized TKIP part of Wi-Fi Protected Access (WPA) WPA software upgrade now available for AP1100 & AP1200 AES The Gold Standard of encryption AES is part of i standard - AES will be part of WPA2 standard (expected in 2004) 2003, Cisco Systems, Inc. All rights reserved. FWL Encryption Modes 2003, Cisco Systems, Inc. All rights reserved. FWL

27 VLANs Configuring your access point to support VLANs is a three-step process: Assign SSIDs to VLANs. Assign authentication settings to SSIDs. Enable the VLAN on the radio and Ethernet ports. 2003, Cisco Systems, Inc. All rights reserved. FWL Using VLANs for Security 802.1Q wired network w/ VLANs AP Channel: 6 SSID data = VLAN 1 SSID voice = VLAN 2 SSID visitor = VLAN 3 SSID: data Security: PEAP + AES SSID: voice Security: LEAP + WPA SSID: visitor Security: None 2003, Cisco Systems, Inc. All rights reserved. FWL

Configure WorkGroup Bridge on the WAP131 Access Point

Article ID: 5036 Configure WorkGroup Bridge on the WAP131 Access Point Objective The Workgroup Bridge feature enables the Wireless Access Point (WAP) to bridge traffic between a remote client and the wireless