Rapid Deployment of Cisco Aironet Wireless Local Area Networks in Temporary Facilities for Disaster Recovery Projects goes here

Transcription

1 APPLICATION NOTE Rapid Deployment of Cisco Aironet Wireless Local Area Networks in Temporary Facilities for Disaster Recovery Projects goes here Wireless Local Area Networks (WLANs) are an ideal means of rapidly deploying broadband network access. WLANs provide up to 11Mbps of shared data rate and can be considered to be roughly analogous to shared 10Mbps Ethernet from a performance and provisioning perspective. With WLANs radio waves take the place of cables, acting as the transmission medium or physical layer. The purpose of this application note is to provide individuals with limited experience with WLAN technology with the ability to quickly set up a wireless infrastructure in temporary facilities consistent with disaster recovery procedures. In addition to this document, the installer should review at minimum the Quick Start Guides provided with all Cisco Aironet equipment and have available the Software and Hardware Configuration Guides provided on CD-ROM with the products. The architecture described here is designed to strike a balance between ease of deployment and optimal network operation. Additional documentation and technical assistance is available to fine tune the WLAN as time and resources allow. Parts List for Product Referenced in this Application Note Part Number AIR-AP352E2C AIR-PCM352 AIR-WGB352C Description 350 Series Access Point with Captured Diversity Antennas and 128-bit WEP 350 Series PC Card with Integrated Diversity Antenna and 128-bit WEP 350 Series Workgroup Bridge with Captured Antenna and 128-bit WEP A wireless LAN consists of infrastructure devices called Access Points (APs) which are conceptually similar to Ethernet hubs in that they provide a shared broadband medium using a media access protocol quite similar to Ethernet. Wireless LAN adapters are similar to Ethernet adapters. This application note Page 1 of 9

2 will discuss PC Card (PCMCIA) WLAN adapters for laptop and notebook computers. Cisco Aironet WLAN PCMCIA adapters support most popular operating systems including the whole family of Microsoft Windows operating systems. For desktop systems, and in keeping with the rapid deployment goals of this document, a WLAN Workgroup Bridge is discussed. The Workgroup Bridge is also ideal for wirelessly enabling Ethernet-equipped network printers. This device provides a single standard Ethernet port as a downlink but will support up to eight MAC addresses. By connecting the Workgroup Bridge to a standard Ethernet hub, this device will provide for WLAN access to up to eight Ethernet-equipped desktop computers or printers. Desktop systems need not be opened for adapter installation and no additional driver support is required on the host desktop computer. This document will discuss the deployment and configuration of the WLAN infrastructure as well as the installation of Client Adapters for host systems. The end goal is communication between the clients and the infrastructure with an acceptable level of performance for standard office applications and a reasonable level of security. In addition to this document, one should additionally review the Quick Start Guides provided with each Cisco Aironet product which, in addition to this document, should provide the installer with all the information required to set up a WLAN consistent with the goal of this document. For more in depth information one should, time permitting, consult the Software and Hardware Configuration Guides provided with the products. Access Point Deployment The Cisco Aironet 350 Series Access Points advocated for this architecture carry the part number AIR-AP352E2C. This Access Point communicates with clients (downlink) over radio waves and with the network (uplink) via a standard 10/100BASE-T RJ-45 jack. One can define the Access Point both as a wireless hub as well as an IEEE Ethernet to IEEE b wireless LAN bridge. This Access Point is powered via the 10/100Mbps Ethernet jack on the unit. These Access Points may therefore be powered by a Cisco line power enabled switch such as the Catalyst Page 2 of 9

3 If a line powered switch is not available, each unit comes complete with a single port power injector that introduces operating current onto the Ethernet line. This single port injector may be located with the non-line power enabled switch and share a common power source or my be located with the Access Point and share, for example, the power source for the client devices. In either scenario, the power injector comes with the required patch cable and power adapter. After the Access Point is connected to the wired network and powered up, it will acquire an IP address from a valid BootP or DHCP server or, in the absence of such a server, may be configured with a static IP address (consult Access Point documentation for detail). The Access Point will then begin sending out beacons over the radio waves, advertising its availability for association (connection) with wireless clients. The installer is well advised at this point to verify that the Access Point is operational. For this, the installer should install a wireless Client Adapter in a host computer and bring that client within close proximity to the Access Point. The Aironet Client Utility (ACU) that is installed on the host computer during the installation process will display the Access Point to which the client is associated. This association will verify that the Access Point is operational. Detailed installation instructions for Client Adapters are provided in the Quick Start Guide provided with each Client Adapter and should be reviewed prior to and during the Client Adapter installation process. Page 3 of 9

4 This Access Point comes equipped with two dipole antennas, which provide for an omni-directional coverage pattern. No additional antennas are required. This omnidirectional coverage pattern can be envisioned as being essentially the shape of a doughnut with the Access Point being in the doughnut hole at the center. In a relatively open office environment and transmitting at the maximum 11Mbps data rate, the radius of coverage is approximately 130 feet. As users range beyond the 11Mbps coverage area, they do not lose connection. Rather, the data rate is automatically decreased (factory default setting) from 11Mbps to 5.5, 2 and finally 1Mbps. When a user goes beyond the 1Mbps coverage area, connection is lost. This document strongly advocates an architecture such that all users are within an 11mbps coverage area. These distances will increase or decrease depending upon a number of factors. In general, the more open the space, the greater the coverage radius. Radio waves will, of course, propagate through walls with the thickness and material of these walls dictating the degree to which the coverage is decreased. Cube walls provide little degradation, cement walls significantly more. Walls, ceilings and floors with a high metallic content like reinforced concrete or large metal objects like file cabinets act as reflectors which cause unpredictable coverage areas or for the signal to actually echo (referred to as multipath propagation). Where possible, one should avoid Access Point placement near reflective sources. Given the coverage pattern described above, one must place the Access Point such that the antennas are perpendicular to the ground. Placement on the ceiling tends to be best, but placement on a table or cubetop is acceptable. At an 11mbps data rate, the actual aggregate throughput is approximately 6Mbps depending upon packet size mix. It is therefore advocated that the WLAN be configured such that each Access Point associate with approximately 20 users thereby providing each user with an average of approximately 300Kbps of throughput, which is understood to be sufficient for most office applications. With WLANs, one provisions the collision domain by managing the size of the coverage area: to decrease the number of users in the collision domain and increase average per user throughput, decrease the coverage area. The size of the coverage area can be adjusted with Cisco Aironet products by reducing the transmit power of the Access Point in much the same way as a dimmer switch controls the coverage area provided by a light. In temporary offices with a relatively high density of users, the maximum coverage area provided by the Access Point will be more than sufficient to cover the desired number of users. Although the Access Points provide for a variety of transmit power settings, for the purposes of this document the following recommended transmit powers and associated coverage radii are provided below: Page 4 of 9

5 Transmit Power Approximate Coverage Radius Cell Sizing 100 mw, default and max setting 130 feet Large Cells, low user density 30 mw 100 feet Medium Cells, medium user density 1 mw 20 feet Small Cells, low user density One should select the transmit power and associated coverage radius based upon the density of users (the number of users that will be within the coverage area) and the desired number of users covered by each Access Point (and therefore the number of users in the shared collision domain). One should tune the coverage area such that it minimizes coverage beyond the desired number of users. The reasons for this are elaborated in the channel selection section below. To verify the coverage area in the facility, a laptop client equipped with a WLAN adapter as per the above is very useful. The Site Survey Utility located in the Commands menu in ACU will display the data rate for the association. By moving the client device progressively further away from the Access Point, one will gain empirical data as to the actual coverage area provided by the Access Point which is very useful when adjusting the transmit power to achieve the desired actual coverage area provided. Channel Selection Cisco Wireless LAN products operate in the 2.4GHz unlicensed portion of the radio frequency spectrum, no licensing is required. This band is approximately 83MHz wide, which is divided into three non-overlapping channels. In instances where Access Points are on the same channel and where there coverage areas overlap, the Access Points will perceive the traffic from the overlapping device as being interference which will degrade performance in the same way as any other source of interference in the 2.4GHz area will, e.g. 2.4GHz cordless telephones, microwave ovens and Bluetooth devices. Therefore, one should 1) avoid the collocation of the interfering devices listed above with the wireless LAN and 2) architect the WLAN such that it minimizes the adjacency of Access Points on the same channel. These three non-overlapping channels are designated as being channels 1, 6 and 11 with channel 6 being the factory default channel for Cisco Aironet Access Points. Below follows a diagram that illustrates one approach to Access Point (AP) placement and channel reuse that will minimize interference. AP7 AP8 AP9 Page 5 of 9

6 [Channel 6] [Channel 11] [Channel 1] AP4 AP5 AP6 [Channel 11] [Channel 1] [Channel 6] AP 1 AP2 AP3 [Channel 1] [Channel 6] [Channel 11] The above is for purposes of illustration only, one will of course adjust it to account for the number of Access Points required and the shape of the room. In areas with no more than three Access Points, simply set them to three different channels. Note on Client Devices: Access points are set to a static channel. Client adapters provide for dynamic channel selection. As client devices move away from an Access Point and as the signal from the Access Point decreases, clients will eventually disassociate from that Access Point and scan the entire 2.4GHz spectrum in search of another beaconing Access Point (presumably set to different channels) that will provide them with a stronger signal. The client will then assume the channel of the Access Point providing the stronger signal. This capability is called roaming which and enables a client to move throughout a facility, from one Access Point s coverage area to that of another without loss of connectivity. This handoff requires no user intervention and is typically transparent to the user. It should be noted that this roaming feature only works when all Access Points in the roaming area are within the same subnet. When roaming from an Access Point on one subnet to an Access Point on another, the client IP address must be renewed with either a release/renew or a reboot - which is undesirable. Access points within a common facility should therefore be located on the same subnet. Security Prior to configuring security parameters, the installer is again well advised to verify operation of the wireless LAN by checking associations as per the above. Having done this, the installer should introduce a level of security to the WLAN. Wireless LAN devices are fundamentally radios and as such broadcast their LAN traffic through the air, through walls and outside the facility. No physical security like with wired LANs may be assumed. As such, even for temporary wireless LANs consistent with disaster recovery procedures some steps to secure the physical medium must be taken. Page 6 of 9

7 There are incremental levels of security provided by Cisco Aironet WLANs, each providing an additional layer of data protection. Consistent with the goal of this document, the security level outlined here strikes a balance between ease of configuration and data protection. More robust levels of security are outlined in the user documentation provided with all Cisco Aironet products. By default, Access Points broadcast their Service Set Identifier (SSID) along with their beacons, thereby inviting association with any client device within range. By changing the default such that it is no longer included with the beacon, only client devices with the same SSID will associate with that Access Point. The default SSID name for Cisco Aironet Access Points is Tsunami which is also the default SSID on Cisco Aironet client devices. Changing the SSID on both clients and Access Points on the wireless LAN to a common name will provide only a very base level of security and should actually be considered more as simply a means of preventing unintended association from clients on a neighboring wireless LAN. Cisco Aironet WLAN products provide for data security through packet encryption. All product referenced in this document provides for 128-bit long encryption keys based on the RC4 encryption algorithm. While this algorithm is known in general to be breakable, it is asserted in this document that it will provide a reasonable level of security on a temporary basis. These keys are static and shared by all devices, clients and Access Points on the WLAN. For longer term security requirements, Cisco advocates our more advanced security system that provides for user level authentication and dynamic single session, single user encryption keys. This configuration of this system is beyond the scope of this document but is detailed in various Cisco Aironet publications. Static encryption keys must be input in hexadecimal format both on the Access Points and clients. They must, of course, be absolutely identical on all devices or no connection will result. The configuration of these keys is menu driven and relatively straight forward and is detailed in the client and Access Point user documentation. Page 7 of 9

8 Finally, for an additional layer of security one can provide for device level authentication with a MAC address inclusion table. The details of this can be found in the Software Configuration Guide provided with the Access Point. With this inclusion table, only devices with MAC addresses in the table will gain access to the WLAN. This MAC address table can and should be propagated across all Access Points on the network to allow for client roaming (and authentication with) all Access Points on the LAN. Desktop Client and Network Printer Configuration The Workgroup Bridge provides for the wireless enablement of any Ethernet-equipped devices such as Desktop computers, workstations and network printers. It has a single 10Mbps Ethernet port but will support up to eight MAC addresses. To wirelessly enable more than a single Ethernet-equipped device, the installer must source a standard Ethernet hub and connect that hub to the Workgroup Bridge via their Ethernet ports. The Ethernet-equipped devices may then be connected to the Ethernet hub thereby gaining access to the wireless LAN via the radio wave uplink on the Workgroup Bridge-which associates with a WLAN Access Point, essentially as a proxy client. The Workgroup Bridge is configured similar to a Client Adapter and supports all the security options of Cisco Aironet WLAN clients and Access Points. Detailed installation and configuration instructions are included with the Workgroup Bridge. Summary The WLAN outlined in this document will provide for a local area network that: Is easy to deploy in a relatively short period of time When architected as per this document will provide for a level of network performance required by typical office applications Provides for an acceptable level of security for a temporary network with the ability to be upgraded to a security level required for more permanent LANs. Page 8 of 9

9 Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax: European Headquarters Cisco Systems Europe 11 Rue Camille Desmoulins Issy-Les-Moulineaux Cedex 9 France www-europe.cisco.com Tel: Fax: Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: Fax: Asia Pacific Headquarters Cisco Systems Australia, Pty., Ltd Level 9, 80 Pacific Highway P.O. Box 469 North Sydney NSW 2060 Australia Tel: Fax: Cisco Systems has more than 200 offices in the following countries and regions. Addresses, phone numbers, and fax numbers are listed on the Cisco Web site at Argentina Australia Austria Belgium Brazil Bulgaria Canada Chile China PRC Colombia Costa Rica Croatia Czech Republic Denmark Dubai, UAE Finland France Germany Greece Hong Kong SAR Hungary India Indonesia Ireland Israel Italy Japan Korea Luxembourg Malaysia Mexico The Netherlands New Zealand Norway Peru Philippines Poland Portugal Puerto Rico Romania Russia Saudi Arabia Scotland Singapore Slovakia Slovenia South Africa Spain Sweden Switzerland Taiwan Thailand Turkey Ukraine United Kingdom United States Venezuela Vietnam Zimbabwe Copyright 2001, Cisco Systems, Inc. All rights reserved. AccessPath, AtmDirector, Browse with Me, CCDA, CCDE, CCDP, CCIE, CCNA, CCNP, CCSI, CD-PAC, CiscoLink, the Cisco NetWorks logo, the Cisco Powered Network logo, Cisco Systems Networking Academy, the Cisco Systems Networking Academy logo, Fast Step, Follow Me Browsing, FormShare, FrameShare, GigaStack, IGX, Internet Quotient, IP/VC, iq Breakthrough, iq Expertise, iq FastTrack, the iq logo, iq Net Readiness Scorecard, MGX, the Networkers logo, Packet, RateMUX, ScriptBuilder, ScriptShare, SlideCast, SMARTnet, TransPath, Unity, Voice LAN, Wavelength Router, and WebViewer are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That s Possible, and Empowering the Internet Generation are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, Cisco, the Cisco Certified Internetwork Expert Logo, Cisco IOS, the Cisco IOS logo, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastSwitch, IOS, IP/TV, LightStream, MICA, Network Registrar, PIX, Post-Routing, Pre-Routing, Registrar, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other brands, names, or trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0104R)