Module 6, Assignment 5

Transcription

1 SusanFerdon,EDTECH552SP11 Module 6, Assignment Multiple Choice Questions 1. Which of the following is unlicensed band, which can be used by WLAN s? A. 2.4 GHz band B. 2.4 MHz band C. 5 GHz band D. 5 MHz band E. 900 GHz band F. 900 MHz band 2. Which standard has the highest possible data rates? A B a C b D g E n 3. Which standard provides the strongest level of WLAN security? A. EAP B. WEP C. WPA D i/WPA2 4. Which regulatory agency contols the standard that governs WLANs? A. Wi-Fi Alliance B. IEEE C. EMA D. WISC 5. When you are using x, how is the client authenticated? Q: 258, A: 472, in text: 244 A. The clent is authenticated against a local database stored on the access point B. The access point forwards all network traffic to the the server where it is either authenticated or blocked C. The access point encapsulates any 802.1x traffic bound for the anthentication server and sends it to the server D. The client encapsulates the 802.1x authrntication traffic before sending it to the access point. This causes the access point to forward it to the server

2 SusanFerdon,EDTECH552SP Configuring Wireless Network Objectives Createasecurityplanforahomeorsmallbusinessnetwork. Configurethewirelessaccesspoint(AP)portionofamulti functiondeviceusingsecuritybest practices. 5.3 Set up a Wireless Environment in Packet Tracer Step1. Step2. Step3. Step4. Step5. Step6. Openpackettracer ChooseWirelessDevicesthenchooseLinksysWRT300N Dragwirelessrouterontoworkarea,chooseenddevices,thenchoosegenericPC DragPContoworkareaanddoubleclickonPC Switchoffpower.DragoffNIC(Justdragitoutsidethecomputer)thenreplacewith Linksys WMP300N(ReplaceNICwithwirelessNIC) TheNIChasbeenreplacedtowirelessNIC switchonthecomputer Step7. Clickondesktoptab YoucansetyourIPconfigurationhere Youcanruncommandprompt(suchasping,tracert, )here. Youcanopenawebbrowsertosetupwirelessroutersettings.Pleasereadtask2 instructionfordetails. Atthispoint,Ifollowedtheprocedureintheforumposttogettherouterconnectedagain. 5.4 Connect a Computer to the Wireless Router Log in to the Administration Interface. Step1. Step2. Connectyourcomputer(EthernetNIC)tothemulti functiondevice(port1ofthelinksys WRT300N)byusingastraight throughcable. (Inmostcases,youcanskipthisstepbecausethewirelessrouterwillassignan XXXIPtoeachofconnecteddevices). ThedefaultIPaddressoftheLinksysWRT300Nis ,andthedefaultsubnet maskis thecomputerandlinksysdevicemustbeonthesamenetworkto

3 SusanFerdon,EDTECH552SP11 communicatewitheachother.changetheipaddressofthecomputerto , andverifythatthesubnetmaskis entertheinternaladdressofthe Linksysdevice( )asthedefaultgateway.DothisbyclickingStart>Control Panel>NetworkConnections.Right clickthewirelessconnectionandchooseproperties. SelecttheInternetProtocol(TCP/IP)andentertheaddresses,asshownbelow. Step3. Step4. Openawebbrowser,suchasInternetExplorer,Netscape,orFirefoxandentertheIP addressofthelinksysdevice( ifresettodefaults)intotheaddressfieldand pressenter.ascreenappears,requestingyourusernameandpassword. EnteradminfortheUsernameandenteradminforthepassword.Itisthedefault passwordonthelinksysdevice.clickok.rememberthatpasswordsarecasesensitive. NOTE:AsyoumakethenecessarychangesontheLinksysdevice,clickSaveSettingson eachscreentosavethechangesorclickcancelchangestokeepthedefaultsettings 5.5 Change the Linksys Device Password Step1. ClicktheAdministrationtab.TheManagementtabisselectedbydefault. Step2. Step3. EnteranewpasswordfortheLinksysdevice,andthenconfirmthepassword.Thenew passwordmustnotbemorethan32charactersandmustnotincludeanyspaces.the passwordisrequiredtoaccessthelinksysdeviceweb basedutilityandsetupwizard.be suretorecordthepasswordyouused. NewRouterPassword:EdTech552 TheWebUtilityAccessviaWirelessoptionisenabledbydefault,asshownbelow.This optionshouldbedisabledorconfiguredonlytoacceptconnectionsthroughsecure protocolsifsecurityisofconcern. Step4. ClicktheSaveSettingsbuttontosavetheinformation. 5.6 Configure the Wireless Security Settings Step1. ClicktheWirelesstab,asshownbelow.TheBasicWirelessSettingstabisselectedby default.thenetworknameisthessidsharedamongalldevicesonyournetwork.it mustbeidenticalforalldevicesinthewirelessnetwork.itiscasesensitiveandmustnot bemorethan32characters. Step2. Verify the SSID in use. If the SSID is set to the default value of linksys, change it to a

4 SusanFerdon,EDTECH552SP11 uniquename.recordthenameyouhavechosen:lab5 Step3. Step4. LeavetheRadioBandsettoAuto.Thissettingallowsyournetworktouseall802.11n,g, andbdevices. For SSID Broadcast, click the Disabled button to disable the SSID broadcast. Wireless clientssurveytheareafornetworkstoassociatewithandwilldetectthessidbroadcast sent by the Linksys device. For added security, do not broadcast the SSID. Please note thatthereareutilitiesandtechniquestodiscoverthessidevenifitisnotbroadcast.this shouldbeusedinconjunctionwithothersecuritymeasures. Step5. Saveyoursettingsbeforegoingtothenexttask. Atthispoint,IgottheRequestTimeoutmessageagain.Itriedprocessfromforumpost againbut Lab5 didn tshowup nothingshowedupwhenitlookedfordevicesandthe wirelessconnectionwasgonebetweenthepcandtherouter.iquitandre-openedpacket tracerfile.whenitopened,theinfothatwaspreviouslyenteredwasstillthereandthe diagramshowsastraight-throughcableconnectionfromtheroutertothepc.iclickedonthe routerthen GUI tabandwasabletocontinuefromwhereileftoff 5.7 Configure Encryption and Authentication Step1. Step2. Step3. Step4. ClicktheWirelessSecuritytabontheWirelessscreen. SelectWPAPersonalintheSecurityModedrop downmenu,asshownbelow. On the next screen, choose an encryption algorithm. To secure a network, use the highest level of encryption possible within the Selected Security mode. The following securitymodesandencryptionlevelsarelistedfromleastsecure(wep)tomostsecure (WPA2withAES): WEP WPA,includingTemporalKeyIntegrityProtocol(TKIP)andAdvancedEncryption System(AES) WPA2,includingTKIPandAES AES is supported only by newer devices that contain a co processor. To ensure compatibilitywithalldevices,selecttkip. For authentication, enter a pre shared key between 8 and 63 characters. This key is sharedbythelinksysdeviceandallconnecteddevices.recordthepre sharedkeythat

5 SusanFerdon,EDTECH552SP11 youused:sharedkey Step5. Step6. Chooseakeyrenewalperiodbetween600and7200seconds.Therenewalperiodishow oftenthelinksysdevicechangestheencryptionkey.theshorterthekeyrenewalperiod the more secure the connection. Unfortunately, shorter key renewal periods also increasethenetworkoverhead. Saveyoursettingsbeforeexitingthescreen. 5.8 Configure MAC Address Filtering Step1. ClicktheWirelessMACFiltertabontheWirelessscreen. Step2. MACaddressfilteringallowsonlyselectedwirelessclientMACaddressestohaveaccess toyournetwork.selectthepermitpcslistedbelowtoaccessthewirelessnetworkradio button. Click the Wireless Client List button to display a list of all wireless client computersonyournetwork. Step3. The next screen allows you to identify which MAC addresses can have access to the wireless network. Check the Save to MAC Address Filter List check box for any client deviceyouwanttoadd,andthenclicktheadd button.anywirelessclients,otherthan those in the list, will be prevented from accessing your wireless network. Save your settingsbeforeexitingthescreen. Igotasfarasthislaststepthenranintoanotherproblem thebuttonthatsays Wireless ClientList isnotclickablesonodevicesareshowinguptoadd.iwasnotabletocomplete Step3.

6 SusanFerdon,EDTECH552SP Reflection Q 5.9.1: List at least three security best practices that you should implement to secure your multi-function device and wireless network. Protecting my Wireless Network: Change password on router so it is not the default. WPA2 Most robust authentication and encryption is the default on my Mac. MAC Address Filtering There are 13 wireless networks within range of my living room and only two of them are mine. That means that my networks are probably within range of their living rooms as well. By enabling access for only my family s computers, our network will be more secure. Disable SSID broadcast so that other clients will not be able to easily find my wireless network. Firewall settings Adjust firewall settings for specific applications (Mac Security settings) and for anti-virus software. Authentication with 802.1X Client configurations can be exported as an Internet Connect file and distributed via , on a secure website, or using other out-of-band methods. When the user opens the file, all necessary settings are imported into Internet Connect, so the client is configured instantly for wireless communications (Source: MacOSX Security, page 7). Protecting my computer: In Bluetooth preferences, uncheck share my Internet connection with other Bluetooth devices. Turn off my laptop s Airport/NIC when I m not online if I can t access the network then attackers can t access me, right? Strong authentication Set up my computer, and other network devices, so that logins/passwords are required. FileVault with FileVault enabled, all documents are stored in encrypted form using AES. Documents are decrypted on the fly and reencrypted as they are saved. If possible, don t use shared open networks, like Starbucks or Borders. Definitely don t access personally identifiable information or password protected sites. Q 5.9.2: In these security settings, which feature that you configured on the Linksys WRT300N makes you feel the most secure and why? WPA2 encryption. It seems that attackers can find all kinds of ways to get into a network. For example, if an attacker is able to intercept a frame, the source and destination MAC addresses can be identified. They could then manually assign their device my MAC address and be able to get in, even with MAC Address filtering enabled. WPA2 encryption means that even if a frame is intercepted, it can t be read because the attacker doesn t have the encryption key. A shorter renewal period will mean a more secure network. Changing the

7 SusanFerdon,EDTECH552SP11 administrator password on the router will safeguard settings, but attackers still seem to find their way in. While building firewalls and other safeguards into the network topology, and adjusting security settings, all go a long way towards a safer environment, safeguarding the data itself (encryption process) makes me feel most secure since that data would be safe even if an attacker gets past all the other safeguards that are in place.