E N D
1. Wireless LAN Solutions- Security, Management Jukka Saarenmaa
Nortel Networks Oy
2. New Ways of Connecting
3. Security Issues and Options with WLANs Security Issues
WEP
Rogue Access Points
IP Mobility
Lack of employee education
Security Options:
Wired and wireless DMZs
IPSec or SSL VPN encryption
Reuse existing IPSec infrastructure or use dedicated wireless security switch
Future: New protocols with better security = added security
4. Different Challenges
5. StandaloneThe Traditional Distributed Architecture Typical Customer Profile
Wireless small branch/remote office
Requires only limited ‘Hot Zone’ capability
Few users
Customer Benefits
Low Startup cost
Easy install / LAN add-on
Simple but effective security
Investment protection
6. Secure Your WLAN IPsec Security for Wired and Wireless LANs Strong end to end IPsec Security
Common User Experience (VPN)
8. HybridCentralized Security and Management for Existing WLANs Typical Customer Profile
Multi-vendor environment
Larger Deployments
Intelligent Overlay requirement
Wireless upgrade or extension
Customer Benefits
Low incremental cost
Minimal disruption
Centralized security
Centralized management
Introduction of Enterprise roaming
Unauthorized AP detection
Wireless VPN capability
9. WLAN Security Implementation
10. Mobile Authentication, Authorisation & Auditing (AAA)
11. Clear Access Method Non encrypted, non-secure access to Intranet/Internet
If no L2 encryption is used (i.e. WEP, TKIP, AES), the traffic is completely unprotected!
Example: Open new browser window and go to http://web.us.nortel.com
Clear access should be carefully controlled in terms of what Intranet resources (if any!) are allowed.
Default configuration allows clear access to all but “Intranet” networks—Internet access available
Useful for PC-based IP Telephony applications: i2050, SIP,...
12. SSL Access Method Client logs into Portal website via SSL connection
This is the Home WSS (determined by WLAN subnet)
Encrypted session between VIP and Client IP
Unencrypted on Intranet
Intranet/Internet access is virtually the same as SSL VPN
Client IP can be proxied with IIP to solve routing issues
Support for SSL VPN client (SOCKS)
13. PPTP Access Method Client logs into Portal website via SSL connection
Get One-time password from Portal website
Solves PPTP dictionary attack weakness
PPTP tunnel between Client IP and VIP
WSS assigns tunnel IPs from local scope
Scope must be routed by WSS
Scope is local to each WSS
Compatible with MS VPN client
14. IPSec (Passthrough) Access Method No client login on WSS; AAA is bypassed on WSS
IPSec tunnel between Client IP and Contivity
WLAN subnet is not routable on Intranet by default
Static routes on Intranet and/or redistribution into IGP
Static routes plus NAT on Intranet router
Requires NAT Traversal
IPSec tunnel could also be non-Contivity solution
15. Nortel Networks SolutionNortel Wireless Security Switch 2250
16. Adaptive Non-Stop Convergence-Ready WLAN for New Deployments Typical Customer Profile
Large number of users
Ubiquitous building coverage
Green field deployments
Recommended for Wireless IP Telephony
Customer Benefits
Ease of deployment
Adjusts to changing environment
Automatic load balancing
Active security including over the air
Voice roaming capability
Dynamic RF management
Plug ‘n’ Play and Plug ‘n’ Grow
Self healing
17. WLAN – Adaptive Solution
18. Split MAC The concept is to decouple timing critical elements of MAC from timing sensitive elements of MAC:
ACKs vs. Probe Responses
Decoupling switching from RF
WSS 2270 is sort of like a traditional L2 switch except with radios instead of 10/100 ports
19. Nortel Access Point Plenum-ratable cast aluminum-case
Standard Ethernet (802.3) cabling
Multi-band support (802.11 a/b/g)
Powerful dual-dispatch directional antenna
Various mounting options
Power over Ethernet(802.3af)
802.11i and 802.11e ready
WPA/TKIP
SNMPv3
SSH v2.0
Multiple SSIDs
Monitor mode available
100 mw radio power
20. Nortel 2270 Wireless Switch Compact design conserves wiring closet space
two 1000Base-SX with LC connector- one logical path(Failover Protection)
On-board VPN capability using Enhanced Security Module crypto processor
Configurable Distribution System Port (GigE)
10/100 Mbps-TX Ethernet Service Port
9 pin Serial Connector for Console Port
n+1 redundancy
Crypto H/W accelerator
IPSEC termination
21. APs use encrypted control traffic
22. Data Paths with WSS 2270 LWAPP transports control messages to/from AP
LWAPP transports data packets to/from AP
L2 or L3 tunneling
23. Overlaying 2270/2230 on LAN All ports untagged in VLAN 1
LWAPP is in VLAN 1
User devices are mapped back to VLAN 1 too
All data is tunneled to 2270
BayStack will see MAC of clients on the port connecting to 2270, not the port connecting to 2230
Right hand side represents what the WLAN looks like to the rest of the data network
24. 2270/2230 with Multiple VLANs L2 Switch:
All ports are members of VLAN1
Link to 2270 has VLANs 1, 2, 3 (all tagged)
Link to router has VLANs 1, 2, 3 (all tagged)
Access link to 2230 is only member of VLAN 1 (untagged)
Right hand side represents what the WLAN looks like to the rest of the data network
25. L3 Mode with Multiple VLANs Layer 3 mode of LWAPP is essentially the same logically
Physically APs are placed anywhere in the network though
26. Per-SSID Security Features Layer 2
Static WEP
Shared or Open authentication
MAC-based authentication
WPA
802.1x
Cranite
Fortress
Layer 3
IPsec
Up to 1 Gbps bulk encryption
Web Authorization
VPN Passthrough
27. Where is Encryption Done (L2) L2 Encryption based methods are encrypted/decrypted on 2230
WEP, dynamic WEP, WPA, AES (future)
28. Where is Encryption Done (L3) IPsec terminated on 2270
Tested clients: SSH, Sentinel, Movian, Cisco, Netscreen
Per-SSID
29. VPN Passthrough VPN Passthrough leverages an external VPN server
Configure IP address of server
Applies traffic filter so only traffic to the server can get through
Per-SSID
30. How to Implement VoIP Multiple SSIDs (i.e. two WLANs)
No Active Load Balancing
QoS:
SSID: VOIP = Gold
SSID: DATA = Bronze
Security:
SSID: VOIP = MAC based and/or WEP (only on b/g radio)
SSID: DATA = 802.1x or whatever is desired
Adjust Queue depth
Prioritize LWAPP on switches between 2270 and 2230
31. How to Implement VoIP (cont.)
32. WLAN Management System User interface to WMS is a web browser
Running locally
Running remotely
Database and control reside on WMS server
33. Accurate RF prediction for AP placement and RF topology mapping
Detailed heat maps for easy analysis
Ekahau Site Survey (ESS) tool to verify RF prediction and perform ongoing analysis (if needed)
34. Nortel WLAN Control Software uses advanced fingerprinting for <10 meter accuracy
35. Nortel Location Positioning Closest AP
How: Identify the AP to which a client is associated
Pro: Easy to do; Nothing new required
Con: Limited accuracy – an AP can easily cover several thousand square feet.
RF Triangulation
How: All APs identify the “strength” with which they hear a client. Intelligent algorithms triangulate responses to pinpoint probable location.
Pro: More accurate than closest AP
Con: Does not account for effects of building material on signal (e.g., reflection, attenuation, multi-path)
RF Fingerprinting
How: RF prediction creates grid that identifies how every single part of a floor plan looks to all access points. Real-world info gathered from APs is compared to these fingerprints to determine precise location
Pro: GPS-like accuracy
Con: More comprehensive (requires RF prediction tools)
36. Understanding RF Fingerprinting
37. Nortel’s WLAN – Adaptive Solution
39. Mesh Minimize Backhaul Costs in Open Environments Typical Customer Profile
Open spaces (depot, campus)
No existing wired infrastructure
Constantly changing environment (e.g. convention center)
Customer Benefits
Minimize backhaul costs
Rapid deployment
Auto-configuration
Resilient
40. Nortel Networks Solutions
41. Security Issues and Options with WLANs Security Is An Issue with WLANs
But….
Problems can be addressed
42. Applying the Unified Security Architecture to Wireless LANs