CSI v2.1—14-
CSI v2.1—14-
Frequency
Power
Time
Power
2.4 GHz to 2.483 GHz
Direct Sequencing
Frequency-Hopping
Frequency
2.4 GHz to 2.483 GHz
Time
Channel Not in Use
Tunnel
Client
Access
Point
RADIUS
Server
CSI v2.1—14-
A security policy is in place.
SAFE WLAN Caveats
SAFE WLAN is based on the following caveats:
802.11 is insecure
IPSec
802.1x EAP
Access Point
with EAP/802.1X
Support
Access Switch
Access switch
RADIUS Server
To User
Database
RADIUS Server with EAP
Support and Dynamic WEP Key Generation
1 Client associates
with access point
2 Access point blocks all user requests to access LAN
8 Access point delivers broadcast WEP key encrypted with unicast WEP key to client
7 RADIUS server delivers unicast WEP key to access point
6 RADIUS server and client derive unicast WEP key
5 User authenticates RADIUS server
4 RADIUS server authenticates user
3 User provides login
authentication
credentials
9 Client and access point activate WEP and use unicast and broadcast WEP keys for transmission
Campus Network
Campus Network
To User
Database
Access Point
with Cisco LEAP
Support
Access Switch
Access Switch
RADIUS Server
RADIUS Server with LEAP
Support and Dynamic WEP Key Generation
1 Client associates
with access point
2 Access point blocks all user requests to access LAN
8 Access point delivers broadcast WEP key encrypted with unicast WEP key to client
7 RADIUS server
delivers unicast WEP key to access point
6 RADIUS server and client derive unicast WEP key
5 User authenticates RADIUS server
4 RADIUS server authenticates user
3 User provides login
authentication
credentials
9 Client and access point activate WEP and use unicast and broadcast WEP keys for transmission
To User
Database
Campus Network
Campus Network
To User
Database
Access Point
with EAP/802.1X
Support
Access Switch
Access Switch
RADIUS Server
RADIUS Server with EAP-TLS
Support and Dynamic WEP Key Generation
1 Client associates
with access point
2 Access point blocks all user requests to Access LAN
7 Access point delivers broadcast WEP key encrypted with unicast WEP key to client
6 RADIUS server
delivers unicast WEP key to access point
5 RADIUS server and client derive
unicast WEP key
4 RADIUS server authenticates user (via digital certificate)
3 User authenticates
RADIUS server (via
digital certificate)
8 Client and access point activate WEP and use unicast and broadcast WEP keys for transmission
To User
Database
Campus Network
Campus Network
To User
Database
Access Switch
Access Switch
RADIUS Server
RADIUS Server with PEAP
Support and Dynamic WEP Key Generation
1 Client associates
with access point
2 Access point blocks all user requests to access LAN
7 Access point delivers broadcast WEP key encrypted with unicast WEP key to client
6 RADIUS server
delivers unicast WEP key to access point
5 RADIUS server and client derive
unicast WEP key
4 RADIUS server authenticates user (Example: OTP authentication)
3 Client verifies
RADIUS server’s
digital certificate
8 Client and access point activate WEP and use unicast and broadcast WEP keys for transmission
To User
Database
Campus Network
Campus Network
To User
Database
PEAP Authentication Process
CSI v2.1—14-
Cisco 3200 Series Wireless
and Mobile Router
Cisco Catalyst 6500 Series Switches
Cisco 7900 Series IP Phones
Management Products
Wireless
Access
Points
AP1200
AP1100
Cisco Secure ACS, CiscoWorks LMS and WLSE
Switches and Routers
SWAN
Cisco Compatible Program for
WLAN Client Devices
Client Security
Standard EAP WLAN Design: Key Devices
DHCP/RADIUS/
OTP/PKI Servers
Access Point with
EAP and TKIP
Wireless Computer
with EAP and TKIP
Wireless Computer
with EAP and TKIP
EAP authentication Dynamic WEP key generation
EAP authentication
TKIP (WEP enhancements)
Inter Subnet filtering
RFC 2827 filtering
Virus scanning
EAP authentication
TKIP (WEP enhancements)
Dynamic WEP key generation
Attack Mitigation Roles for Standard VPN WLAN Design: Key Devices
DHCP/RADIUS/
OTP/PKI Servers
Access Point with
Management Interface
Wireless Computer
with VPN Client
VPN Concentrator
Wireless Computer
with VPN Client
Remote users authentication IPSec termination
DHCP relay
Packet filtering
Inter-subnet filtering
RFC 2827 filtering
VPN Concentrator
Two-factor
authentication
Possible packet filtering
(device-dependent)
Remote VPN gateway authentication
IPSec termination
Personal firewall for local attack mitigation VPN client auto-initiation
Building Module
Building Distribution Module
Core Module
Server Module
RADIUS/OTP/PKI
Servers
DHCP/AP
Management
Servers
Edge
Distribution
Module
To E-Commerce
Module
To Corporate
Internet Module
To VPN and Remote
Access Module
To WAN Module
Server Module
RADIUS/OTP
Servers
DHCP/AP
Management
Servers
Edge
Distribution
Module
To E-Commerce
Module
To Corporate
Internet Module
To VPN and Remote
Access Module
To WAN Module
VPN Concentrator Cluster
Wireless Computer
with VPN Client
Access Point
with EAP and TKIP
Access Point
VPN Concentrator
Access Point
VPN
Concentrator
Access Point
with EAP and TKIP
DHCP/RADIUS/OTP/PKI
Management Servers
VPN
Concentrator
Broadband
Access
Device
Internet
10.0.P.21
.1 e1
RTS
10.0.P.11
Wireless
computer
10.0.P.21
10.0.P.21
Если не удалось найти и скачать презентацию, Вы можете заказать его на нашем сайте. Мы постараемся найти нужный Вам материал и отправим по электронной почте. Не стесняйтесь обращаться к нам, если у вас возникли вопросы или пожелания:
Email: Нажмите что бы посмотреть