Cisco Networking

Cisco Networking

Switches:                                                                              

  1. Layer two
    1. LAN port
    2. Management Port
      1. Console
    3. Interface Port
  2. Layer three
    1. LAN Port
    2. WAN Port
    3. Management Port
    4. Interface Port

Initial Configuration of Switch:

  1. Login through Console port
  2. Hostname
  3. Negating Commands
  4. Console Password
  5. Telnet Password
  6. Enable Password
  7. Enable Secret
  8. Management VLAN
  9. Default Gateway
  10. Shutdown
  11. Login Banner
  12. Saving Configuration

Configure SSH on a Cisco Device

  • Configure Hostname
  • Configure a domain-name
  • Generate encryption key
  • Enable SSH version 2
  • Create local username
  • Choose to allow telnet and ssh
  • Enable login local on vty

Switch(config)# Hostname HRT-S1

HRT-S1(config)# ip domain-name cisco.com

HRT-S1(config)#crypto key generate  rsa

HRT-S1(config)#ip ssh version 2

HRT-S1(config)#username  admin secret admin

HRT-S1(config)#line vty 0 15

HRT-S1(config-line)#transport input (all, none, ssh, telnet)

Port Security

  • Port security – what is it?
  • Limiting the number of devices on a port
  • Limiting ports to a specific AND “Sticky” MAC ADDRESS

HRT-S1(config)#interface fastethernet 0/12

HRT-S1(config-if)#switchport mode access

HRT-S1(config-if)#switchport port-security (aging, Mac-address, Maximum, Violation)

HRT-S1(config-if)#switchport port-security mac-address sticky

HRT-S1(config-if)#do show run interface fa0/12

HRT-S1# show port-security

HRT-S1#show port-security address

HRT-S1#show port-security interface fa0/1

Half and Full Duplex

Speed and Duplex

HRT-S1 (config-if)#duplex (auto, half, full)

Auto is used when the speed is Gigabit

HRT-S1 (config-if)#speed (10,100,1000)

VLAN and Trunk

VLAN makes separate broadcast domain and divide one physical broadcast domain to different virtual domains.

VLAN 1: It is the default vlan that all interfaces are assigned to it. We can’t delete or rename the VLAN1.

VLAN Features:

  • Logical Group Users
  • Segments Broadcast Domain
  • Subnet correlation
  • Access Control
  • Quality of Service
  • Security
  • Management
  • Traffic Control

How to create a new VLAN

HRT-S1# vlan database

HRT-S1(vlan-if)#vlan 100

HRT-S1(vlan-if)#name finance

How to assign ports to a VLAN

HRT-S1(config-if)#switchport mode access

HRT-S1(config-if)#switchport access vlan 100

How to see VLANs

HRT-S1# show vlan 100

HRT-S1(config-if)#do show vlan brief

Trunk: Different VLANs can communicate with each other through trunking. And it is used between two switches ports to allow the same VLANs on each switch to communicate together.

Switch interface Mode

HRT-S1(config-if)#switchport mode access

HRT-S1(config-if)#switchport mode trunk

HRT-S1(config-if)#switchport trunk (auto, negotiable, nonnegotiable, desirable)

Inter VLAN

Allow different of VLANs in a single switch to communicate to each other through sub-interfaces of a router.

VTP

VTP stands for vlan trunking protocol. It is used to create communication among vlan of different switches.

VTP Mode:

  1. Server: create, change and update vlans(By default all VTP mode is server)
  2. Client: only update vlans
  3. Transparent: It is neutral and just pass the updates

HTTP Activation

By activating of HTTP protocol in Cisco’s device, we can login to them graphically and do configuration or changes.

Router (config)# ip http server

Router (config)# ip http secure-server

Router (config)#ip http authentication local

Router (config)# username admin privilege 15 password admin or secret admin

Router (config)# line vty 0 15

Router (config-line)#password 12345

Router (config)# line console

Router (config-line)# password

Router (config)# interface fastethernet 0/1

Router (config-if)# ip address 10.10.10.1 255.0.0.0

Router (config)# do wr

Password Recovery for Cisco 2950 Switches

The default configuration for the switch allows an end user with physical access to the switch to recover from a lost password by interrupting the boot process during power-on and by entering a new password. These recovery procedures require that you have physical access to the switch.

Note On these switches, a system administrator can disable some of the functionality of this feature by allowing an end user to reset a password only by agreeing to return to the default configuration. If you are an end user trying to reset a password when password recovery has been disabled, a status message shows this during the recovery process.

These sections describes how to recover a forgotten or lost switch password:

  • Procedure with Password Recovery Enabled
  • Procedure with Password Recovery Disabled

You enable or disable password recovery by using the service password-recovery global configuration command. Follow the steps in this procedure if you have forgotten or lost the switch password.

Step 1 Initialize the flash file system:

switch: flash_init

Step 2 If you had set the console port speed to anything other than 9600, it has been reset to that particular speed. Change the emulation software line speed to match that of the switch console port.

Step 3 Load any helper files:

swtch: load_helper

Step 4 Display the contents of flash memory:

switch: dir flash:

The switch file system appears:

Directory of flash:

13  drwx         192   Mar 01 1993 22:30:48  c2960-lanbase-mz.122-25.FX

11  -rwx        5825   Mar 01 1993 22:31:59  config.text

18  -rwx         720   Mar 01 1993 02:21:30  vlan.dat

16128000 bytes total (10003456 bytes free)

Step 5 Rename the configuration file to config.text.old.

This file contains the password definition.

switch: rename flash:config.text flash:config.text.old

Step 6

Boot the system:

switch: boot

You are prompted to start the setup program. Enter N at the prompt:

Continue with the configuration dialog? [yes/no]: N

Step 7 At the switch prompt, enter privileged EXEC mode:

Switch> enable

Step 8 Rename the configuration file to its original name:

Switch# rename flash:config.text.old flash:config.text

Step 9 Copy the configuration file into memory:

Switch# copy flash:config.text system:running-config

Source filename [config.text]?

Destination filename [running-config]?

Press Return in response to the confirmation prompts.

The configuration file is now reloaded, and you can change the password.

Step 10 Enter global configuration mode:

Switch# configure terminal

Step 11 Change the password:

Switch (config)# enable secret password

The secret password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, and allows spaces but ignores leading spaces.

Step 12 Return to privileged EXEC mode:

Switch (config)# exit

Switch#

Step 13 Write the running configuration to the startup configuration file:

Switch# copy running-config startup-config

The new password is now in the startup configuration.

Note This procedure is likely to leave your switch virtual interface in a shutdown state. You can see which interface is in this state by entering the show running-config privileged EXEC command. To re-enable the interface, enter the interface vlan vlan-id global configuration command, and specify the VLAN ID of the shutdown interface. With the switch in interface configuration mode, enter the no shutdown command.

Step 14 Reload the switch:

Switch# reload

Step 1:

Power off the switch first, then press the mode button while you are switching on the switch again. Hold it for 15 seconds until SYS is solid green, and then release it.

Step 2:

Switch:

Switch: flash_init

Step 3:

Switch: dir flash:

Switch: config.text

Step 4:

Switch: rename flash:config.text flash: oldconfig.backup

Switch: boot

Step 5:

To recover the old configuration:

Switch# rename flash:oldconfig.backup flash:config.text

Router

Router a device that connect different network together and it is layer three device. A router is used for WAN network.

There are three kinds of routers in Cisco’s routers

  1. Access layer
  2. Distribution layer
  3. Core layer 4600 – 60000

Many companies manufacturing router:

  1. Cisco
  2. Nortel
  3. MultiCom
  4. Cyclades
  5. Juniper
  6. Dlink
  7. Linksys
  8. 3com

But Cisco is having monopoly in the market of routers.

Note:

There are fixed devices and modulator

Fixed Devices: You cannot change the interfaces or ports

Modulator: You can insert and change interfaces

Router Interfaces:

  1. LAN Interfaces
  2. WAN Interfaces
  3. Management Interfaces
    1. Console – is used for initial configuration
    2. Auxiliary interfaces – outside configuration – connect to a modem. But public IP should be assigned to the router.

Router Mode:

  1. User mode
  2. Privilege mode (show, copy, write, reload)
  3. Global Configuration mode (hosname, interface, enable secret…)
  4. Setup mode
  5. X*Boot mode ( In this mode you can recover the password if lost it)
    1. It is also called router’s maintenance mode
    2. Press the break key (console connection) for 60 sec

Routing Protocols

There is a database in router which is called Routing Table. All data are stored in this table. And there are basically two kinds of routing:

  1. Static Routing protocols
  2. Dynamic Routing Protocols

Static Routing:

  • It is used in small companies
  • It has high security
  • Better performance
  • Better management,
  • Better Monitoring and maintenance.
  • Network administrator has to have all information about protocols and routers
  • Network administrator has to set the information to all routers manually.

Static Routing Configuration

R1(config)# ip route

R1(config-rout)# ip route source_Network subnet mask Destination_Network_IP-interface

R1(config-route) ip route 192.168.1.0 255.255.255.0 172.17.1.1

R1(config-route) ip route any any subnet mask interface-IP

R1(config-route) ip route 0.0.0.0 0.0.0.0 172.17.1.1

Dynamic Routing:

It is used with big companies and large networks. And the network administrator don’t have to set information to all devices. There three kinds of dynamic routing protocol:

  1. Distance Victor: send data to near routers, like RIP 1 and IGRP
  2. Links State: Before send data to other routers. It first try have a complete image of all network, like OSPF.
  3. Hybrid

Autonomous System:

A collection networks under a common administrative domain. And it start from 0 -65535.

IGP (Interior Gate Protocol)

It operates in AS and it is used for internal communication in a company through a country like RIP, IGRP, and OSPF.

EGP (Exterior Gate Protocol)

It operates within different AS. Like ISIS, Frame Relay…

IANA: Controls all AS in the world.

NIRA (National Intent Registry of Afghanistan)

It gives AS number to Telecommunications Company. Like Roshan, AWCC, ISP. And uses IGP protocols like OSPF, RIP and…

IANA
NIRPK
AWCC
Bahador
P
Z
Y
X
To connect different AS like Afghanistan and Pakistan, we must use EGP protocol. By activating of BGP which is one EGP’s protocol we can create communications.
NIRA

AS: 110                                                                                                             AS: 169

Roshan

Single Autonomous – IGP                                                       Single Autonomous – IGP

Dynamic Routing Protocols: VLSM supporting or not supporting

  1. Classless Routing
  2. Classful Routing

RIP (Routing Information Protocol)

  • Oldest protocol and public protocol. It is from IGPs
  • RIP works in AS
  • It is Distance-Victor
  • RIP updates every 30 seconds routing table by 255.255.255.255
  • It has two types: RIP v1 and V2
  • It is hop count protocol and its metric up 15 routers
  • Load balancing
  • RIP v1 is Classful routing protocols

RIP has 4 times by default:

  1. Update timer: 30 sec
  2. Invalid timer: 180
  3. Hold-down timer: 180
  4. Flush timer: 240
172.17.10.1
172.17.20.1
172.17.40.1
172.17.60.1
172.17.50.1
172.17.70.1
R1
R2
R3
SW2
SW1
SW4
SW3
SW5
SW6
172.17.30.1
172.17.80.1

The following steps are RIP protocol activation of above diagram:

R1 (config)# router rip

R1 (config)# network 172.17.30.0

R1 (config)# network 172.17.20.0

R1 (config)# network 172.17.10.0

R2 (config)# router rip

R2 (config)# network 172.17.10.0

R2 (config)# network 172.17.80.0

R2 (config)# network 172.17.70.0

R2 (config)# network 172.17.40.0

R3 (config)# router rip

R3 (config)# network 172.17.40.0

R3 (config)# network 172.17.50.0

R3 (config)# network 172.17.60.0

Now all devices can communicate to each other because they are routed. Now if they want to communicate, they check their routing table.

IGRP (Interior Gateway Routing Protocol)

  1. Created by Cisco in 1980
  2. Used in large network
  3. Using one AS
  4. Sending information to other routers every 90 seconds
  5. Uses different times
    1. Update timer
    2. Invalid timer
    3. Hold down timer
    4. Flush timer
  6. Its configuration same as RIP plus AS number
  7. New routers don’t support IGRP

IGRP Configuration:

R1(config)# router IGRP 102

R1(config-router)# network 172.17.30.0

R1(config-router)# network 192.168.1.0

EIGRP (Enhanced Interior Routing Protocol)

  1. Works in AS
  2. Lager networks
  3. Must have AS number From ISP or MCIT
  4. Works with any topology and media
  5. High speed
  6. Taking backup and saving in topology table
  7. It has three table
    1. Neighboring Table
    2. Topology Table
    3. Xxxx
  8. Its configuration is like IGRP

OSPF (Open Shortest Path First)

  1. It is also IGP protocol
  2. It is link-state victor protocol
  3. It has two area for its configuration
    1. Single area
    2. Multi area
  4. It was created in 1988 by IETF
  5. It advertises its info every 30 seconds
  6. Wild card mask is used in its configuration

OSFP Configuriation Steps:

R1(conf)# router ospf AS_number

R1(conf-router)# network network_range wildcard mask area 0

R1(conf-router)# network 192.168.0.0 0.0.255.255 area 0

R1(conf-router)# network 172.17.1.0 0.0.0.255 area 0

R1(conf-router)# network 10.0.0.0 0.255.255.255 area 0

Some other commands for OSPF

  • Show ip route
  • Show ip protocols
  • Show ip ospf neighbor
  • Show ip ospf interface

ACL-Access List

ACL is used to maintenance that which traffics should be passed on an interface and which traffics should not.

  • Controlling of outgoing and incoming traffics on an interface.
  • Controlling of virtual terminal access (Telnet)
  • They are specified by either name or number
  • Prior to Cisco’s IOS version 11.2, ACL could be specified only by number.
  • It is a sequential collection of permit deny criteria that are checked against IP packets
  • Wildcard Mask must me assigned
    • 0 in wildcard mask means: allow
    • 255 means: don’t care

Basically there are two kinds of ALCs

  1. Standard ACL
    1. The source IP address is determined for matching criteria, not destination IP Address.
    2. 1-99
    3. 1300 – 1999 (IOS 12.0 and above)
  2. Extended ACL
    1. Determined Source and Destination IP addresses
    2. 100 – 199
    3. 2000 – 2699 (IOS 12.0 and above)

Applying ACL:

They can be applied either to the:

  • Outbound interface a router
  • Inbound interface of a router

Standard ACLs within Number:

Example; create an ACL that: permit any IP address that are sourced from subnet mask 172.16.10.0 255.255.255.0

R1(config)# acces-list number Permit/deny Source_IP wildcard_mask

R1(config)# access-list 1 permit 172.16.10.0 0.0.0.255

If we determine a single IP address, it can be done in two ways:

R1(config)# access-list 1 permit 172.16.10.250 0.0.0.0

R1(config)# access-list 1 permit 172.16.10.250

R1(config-if)ip address 10.10.10.1 255.0.0.0

R1(config-if) ip access-group 1 in or out

Standard ACLs within Name:

R1(config)# ip access-list standard Test permit 172.16.10.0 0.0.0.255

ACL Remark:

IOS version 12.0(T) supports remarks (comments) and 100 characters are allowed.

R1(config)# access-list 1 remark permit only traffic from Corporate network is allowed

R1(config)# access-list 1 permit 172.16.10.0 0.0.0.255

NAT (Network Address Translation)

CCNA Wireless IUWNE 640-722

CCNA Wireless IUWNE 640-722

Wi-Fi Technology Overview
The Wi-Fi technology is based on the RF radio frequency signals that enable fast data transfers for indoor range up to 70 meters and outdoor range up to 250m. The speeds, range, coverage, and other characteristics depend on the type of the Wi-Fi signals.

Wi-Fi networks are professionally called WLAN networks. WLAN – Wireless Local Area Networks are local networks based on the wireless technology.

The Five Generations of the Wi-Fi (Wireless Medium)

Wi-Fi technology has five generations. Each generation is defined by the IEEE 802.11 family of standards. These standards define various aspects of each generation.

  • Frequency
  • Frequency channels
  • The number of channels
  • The bandwidth of channels
  • Modulation techniques – the way radio frequency signals are formed to enable data transfer.

As a result of this, every generation of the Wi-Fi (WLAN standard) has its own characteristics:

  • Speed of wireless data transfer
  • The range of wireless signals
  • The ability of the signals to handle the physical obstacles.

The five generations of Wi-Fi technology are:

IEEE standards

The IEEE Standards called these five generation s as the below:

  • 1st generation: 802.11a – usually called a.
  • 2nd generation: 802.11b – usually called b.
  • 3rd generation: 802.11g – usually called g.
  • 4th generation: 802.11n – usually called n.
  • 5th generation: 802.11ac – usually called ac.

Wireless Terminology (Vocabulary) and topology:

  1. Ad hoc mode (Operates on half duplex)
    1. BSS (The range for each device or computer is BSS)
    2. IBSS(Ad hoc, Peer 2 Peer )
  2. Infrastructure mode
    1. AP(Hot Spot)
    2. BSA (Basic Service Area)/Cell
    3. SSID
    4. DS(Distribution System) is the path from AP to any other devices like Server, Internet …
  3. WLC – Controller mode
    1. ESS (Extended Service Set): Extended Service Set is a larger network made of access points that are connected to the wired network device – a router
    2. Roaming (seamless movement among APs is called roaming)

Wireless Standards and Regulatory Bodies:

The standards are provided and organized by IEEE and WLAN works under the layer 1 and 2 standards.

  1. Layer 1 and 2
    1. 11
    2. Public Protocols
    3. Modulation
    4. Framing
    5. Frequency
  2. Interoperability testing
    1. Wi-Fi Alliance
  3. Regulation Organization
    1. FCC: Federal communication Commission
    2. ETSI: European Telecommunication Standard Institute
    3. TELEC: Telecom Engineering Center
    4. BRAI: Broadcasting Regulatory Authority of India

Radio Frequency 101:

RF signals that are used to send bits forward and back to our network.

  1. 1Hz, KHz, MHz ,GHz, THz
  2. Wave Length (How wide one cycle is)
  3. How tall (Amplitude) more energy = more Amplitude

Note: what a node does when it wants do connect an AP? Only waves nothing more

Note: The lower the frequency the longer the wavelength

Note: The higher the frequency the shorter the wavelength

RSSI (Received signal strength identifier): RSSI is used to identifies the length of the signal from receiver

RSSI – Noise = Signal to noise ratio (SNR)

How good RF Signals get bad:

  1. Path loss and Scattering (Free of charge)
  2. Lead(other obstacles absorb the signals)
  3. Mirror Mirror (Reflection, Multipath, Fade)
  4. Long range atmosphere refraction
  5. Noise(Interference with RF)

Basic Elements of Wi-Fi Networks

Every Wi-Fi network consists of these four basic elements.

  • Access point
  • Distribution system
  • Wireless medium
  • Station

Access point – AP

The wireless access point (AP) is the heart of the all Wi-Fi networks – key device in WLAN formation. It is wireless gateway and bridge between wireless networks and wired networks. AP enables that all connected Wi-Fi devices can exchange information with the wired network. Usually the most home wireless networks have a wireless router. Wireless router consists of many devices. Often it is the modem at the same time, so you have a DSL connection to the internet, router with 4 Ethernet ports and access point.

Distribution System – DS

802.11 standards, which define how all WLAN networks work, define the distribution system as a combination of bridging engine and backbone network. The distribution system has two functions:

  • Connecting access point to the backbone – usually internet.
  • Connects two different access points over a wired network.

Stations – Wireless Clients

The stations or wireless clients are all the devices that support Wi-Fi connection. Together with access point they are the most important elements of the WLAN formation. Stations, just like wireless medium of the access points, work according to five types of 802.11 networks. Today there are more and more different kinds of devices which can connect to the wireless access points.

Wi-Fi client is going through the five stages:

  1. Scanning
  2. Joining
  3. Authentication
  4. Association
  5. Re-association

Scanning

The scanning is the process of finding the Wi-Fi network. Classical wired networks use cables for the interconnection. In the wireless network, the first thing you need to do is to identify the appropriate network. Wi-Fi clients use the scanning to find existing networks in the area. After scanning, the client can choose to join one of the available wireless networks.

Joining

Joining does not guarantee the network access. It is only the first step for the client to be connected to the WLAN network. After joining, the client also needs to pass the authentication and associate stage.

The client can connect to the BSS in two ways:

  • Manually
  • Automatically

In the manual joining the client chooses the BSS manually. In the automatic joining wireless client picks the best access point according to a power level and signal strength.
In the both cases, parameters configured on wireless client and access point, need to match.

Authentication

In wireless networks, you don’t need the physical access to the network. You only need to be within the range. Wireless authentication is the security method in the wireless networks

Association

Association is the process that enables the client the actual access to the WLAN network. It is the same like plugging the cable into the wired network. It is not possible to be associated in more than one access point.

Re-association

The association can occur only in the ESS wireless network. The client, in this case, associates to the other access point in the same ESS. It is triggered when the client detects that the other access point have a stronger wireless signal.

Extension of the Wireless Network

There are different kinds of wireless routers. They can work on different standard (different Wi-Fi generation). The most time they are used as a standalone wireless router. In some cases it could be the problem with insufficient range and coverage and low speed in some part of your home. So you need to extend your wireless network. This can be done in seven ways.

What is a Broadband Wireless Router?

The Broadband wireless router is a network device which can have the following functionalities:

  • Wireless access point
  • Network Switch
  • Router
  • Firewall
  • DHCP server
  • NAT
  • Modem (DSL, cable, fiber optics)

Wireless Authentication Types

The Wireless authentication types are associated with the SSIDs configured on the wireless access point. If you need different types of wireless authentication, you need different SSIDs. Each SSID can have different security parameters.

Wireless authentication has two levels of security:

  • Open or Shared-key authentication
  • EAP – Extensible Authentication Protocol

Open and shared-key authentication use WEP. WEP doesn’t give you a proper security level. Shared-key authentication is especially vulnerable.

Note:

For the EAP you need a Radius server, while for the Open and Shared-key authentication there is no need for any external device.

WEP Authentication Protocol

WEP – Wired Equivalent Privacy has never deserved the meaning of its name. It is really easy to crack WEP. It can be done in less than a minute.

There is a 40, 64-bit, 128-bit and 256-bit WEP. It is a lot easier and more user-friendly to use a passphrase than a WEP key. When you use the passphrase, it is converted to keys in the hexadecimal format.

The biggest problem with WEP is the static key which does not change during a session. The length of the key (64-bit, 128-bit and 256-bit WEP) only extends the time needed to crack the wireless network. The only advantage of WEP is that all Wi-Fi equipment supports it. Even with the older wireless cards and access points you can configure WEP as the wireless internet security.

WEP Disadvantages

  • It’s very easy to crack
  • It slightly reduces a performance
  • It uses a static key

WPA Authentication Protocol

Wi-Fi Alliance has launched WPA in October 2003. WPA – Wi-Fi Protected Access was much better replacement of WEP. The biggest WEP problem is that it uses a static key. WPA has solved the WEP problems with better encryption and authentication.. There are two versions of WPA.

  • WPA – Personal Mode
  • WPA – Enterprise Mode

WPA – Personal Mode:

Personal mode WPA has PSK authentication and TKIP/MIC encryption.

WPA – Enterprise Mode:

Enterprise mode WPA has EAP authentication and TKIP/MIC encryption.

WPA Advantages

  • Much better encryption mechanism
  • Uses the temporary key – TKIP
  • Compatible with many older devices.

What is WPA2?

Soon after WPA, Wi-Fi Alliance has launched WPA2.  Thanks to PSK authentication, it is backward compatible with the WPA. Besides PSK, WPA2 uses much better encryption standard – AES. IEEE has defined the WPA2 with the 802.11i standard.

WPA2 Advantages

  • Provides stronger data protection and network access control
  • Uses better encryption – AES
  • It can use TKIP for interoperability with WPA
  • Impossible to crack without access to the network
  • Older equipment does not support it

WPA2 is the latest WPA implementation. It is based on 802.11i standard and provides government grade security.  The WPA2 uses better encryption – AES comparing to TKIP used by WPA. You can also use TKIP encryption which is used for interoperability with WPA.

Different Modes of WPA and WPA2

  • Enterprise
  • Personal

WPA and WPA2 in Personal Mode

Personal mode was designed for home and office environment. Here you do not need the special server dedicated for the wireless security. The security level of the wireless network is based on the PSK – pre-shared key or a passphrase.

WPA and WPA2 in Enterprise Mode

In the enterprise mode you need to have dedicated authentication server – RADIUS server. This mode meets with the rigorous requirements of the enterprise security.

Both versions of WPA use 802.1X/EAP Authentication. WPA has TKIP encryption, while WPA2 has AES.

According to this, we can divide all Wi-Fi Certified equipment in four groups:

  • WPA-Personal
  • WPA2-Personal
  • WPA-Enterprise
  • WPA2-Enterprise

Here is a brief overview of these four groups. They are divided by the authentication and encryption methods that they use:

WPA WPA2
Enterprise mode Authentication:802.1X/EAP
Encryption: TKIP/MIC
Authentication:802.1X/EAP
Encryption: AES/CCMP
Personal mode Authentication:PSK
Encryption: TKIP/MIC
Authentication:PSK
Encryption: AES/CCMP

 

Setting Up a Wireless Network – Overview

Setting up a wireless network has never been easier. With these five simple steps you can set up your own wireless network in a few minutes.

  1. Get the Right Equipment
  2. Connect the Cables
  3. Position the Wireless Router
  4. Configure the Wireless Router
  5. Connect the Clients to the Wi-Fi Network

1. Get the Right Equipment

The first step is getting the right equipment. You need the following devices:

  • Internet connection
  • Modem
  • Wireless router
  • Clients with Wi-Fi adapters

You can have the modem and the wireless router in the same device. I have a DSL port on my wireless router. My wireless router is directly connected with the telephone cable to my ISP.

2. Connect the Cables

The second step of setting up a wireless network is to physically connect equipment with the cables. This can be done in two steps:

  • Setting up a modem and internet connection
  • Setting up a Wireless router

Setting Up the Modem and Internet Connection

The ISP – Internet Service Provider is responsible for setting up your internet connection and a modem. If it wasn’t done by them, follow the instruction you get with a modem. The modem can be the DSL – digital subscriber line modem and the cable modem.

Setting Up a Wireless Router

The router has four kinds of ports:

  • 4 Ethernet ports
  • Internet connection
  • USB port
  • Power

If are looking from the left, first there are 4 Ethernet ports. The ports are for connecting UTP Ethernet cables to your computers in a wired network. In the middle there is a port with the yellow label Internet. This is also the Ethernet port, but this one you need to connect to the modem with the UTP cable.

To the USB port you can plug into your external hard disk and you will have a NAS – Network Attached Storage Server. The last port is for the power cable.

3. Position the Wireless Router

In positioning the wireless router the most important is to enable the maximum wireless signal all over your place. The third step in setting up a wireless network can be summed up with the following:

  • Place the wireless router in a central location.
  • Avoid physical obstructions – walls and metal objects.
  • Set up the wireless router away from the electrical devices, especially microwave ovens, cordless phones and baby monitors.

4. Configure the Wireless Router

In setting up a wireless network it is critical to configure the appropriate wireless security. If you apply these five steps, you can get the maximum security:

  • Change a Default Password
  • Change Default SSID
  • Do Not Use WPS – Wi-Fi Protected Setup
  • Enable the WPA2
  • Enable a MAC Address Filtering
  1. Change a Default Password

The very first thing you should do on the wireless router and access point is to change the default password. All these devices have a web user interface for their configuration. This webpage is protected with the username and password.

To be able to access the device’s web interface, the first thing you should know is the IP address.

Password Recommendations for the Maximum Wireless Internet Security

  • Do not use the default password
  • Mix of letters, numbers and non-alphanumeric characters
  • Use both small and capital letters
  • Don’t use the words from the dictionary
  • Change the password every month or two
  1. Change Default SSID on Your Wireless Router

The second most important thing you need to change is the default SSID or a network name. Default SSIDs, listed below, are a sign for hackers that the Wi-Fi network is easy to crack.

  • Linksys
  • NETGEAR
  • D-link
  • default

Recommendations for SSID

  • Don’t use the default SSID
  • Don’t use your name, address, or any other personal information
  • Don’t use the passwords that you are using on your computer
  • Use both letters and numbers
  • Use the maximum allowed length
  • Change SSID every month or two
  1. Do Not Use WPS – Wi-Fi Protected Setup

A major security flaw was found with the WPS – Wi-Fi Protected Setup feature. All recent models of the wireless routers support the WPS and it is enabled by default. Thanks to this flaw, a hacker can recover the WPS PIN and WPA2 key in a few hours. So please disable the WPS feature on your wireless router.

  1. Enable the WPA2 for the Maximum Wireless Internet Security

Enable the WPA2 on the wireless router or access point. Do not use WEP in any case.

WPA Recommendations for the Maximum Wireless LAN Security

  • Use WPA2 – Authentication PSK, Encryption AES, for personal use
  • Use WPA2 – Authentication EAP, Encryption AES with the Radius server for enterprise
  • Use the maximum length for the WPA2 key
  • Use combination of small and capital letters, numbers and non-alphanumeric characters for WPA2 key
  • Don’t use dictionary words for the WPA2 key
  • Change WPA2 key every month or two

5. Enable a MAC Address Filtering for the Maximum Wireless LAN Security

All wireless routers and access points have a built-in feature to enable the MAC address filtering. You need to find out the MAC addresses of all the clients in your wireless network. After you specify them in MAC address filtering table, only these clients can be in your wireless network.

Have You Ever Been Hacked?

Have you been a victim of some hacker? ? Poor wireless internet security has almost ruined the life of some persons.

5. Connect the Clients to the Wi-Fi Network

Configure the appropriate parameters for your clients – computers, smartphones and tablets. SSID and the security settings – encryption, authentication and the key have to match with the ones you have on the wireless router.

802.11i – A New Generation of the Wireless Network Security

802.11i is standard that specifies security mechanisms for wireless networks. It is an amendment to the IEEE 802.11 with the full name IEEE 802.11i-2004. Practically is implemented as WPA2 also called RSN – Robust Security Network. Its main task is to replace security compromised WEP by the use of the AES – Advanced Encryption Standard.

Application to 802.11i

There are two points of the decision to allow the 802.11 access:

  • Access Point
  • Authentication Server (usually Radius)

The decision is decided by authentication and 802.11 Policy decision token is Master Key.

Master Key – MK

  • Symmetric key that represents client’s and Radius server’s decision during one session
  • Only the client and authentication server has it
  • Decision for authorization is based on the MK

Pairwise Master Key – PMK

  • Fresh symmetric key that controls client’s and access point’s access to the wireless network during the session
  • Only clients and access point can produce the PMK
  • Derived from MK
  • Radius server distributes PMK to the access point
  • PMK possession demonstrates authorization to access the wireless network during the session

Pairwise Transient Key – PTK

  • Generated from PMK
  • Temporal operation key used to secure multicast and broadcast traffic

Authentication Procedure

802.11i Operational Phases

Security Capabilities Discovery

  • Access point advertises the network security capabilities

Client knows:

  • SSID
  • Authentication method

Access Point knows:

  • SSID
  • Authentication method

802.1x Authentication

  • Centralized network admission policy decisions at the access point
  • To mutually authenticate client and Radius server
  • Generation of Master Key
  • Generation of Pairwise Master Key as an access authorization token

At the end of successful authentication:

  • Radius server and client have established a session
  • Radius server and client have the master key
  • Radius server and client have derived pairwise master key
  • Radius has distributed pairwise master key to the access point

Radius-based Key Distribution

  • Radius server moves (not copies) Pairwise Master Key to access point

802.1x Key Management

  • Binds Pairwise Master Key to client and access point
  • Generate fresh PTK
  • Proving that each peer is live
  • Synchronization of PTK use
  • 4-way handshake used to derive, bind and verify PTK

802.11i Data Transfer

802.11i have 3 protocols for data protection:

1) CCMP – Counter Mode with Cipher Block Chaining Message Authentication Code Protocol

2) WRAP – Wireless Robust Authenticated Protocol

3) TKIP – Temporal Key Integrity Protocol – for legacy devices only

  • Unprotected packets are never send
  • The authenticity of message origin
  • Protection of source and destination address
  • Use of strong cryptographic mechanism

Wireless Antennas:

You can find two basic types of Wi-Fi antennas:

  • Directional
  • Omnidirectional

Omnidirectional Wireless Router Antenna

The omnidirectional wireless router antenna is used for point to multipoint connections. The omnidirectional antenna transmits the radio signals in all directions. In most cases it has lower gain than directional wireless internet antenna.

If you are trying to make your wireless signal stronger and the range longer, the best Wi-Fi antenna for you is omnidirectional antenna.

There are five types of omnidirectional wireless router antenna:

  • Vertical Omnis
  • Ceiling Domes
  • Rubber Ducks
  • Small Desktops
  • Mobile Vertical Antennas

Directional Wireless Router Antenna

The directional wireless router antenna is mostly used for point to point connections. If you are trying to connect to remote wireless access points or the wireless routers, the best Wi-Fi antenna is the directional wireless router antenna.

There are four types of directional antennas:

  • Yagi
  • Dish
  • Panel
  • Sector

Homemade Wi-Fi antenna

The homemade Wi-Fi antenna is not the best Wi-Fi antenna, but it is for sure the cheapest. You will be surprised by how easy is to build your own homemade Wi-Fi antenna. You could make it very easy in your home for almost free.

Wireless Signal Booster Overview

Wireless signal booster is a device which boosts the wireless signal and increases the effective range and the coverage of the wireless network.

Different Types of the Wireless Signal Booster

On the market you can find different versions of the wireless boosters:

  • Wi-Fi signal booster
  • cellular signal booster
  • software Wi-Fi booster.

For boosting your Wi-Fi signal you can use six methods:

Wi-Fi Signal Booster

Wi-Fi signal booster is a wireless booster for Wi-Fi signals. We can group Wi-Fi signal boosters according to the position in the Wi-Fi network. One group is on the side of the wireless router and the other is on the client side.

The types of the Wi-Fi signal boosters:

  • wireless signal booster for the wireless routers and access points
  • Wi-Fi booster for the clients

Wireless Signal Booster for the Wireless Routers
Wi-Fi booster for wireless routers expands the range of a Wi-Fi network by repeating the signal from the wireless router and redistributing the Wi-Fi signal to new locations. On the right, you can see Amped SR300 – Wireless signal booster for the wireless router. It has the best marks from the customer reviews on the Amazon.

 

Wireless Repeater Overview

Wireless repeater or Wi-Fi repeater is a device which enables you to extend the range and improve the coverage of your wireless network.

Parts of your home have weak Wi-Fi signal or even they don’t have a wireless signal at all. There are seven ways to boost the range and improve the coverage.

  • Increasing the power of the wireless router.
  • Using the Wi-Fi signal booster.
  • Finding a better place for the Wi-Fi router.
  • Using of secondary access point.
  • Using the newer generation of Wi-Fi.
  • Using of Wireless repeater.
  • Using of Wi-Fi antenna.

Wireless repeater

Wireless router (access point) connected to the internet is called a root wireless router (root access point).  Other wireless router or access point which has a wireless connection to the root is called repeatedly.

Wi-Fi repeater acts as a relay between the root wireless router and the wireless client. It receives the signal from the root wireless router and forwards this signal to the client. When wireless traffic is going from the opposite direction, wireless client sends the signal to the Wi-Fi repeater, which then forwards the signal to the wired wireless router.

Two Kinds of the Wi-Fi Repeaters

Wi-Fi repeaters can be grouped by how they are connected to the root wireless router. They can use WDS – wireless distribution system or not.

  • WDS repeater
  • non-WDS repeater.

Non-WDS Repeater – Wi-Fi Range Extender

Non-WDS repeater connects to the root wireless router as a wireless client. The devices, wireless repeater and root wireless router, needs to have the same SSID. Non-WDS repeaters are usually called wireless range extenders.

Setting up the Wireless Range Extender

During the setup of the wireless repeater without WDS, take care of the following things.

  • Use the same channel like a root wireless router
  • Use the same SSID like the root wireless router
  • Use the same security parameters (security type, passphrase)
  • Don’t place the repeater too far away from the root wireless router.

WDS Repeater

Wi-Fi repeater uses a wireless distribution system for connection to the root wireless router. The WDS wireless connection is dedicated only for wireless connection between the repeater and root.

Wireless Site Survey

What is Wireless Site Survey?

Wireless site survey should be the first step in deployment any new wireless network. Wireless site survey, sometimes called an RF site survey, is the process of planning and designing a wireless network.

Types of Site Surveys

There are three types of wireless site survey:

  • Passive
  • Active
  • Predictive.

Passive Survey

Passive site surveys are performed without connecting to the access point or wireless router. The result is the most often:

  • Initial site surveys
  • Validate the final RF settings
  • Identify the rogue access points
  • Locate the locations with the possible RF problems.

Active Survey

In the active wireless site surveys you need to connect to the access point. The active wireless site surveys can be performed in two ways:

  • BSSID – Basic Service Set Identifier Method
  • SSID – Service Set Identifier Method.

BSSID Method

In the BSSID method client is locked only to one AP (AP prevents that client from roaming).

SSID Method

In SSID method client associates to the one SSID and then it roams between different APs. The method is usually used for survey of multiple APs and is done after deployment.

The Site Survey Process

The process of the wireless site survey consists of these steps:

  • Getting the exact requirements
  • Getting the proper maps
  • Visual inspection
  • Evaluation of the existing network infrastructure
  • Identify the coverage areas
  • Choose the preliminary locations for the access points.
  • Verification of the access point locations.
  • Document the APs locations

Getting the Exact Wireless Requirements

To be able to identify the optimum number and locations for the access points, you must have a real understanding of the different requirements for that particular site:

  • The primary requirements
    • Type of the traffic (voice, data, video..)
    • Type of the facility
    • Type of the wireless clients
  • The Customer facility requirements
    • Single floor/multi-floor
    • Indoor/outdoor
    • Warehouse/office
  • The wireless clients requirements
    • Minimum RSSI – Receiver Signal Strength Indicator
    • Minimum SNR – Signal to Noise Ratio
    • Delay and Jitter
    • Maximum transmit power (Tx)

Getting the Maps

Collect the maps and blueprints of the site location. If you can’t get them, you will need to make them by yourself. The diagrams should have exact locations of walls, corridors, floors…  Wireless site survey applications have option to import the maps.

Visual Inspection

The next step in the wireless site survey is a visual inspection of the facility. Note any obstacles that have an impact on the Wi-Fi signals (metal racks and partitions or any other barriers that are not located on the maps). Also note the possible best locations for placing the access points like ceiling tiles or pillars.

Evaluation of the Existing Network Infrastructure

Evaluate capacity of the existing wired networks – the backbone in which the access points will connect. This includes:

  • Number of Ethernet switches
  • Number and type of free ports on the switches (electrical, optical, PoE – power over Ethernet).
  • Type and number of routers
  • Data rate capacity of the routers

Identify the Coverage Areas

Note on the map all areas that need to have the Wi-Fi signal.  Also, you need to identify the places where the wireless coverage is not needed and also where you need to avoid the wireless coverage. The best way is to cover the site with the least number of access points, because the cost will be lower.

Choose the Preliminary Locations for the Access Points
Consider the best locations for placing the APs. Plan the overlapping between the APs – usually the best option is to have 25% of overlapping among adjacent APs. Keep in mind the channels of adjacent access points need to be far enough (the best is 5 channel differences).

Also, do not forget the mounting locations for the APs like and place for the UTP cables for the access points.

Verification of the AP Locations

After placing all the access points in preliminary locations, you need to perform the wireless site survey testing. Applications for the site survey have option to identify:

  • Location of APs
  • Data rates
  • Signal strengths
  • Signal quality

Monitor the readings in wireless site survey application and cover all needed locations. Consider the minimum needed SNR and the signal strength.

Based on all these results, reconsider the locations for the APs.

Document the AP locations

When you have optimal positions for all the APs, document them on the map. This is the last but also very important step in the wireless site survey.

Wireless Internet Card – Overview
Wireless internet card, also known as a wireless adapter, is a device that enables a wireless connection. You could also find a name wireless network interface controller or WNIC. It is built for desktop and laptop computers.

There are three types of the wireless interface cards:

  • Wi-Fi Adapters
  • Cellular Adapters
  • Bluetooth Adapters

Wi-Fi Adapters

Wi-Fi adapters provide connectivity to the Wi-Fi network. You could use them for the following purposes:

  • Adding wireless connectivity to desktop computers.
  • Adding wireless connectivity to the old laptops without a built-in Wi-Fi card.
  • Increasing the speed of wireless connection for the laptops by using a newer Wi-Fi adapter.

Usually they are for the desktop computers. All the laptops have the built-in Wi-Fi card for last few years. You could increase the speed of your Wi-Fi network by using new wireless internet cards that are working on higher data rate.

You can find Wi-Fi adapters in different variations:

  • PCI wireless network card – for desktop (newer versions are PCIe)
  • PCMCIA Wi-Fi adapter – for laptop
  • USB  wireless network adapter – for both laptop and desktop

Wi-Fi adapter can work in two modes:

  • Ad-hoc mode
  • Infrastructure mode

Wi-Fi Adapter in an Infrastructure Mode

When Wi-Fi adapter runs in the infrastructure mode, wireless access point or wireless router should be present in the Wi-Fi network. Transfer of all packets between wireless interface cards is going via the access point or the wireless router.

Wi-Fi Adapter in an Ad-Hoc Mode

In the ad-hoc mode, there is no need for an access point. Data traffic goes directly from one Wi-Fi adapter to another. All devices need to have the same channel and SSID.

Cellular Adapters

This type of wireless internet card provides 3G and 4G wireless internet connection to your computers. They are mostly used on laptop computers, but they can also work for desktop.

Cellular adapter can be in two different versions:

  • USB cellular adapter
  • PCMCIA cellular adapter

Bluetooth Adapters
Bluetooth adapters provide short range wireless connectivity to laptop and desktop computers. Mostly they are used for wireless connection with the mouse, keyboard and smartphone.

Bluetooth adapters can be:

  • USB Bluetooth adapter – for both laptops and desktop computers
  • PCI Bluetooth adapter – for desktop computers