Configuration Example - AIR-AP1220B

[Last Updated: Monday, 20-Oct-2008 22:24:50 EDT]

The goal of your wireless setup should, obviously, be to primarily provide good connectivity with consistent acceptable signal strength in all the areas you need to use it. However, There are alot of bad people, nosy people, and "freeloaders" out there who'd like to use your connectivity for free to do things you might not approve of or want happening on your network. So, in order to protect access to and the use of your network, you need a sufficiently strong method(s) of authentication and sufficiently strong encryption to protect your personal data and information. You have to also balance this with ease of use and client configuration. If it is difficult for legitimate clients to connect using standard wireless clients and drivers, then you need to rethink your approach. Unfortunately, there are a myriad of protocols and methods for achieving these requirements which is thoroughly confusing to the average user. Some are highly compatible and easy to configure and others are less compatible and harder to setup. Hopefully I can clear up a little of the confusion around these configurations so you can provide acceptable protection levels along with a straightforward and more compatible client configuration.

Most access points on the market today provide at a minimum WEP, WEP 128, WPA, and possibly WPA2 support. WEP or Wired Equivalent Privacy was one of the first authentication and encryption schemes for WiFi networks. Being that it was the first, it was naturally full of protocol weaknesses and algorithm vulnerabilities. Do not use WEP or WEP 128 if possible. It is fairly trivial for anyone with half a clue to crack it and gain access.

WPA or WiFi Protected Access was created in response to the weaknesses found in WEP. In its original form it is a fairly secure protocol and provides support for pre-shared key solutions (PSK) as well as more advanced 802.1x authentication methods such as EAP, EAP-TLS, and PEAP and uses the TKIP encryption algorithm. Pretty much all access points on the market since 2003 support this option. WPA2 is the second iteration and a more complete protocol implementation. It also provides for the use of the Advanced Encryption Standard (AES) CCMP algorithm which is considered to be the most advanced encryption protocol publicly available. This option is mostly only available on access points and network cards sold from 2006 to present.

All current products on the market that are marked with by the WiFi Alliance are required to provide support for WPA2.

Personally, I have configured 3 different VLANs with 3 different SSIDs for wireless access on my home network. The primary SSID requires WPA2 with AES and uses PEAP with EAP-TLS for 802.1x user authentication via a local Radius server on my network. I also created a wireless Voice segment which uses WPA2 with AES and pre-shared key (PSK). Finally, I have a guest VLAN which uses WPA2 with AES and a pre-shared key for access and also provides fallback to WPA with TKIP envryption.

Warning: Aironet Extensions

One comment of note is that the Cisco Aironet access points have a default wireless interface configuration that enables the proprietary Aironet extensions. If you have client devices or drivers that do not support these extensions or have strict implementations, they will not work with this setup. You must explicitly disable these extensions for those clients to be able to properly authenticate and gain access. Issue the command 'no dot11 extension aironet' globally on the main Radio interface to do this.

Enabling Beacon SSID Broadcast

Additionally, many devices that have Wifi capability included expect the SSID information to be broadcast as part of the normal Beacon. Without an SSID name in the Beacon, many devices just ignore it. You may be required to explicitly configure the SSID name onto the device to use the network. This will usually take longer for the device to associate to the network and gain access. Some devices also lose this information when they are powered off and rebooted. That can be an extreme pain in the butt for client configuration. As the SSID name can be easily discerned, anyway, from active user traffic, there is really no real reason to not advertise the SSID name with the beacon, unless you just don't want the particular name to just show up on nearby client machines available wireless networks list. Hence, the suggestion is to use a sufficiently vague SSID name that does not clearly identify to whom the network belongs or is associated. Cisco IOS, by default, does not advertise the SSID name in the beacon messages. In order to broadcast the SSID name, the command 'guest-mode' must be configured explicitly under the relevant SSID configuration.

Radio Configuration

One of the tricker things to setup is which radio frequency to use, which speeds to enable, and what power settings. Each of these can affect performance and device compatibility. There is a ton of math and science involved in this topic. I will not go into that detail here. My goal is to make this easy to read and use for anyone.

Frequency
For frequency configuration, Cisco provides a beautiful shortcut trick. If you login to the command line and go to the dot11radio interface mode, you issue the command 'channel least-congested'. This automatically scans all the available frequency channels 1 through 11 (US) and finds a channel that has the fewest access points assigned and the least amount of signal interference.

Speed
The speed configuration has a myriad of possibilities. If you are only supporting 802.11b, this limits the options. However, if you intend to support both 802.11b and 802.11g or 802.11a, the configuration can be a little trickier. The options are endless. What speeds do you really need to offer at a minimum to be flexible and support the largest variety of client devices without going overboard and configuring everything? Personally I have both the b and g radios installed in my access point. However, if you support both b and g clients simultaneously, the drawback is that actual data throughput will tend to drop off to 11Mbps. So in order to ensure maximum throughput up to 54Mbps, it is best to configure using the Orthogonal Frequency Division Multiplexing (OFDM) rates which will enforce that only 802.11g clients can associate. 'speed basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0'

Power
Setting your radio to maximum power will certainly work but it will also advertise your network at greater distances and provide the ability for others outside your home or office to have the ability to associate to your network from greater distances. The trick here is to reduce the power settings and then to walk around your home or office and test with a laptop and a software client like Network Stumbler. You will be able to determine the optimal power setting so that you can successfully connect where you need to but also limit the distance that you broadcast your signal.

Configuration Overview

The following is a configuration example taken from my own personal Cisco Aironet AP1220B Wireless Access Point that I use at home. When I get a chance I will add a list of detailed comments on the relevant portions. I ran into a lot of headaches trying to properly configure the 802.1x method along with the various encryption options and client settings as well as the use of local RADIUS authentication.

The information supplied in this configuration is in no way guaranteed to work in every situation nor supported by the author. This document is meant to provide an example of general Wireless configuration practices. The ! signifies a commented line in Cisco's notation. Non-commented lines are the actual configuration syntax as it would be entered on the Cisco Access Point.

Using an integrated Intel 2200BG wireless card with the Intel PROSet/Wireless client application, I was able to login to my access point on VLAN3 with the following parameters:

• Network Authentication: Open
• Data Encryption: AES
• Mandatory WPA2 with a sufficiently long pre-shared key

I want to use Cisco PEAP or EAP-TLS for 802.1x authentication. However, these features are only supported on full blown RADIUS server implementation. Using the local RADIUS authentication within the AP limits the available EAP options supported. It seems that you can only run EAP, LEAP, and EAP-FAST with the local RADIUS implementatation. Out of the 3, EAP-FAST would be the best recommendation. The other 2 options are not considered to be equivalently strong implementations.

I finally installed FreeRadius on my Linux server and was able to get PEAP/EAP-TLS working properly using CACERT signed SSL certificates. Below I have included a good step-by-step tutorial of this configuration. Also, here are some offsite links to other good articles covering this implementation:

• http://www.dslreports.com/forum/remark,9286052
• http://ldp.rtin.bz/HOWTO/8021X-HOWTO/freeradius.html

Go To Configuration

DISCLAIMER
 
No Warranty of any kind is expressed or implied with respect to the information contained in this document!
The information found here is compiled for the convenience of anyone looking for general guidelines and best practices for configuration based on my own professional experience, as well as industry standards.
Use this information at your own risk!
 
Scott S. 2007

Example Configuration for the Cisco AP1220B Access Point

version 12.3
service nagle
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone year
service password-encryption
service sequence-numbers
!
hostname w5418-ap1
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
clock timezone EST -5
clock summer-time EDT recurring
clock save interval 24
ip subnet-zero
no ip source-route
ip domain name thewaystation.com
ip name-server 192.168.x.x
ip name-server 4.2.2.1
!
!
ip ssh time-out 30
aaa new-model
!
!
aaa group server radius rad_eap
 server 192.168.x.x auth-port 1812 acct-port 1813
!
aaa authentication login default local
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local 
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 activity-timeout client default 3600
!
dot11 ssid external
   vlan 3
   max-associations 10
   authentication open 
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
dot11 ssid internal
   vlan 1
   max-associations 2
   authentication open eap eap_methods
   authentication network-eap eap_methods
   authentication key-management wpa
!         
dot11 ssid voip
   vlan 2
   max-associations 2
   authentication open eap eap_methods
   authentication network-eap eap_methods
   authentication key-management wpa
!
dot11 phone
!
!
username user privilege 15 password 7 xxxxxxxxxxxxxxxxxxxxxxx
!
bridge irb
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption mode ciphers aes-ccm tkip 
 !
 encryption vlan 1 mode ciphers aes-ccm tkip 
 !
 encryption vlan 3 mode ciphers aes-ccm tkip 
 !
 encryption vlan 2 mode ciphers aes-ccm tkip 
 !
 broadcast-key vlan 1 change 3600
 !
 broadcast-key vlan 3 change 3600
 !
 broadcast-key vlan 2 change 3600
 !
 ssid external
 !
 ssid internal
 !
 ssid voip
 !
 speed basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
 no power client local
 station-role root
 rts threshold 2312
 payload-encapsulation dot1h
 no dot11 extension aironet
 no cdp enable
 dot1x reauth-period 1800
!
interface Dot11Radio0.1
 encapsulation dot1Q 1 native
 no ip route-cache
 no cdp enable
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio0.2
 encapsulation dot1Q 2
 no ip route-cache
 no cdp enable
 bridge-group 2
 bridge-group 2 subscriber-loop-control
 bridge-group 2 block-unknown-source
 no bridge-group 2 source-learning
 no bridge-group 2 unicast-flooding
 bridge-group 2 spanning-disabled
!
interface Dot11Radio0.3
 encapsulation dot1Q 3
 no ip route-cache
 no cdp enable
 bridge-group 3
 bridge-group 3 subscriber-loop-control
 bridge-group 3 block-unknown-source
 no bridge-group 3 source-learning
 no bridge-group 3 unicast-flooding
 bridge-group 3 spanning-disabled
!
interface FastEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 hold-queue 160 in
!
interface FastEthernet0.1
 description Wireless Internal Secure Trunk
 encapsulation dot1Q 1 native
 no ip route-cache
 bridge-group 1
 no bridge-group 1 source-learning
 bridge-group 1 spanning-disabled
!
interface FastEthernet0.2
 description Wireless VoIP Trunk
 encapsulation dot1Q 2
 no ip route-cache
 bridge-group 2
 no bridge-group 2 source-learning
 bridge-group 2 spanning-disabled
!
interface FastEthernet0.3
 description Wireless External Trunk
 encapsulation dot1Q 3
 no ip route-cache
 bridge-group 3
 no bridge-group 3 source-learning
 bridge-group 3 spanning-disabled
!
interface BVI1
 ip address 192.168.x.x 255.255.255.0
 no ip route-cache
!
ip default-gateway 192.168.x.x
ip http server
ip http authentication local
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1 
!
logging trap notifications
logging origin-id hostname
logging 192.168.x.x
snmp-server community xxxxxx RO
snmp-server enable traps tty
!
radius-server attribute 32 include-in-access-req format %h
radius-server host 192.168.x.x auth-port 1812 acct-port 1813 key 7 xxxxxxxxxxxxxxxxxxxxxxx
radius-server vsa send accounting
!
control-plane
!
bridge 1 route ip
!         
!
banner login ^C

                   Unauthorized Use Is Prohibited

       Access to this device or attached networks is expressly 
            prohibited without express written permission.
         Violators will be prosecuted to the fullest extent 
                  of both civil and criminal law.
     
^C
banner motd ^C

  Welcome to w5418-ap1.thewaystation.com!
  All activity is logged and audited.

^C
!
line con 0
 exec-timeout 0 0
 timeout login response 120
 password 7 xxxxxxxxxxxxxxxxxx
 logging synchronous
 terminal-type ansi
 length 40
 transport preferred none
line vty 0 4
 exec-timeout 15 0
 timeout login response 120
 password 7 xxxxxxxxxxxxxxxxxx
 logging synchronous
 terminal-type ansi
 length 40
 transport input telnet ssh
line vty 5 15
!
sntp server 192.168.x.x
end

DISCLAIMER
 
No Warranty of any kind is expressed or implied with respect to the information contained in this document!
The information found here is compiled for the convenience of anyone looking for general guidelines and best practices for configuration based on my own professional experience, as well as industry standards.
Use this information at your own risk!
 
Scott S. 2007

...
# req_extensions = v3_req

# The extensions to add to a certificate request

[ req_distinguished_name ]

countryName = Country Name (2 letter code)
countryName_default = US
countryName_min = 2
countryName_max = 2

stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Tennessee

localityName = Locality Name (eg, city)
localityName_default = Brentwood

0.organizationName = Organization Name (eg, company)
0.organizationName_default = Helava

organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = Engineering

commonName = Common Name (eg, YOUR name)
commonName_max = 64
commonName_default = HAI

emailAddress = Email Address
emailAddress_max = 40
emailAddress_default = ohb@cmcast.net

# SET-ex3 = SET extension number 3

[ req_attributes ]

challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
challengePassword_default = whatever

unstructuredName = An optional company name

client 192.168.1.0/24 {
	secret = AP_Shared_Secret
	shortname = WLAN
}

eap {
	default_eap_type = md5

tls {
	private_key_password = whatever
	private_key_file = /usr/local/radius/etc/1x/cert-srv.pem
	certificate_file = /usr/local/radius/etc/1x/cert-srv.pem
	CA_file = /usr/local/radius/etc/1x/root.pem
	dh_file = /usr/local/radius/etc/1x/dh
	random_file = /usr/local/radius/etc/1x/random
	fragment_size = 1024
	include_length = yes
}

eap {
	default_eap_type = peap

peap {
	default_eap_type = mschapv2
}

More details coming...

Last Revised: Monday, 20-Oct-2008 22:24:50 EDT

© thewaystation.com 1993-2009

Privacy Statement