Information Systems:Exploring a wireless (WLAN) redesign

Overview

The wireless infrastructure currently has many limitations and is slated for a complete overhaul in Q2 2016. This page is dedicated to the planning of this project.

Planning Notes

Wireless hardware/vendor considerations

Zebra AP-7532

• Wireless 802.11ac, 3x3 dual radio.
• WiNG 5.8 controller OS
• One AP serves as the

Former considerations

• 3 x Ruckus Wireless R710 access points
  • http://ca.insight.com/en_CA/search.html?qtype=all&q=ruckus
  • 1 x ZoneDirector 1200
  • Deemed too expensive and wireless clients wouldn't be able to take advantage of the advanced features of the AP (802.11k, 4x4 AC wave 2 etc.)

Proposed wireless configuration changes

WLAN security

WPA2

Currently, the Psion wireless access points (the RF infrastructure) employ WPA2-Enterprise authentication: AES encryption and EAP authentication. While on paper this may seem "proper", EAP authentication is overkill. First of all, the EAP-type used is 802.1x and avails of the internal RADIUS functionality of the access point. Therefore, we're using an advanced authentication mechanism designed to work with large-userbase, centralized auth servers, but we're using a single, generic username/password pair ("gunuser2") for all devices and we're using the RADIUS capabilities of an ARM CPU-powered access point. Moreover, EAP authentication in a high-roam setting is most ideal with one of the key-caching/fast-roam mechanisms that have developed over the years (802.11 standards). Recently, it has been discovered that the caching mechanism configured on the RF guns isn't even compatible with the access point, and the fallback is to not perform key-caching at all. Thus, the RF guns have to re-authenticate with the access point not only every time they roam between access points, but also after very short periods of inactivity. This causes excessive and undue load on the APs. To provide a metaphor, a system like this is like having a key-fob system at every doorway in your household. You re-authenticate too many times and for no good reason.

WPA2-Personal/WPA2-PSK will thus be used in the new setup. Authentication is done according to a shared key (just like your home router), which if compromised can be easily addressed. Traffic is still encrypted through AES.

MAC Filtering

MAC filtering (whitelist) is employed in a the Psion and Cisco access points. It is not a useful practice and will not be carried over to the new setup.

SSIDs

SSIDs for the RF guns, company devices (privileged), and guest access are planned and will each correspond to a different VLAN.

Captive Portal

Captive portal functionality is built in to the access points (complete with HTTP server). This will be used to serve authentication functionality for the guest wireless network.

Radio configuration

The new model of access point will have dual radios - 2.4GHz and 5GHz (802.11n/ac). Both will be enabled, but the intent will be to drive non-RF-gun traffic towards the 5GHz band to mitigate congestion on the delicate 2.4GHz band. This requires enabling certain SSIDs on specific APs only.

Other Notes

• Mirador wireless has to be investigated to see if it's on the same spectrum.

Pilot test: DC Receiving

DC Receiving is the ideal area for testing the access point for the following reasons:

• There is no inter-access point roaming within Receiving, unlike the Picking zones, where RF users are highly mobile.
• Several access points and networks serve this area - including the DHL/guest network, the mobile printer network, and the current RF gun network.
• A Mirador access point exists nearby and there is also a lot of temperature probe traffic in this area, thus it would be a good test of the co-harmony of the networks.