Revision as of 13:22, 8 August 2016

Overview

The wireless infrastructure currently has many limitations and is slated for a complete overhaul in Q2 2016. This page is dedicated to the planning of this project.

Planning Notes

Wireless hardware/vendor considerations

Zebra AP-7532

Wireless 802.11ac, 3x3 dual radio.
WiNG 5.8 controller OS
One AP serves as the

Former considerations

3 x Ruckus Wireless R710 access points
- http://ca.insight.com/en_CA/search.html?qtype=all&q=ruckus
- 1 x ZoneDirector 1200
- Deemed too expensive and wireless clients wouldn't be able to take advantage of the advanced features of the AP (802.11k, 4x4 AC wave 2 etc.)

Proposed wireless configuration changes

WLAN security

WPA2

Currently, the Psion wireless access points (the RF infrastructure) employ WPA2-Enterprise authentication: AES encryption and EAP authentication. While on paper this may seem "proper", EAP authentication is overkill. First of all, the EAP-type used is 802.1x and avails of the internal RADIUS functionality of the access point. Therefore, we're using an advanced authentication mechanism designed to work with large-userbase, centralized auth servers, but we're using a single, generic username/password pair ("gunuser2") for all devices and we're using the RADIUS capabilities of an ARM CPU-powered access point. Moreover, EAP authentication in a high-roam setting is most ideal with one of the key-caching/fast-roam mechanisms that have developed over the years (802.11 standards). Recently, it has been discovered that the caching mechanism configured on the RF guns isn't even compatible with the access point, and the fallback is to not perform key-caching at all. Thus, the RF guns have to re-authenticate with the access point not only every time they roam between access points, but also after very short periods of inactivity. This causes excessive and undue load on the APs. To provide a metaphor, a system like this is like having a key-fob system at every doorway in your household. You re-authenticate too many times and for no good reason.

WPA2-Personal/WPA2-PSK will thus be used in the new setup. Authentication is done according to a shared key (just like your home router), which if compromised can be easily addressed. Traffic is still encrypted through AES.

MAC Filtering

MAC filtering (whitelist) is employed in a the Psion and Cisco access points. It is not a useful practice and will not be carried over to the new setup.

SSIDs

SSIDs for the RF guns, company devices (privileged), and guest access are planned and will each correspond to a different VLAN.

Other Notes

Mirador wireless has to be investigated to see if it's on the same spectrum.

@@ Line 15: / Line 15: @@
 ==Proposed wireless configuration changes==
+===WLAN security===
-Currently, the Psion wireless access points (the RF infrastructure) employ WPA2-Enterprise authentication: AES encryption and EAP authentication. While on paper this may seem "proper", EAP authentication is overkill. First of all, the authentication type is 802.1x and avails of the internal RADIUS functionality of the access point. Therefore, we're using an advanced authentication mechanism designed to work with large-userbase, centralized auth servers, but we're using a single, generic username/password pair ("gunuser2") to authenticate all devices and the RADIUS capabilities of an ARM CPU-powered access point. Moreover, EAP authentication in a roaming setting is ideal with one of the key-caching/fast-roam mechanisms developed. Recently, it has been discovered that the caching mechanism configured on the RF guns isn't even compatible
+====WPA2====
+Currently, the Psion wireless access points (the RF infrastructure) employ WPA2-Enterprise authentication: AES encryption and EAP authentication. While on paper this may seem "proper", EAP authentication is overkill. First of all, the EAP-type used is 802.1x and avails of the internal RADIUS functionality of the access point. Therefore, we're using an advanced authentication mechanism designed to work with large-userbase, centralized auth servers, but we're using a single, generic username/password pair ("gunuser2") for all devices and we're using the RADIUS capabilities of an ARM CPU-powered access point. Moreover, EAP authentication in a high-roam setting is most ideal with one of the key-caching/fast-roam mechanisms that have developed over the years (802.11 standards). Recently, it has been discovered that the caching mechanism configured on the RF guns isn't even compatible with the access point, and the fallback is to not perform key-caching at all. Thus, the RF guns have to re-authenticate with the access point not only every time they roam between access points, but also after very short periods of inactivity. This causes excessive and undue load on the APs. To provide a metaphor, a system like this is like having a key-fob system at every doorway in your household. You re-authenticate too many times and for no good reason.
+WPA2-Personal/WPA2-PSK will thus be used in the new setup. Authentication is done according to a shared key (just like your home router), which if compromised can be easily addressed. Traffic is still encrypted through AES.
+====MAC Filtering====
+MAC filtering (whitelist) is employed in a the Psion and Cisco access points. It is not a useful practice and will not be carried over to the new setup.
+===SSIDs===
+SSIDs for the RF guns, company devices (privileged), and guest access are planned and will each correspond to a different VLAN.
+==Other Notes==
+* Mirador wireless has to be investigated to see if it's on the same spectrum.
 [[Category:I.T. Projects and Ideas]]

Difference between revisions of "Information Systems:Exploring a wireless (WLAN) redesign"