Information Systems:Exploring a wireless (WLAN) redesign

Overview

The wireless infrastructure currently has many limitations and is slated for a complete overhaul in Q2 2016. This page is dedicated to the planning of this project.

Planning Notes

Wireless hardware/vendor considerations

Zebra AP-7532

• Wireless 802.11ac, 3x3 dual radio.
• WiNG 5.8 controller OS
• One AP serves as the controller, no appliance/virtual appliance needed as we will have too few access points.

• UPDATE 5/17: Zebra has been acquired by Extreme Networks, but after establishing a rapport with Extreme Networks, this AP is still a viable choice and will remain as the primary candidate.

Former considerations

• 3 x Ruckus Wireless R710 access points
  • http://ca.insight.com/en_CA/search.html?qtype=all&q=ruckus
  • 1 x ZoneDirector 1200
  • Deemed too expensive and wireless clients wouldn't be able to take advantage of the advanced features of the AP (802.11k, 4x4 AC wave 2 etc.)
• Meraki access points
  • Cloud-managed and likely focuses on carpeted office space

Proposed wireless configuration changes

WLAN security

WPA2

Currently, the Psion wireless access points (the RF infrastructure) employ WPA2-Enterprise authentication: AES encryption and EAP authentication. While on paper this may seem "proper", EAP authentication is overkill. First of all, the EAP-type used is 802.1x and avails of the internal RADIUS functionality of the access point. Therefore, we're using an advanced authentication mechanism designed to work with large-userbase, centralized auth servers, but we're using a single, generic username/password pair ("gunuser2") for all devices and we're using the RADIUS capabilities of an ARM CPU-powered access point. Moreover, EAP authentication in a high-roam setting is most ideal with one of the key-caching/fast-roam mechanisms that have developed over the years (802.11 standards). Recently, it has been discovered that the caching mechanism configured on the RF guns isn't even compatible with the access point, and the fallback is to not perform key-caching at all. Thus, the RF guns have to re-authenticate with the access point not only every time they roam between access points, but also after very short periods of inactivity. This causes excessive and undue load on the APs. To provide a metaphor, a system like this is like having a key-fob system at every doorway in your household. You re-authenticate too many times and for no good reason.

WPA2-Personal/WPA2-PSK will thus be used in the new setup. Authentication is done according to a shared key (just like your home router), which if compromised can be easily addressed. Traffic is still encrypted through AES.

MAC Filtering

MAC filtering (whitelist) is employed in a the Psion and Cisco access points. It is not a useful practice and will not be carried over to the new setup.

SSIDs

SSIDs for the RF guns, company devices (privileged), and guest access are planned and will each correspond to a different VLAN.

Captive Portal

Captive portal functionality is built in to the access points (complete with HTTP server). This will be used to serve authentication functionality for the guest wireless network.

Radio configuration

The new model of access point will have dual radios - 2.4GHz and 5GHz (802.11n/ac). Both will be enabled, but the intent will be to drive non-RF-gun traffic towards the 5GHz band to mitigate congestion on the delicate 2.4GHz band. This requires enabling certain SSIDs on specific APs only.

Other Notes

• Mirador wireless has to be investigated to see if it's on the same spectrum.

Pilot test: DC Receiving

DC Receiving is the ideal area for testing the access point for the following reasons:

• There is no inter-access point roaming within Receiving, unlike the Picking zones, where RF users are highly mobile.
• Several access points and networks serve this area - including the DHL/guest network, the mobile printer network, and the current RF gun network.
• A Mirador access point exists nearby and there is also a lot of temperature probe traffic in this area, thus it would be a good test of the co-harmony of the networks.

Since there are only 3 possible channels to work with on the 2.4GHz spectrum, it will not ideal to have both test and production wireless networks running simultaneously. Thus the plan will be as follows:

• Configure all production belt printers to connect to test access point.
• Configure 6 spare RF guns to connect to new access point.
• Shut down Cisco network for mobile printers and connect mobile printers to new access point.
• Configure Cisco AP to mirror network config of the new access point so mobile printers will not have to be reconfigured when testing is finished.
• Shut down DHL guest network.
• Shut down Psion RF access point and connect RF guns to new access point

Business Case Planning

Major Talking Points

• Some wireless access points are showing signs of memory corruption, and become unable to be administrated.
• Current features don't allow the cluster of RF APs to lock the same channel
• UPDATE 5/17: A conference call with TRG revealed that WPA2-PSK (AES CCMP) is more than sufficient to secure the guns. Currently, 802.1x is employed, and the handshake authentication required when roaming between access points is what I've always believed causes delays.
• UPDATE 5/17: For the AP-7532 access points, the external antennae model is more appropriate for the warehouse according to TRG.