1. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-1 Security Olga Torstensson Halmstad University

2. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-2 Key terms WEP TKIP MIC EAP 802.1X WPA CCKM RADIUS SSH Encryption RSA RC4 (WEP) DES, 3DES, AES Cipher BKR

3. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-3 Advanced Security Terms WEP – Wired Equivalent Privacy EAP – Extensible Authentication Protocol TKIP – Temporal Key Integrity Protocol CKIP – Cisco Key Integrity Protocol CMIC – Cisco Message Integrity Check Broadcast Key Rotation – Group Key Update WPA – Wi-Fi Protected Access (WPA)

4. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-4 Security Fundamentals Balancing Security and Access

5. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-5 Vulnerabilities Technology –TCP/IP –WEP and Broadcast SSID –Association Process –Wireless Interference Configuration –Default passwords –Unneeded Services enabled –Few or no filters –Poor device maintenance Policy –Weak Security Policy –No Security Policy –Poorly enforced Policy –Physical Access –Poor or no monitoring

6. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-6 Threats Internal External Structured Unstructured

7. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-7 The Security Attack—Recon and Access

8. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-8 The Security Attacks—DoS

9. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-9 WLAN Security Wheel Always have a good WLAN Security Policy in place. Secure the network based on the policy

10. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-10 WLAN Security Considerations Authentication – only authorized users and devices should be allowed. Encryption – traffic should be protected from unauthorized access. Administration Security – only authorized users should be able to access and configure the AP configuration interfaces.

11. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-11 Common Protocols which use Encryption When using a public network such as a WLAN, FTP, HTTP, POP3, and SMTP are insecure and should be avoided whenever possible. Utilize protocols with encryption. Traffic No Encryption Encryption Web Browsing HTTPS * HTTP File Transfer TFTP or FTP SCP Email Remote Mgmt POP3 or SMTP SPOP3 * Telnet SSH * SSL/TLS

12. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-12 WLAN Security Hierarchy Virtual Private Network (VPN) No Encryption, Basic Authentication Public “Hotspots” Open Access 40-bit or 128-bit Static WEP Encryption Home Use Basic Security 802.1x, TKIP/WPA Encryption, Mutual Authentication, Scalable Key Mgmt., etc. Business Enhanced Security Remote Access Business Traveler, Telecommuter

13. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-13 Basic WLAN Security Admin Authentication on AP To prevent unauthorized access to the AP configuration interfaces: Configure a secret password for the privileged mode access. (good) Configure local usernames/passwords. (better) Configure AP to utilize a security server for user access. (best)

14. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-14 User Manager

15. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-15 Admin Access CLI View

16. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-16 Console Password

17. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-17 SSID Manager

18. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-18 SSID Manager (cont)

19. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-19 Global SSID Properties

20. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-20 SSID CLI View

21. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-21 WEP WEP is a key. WEP scrambles communications between AP and client. AP and client must use same WEP keys. WEP keys encrypt unicast and multicast. WEP is easily attacked

22. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-22 Supported Devices What can be a client? Client Non-Root bridge Repeater access point Workgroup Bridge Authenticator? Root access point Root bridge ?

23. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-23 Enabling LEAP on the Client

24. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-24 Configuring LEAP on the Client

25. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-25 WEP Encryption Keys

26. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-26 Enterprise WLAN Authentication Authentication Types Open Authentication to the Access Point Shared Key Authentication to the Access Point EAP Authentication to the Network MAC Address Authentication to the Network Combining MAC-Based, EAP, and Open Authentication Using CCKM for Authenticated Clients Using WPA Key Management

27. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-27 WLAN Security: 802.1X Authentication Mutual Authentication EAP-TLS EAP-Transport Layer Security Mutual Authentication implementation Used in WPA interoperability testing LEAP “Lightweight” EAP Nearly all major OS’s supported: –WinXP/2K/NT/ME/98/95/CE, Linux, Mac, DOS PEAP “Protected” EAP Uses certificates or One Time Passwords (OTP) Supported by Cisco, Microsoft, & RSA GTC (Cisco) & MSCHAPv2 (Microsoft) versions Client AP Radius Server

28. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-28 EAP Extensible Authentication Protocol (802.1x authentication) Provides dynamic WEP keys to user devices. Dynamic is more secure, since it changes. Harder for intruders to hack…by the time they have performed the calculation to learn the key, they key has changed!

29. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-29 Basic RADIUS Topology RADIUS can be implemented: Locally on an IOS AP Up to 50 users On a ACS Server

30. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-30 Local Radius Server

31. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-31 Local Radius Server Statistics

32. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-32 Radius Server User Groups

33. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-33 ACS Server Options Cisco Secure ACS Software Cisco ACS Solution Engine

34. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-34 Backup Security Server Manager

35. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-35 Global Server Properties

36. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-36 Enterprise Encryption WPA Interoperable, Enterprise-Class Security

37. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-37 Cipher “Suite” Cipher suites are sets of encryption and integrity algorithms. Suites provide protection of WEP and allow use of authenticated key management. Suites with TKIP provide best security. Must use a cipher suite to enable: WPA – Wi-Fi Protected Access CCKM – Cisco Centralized Key Management

38. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-38 Configuring the Suite Create WEP keys Enable Cipher “Suite” and WEP Configure Broadcast Key Rotation Follow the Rules

39. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-39 WEP Key Restrictions Security ConfigurationWEP Restriction CCKM or WPA key mgt.No WEP in slot 1 LEAP or EAPNo WEP in slot 4 40-bit WEPNo 128-bit key 128-bit WEPNo 40-bit key TKIPNo WEP keys TKIP and 40 or 128 WEPNo WEP in slot 1 and 4 Static WEP w/MIC or CMIC WEP and slots must match on AP & client Broadcast key rotationKeys in slots 2 & 3 overwritten

40. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-40 Security Levels

41. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-41 Enterprise WLAN Security Evolution TKIP/WPA Successor to WEP Cisco’s pre-standard TKIP has been shipping since Dec.’01 Cisco introduced TKIP into 802.11i committee 802.11i-standardized TKIP part of Wi-Fi Protected Access (WPA) WPA software upgrade now available for AP1100 & AP1200 AES The “Gold Standard” of encryption AES is part of 802.11i standard –- AES will be part of WPA2 standard (expected in 2004)

42. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-42 Encryption Modes

43. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-43 Encryption Global Properties

44. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-44 Matching Client to AP

45. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-45 Matching Client to AP

46. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-46 Matching Client to AP

47. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-47 Matching Client to AP

48. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-48 Matching Client to AP

49. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-49 Matching Client to AP

50. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-50 Advanced Security: MAC Authentication

51. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-51 Adv. Security: EAP Authentication

52. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-52 Adv. Security: Timers

53. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-53 VLANs Configuring your access point to support VLANs is a three-step process: Assign SSIDs to VLANs. Assign authentication settings to SSIDs. Enable the VLAN on the radio and Ethernet ports.

54. © 2003, Cisco Systems, Inc. All rights reserved. FWL 1.0—8-54 Using VLANs for Security SSID: data Security: PEAP + AES 802.1Q wired network w/ VLANs SSID: visitor Security: None AP Channel: 6  SSID “data” = VLAN 1  SSID “voice” = VLAN 2  SSID “visitor” = VLAN 3 SSID: voice Security: LEAP + WPA