- Introduction
- Understanding the Threats
- Deploying a Secure Wireless Network
- Wireless Implementation Guidelines
- Chapter Summary
- Apply Your Knowledge
This chapter is from the book
This chapter is from the book
This chapter is from the book
Wireless Implementation Guidelines
Objectives:
- Identify and describe the purpose of the components in a small wireless network. (Including: SSID, BSS, ESS)
- Identify the basic parameters to configure on a wireless network to ensure that devices connect to the correct access point
Now that you've read an overview of the wireless security considerations, let's talk about planning to implement wireless technology. There's much more to planning a wireless LAN deployment than putting a few wireless access points in place. You need to understand how the topology, distance, and placement of wireless access points can affect the efficiency of your wireless LAN.
Understanding Wireless Topologies
Webster's Dictionary defines "topology" as a branch of mathematics concerned with properties of geometric configurations (such as point sets) that are unaltered by elastic deformations (as stretching or twisting) that are homeomorphisms. The CCENT and CCNA exams stop short of requiring a full understanding of homeomorphism (or elastic deformation, for that matter). However, the exams do require you to have some knowledge of the placement of wireless access points in your corporate network. The first piece to understand is that anyone can deploy a wireless network in one of two forms: ad hoc or infrastructure.
Ad hoc wireless networks technically use an Independent Basic Service Set (IBSS) topology. This means that each wireless device independently manages the wireless network. This type of wireless network originates from and includes the wireless device, as shown in Figure 18.3.
)
Figure 18.3 Ad hoc wireless networking.
This type of network can be created by users on-the-fly to share files or services with others. For example, someone on an airplane might want to share a folder of files with the person next to her. She can create an ad hoc wireless network and allow the other person to join and access the shared files over a network connection.
Ad hoc networks typically are very limited in range and security capabilities. You may want to consider restricting laptops in your corporation from starting ad hoc wireless networks, because they could be considered a potential security vulnerability.
Infrastructure wireless networks are a far more common topology. This involves using a dedicated piece of equipment (typically a wireless access point) to initiate and manage the wireless network. Wireless access points can be configured to use one of two infrastructure modes: Basic Service Set (BSS) or Extended Service Set (ESS). The BSS is the simplest form of wireless network. It includes a single wireless access point managing a group of clients, as shown in Figure 18.4.
)
Figure 18.4 A single basic service set design.
An ESS is a wireless topology (note the word change from "network" to "topology") that includes two or more wireless access points providing extended wireless coverage across the network, as shown in Figure 18.5.
)
Figure 18.5 An extended service set design.
In Figure 18.5, notice that the wireless coverage overlaps. Wireless best practices state that you should have a 10 to 15% overlap in your wireless coverage. This allows you to implement seamless roaming, allowing a wireless client to move between access points with no service interruption. This is not as critical for data clients, such as laptops. Rather, real-time wireless clients such as 802.11-compatible cell phones, cordless VoIP phones, and some PDAs benefit from the overlapping coverage. Imagine dropping a phone call anytime you moved more than 300 feet in the network! More steps are involved in implementing seamless wireless roaming, but the 10 to 15% overlapping coverage is the starting point.
The second thing to notice in Figure 18.5 is that the channels are different on the two wireless access points. One of the wireless access points uses Channel 11, and the other uses Channel 6. This prevents the two wireless access points from interfering with each other. This channel concept is more fully discussed in Chapter 17, "Understanding Wireless Networking."
Understanding Wireless Data Rates
So you purchased a new 802.11g wireless access point and implemented it with clients running 802.11g cards. 54Mbps of pure wireless speed—right? Wrong! You may have purchased an access point capable of handling 54Mbps, but you will never reach that speed. Never! Repeated performance tests have revealed that actual data rates are about half of the theoretical data rate, on average. This means that your 802.11b access point typically averages about a 5Mbps actual data rate. 802.11g usually is in the 20Mbps range. You might be wondering why the standard says that you can handle 54Mbps when the actual throughput is much less. Well, there are many reasons.
Suppose you travel to the moon in an oxygen-free environment. You carry a single wireless access point and a single wireless card plugged into a single solar-powered laptop that does nothing but run the wireless card (no Bluetooth, no electrical interference). You sit with the wireless access point about 2 feet from the laptop and only send or receive data (never both). You might get close to the 54Mbps capability. But even that is stretching it. When you move from the world of cables into the world of wireless, you open yourself to an entirely different style of communication. One of the first considerations that you'll notice is the truth behind the range of the access point. Yes, in an obstruction-free environment, the 802.11b/g wireless signal can travel 300 feet. But couple that fact with the idea that higher data rates (11Mbps for 802.11b and 54Mbps for 802.11g) require stronger signals. You'll find that the data rates step down the farther you go from the access point. The following steps are defined for each standard:
- 802.11a and 802.11g:
- Step 1: 54Mbps
- Step 2: 48Mbps
- Step 3: 36Mbps
- Step 4: 24Mbps
- Step 5: 18Mbps
- Step 6: 12Mbps
- Step 7: 9Mbps
- Step 8: 6Mbps
- 802.11b:
- Step 1: 11Mbps
- Step 2: 5.5Mbps
- Step 3: 2Mbps
- Step 4: 1Mbps
So, when you picture wireless data rates coming from your wireless access point, think of them as a radial circle for each rate, with the rates continually decreasing the farther you go. This is represented in Figure 18.6.
)
Figure 18.6 Wireless data rates.
You'll notice that no exact measurement is attached to each of the radial circles dictating speed around the wireless access point. That's because range is not the only criterion to consider when determining wireless data throughput. From Chapter 17, you'll remember that wireless shares the unlicensed FCC frequency bands with many other pieces of equipment. Bluetooth, other 802.11 wireless clients, cordless phones, and microwave ovens are just a few that can cause interference. Couple that with typical obstructions such as walls, cubicles, desks, and so on, and you have a wireless signal that varies from business environment to business environment. It is impossible to say just how far and "clean" the signal will be in your specific environment. Many companies make testing equipment that displays the signal strength and data rate to a laptop or PDA screen. This gives you a good idea of how wireless will fare in your environment.
The saving grace of wireless data rates is the fact that most users will not notice. Most devices that use a wireless signal are used for lower-bandwidth communication. For example, a wireless VoIP phone consumes about 100Kbps of bandwidth. Laptops used in wireless environments typically surf the net or check email. Most devices that handle large data file transfers or other high-bandwidth communication typically are hardwired.
General Wireless Implementation Steps
With all those considerations floating around your mind, here are the general steps to implement wireless:
- Ensure hardwired operation: Before adding any wireless to the network, connect a device (such as a laptop) to the same switch port where you plan to connect your wireless access point. Ensure that it operates as expected, verifying VLAN assignment, DHCP operation, and Internet connectivity (if applicable).
- Install the wireless access point in your tested switch port: Some access points will connect using straight-through Ethernet cabling, and others may require a cross-over cable.
- Configure a basic wireless network and test: Keep this initial test extremely simple. Just implement a wireless SSID with no security. After it is configured, join the wireless network from a client, and test your connectivity. Ensure that the client obtains an IP address and can perform the same actions as when you use a hardwired connection.
- Add wireless security and test: Implement the wireless security standard chosen for your network. It's usually best to begin with a preshared key system of security to keep it simple. After you have added the security, reconfigure the wireless client, and test again.
Working through these four steps, you have established a baseline for your wireless network. As you add more features or security standards on top of the existing foundation, you can return to a "last known good" configuration if something goes wrong.
Wireless Troubleshooting
Objective:
- Identify common issues with implementing wireless networks.
Wireless troubleshooting is far more complex than typical wired troubleshooting. Physical problems are much more elusive, because they deal primarily with interference rather than a simple cable break or failing switch port. For example, I recently deployed in a business a wireless network that worked great until 4 in the afternoon. As soon as we crossed the 4 p.m. barrier, all wireless connectivity was lost. After doing some spectrum analysis, we found that a nearby airport was using a device (we still aren't sure what it was) that completely flooded the 2.4GHz frequency range. The company decided to move to 802.11a (which was a fairly large network upgrade) to avoid this interference.
Likewise, wireless technology is fairly new to the industry. You may find that firmware for your access point has bugs and needs to be upgraded to a newer version to avoid persistent crashing (this happens far more often than you may realize). The following wireless troubleshooting checklist may be helpful as you attempt to diagnose the issue.
Client Troubleshooting
Most wireless issues are related to the client:
- Verify that the wireless card is enabled: Most new laptops have a button or switch that disables the wireless card to save battery life.
- Move to a "known good" region of the building: Do your testing in an area known to have a strong wireless signal. This may require using multiple wireless devices.
- Verify that the client can identify the wireless network using the installed wireless utility: If you are unable to identify wireless SSID(s) in your vicinity, the client's wireless card may be disabled, or the wireless access point may not be working.
- Ensure that the wireless client has the correct wireless security information and supports your security standards: You may need to re-enter the preshared key to ensure that you entered it correctly. Likewise, the wireless card may not support the wireless security on your network. Try connecting to an SSID that does not use security from the wireless device.
Wireless Access Point Troubleshooting
Most troubleshooting that deals with the wireless access point focuses on physical considerations:
- Verify that the wireless access point is running the latest firmware version: Nothing is worse than spending hours on a problem that is related to a bug in the wireless firmware.
- Test the wireless reception radius at different times of the day: Because of the varying degrees of interference that may occur over time, it is best to run multiple tests on your signal strength. You can do this simply and inexpensively by carrying around a laptop and observing the reception at differing locations.
- Verify your wireless channel configuration: If you have multiple wireless access points or are in an area where other access points may interfere, verify (using wireless software) the most saturated and unsaturated channels. For 802.11b/g, use channels 1, 6, or 11 in the U.S. For 802.11a, many more channels are available, and you should test for the cleanest frequency.
- Consider the materials around and close to the access point: Try to avoid installing the access point near metal objects, which reflect the signal. Realize that a concrete block wall will absorb much more signal than a drywall barrier.