Reference Manual for the Double 108 Mbps Wireless Firewall Router WGU624

Wireless Networking Basics

D-17

M-10153-01

Changes to Wireless Access Points

Wireless access points must have their firmware updated to support the following:

•

The new WPA information element

To advertise their support of WPA, wireless APs send the beacon frame with a new 802.11

WPA information element that contains the wireless AP's security configuration (encryption

algorithms and wireless security configuration information).

•

The WPA two-phase authentication

Open system, then 802.1x (EAP with RADIUS or preshared key).

•

TKIP

•

Michael

•

AES

(optional)

To upgrade your wireless access points to support WPA, obtain a WPA firmware update from

your wireless AP vendor and upload it to your wireless AP.

Changes to Wireless Network Adapters

Wireless networking software in the adapter, and possibly in the OS or client application, must be

updated to support the following:

•

The new WPA information element

Wireless clients must be able to process the WPA information element and respond with a

specific security configuration.

•

The WPA two-phase authentication

Open system, then 802.1x supplicant (EAP or preshared key).

•

TKIP

•

Michael

•

AES

(optional)

To upgrade your wireless network adapters to support WPA, obtain a WPA update from your

wireless network adapter vendor and update the wireless network adapter driver.

For Windows wireless clients, you must obtain an updated network adapter driver that supports

WPA. For wireless network adapter drivers that are compatible with Windows XP (Service Pack

1) and Windows Server 2003, the updated network adapter driver must be able to pass the

adapter's WPA capabilities and security configuration to the Wireless Zero Configuration service.

Reference Manual for the Double 108 Mbps Wireless Firewall Router WGU624

D-18

Wireless Networking Basics

M-10153-01

Microsoft has worked with many wireless vendors to embed the WPA firmware update in the

wireless adapter driver. So, to update your Microsoft Windows wireless client, all you have to do is

obtain the new WPA-compatible driver and install the driver. The firmware is automatically

updated when the wireless network adapter driver is loaded in Windows.

Changes to Wireless Client Programs

Wireless client programs must be updated to permit the configuration of WPA authentication (and

preshared key) and the new WPA encryption algorithms (TKIP and the optional AES component).

To obtain the Microsoft WPA client program, visit the Microsoft Web site.

M-10153-01

Glossary

1

Glossary

Use the list below to find definitions for technical terms used in this manual.

List of Glossary Terms

10BASE-T

IEEE 802.3 specification for 10 Mbps Ethernet over twisted pair wiring.

100BASE-Tx

IEEE 802.3 specification for 100 Mbps Ethernet over twisted pair wiring.

3DES

3DES (Triple DES) achieves a high level of security by encrypting the data three times using DES with three

different, unrelated keys.

802.1x

802.1x defines port-based, network access control used to provide authenticated network access and

automated data encryption key management.

The IEEE 802.1x draft standard offers an effective framework for authenticating and controlling user traffic

to a protected network, as well as dynamically varying encryption keys. 802.1x uses a protocol called EAP

(Extensible Authentication Protocol) and supports multiple authentication methods, such as token cards,

Kerberos, one-time passwords, certificates, and public key authentication. For details on EAP specifically,

refer to IETF's RFC 2284.

802.11a

IEEE specification for wireless networking at 54 Mbps operating in unlicensed radio bands over 5 GHz.

802.11b

IEEE specification for wireless networking at 11 Mbps using direct-sequence spread-spectrum (DSSS)

technology and operating in the unlicensed radio spectrum at 2.5 GHz.

802.11g

A soon to be ratified IEEE specification for wireless networking at 54 Mbps using direct-sequence

spread-spectrum (DSSS) technology and operating in the unlicensed radio spectrum at 2.5 GHz. 802.11g is

backwards compatible with 802.11b.

Reference Manual for the Double 108 Mbps Wireless Firewall Router WGU624

2

Glossary

M-10153-01

ADSL

Short for asymmetric digital subscriber line, a technology that allows data to be sent over existing copper

telephone lines at data rates of from 1.5 to 9 Mbps when receiving data (known as the downstream rate) and

from 16 to 640 Kbps when sending data (known as the upstream rate).

ADSL requires a special ADSL modem. ADSL is growing in popularity as more areas around the world

gain access.

AES

Advanced Encryption Standard, a symmetric 128-bit block data encryption technique.

It is an iterated block cipher with a variable block length and a variable key length. The block length and the

key length can be independently specified to 128, 192 or 256 bits.The U.S government adopted the

algorithm as its encryption technique in October 2000, replacing the DES encryption it used. AES works at

multiple network layers simultaneously.

AH

Authentication Header.

ARP

Address Resolution Protocol, a TCP/IP protocol used to convert an IP address into a physical address (called

a DLC address), such as an Ethernet address.

A host wishing to obtain a physical address broadcasts an ARP request onto the TCP/IP network. The host

on the network that has the IP address in the request then replies with its physical hardware address. There is

also Reverse ARP (RARP) which can be used by a host to discover its IP address. In this case, the host

broadcasts its physical address and a RARP server replies with the host's IP address.

Auto Uplink

Auto Uplink

TM

technology (also called MDI/MDIX) eliminates the need to worry about crossover vs.

straight-through Ethernet cables. Auto Uplink

TM

will accommodate either type of cable to make the right

connection.

CA

A Certificate Authority is a trusted third-party organization or company that issues digital certificates used

to create digital signatures and public-private key pairs.

Cat 5

Category 5

unshielded twisted pair (UTP) cabling. An Ethernet network operating at 10 Mbits/second

(10BASE-T) will often tolerate low quality cables, but at 100 Mbits/second (10BASE-Tx) the cable must be

rated as Category 5, or Cat 5 or Cat V, by the Electronic Industry Association (EIA).

This rating will be printed on the cable jacket. Cat 5 cable contains eight conductors, arranged in four

twisted pairs, and terminated with an RJ45 type connector. In addition, there are restrictions on maximum

cable length for both 10 and 100 Mbits/second networks.

Certificate Authority

Reference Manual for the Double 108 Mbps Wireless Firewall Router WGU624

Glossary

3

M-10153-01

A Certificate Authority is a trusted third-party organization or company that issues digital certificates used

to create digital signatures and public-private key pairs.

The role of the CA in this process is to guarantee that the individual granted the unique certificate is, in fact,

who he or she claims to be. Usually, this means that the CA has an arrangement with a financial institution,

such as a credit card company, which provides it with information to confirm an individual's claimed

identity. CAs are a critical component in data security and electronic

commerce because they guarantee that

the two parties exchanging information are really who they claim to be.

CRL

Certificate Revocation List. Each Certificate Authority (CA) maintains a revoked certificates list.

Denial of Service attack

DoS. A hacker attack designed to prevent your computer or network from operating or communicating.

DHCP

An Ethernet protocol specifying how a centralized DHCP server can assign network configuration

information to multiple DHCP clients. The assigned information includes IP addresses, DNS addresses, and

gateway (router) addresses.

DMZ

A Demilitarized Zone is used by a company that wants to host its own Internet services without sacrificing

unauthorized access to its private network.

The DMZ sits between the Internet and an internal network's line of defense, usually some combination of

firewalls and bastion hosts. Typically, the DMZ contains devices accessible to Internet traffic, such as Web

(HTTP) servers, FTP servers, SMTP (e-mail) servers and DNS servers.

DNS

Short for Domain Name System (or Service), an Internet service that translates domain names into IP

addresses.

Because domain names are alphabetic, they're easier to remember. The Internet however, is really based on

IP addresses. Every time you use a domain name, therefore, a DNS service must translate the name into the

corresponding IP address. For example, the domain name www.example.com might translate to

198.105.232.4. The DNS system is, in fact, its own network. If one DNS server doesn't know how to

translate a particular domain name, it asks another one, and so on, until the correct IP address is returned.

Domain Name

A descriptive name for an address or group of addresses on the Internet. Domain names are of the form of a

registered entity name plus one of a number of predefined top level suffixes such as .com, .edu, .uk, etc. For

example, in the address mail.NETGEAR.com, mail is a server name and NETGEAR.com is the domain.

DoS

A hacker attack designed to prevent your computer or network from operating or communicating.