An Airport is planning an enterprise-wide wireless network for employees and air

Question

An Airport is planning an enterprise-wide wireless network for employees and airline staff only. This network will be connected to the airport’s existing wired network. You are given the task of designing this network with the highest degree of security possible:
a. Illustrate and Describe your design indicating all authentication and encryption algorithms used.
b. Describe how the user device discover and associate with the network’s access point.
c. Describe how a user is authenticated in your design.
d. Describe how the keys between the user device and the access point are agreed upon.
e. Describe how each transmission key is determined.

Explanation / Answer

First we need to have wireless controller in place . All the access points registered to this controller , managed and monitored from this central device.
Access point's SSID, Password, encryption details configured via wireless controller.The subnet /VLAN for each access points defined in WLC.
WPA2- Enterprise authentication protocol recommended.
To use WPA2-Enterprise, you’ll need a RADIUS authentication server.RADIUS stands for Remote Authentication Dial In User Service.To authenticate with such a server, a variety of EAP — Extensible Authentication Protocols — can be used. After connecting to the Wi-Fi network, each client would have to log in with a username and password.Traffic to each client would be encrypted with a unique encryption key which isn’t derived from a pre-shared key.

Brief association process:       

Mobile device (supplicant ) when starts association process with Access points(authenticator) ,
authenticator will forward the credentials to authentication servers (Radius server),
which is synced with domain controller for updated credentials. once credentials matched ,
it will ask DHCP server to release the valid IP address for supplicant . Therefore the supplicant gets associated and connected to to wireless network with valid IP address.
Now supplicant can start transmitting the data.

Hope this makes sense. you need to refer 802.1x authentication process in detail to understand the packet level negatiations.

Thanks

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.