CWDP 305 Chapter 3 Defining Requirement Areas

In this chapter, we learn of specific requirements relating to facility areas
(requirement areas) that are impacted by client device types, security settings, application
specifics and SSIDs and WLAN profiles.

• When selecting WLAN architectures, the basic choices are among controller‐based, cloud‐based, and autonomous architectures.

In a WLAN, channel capacity is affected by the number of Basic Service Sets (BSSs) operating on the same channel. Each Access Point sends Beacon frames about 9.76 times per second, so multiple BSSs increase this rate and can consume 10-13% of channel capacity. Using multiple APs with the same SSID also reduces capacity. Additionally, the total capacity is further diminished by the number of client devices communicating through the channel. So, capacity is determined by the total devices in the channel, not just those in a single BSS, as they impact each other within the same coverage area.

Desiging a WLAN just like a houseparty

Ok so let's explain it this way, think of designing a wireless network (WLAN) like planning a party in a house, because we all know how to party, right? The "requirement areas" are like the different aspects you need to consider: the size of the house (capacity), the type of guests (device types), the music and activities planned (applications), the house rules (security), and how many people can comfortably fit in each room (quality requirements).

Choosing the right setup like whether to have a DJ (use of a Controller), stream music from the cloud (cloud), or let everyone play their own tunes (autonomous), depends on understanding these factors. If too many guests (devices) crowd into one room (channel), it can get noisy and chaotic, making it hard for anyone to enjoy the party. So, just like a well-planned party, a successful WLAN needs careful consideration of all these elements to ensure everyone has a good time.

Radio Resource Management (RRM) helps manage the channels that these APs use, making sure they’re not interfering with each other. Sometimes, especially outdoors, you might need to set these channels manually to avoid issues, much like adjusting the volume of different speakers to ensure a balanced sound throughout the house.

When planning a Wi-Fi network, the goal is to reduce interference, which can slow down your connection. You can create RF profiles, which are like custom settings for groups of APs to make everything run better, ensuring that the music and conversations remain clear and enjoyable for everyone.

The 802.11ac standard works on the 5GHz band, but you’ll find dual-band devices that also use the older 2.4GHz band with 802.11n. This is similar to having different music genres playing in various rooms, catering to the diverse tastes of your guests. For security, Public Key Infrastructure (PKI) uses Certificate Authorities (CAs) to issue certificates that help keep your data safe during online activities, much like having a guest list and a bouncer to ensure that only invited friends can join the fun.

As the party continues, you’ll want to ensure that every guest feels included and has a great time. By understanding the dynamics of your WLAN, just like the flow of a party, you can create an environment where everyone stays connected, engaged, and happy, ensuring that the celebration lasts all night long.

802.11 Key Hierarchy

The Pairwise Transient Key (PTK) is a security key created during a handshake process after you log in to the network, ensuring your data stays secure. When planning for network capacity, it’s important to know what apps you’ll be using and how many devices will connect, so the network can handle the load.

Fast Basic Service Set (BSS) Transition helps you switch between APs quickly without losing your connection. The Fast BSS Transition (FT) Four-Way Handshake is a security step that confirms both your device and the AP have the right keys to communicate securely.

A mobility domain is a group of BSSs that support these fast transitions, making it easier for your device to stay connected. There are two ways to transition: Over-the-Air FT, which lets your device talk directly to the new AP for a quicker switch, and Over-the-DS FT, which goes through the current AP, which can be a bit slower.

The 802.1X authentication process involves a key hierarchy essential for understanding key caching during wireless communication. The key components:

1. Master Session Key (MSK): Unique to each client session, generated during the EAP exchange, and used to create the Pairwise Master Key (PMK).
2. Pairwise Master Key (PMK): Derived from the MSK and shared between the client device (Supplicant) and the Authenticator (WLC).
3. Pairwise Transient Key (PTK): Created during a four-way handshake using the PMK and nonce values, this key encrypts data frames and is never transmitted over the air.
4. Group Master Key (GMK): A supporting key for generating a Group Temporal Key (GTK), which can be periodically regenerated to enhance security.
5. Group Temporal Key (GTK): Protects broadcast or multicast data on a wireless link.

To facilitate efficient roaming, protocols like 802.11k and 802.11r are utilized. Key features include:

• 802.11k: Provides neighbor reports to help devices identify nearby access points (APs) for quicker transitions.
• 802.11r: Enables fast, secure handoffs by caching keys established during the initial 802.1X process.

Key definitions from 802.11r include:

• Fast BSS Transition: Minimizes connectivity loss when moving between BSSs within the same ESS.
• FT Four-Way Handshake: Confirms possession of the PMK and distributes the GTK during mobility domain associations.
• Mobility Domain: A set of BSSs supporting fast transitions, identified by a mobility domain identifier (MDID).

Pre-authentication allows a wireless station to prepare for connectivity with another AP while remaining connected to its current AP, reducing roaming delays.

PMK Caching eliminates the need for the full 802.1X process during roaming by allowing APs to cache PMK identifiers, enabling immediate transition to the four-way handshake.

Opportunistic Key Caching (OKC) extends PMK caching by sharing the client’s PMKID across all APs in the same Layer 2 network, facilitating quicker roams without additional overhead, making it particularly beneficial for real-time applications like VoIP.

Latency for VoIP should be under 150 ms unidirectional and 300 ms RTT with less than 1% packet loss, influenced by connectivity and processing devices.

Throughput indicates data transfer rates, with applications needing specific demands; for example, 50 users may require 12.5 Mbps if each needs 250 Kbps.

For voice, latency is critical, while both latency and throughput matter for video, especially live streaming. VoIP devices require a signal strength of -67 dBm and a SNR of 25 dBm.

Video conferencing needs careful design, as seen in a university requiring 20 APs for 400 students. Streaming video uses buffering to manage latency, making it essential to address these requirements for effective WLAN design.

Network firewalls may need reconfiguration to allow LWAPP (UDP ports 12222 and 12223) and CAPWAP (UDP ports 5246 and 5247) traffic. Consult vendor documentation for additional port requirements. ACLs manage network traffic by allowing necessary communications and blocking unauthorized access, enhancing security. RADIUS is essential for authentication, often using directory services like Microsoft Active Directory via LDAP. It also helps generate encryption keys for WLAN data. Choosing the right EAP type is crucial for security. Common types include: PEAP: Requires only server certificates and EAP-TLS: Requires both client and server certificates. WLANs use three main security protocols:

1. WPA: WPA-PSK (256-bit key) for personal; 802.1x EAP with TKIP for enterprise.
2. WPA2: WPA2-PSK (256-bit key) for personal; 802.1x EAP with CCMP for enterprise.
3. WPA3: SAE for personal; 192-bit mode for enterprise with management frame protection.
4. In the 6 GHz band, open networks must use Opportunistic Wireless Encryption (OWE), and WPA3 is required for password-based networks.

Public Key Infrastructure (PKI) is essential for EAP types that require certificates, managed by certificate authorities; Role-Based Access Control (RBAC) simplifies authorization by organizing users into roles; Mobile Device Management (MDM) is crucial for overseeing both organization-owned and BYOD devices, including features like remote wipe; Virtual Private Networks (VPN) enhance security in public hotspots by creating a secure tunnel for all network activity; and Endpoint Security safeguards client devices from vulnerabilities through antivirus protection and WLAN security enforcement.

Quality of Service (QoS) is vital for real-time communications like voice and video, ensuring quick packet delivery by prioritizing latency-sensitive packets. Voice packets are prioritized over video and data. QoS implementation involves assessing network performance and categorizing traffic using methods like FIFO and Fair Queuing. The 802.11 QoS, defined in 802.11e, uses access categories (AC) to prioritize traffic: AC_BK (Background), AC_BE (Best Effort), AC_VI (Video), and AC_VO (Voice). This allows higher-priority traffic to access the medium more frequently, reducing latency. The Wi-Fi Alliance's Wireless Multimedia (WMM) certification ensures effective QoS, converting DSCP values for wired communication to maintain end-to-end QoS.

In WLAN design, traffic separation is vital for security and bandwidth, using VLANs linked to specific SSIDs. WLAN profiles configure settings for various environments, such as higher density APs with a minimum of 36 Mbps in offices and support for older devices on 2.4 GHz and VoIP on 5 GHz in warehouses, with profiles stored on the Wireless LAN Controller (WLC) for flexible deployment.

A Wireless Intrusion Prevention System (WIPS) is essential for defending against unauthorized wireless access in corporate environments. It can be implemented as either an Integrated WIPS, which is cost-effective but scans part-time, or an Overlay WIPS, which offers full-time monitoring at a higher cost. WIPS recognizes and reports rogue devices, available in Software-based, Hardware-based, or Cloud-managed forms. It provides continuous monitoring, alerts on various threats, and compliance validation. By detecting rogue APs and disabling their switchports, WIPS effectively protects sensitive information from unauthorized access.

Until next time, keep the signal strong!

Source(s):

Carpenter, T., et al. (2024). CWDP-305: Certified Wireless Design Professional Study Guide (1st ed.). Durham NC, USA: Certitrek Publishing