My80211 White Papers (Coming Soon!)
This area does not yet contain any content.
Social Links
Peek Inside Cisco's Gear

See inside Cisco's latest wireless gear!

2.4 GHz Channel Overlap

EXAMPLE 1  

EXAMPLE 2

EXAMPLE 3  

LWAPP QoS Packet Tagging

 

 

CWSP RELEASE DATE 2/08/2010
  • CWSP Certified Wireless Security Professional Official Study Guide: Exam PW0-204
    CWSP Certified Wireless Security Professional Official Study Guide: Exam PW0-204
    by David D. Coleman, David A. Westcott, Bryan E. Harkins, Shawn M. Jackman

    Shawn Jackman (Jack) CWNE#54 is a personal friend and has been a mentor to me for many years.  I've had the pleasure and opportunity to work with Jack for 4 years. Jack is a great teacher who takes complex 802.11 standards and breaks them down so almost anyone can understand the concept at hand. I'm excited for you brother. Great job and job well done! Put another notch in the belt!

Interference Types

BLUETOOTH
 

Microwave Oven
 

Cordless Phone

JAMMER!
 

IEEE 802.11a/g/n Reference Sheet

 

Saturday
Feb132010

Site Survey Hint: Attach Your WiFi Phone To Your Survey PC (VoIP Assessment)

 

 

Having conducted more surveys then a belt will allow notches you start to find ways to improve your survey skill set with accuracy and speed. One of these ways came to me completely by accident one day many years ago at lunch.

If you are new to surveys or perhaps you have a few hundred already under your belt. The common theme to a good active survey is to understand your lowest powered clients and sensitive applications and their limitations. It is also important to understand the environment in which these devices will operate. Then calibrate your survey cards to these lower devices, which can be tricky for someone with limited experience.

There are many decent tools in which you can conduct active site surveys. One of these tools in which I am very familiar with is AirMagnet Surveyor. But never ever assume ANY old wifi card is OK to conduct a survey. In fact, when conducting active surveys you want to use the identical card or one very close to which will be used by your customer.

Example -- If you are surveying for Vocera B2000, Cisco 7921,7925, Ascom i75 deployment you don’t want to roll in with a 200mW card or a crappy chipset and let it run loose!?

When I survey for a Voice assessment I like to use that device during my assessment. Why? Because you know WITHOUT QUESTION how that phone / vocera badge / ascom phone will operate.

When I survey for a Vocera deployments, I will use the badge in survey mode in combination with AirMagnet. I will wear the badge around my neck enter the room, door closed and my back to the door and see what the Vocera badge is telling me. You will be surprised when you see what a pcmcia card reads and what the badge reads! In fact the majority of Vocera deployment failures is due to poor assessments. Thus the reason why Vocera has pulled in the assessment portion for their deployments.

Same holds true for handset deployments with Cisco, Ascom and others. These devices have a site survey mode as well. I will put these devices in site survey mode and use in combination with AirMagnet. Then one day at lunch many years ago I attached my Cisco handset to my laptop! Light bulb went off! What better way to survey and easily see the phones survey readings!

I hope you find this helpful during your surveys as well!

Wednesday
Dec302009

WLC "DHCP Address Assignment Required" Option 

DHCP address assignment required is one of those check boxes that make you go huh, while you scratch your head, if you don't know how it works. Cisco's best pratice for voice is to disable this feature. However, keep in mind,  if DHCP Addr. Assignment Required is selected, clients must obtain an IP address via DHCP. Any client with a static IP address is not allowed on the network.


The DHCP Required option in WLAN settings allows you to force clients to do a DHCP address
request/renew every time they associate to the WLAN before they are allowed to send or receive other
traffic to the network.
 
From a security standpoint, this allows for a more strict control of IP addresses
in use, but also might have affects in the total time for roaming before traffic is allowed to pass again.
 
Additionally, this might affect some client implementations which do not do a DHCP renew until the
lease time expires. For example, Cisco 7920,7921 and 7925 phones might have voice problems while they roam if this option is enabled, as the controller does not allow voice or signaling traffic to pass until
the DHCP phase is completed.
 
Some third−party printer servers might also be affected. In general, it is a good idea not to use this option if the WLAN has non−Windows clients. This is because the more strict controls might induce connectivity issues, based on how the DHCP client side is implemented.
 
Additional Notes: The WLAN advance configuration has an option to require that a user must pass DHCP before going into the RUN state (a state where the client will be able to pass traffic through the controller). This option requires the client to do a full or half DHCP request. The main thing the controller is looking from the client is a DHCP request and a ACK coming back from the DHCP server. As long as the client does these steps, the client will pass the DHCP required step and move to the RUN state.

L2 and L3 Roaming

L2 - Roam—If the client has a valid DHCP lease and performs a L2 roam between two different controllers on the same L2 network, the client should not need to re-dhcp and the client entry should be completely moved to the new controller from the original controller. Then if the client does need to DHCP again, the DHCP bridging or proxy process on the current controller would transparently bridge the packet again.

L3 – Roam—In a L3 roam scenario the client is moving between 2 different controllers in different L3 networks. In this situation the client is anchored to the original controller and listed in the client table on the new foreign controller. During the anchoring scenario the client’s DHCP is handled by the anchor controller as the client data is tunneled within an EoIP tunnel between the foreign and anchor controllers.

 
SHOW WLAN <WLAN ID>
To confirm the current config, this option lives under the show wlan <WLAN ID>
 
(Cisco Controller) >show wlan 1
WLAN Identifier.................................. 1
Profile Name..................................... TEST
Network Name (SSID).............................. TEST
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Number of Active Clients......................... 6
Exclusionlist.................................... Disabled
Session Timeout.................................. 1800 seconds
Interface........................................ management
WLAN ACL......................................... unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Quality of Service............................... Silver (best effort)
WMM.............................................. Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
IPv6 Support..................................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
<omitted>
 
CONFIG DHCP Address Assignment Required
Hummm... For the life of me I can not find the CLI command for this config. I will post it shortly, but here is the GUI command.
 
WLANs-->(click on SSID)--> ADVANCE TAB--> Check box DHCP Addr. Assignment Required
Tuesday
Dec292009

Configure TKIP Countermeasure Holdoff Timer on WLC

After having worked on countless Cisco WLAN VoIP deployments a general rule of thumb from Cisco TAC is to disable TKIP countermeasure on ALL voice WLANs and lessen the timer for DATA WLANs. Again this is all subject to your comfort level and performance requirements. Personally, I can't say I have ever seen this to be an issue or had an issue that was directly related to the countermeasure. But something to chew on!

TKIP countermeasure mode can occur if the Access Point receives 2 message integrity check (MIC) errors within a 60 second period. When this occurs, the Access Point will de-authenticate ALL TKIP clients associated to that 802.11 radio and holdoff any clients for the countermeasure holdoff time (default = 60 seconds).


(Cisco Controller)config wlan security <tkip> hold-down <seconds> <wlan id>

Note:  Configures TKIP MIC countermeasures hold-down timer (0-60 seconds)


The following command disables TKIP countermeasure on WLAN 1 

(Cisco Controller) >config wlan security tkip hold-down 0 1

 

Wednesday
Dec232009

CISCO VOIP BEST PRACTICE - WLC IEEE 802.1X Timeout for EAP-FAST

When using EAP-FAST you want to insure you give the client enough time to obtain the PAC. By default the WLC is set to only 2 seconds. However I noticed with code 6.0.188.0 it is set to 30 seconds by default. This command can only be configed from the CLI of the WLC.

When using EAP-FAST, the IEEE 802.1X timeout on the controller must be increased (default = 2 seconds) in order for the client to obtain the PAC via automatic provisioning. The default timeout on the Cisco ACS server is 20 seconds, which is the recommended value.
To change the IEEE 802.1X timeout on the Cisco Wireless LAN controller, connect using Telnet or SSH to the controller and enter the following command:
(Cisco Controller)> config advanced eap request-timeout 20

(Cisco Controller)> show advanced eap

EAP-Identity-Request Timeout (seconds)........... 1
EAP-Identity-Request Max Retries................ 20
EAP Key-Index for Dynamic WEP.................... 0
EAP-Request Timeout (seconds)................... 20
EAP-Request Max Retries.......................... 2