Chapter 8
Investigating Wireless Network Considerations
8.1. Introduction
Wireless networks are becoming more and more common. Coffee shops, bookstores, and public
parks are adding wireless networking for their customers. The seamless integration of wireless
does, however, pose a challenge to the network designer. Implementing wireless networking while
maintaining functionality, manageability, and security of the wired network can introduce new
issues that the designer must address.
8.2. Network Design Considerations Unique to WLANs
Before designing an indoor wireless LAN (WLAN) implementation, the network designer needs
to fully understand how the customer intends to use wireless network, and the designer learns
about the network requirements by asking the customer questions. The answers to these questions
affect how a wireless network is implemented. Examples of some of these questions include the
following:
What authentication for users is needed?
Will open access (hotspots) be provided for the guests?
Which network services and applications are available to wireless users?
What encryption technique can be used?
Are wireless IP telephones planned?
Which coverage areas need to be supported?
How many users are in each coverage area?
If designer doesn’t get answers to the questions or fully understand customer requirements,
implementing a wireless LAN will be difficult, if not impossible.
1|Page
8.2. [Link] Network Design
In typical wireless network designs, most of the effort focuses on the physical coverage areas of
the network. The network designer conducts a site survey to determine the coverage areas for the
network and to find the optimum locations for mounting wireless access points. The site survey
results help determine the access point hardware, types of antennas, and desired wireless feature
sets. The designer determines that roaming between overlapping coverage areas can be supported.
Figure 8-1 Physical WLAN Topology
8.2.2. Logical Network Design
Designing the logical network usually causes network designers the most difficulty. Customers
often want to provide different levels of access to different types of wireless users. In addition,
wireless networks must be both easy to use and secure. Resolving both the desired features and
the constraints presents many different ways to design and configure wireless LANs. An example
of a complex wireless network design is a business that needs to offer the following services:
2|Page
Open wireless access for their visitors and vendors
Secured wireless access for their mobile employees
Reliable connectivity for wireless IP phones
8.2.3. Network Access Considerations Unique to WLANs
Each type of wireless access requires unique design considerations.
Open Guest Access: When visitors and vendors are at a business site, they often require access to
e-mail and websites. This type of access must be convenient to use, and typically is not Wired
Equivalent Privacy (WEP) or Wi-Fi Protected Access (WPA) encrypted. To help guest users
connect to the network, the Access Point service set identifier (SSID) is broadcast. Many hotspot
guest systems use DHCP and a logging server to register and record wireless use.
Guest users typically access the wireless network by opening a browser. The guest registration
system records the user information and hardware address and then begins logging the IP traffic.
Secured Employee Access: Some WLAN devices don’t support isolated guest access. To secure
employee access, use an entirely separate WLAN infrastructure that does not include guest access.
The recommended practice is to separate the internal users on a different VLAN. Figure 8-2 shows
open guest and secured employee access WLANs. This setup allows for guests to access the
Internet or other permitted area without providing total access to the network.
Figure 8-2 Open Guest and Secured Employee Access WLANs
3|Page
8.3. Best Practice Guidelines for WLAN Access
Other wireless implementation recommended practices include te following:
Non-broadcast SSID
Strong encryption
User authentication
VPN tunneling for sensitive data
Firewall and intrusion prevention
In areas where secured wireless is restricted to a few devices, MAC address filtering can be used
to limit access. One of the primary benefits of wireless networking is ease and convenience of
connecting devices.
Unfortunately, that ease of connectivity, and the fact that the information is transmitted through
the air, makes a wireless network vulnerable to interception and attacks.
Standard best practices for securing wireless access point and the associated wireless
transmissions include:
Modify the default SSID, and do not broadcast it unless necessary.
Use strong encryption.
Deploy mutual authentication between the client and the network using pre-shared keys
or an implementation of Extensible Authentication Protocol (EAP).
Use VPNs or WPA combined with MAC ACLs to secure business-specific devices.
Use VLANs to restrict access to network resources.
Ensure that management ports are secured.
Deploy lightweight access points, because they do not store security information
locally.
Physically hide or secure access points to prevent tampering.
Monitor the exterior building and site for suspicious activity
4|Page
8.3.1. Wireless Network Considerations
Site survey
WLAN roaming
Use of wireless networks
Number of network users
Construction materials
Types and capabilities of wireless client devices
Infrastructure devices in network
5|Page