Hardware Networking Services: How Wireless Network Work

Saturday, February 21, 2009

How Wireless Network Work

Wireless Network

Ripe with security holes for some time, wireless network equipment is
just now starting to incorporate needed security technologies that at
least allow secure configuration. The following checklist reflects the
current state of wireless technologies, but many improvements are
right around the corner in this fast-evolving area. Additional technologies
will allow you to negate or at least mitigate most of the issues
addressed in this list. For additional wireless security configuration
and deployment guidelines, check out a new Microsoft publication
“Microsoft Solution for Securing Wireless LANs Cisco publication at
■ Ensure that any updates from the vendor are applied.
■ Ensure that access points are connected to switched networks.

■ Configure wireless networks as an untrusted DMZ off the
regular network.
■ Ensure that WEP encryption is enabled and that the highest
encryption level is chosen.
■ Change the WEP encryption key periodically as appropriate.
■ Do not rely on built-in encryption mechanisms for security.
Instead, implement VPNs over wireless for all traffic, if possible.
They are more robust, extensible, and manageable.
■ Disable SSID broadcasts as able, but do not rely on this as
a strong security measure.
■ Ensure that the default SSID has been changed from default,
and periodically change it if possible.
■ Ensure that the SSID does not describe the network owner or
function.
■ Ensure that any web administration interfaces are disabled or
tightly controlled.
■ Ensure that the default administrator password is changed to
a very strong password.
■ Ensure that MAC address filtering and control measures are
enabled if appropriate.
■ Implement static IP addressing if possible, and avoid DHCP.
■ Ensure that SNMP settings are disabled or that strong community
strings are enabled.
■ Ensure that any TFTP service is disabled.
■ Ensure that the access point does not answer on any unknown
ports (through 65,000).
■ Implement advanced encryption and authentication mechanisms
as soon as possible with upgrades such as WPA, 802.1x, and
802.11i.
■ Ensure that the radio dispersion from all antennas is appropriate

No comments:

What is Lan Technologies

LAN Technologies

Ethernet was developed by DIX (Digital, Intel and Xerox) in the 1970s. In 1980 the IEEE 802.3 standard was released. Two years later version 2 was introduced, which is the basic for today's Ethernet networks. The access method (how the wire is accessed) is Carrier Sense Multiple Access/Collision Detection (CSMA/CD). In a CSMA/CD network stations listen to check if the network is busy, if the network is free the station transmits data. When two stations listen, and both determine the network is available, they will start sending the data simultaneously and a collision occurs. When the collision is detected both stations will retransmit the data after a random wait time created by a back off algorithm. In today's large-fast-growing-bandwidth-eating network environments this will soon become a problem, stations will have to wait more often before they can transmit data and more collisions will occur. The solution to this is to separate the network in multiple collisions domains, which devices can be used for this purpose will be explained using a network diagram for each of the following relevant network components.
An Ethernet network is a broadcast system; this means that when a station transmits data every other station receives the data. The frames contain an address in the frame header; only the station with that address will pick up the frame and pass it on to upper-layer protocols to be processed.

BROADCAST DOMAIN

All devices in this domain will receive broadcast frames originating from any other device within the domain. Broadcast domains are typically bounded by routers because routers do not forward broadcast frames. Broadcast frames are frames explicitly directed to all nodes on the LAN, as networks grow this will become a problem as well.

REPEATERS

A repeater is a simple device that is used to expand LANs over larger distances by connecting segments. They do not control broadcast or collision domains, they are not aware of upper-layer protocols and frame formats, they merely regenerate/amplify the signal. Repeaters operate at the Physical layer of the OSI model. An important rule when using repeaters to expand a network is the 5-4-3 rule, which defines that the maximum distance between two hosts on the same network can be 5 segments, 4 repeaters, and only 3 of the segments can be populated, as illustrated in the following logical network diagram:

HUBS/CONCENTRATORS

Hubs, also known as concentrators or multiport repeaters, are used in star/hierarchical networks to connect multiple stations/cable segments. There are two main types of hubs: passive and active. An active hub takes the incoming frames, amplifies the signal, and forwards it to all other ports; a passive hub simply splits the signal and forwards it. Another type of hubs can be managed allowing individual port configuration and traffic monitoring, these are know as intelligent- or managed hubs.

Hubs operate on the physical layer of the OSI model and they are protocol transparent that means they are not aware of the upper-layer protocols and such as IP, IPX or MAC addressing. Hence they do not control broadcast or collision domains, but they extend them as illustrated below:

BRIDGES

Bridges are more intelligent than hubs; they operate on the Data Link layer of the OSI model.
They are used to increase network performance by segmenting networks in separate collision domains. Bridges are also protocol transparent, they are not aware of the upper-layer protocols. They keep a table with MAC addresses of all nodes, and on which segment they are located.
A bridge takes an incoming frame, reads its destination MAC address and consults the database to decide what should be done with the frame; if the location of the destination MAC address is listed in the database, the frame is forwarded to the corresponding port. If the destination port is the same as the port where the frame arrived it will be discarded. If the location is not known the frame will be flooded through all outgoing ports/segments.

As illustrated below, bridges control collision domains; they do not control broadcast domains:

SWITCHES

To improve network performance even more switches were developed, switches are very similar to bridges; they also keep a table with MAC addresses per port to make switching decisions, operate in the OSI model and are protocol transparent.
Some of the main differences are:
- A switch has more ports than a bridge
- Bridges switch in software whereas switches switch in hardware (integrated circuits)
- switches offer more variance in speed, an individual port can be assigned 10 Mb/s or 100 Mb/s or even more.

As illustrated below, switches control collision domains, they do not control broadcast domains*:

* Do not control broadcast domains unless Virtual Local Area Networks (VLANs) are being used, and most modern switches do support VLANs. The following diagram represents a router configured with two VLANs. Like in the previous diagram each port forms an collision domain, but as you can see in this diagram the network is separated in two broadcast domains using VLANs. If the network protocol used in this network would be TCP/IP the VLANs would each have its own (sub-) network address, for example VLAN 1 could be Class C 192.168.110.x and VLAN 2 192.168.220.x.

Switches are able to use software to create Virtual LANs; a logical grouping of network devices where the members can be on different physical segments. A VLAN can be based on Port IDs, MAC addresses, protocols or applications. For example in the network diagram above port 1 to 12 on the switch could be assigned to VLAN 1, and port 13 to 24 to VLAN 2, resulting in two different broadcast domains, or station 1, 2 and 3 could be using IPX/SPX while station 4, 5 and 6 could be using TCP/IP.

An example of a large network with VLANs could be an office building with a switch on each of the three floors and a main switch connecting them all together. An administrator would be able to keep a list of MAC addresses and assign stations from different floors to a single VLAN and for example create a VLAN (broadcast domain) for each department in the company. Switches share their MAC address table information with other switches so the path to a destination can be found quickly.

ROUTERS

Routers are used to interconnect multiple (sub-) networks and route information between these networks by choosing an optimal path ("route") to the destination. They operate on the Network layer (Layer 3) of the OSI model and in contradiction to hubs, bridges and switches, routers are protocol-aware. Examples of these protocols are: IP, IPX, and AppleTalk. Routers make forwarding decisions based on a table with network addresses and there corresponding ports, this table is known as the route table. Common use of routers is to connect two different type of networks (for example Ethernet and Token ring) or to interconnect LANs into a WAN. The concept of routing will be covered in more detail in the Routing Protocols TechNote.

As illustrated below, routers control collision domains AND broadcast domains:

GATEWAYS

A gateway (as a network component) is a device that connects networks with dissimilar network protocols or architectures and translates between the networks. Gateways are very intelligent devices; generally they operate on the Transport layer and on those above it (Session, Presentation, and Application). A gateway could be used to allow IPX/SPX clients to use a gateway with a TCP/IP uplink to an internet connection. TCP/IP would be converted to IPX/SPX. Another common use of a gateway is to connect an Ethernet network to an IBM SNA mainframe environment.

NICs

A NIC (Network Interface Card) is an expansion cards for a computer used to connect the physical network. The NIC's interface itself is defined at the Physical layer (Layer 1) of the OSI model, the physical address (also known as Burned-In Address and commonly: MAC address) of the adapter as well as the drivers to control the NIC are located at the Data Link layer's MAC sub-layer. The reason the physical address is defined at the Data Link layer is that the Physical layer only handles bits.

Half duplex

Half-duplex means that only one host can communicate at a given time, two hosts communicating with each other will take turns transmitting. This is the default on non-switched LANs.
Full-duplex

In full-duplex communication both hosts can transmit at the same time, theoretical allowing twice as much data to be transmitted over the same connection.
In order for full-duplex to work, some requirements must be met:
- The NICs, hubs etc. must support it,
- Collision Detection and Loop back functions must be disabled.
In reality the connections able to run at full-duplex are cross-cable connections and connection to a port on a switch, where collisions cannot occur because each end has its own wire pair (segment).

LAN Technologies

Determine the appropriate uses for full- and half-duplex Ethernet operation
Describe the causes and effects of network congestion in Ethernet networks
Describe the benefits of network segmentation with various networking devices
Identify the cause(s) of LAN connectivity problem
Describe the function, operation, and primary components on a LAN

What Is Vlan Technologies

Virtual LAN

A virtual LAN, commonly known as a VLAN, is a group of hosts with a common set of requirements that communicate as if they were attached to the same wire, regardless of their physical location. A VLAN has the same attributes as a physical LAN, but it allows for end stations to be grouped together even if they are not located on the same LAN segment. Network reconfiguration can be done through software instead of physically relocating devices.
A VLAN can be thought of as a broadcast domain that exists within a defined set of switches. Ports on a switch can be grouped into VLANs in order to limit traffic flooding since it is limited to ports belonging to that VLAN and its trunk ports. Any switch port can belong to a VLAN. Packets are forwarded and flooded only to stations in the same VLAN. Each VLAN is a logical network, and packets destined for stations that do not belong to the same VLAN must be forwarded through a routing device. Each VLAN can also run a separate instance of the spanning-tree protocol (STP). Cisco switches support an independent implementation of STP for each VLAN by using per-VLAN spanning tree (PVST).
VLANs are created to provide the segmentation services traditionally provided by routers in LAN configurations. VLANs address issues such as scalability, security, and network management. Routers in VLAN topologies provide broadcast filtering, security, address summarization, and traffic flow management. By definition, switches may not bridge IP traffic between VLANs as it would violate the integrity of the VLAN broadcast domain.
Virtual LANs are essentially Layer 2 constructs, whereas IP subnets are Layer 3 constructs. In a campus LAN employing VLANs, a one-to-one relationship often exists between VLANs and IP subnets. Although it is possible to have multiple subnets on one VLAN or have one subnet spread across multiple VLANs. Virtual LANs and IP subnets provide an independent Layer 2 and Layer 3 constructs that map to one another and this correspondence is useful during the network design process.

Motivation for VLAN
In a legacy network, users were assigned to networks based on geography and was limited by physical topologies and distances. By using VLAN, one can logically group networks and is no longer restricted by physical distance. This includes high-speed technologies such as:
Asynchronous Transfer Mode (ATM)
Fiber Distributed Data Interface (FDDI)
Fast Ethernet
Gigabit Ethernet
10-Gigabit Ethernet
By using VLAN, one can control traffic patterns and react quickly to relocations. VLANs provided the flexibility to adapt to changes in network requirements and allowed for simplified administration. Additionally, it provided an increased security measure and the ability to limit broadcasts.
Protocols and design
The protocol used in configuring virtual LANs is IEEE 802.1Q. The IEEE committee defined this method of multiplexing VLANs in an effort to provide multivendor VLAN support.
Both ISL and IEEE 802.1Q tagging perform explicit tagging as the frame is tagged with VLAN information explicitly. ISL uses an external tagging process that does not modify the existing Ethernet frame whereas 802.1Q uses an internal tagging process that does modify the Ethernet frame. This internal tagging process is what allows IEEE 802.1Q tagging to work on both access and trunk links, because the frame appears to be a standard Ethernet frame.
The IEEE 802.1Q header contains the following: * A 4-byte tag header containing a tag protocol identifier (TPID) and tag control information (TCI) * A 2-byte TPID with a fixed value of 0x8100 that indicates that the frame carries the 802.1Q/802.1p tag information.
A TCI containing the following elements: * Three-bit user priority * One-bit canonical format indicator (CFI) * Twelve-bit VLAN identifier (VID)-Uniquely identifies the VLAN to which the frame belongs
The 802.1Q standard can create an interesting scenario on the network. Recalling that the maximum size for an Ethernet frame as specified by IEEE 802.3 is 1518 bytes, this means that if a maximum-sized Ethernet frame gets tagged, the frame size will be 1522 bytes, a number that violates the IEEE 802.3 standard. To resolve this issue, the 802.3 committee created a subgroup called 802.3ac to extend the maximum Ethernet size to 1522 bytes. Network devices that do not support a larger frame size will process the frame successfully but may report these anomalies as a "baby giant."
Prior to the introduction of the 802.1Q standard, several proprietary protocols existed, such as Cisco's ISL (Inter-Switch Link, a variant of IEEE 802.10) and 3Com's VLT (Virtual LAN Trunk). ISL is no longer supported by Cisco.
Inter-Switch Link (ISL) is a Cisco proprietary protocol used to interconnect multiple switches and maintain VLAN information as traffic travels between switches on trunk links. This technology provides one method for multiplexing bridge groups (VLANs) over a high-speed backbone. It is defined for Fast Ethernet and Gigabit Ethernet, as is IEEE 802.1Q. ISL has been available on Cisco routers since Cisco IOS Software Release 11.1.
With ISL, an Ethernet frame is encapsulated with a header that transports VLAN IDs between switches and routers. ISL does add overhead to the packet as a 26-byte header containing a 10-bit VLAN ID. In addition, a 4-byte CRC is appended to the end of each frame. This CRC is in addition to any frame checking that the Ethernet frame requires. The fields in an ISL header identify the frame as belonging to a particular VLAN.
A VLAN ID is added only if the frame is forwarded out a port configured as a trunk link. If the frame is to be forwarded out a port configured as an access link, the ISL encapsulation is removed.
Early network designers often configured VLANs with the aim of reducing the size of the collision domain in a large single Ethernet segment and thus improving performance. When Ethernet switches made this a non-issue (because each switch port is a collision domain), attention turned to reducing the size of the broadcast domain at the MAC layer. Virtual networks can also serve to restrict access to network resources without regard to physical topology of the network, although the strength of this method remains debatable as VLAN Hopping is a common means of bypassing such security measures.
Virtual LANs operate at Layer 2 (the data link layer) of the OSI model. Administrators often configure a VLAN to map directly to an IP network, or subnet, which gives the appearance of involving Layer 3 (the network layer). In the context of VLANs, the term "trunk" denotes a network link carrying multiple VLANs, which are identified by labels (or "tags") inserted into their packets. Such trunks must run between "tagged ports" of VLAN-aware devices, so they are often switch-to-switch or switch-to-router links rather than links to hosts. (Note that the term 'trunk' is also used for what Cisco calls "channels" : Link Aggregation or Port Trunking). A router (Layer 3 device) serves as the backbone for network traffic going across different VLANs.
On Cisco devices, VTP (VLAN Trunking Protocol) maintain VLAN configuration consistency across the entire network. VTP uses Layer 2 trunk frames to manage the addition, deletion, and renaming of VLANs on a network-wide basis from a centralized switch in the VTP server mode. VTP is responsible for synchronizing VLAN information within a VTP domain and reduces the need to configure the same VLAN information on each switch.
VTP minimizes the possible configuration inconsistencies that arise when changes are made. These inconsistencies can result in security violations, because VLANs can crossconnect when duplicate names are used. They also could become internally disconnected when they are mapped from one LAN type to another, for example, Ethernet to ATM LANE ELANs or FDDI 802.10 VLANs. VTP provides a mapping scheme that enables seamless trunking within a network employing mixed-media technologies.
VTP provides the following benefits: * VLAN configuration consistency across the network * Mapping scheme that allows a VLAN to be trunked over mixed media * Accurate tracking and monitoring of VLANs * Dynamic reporting of added VLANs across the network * Plug-and-play configuration when adding new VLANs
As beneficial as VTP can be, it does have disadvantages that are normally related to the Spanning-Tree Protocol (STP) as a bridging loop propagating throughout the network can occur. Cisco switches run an instance of STP for each VLAN, and since VTP propagates VLANs across the campus LAN, VTP effectively creates more opportunities for a bridging loop to occur.
Before creating VLANs on the switch that will be propagated via VTP, a VTP domain must first be set up. A VTP domain for a network is a set of all contiguously trunked switches with the same VTP domain name. All switches in the same management domain share their VLAN information with each other, and a switch can participate in only one VTP management domain. Switches in different domains do not share VTP information.
Using VTP, each Catalyst Family Switch advertises the following on its trunk ports: * Management domain * Configuration revision number * Known VLANs and their specific parameters

Establishing VLAN memberships
The two common approaches to assigning VLAN membership are as follows: * Static VLANs * Dynamic VLANs
Static VLANs are also referred to as port-based VLANs. Static VLAN assignments are created by assigning ports to a VLAN. As a device enters the network, the device automatically assumes the VLAN of the port. If the user changes ports and needs access to the same VLAN, the network administrator must manually make a port-to-VLAN assignment for the new connection.
Dynamic VLANs are created through the use of software packages such as CiscoWorks 2000. With a VLAN Management Policy Server (VMPS), an administrator can assign switch ports to VLANs dynamically based on information such as the source MAC address of the device connected to the port or the username used to log onto that device. As a device enters the network, the device queries a database for VLAN membership.
Port-based VLANs
With port-based VLAN membership, the port is assigned to a specific VLAN independent of the user or system attached to the port. This means all users attached to the port should be members in the same VLAN. The network administrator typically performs the VLAN assignment. The port configuration is static and cannot be automatically changed to another VLAN without manual reconfiguration.
As with other VLAN approaches, the packets forwarded using this method do not leak into other VLAN domains on the network. After a port has been assigned to a VLAN, the port cannot send to or receive from devices in another VLAN without the intervention of a Layer 3 device.
The device that is attached to the port likely has no understanding that a VLAN exists. The device simply knows that it is a member of a subnet and that the device should be able to talk to all other members of the subnet by simply sending information to the cable segment. The switch is responsible for identifying that the information came from a specific VLAN and for ensuring that the information gets to all other members of the VLAN. The switch is further responsible for ensuring that ports in a different VLAN do not receive the information.
This approach is quite simple, fast, and easy to manage in that there are no complex lookup tables required for VLAN segmentation. If port-to-VLAN association is done with an application-specific integrated circuit (ASIC), the performance is very good. An ASIC allows the port-to-VLAN mapping to be done at the hardware level.

Saturday, February 21, 2009

How Wireless Network Work

No comments:

Blog Archive