Network Implementation · Topic 7 of 8
Wireless Configuration and Design
Configure SSID, BSSID and ESS, roaming, antenna types, WPA2 and WPA3 security, captive portals, site surveys and controller based access points.
- 5 min
- SSID is the network name. BSSID is the MAC address of one access point radio.
- An ESS is multiple access points sharing an SSID so clients can roam.
- Omnidirectional antennas cover all directions. Directional antennas focus a beam for longer distance.
What it is
Choosing the standard and band is only half the job. You also have to name the network, plan coverage, choose antennas, secure the connection and manage many access points together.
The exam asks you to match these settings to scenarios: a client that will not roam, a weak signal in one corner, or a network that needs to be secure without a shared password.
How it works
Network names and service sets
The Service Set Identifier (SSID) is the network name that users see. The Basic Service Set Identifier (BSSID) is the Media Access Control (MAC) address of one access point's radio, so it identifies a single access point.
An extended service set (ESS) is several access points that share the same SSID and are joined by a wired network. This lets users move around a building and stay on one network.
In infrastructure mode clients connect through an access point. In ad hoc mode, also called an independent basic service set (IBSS), clients talk directly to each other with no access point. Ad hoc suits a quick two device link, but it does not scale, has no central management and offers weaker security.
Roaming
Roaming means a client moves from one access point to another without losing its session. The client decides when to move, usually when the signal strength of the current access point falls.
For smooth roaming, neighboring access points use the same SSID and security settings, but different channels, and their coverage areas overlap slightly. A client that stays attached to a distant access point is a "sticky client" and shows slow speeds.
Antennas
| Antenna type | Coverage | Typical use |
|---|---|---|
| Omnidirectional | All directions around the antenna | Normal office access points |
| Directional (for example Yagi) | A narrow beam | Long point to point links or covering a corridor |
| Parabolic | Very narrow, high gain | Long distance outdoor links |
Antenna gain is the focusing of signal in a direction, measured in decibels. A higher gain antenna reaches farther but covers a narrower area.
Site surveys and signal strength
A wireless site survey measures signal strength and interference to decide where to place access points. A heat map shows coverage as colors on a floor plan.
Signal strength is reported as the Received Signal Strength Indicator (RSSI), usually as a negative number in decibels relative to a milliwatt. A value closer to zero is stronger.
Securing wireless networks
| Mode or protocol | Notes |
|---|---|
| Open | No encryption, anyone can join and read traffic |
| WEP (Wired Equivalent Privacy) | Broken and obsolete |
| WPA2 (Wi-Fi Protected Access 2) | Uses Advanced Encryption Standard (AES) encryption with the Counter Mode CBC-MAC Protocol (CCMP), still widely used |
| WPA3 (Wi-Fi Protected Access 3) | Newer, uses Simultaneous Authentication of Equals (SAE) for stronger password based protection |
| Personal | One shared passphrase for everyone |
| Enterprise | Each user logs in with 802.1X (port based network access control) through a Remote Authentication Dial In User Service (RADIUS) server |
In Enterprise mode, the access point forwards login requests to the RADIUS server, so each user has an individual credential. Removing one user does not require changing a shared password.
Guest access and filtering
A captive portal redirects a new user to a web page to accept terms or log in before access is granted. Guest networks are usually placed in a separate virtual LAN (VLAN) with limited access.
MAC filtering allows or blocks devices by MAC address. It is weak security, because MAC addresses can be copied, and it should not replace encryption.
Controllers and access point types
An autonomous access point is configured on its own. A controller based design uses a wireless local area network (LAN) controller to configure, monitor and update many lightweight access points together, which keeps channels and power levels consistent.
A mesh network uses access points that connect to each other wirelessly to extend coverage where cabling is hard.
What to remember for the exam
- SSID is the network name. BSSID is the MAC address of one access point radio.
- An ESS is multiple access points sharing an SSID so clients can roam.
- Omnidirectional antennas cover all directions. Directional antennas focus a beam for longer distance.
- A site survey and heat map plan coverage and find interference.
- RSSI closer to zero is stronger, for example minus 55 is better than minus 80.
- WPA2 uses AES with CCMP. WPA3 uses SAE. WEP is obsolete.
- Personal mode uses a shared passphrase. Enterprise mode uses 802.1X with RADIUS.
- A captive portal is used for guest login.
- Controller based access points are managed centrally.
When a scenario says employees must authenticate individually and be removed without changing a shared key, the answer is WPA2 or WPA3 Enterprise with 802.1X and RADIUS.
Common mistakes
Thinking hidden SSIDs add security. Hiding the name only removes it from lists. Tools can still detect the network.
Relying on MAC filtering. MAC addresses are visible in the air and easy to copy.
Using the same channel for neighboring access points. Roaming overlap areas should use different channels to avoid co channel interference.
Reading RSSI backwards. A reading of minus 90 is far weaker than minus 50.
Mounting a high gain antenna for broad coverage. It narrows the coverage area, so use omnidirectional for broad areas.
Open guest networks send traffic unencrypted. A captive portal controls access but does not by itself encrypt the data.
Check yourself
Try these three.
What identifies a single access point radio?
The BSSID, which is the MAC address of the radio.
Which wireless security mode gives each user an individual login?
WPA2 or WPA3 Enterprise, using 802.1X and a RADIUS server.
Which antenna type fits a long point to point link between buildings?
A directional antenna, such as a Yagi or a parabolic dish.
Topic 7 of 8 in Network Implementation
Test yourself on Network Implementation
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.