Wireless Security

What this chapter covers

This chapter explains how to protect a wireless network from the radio link up to the management controls.

Wireless frames travel through the air, so security has to be built in. The chapter covers how clients prove who they are, how data is encrypted, how enterprise authentication works, and how to manage access once the basics are in place.

It uses the RouterOS security profile for the legacy wireless package and mentions the wifi driver where its settings differ.

How the topics fit together

The three topics form a stack, from the strongest basic protection to the daily management.

The first page covers the basic methods and the choice between a shared passphrase and enterprise login. The second page covers the enterprise option in detail, with the roles, the EAP methods and RADIUS. The third page covers the controls that surround both, including access lists, client isolation, rogue access points and safe management access.

• Authentication and encryption compares open, WEP, WPA, WPA2 and WPA3, and shows the security profile settings.
• 802.1X and EAP explains the supplicant, the authenticator and the RADIUS server.
• Wireless security management covers the lists and settings that control who joins and what they can reach.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read the pages in order. Make a short table for yourself of each security method and the status of its encryption.

Then practise the three roles of 802.1X until you can name them without looking. Many questions test only whether you know which device does which job.