Wireless Security

What this chapter covers

Wireless Security is about keeping unwanted people off a wireless network and keeping the traffic private.

Radio waves cannot be fenced in, so security cannot rely on a locked door. It has to be built into the link: who may join, how they prove who they are, how the data is scrambled, and how the control messages are protected.

The chapter follows the seventh part of the MTCWE syllabus. It has two topics, covered by four pages.

How the topics fit together

Security on a wireless link is a series of layers, and each answers a different question.

The pages follow the layers:

• Access management covers the access list and connect list, which filter devices.
• RADIUS and authentication cover security profiles, shared keys and central servers.
• Encryption and EAP cover the ciphers and the per user methods.
• Management frame protection covers forged control messages.

No layer is enough alone. A MAC filter without encryption can be copied, and encryption without frame protection can be disrupted by a forged message.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

The first topic is a lab in the syllabus. Build a small network with two clients, add access list rules, and check how the order of rules changes the result. Then add a security profile and a RADIUS server.

Take care with every change that can lock you out. Keep a second way into the device, such as a wired connection, while you test.