Chantry BeaconWorks Manuale utente

Chantry

BeaconWorks

User Guide

Chantry’s next generation of wireless networking devices

provide a truly scalable WLAN solution. Chantry’s

BeaconPoints are thin access points that are controlled

through a sophisticated network device, the BeaconMaster.

This solution provides the security and manageability

required by enterprises and service providers alike.

BeaconMaster

BeaconPoint

BeaconWorks Release 2.0

BeaconWorks User Guide – In this document

In this document The Chantry BeaconWorks Solution.................................................................. 4

What is the Chantry BeaconWorks System? ............................................... 4

Conventional Wireless LANS ....................................................................... 4

The Chantry BeaconWorks Solution ............................................................ 5

BeaconWorks and Your Enterprise Network ..................................................... 8

Network traffic flow in the BeaconWorks System ......................................... 8

Network security ........................................................................................... 9

Interaction with Wired Networks: Virtual Network Services........................ 10

Static Routing and Routing Protocols......................................................... 10

Policy: Packet Filtering ............................................................................... 10

Mobility and Roaming ................................................................................. 11

Availability................................................................................................... 11

BeaconWorks Release 2.0 Features: Overview.............................................. 12

Backwards compatibility with Release 1.1 on the BeaconPoint............ 12

Backwards compatibility with Release 1.1 on the BeaconMaster ......... 12

Multi-SSID: BeaconPoint radios on more than one VNS ...................... 12

Privacy using Wi-Fi Protected Access (WPA)....................................... 13

BeaconPoint software: Dual image capability ....................................... 13

BeaconPoint software: Dynamic reconfiguration (without reboot) ........ 13

BeaconPoint Statistics........................................................................... 13

Event reporting using Syslog................................................................. 13

Capacity for Redundant RADIUS servers ............................................. 14

Detection of Rogue APs ........................................................................ 14

Quality of Service (QoS) on a VNS: Spectralink Voice Protocol (SVP) 14

BeaconPoint static configuration: Branch Office, Phase 1.................... 14

BeaconMaster: Startup .................................................................................... 15

BeaconMaster Features and Installation .................................................... 15

First-Time Setup of BeaconMaster............................................................. 16

Management Port First-Time Set Up..................................................... 16

The Graphical User Interface (GUI): Overview........................................... 20

BeaconWorks Configuration Steps: Overview................................................. 22

BeaconWorks Configuration: Data Port and Routing Setup............................ 23

Setting Up the Data Ports........................................................................... 23

Port Type or Function ............................................................................ 24

Port-Level Filtering of Unauthorized Traffic........................................... 25

Setting up Static Routes ............................................................................. 26

Setting up OSPF Routing ........................................................................... 27

BeaconPoint: Startup ....................................................................................... 30

BeaconPoint (BP200) Features.................................................................. 30

Installing the BeaconPoints ........................................................................ 32

BeaconPoint: Registering ........................................................................... 33

Setting Parameters for BeaconPoint Registration................................. 33

Discovery and Registration: The DHCP and SLP Solution ................... 34

The BeaconPoint’s Discovery Process and LED Sequence ................. 35

BeaconPoint: Configuring Properties and Radios ...................................... 36

BeaconPoint: Adding Manually ............................................................. 40

BeaconPoint Radios on a VNS ............................................................. 41

BeaconPoint Static Configuration: Branch Office Deployment ............. 41

Virtual Network Services (VNS): Overview...................................................... 43

What is a VNS? .......................................................................................... 44

Topology of a VNS: Overview .................................................................... 44

Multi-SSID: BeaconPoint radios on more than one VNS ...................... 45

Other network parameters for the VNS topology .................................. 45

Network Assignment and Authentication for a VNS ................................... 45

RADIUS Server: Location and Redundancy ......................................... 46

Filtering for a VNS: How it works................................................................ 46

Privacy on a VNS: Overview of WEP and WPA......................................... 47

Setting up a new VNS................................................................................. 48

BeaconWorks User Guide – In this document

Virtual Network Configuration: A VNS for Captive Portal ................................ 50

Topology for a VNS for Captive Portal ....................................................... 50

Authentication for a VNS for Captive Portal ............................................... 53

Filtering Rules for a VNS for Captive Portal ............................................... 57

The Non-Authenticated Filter ................................................................ 57

Privacy using WEP for a VNS for Captive Portal ....................................... 59

Virtual Network Configuration: A VNS with No Authentication ........................ 61

Virtual Network Configuration: A VNS for Voice Traffic (QoS with SVP) ........ 62

Voice Data Traffic on a Wireless Network: Overview................................. 62

Setting up a VNS for Voice Traffic.............................................................. 62

Virtual Network Configuration: A VNS for AAA................................................ 65

Topology for a VNS for AAA....................................................................... 65

Authentication for a VNS for AAA............................................................... 68

VNS Topology for an AAA group........................................................... 71

Filtering Rules for a Filter ID group............................................................. 72

Filtering Rules for a Default Filter ............................................................... 74

Filtering Rules for an AAA Group VNS.................................................. 75

Filtering Rules between two wireless devices....................................... 76

Privacy for a VNS for AAA.......................................................................... 76

Privacy for a VNS for AAA: WEP .......................................................... 76

Privacy for a VNS for AAA: Wi-Fi Protected Access (WPA) ................. 77

BeaconMaster Configuration: Availability ........................................................ 80

BeaconMaster Configuration: Mobility and the VN Manager........................... 85

BeaconMaster Configuration: Management Users.......................................... 88

BeaconMaster Configuration: Network Time................................................... 89

Setting up Third-Party Access Points .............................................................. 90

BeaconKeeper Mitigator: Detecting Rogue Access Points.............................. 93

BeaconKeeper Mitigator: Overview....................................................... 93

BeaconKeeper Mitigator: Enabling the Analysis and RFDC Engines ... 94

BeaconKeeper Mitigator: Running Scans ............................................. 95

BeaconKeeper Mitigator: How the Analysis Engine works ................... 97

BeaconKeeper Mitigator: Viewing the Scanner Status Report ........... 100

Ongoing Operation: BeaconPoint Maintenance – Software .......................... 101

BeaconPoint software: Dynamic reconfiguration (without reboot) ...... 101

BeaconPoint software: Dual image backup ........................................ 101

Ongoing Operation: BeaconPoint Access Approval ...................................... 104

Ongoing Operation: BeaconPoint Disassociate a Client ............................... 105

Ongoing Operation: BeaconMaster System Maintenance ............................ 106

Event Messages relayed to a Syslog server ....................................... 107

Ongoing Operation: BeaconWorks Logs and Traces .................................... 109

Logs and Alarms.................................................................................. 109

Traces.................................................................................................. 111

Audits................................................................................................... 111

Ongoing Operation: BeaconWorks Reports and Displays............................. 112

View Displays ........................................................................................... 112

View Statistics for BeaconPoints .............................................................. 113

View Reports ............................................................................................ 114

BeaconMaster Configuration: Setting up SNMP ........................................... 115

Appendix 1: BeaconWorks System States and LEDs ................................... 118

Appendix 2: Glossary of Terms and Acronyms ............................................. 120

Appendix 3: Index of Procedures, Screens and Figures ............................... 131

BeaconWorks User Guide – The Chantry BeaconWorks Solution

The Chantry BeaconWorks Solution

The BeaconWorks system is a highly scalable wireless local area network (WLAN)

solution developed by Chantry Networks Inc. Based on a third generation WLAN

topology, the BeaconWorks system makes wireless practical for medium and large-

scale enterprises and for service providers.

The BeaconWorks system provides a secure, highly scalable, cost-effective solution

based on the IEEE 802.11standard. The solution is intended for enterprise networks

operating on many floors in more than one building, as well as in public environments

such as airports and convention centers that require more than two access points.

This section provides an overview of the fundamental principles of the Chantry

BeaconWorks system: what it is, how it works, and its advantages.

What is the Chantry BeaconWorks System?

The BeaconWorks system replaces the conventional access points used in wireless

networking with two network devices that work as a system:

BeaconMaster A network device that provides smart centralized control over the

elements (BeaconPoints) in the wireless network.

BeaconPoints The access points for 802.11 clients (wireless devices) in the

network, controlled by the BeaconMaster. The BeaconPoint is a

“thin access point” because its wireless control is handled by the

BeaconMaster. The BeaconPoint (BP200 model) is a dual-band

access point, with both 802.11a and 802.11b/g radios.

Together, the BeaconWorks products enable a radically simplified new approach to

setting up, administering and maintaining a WLAN. BeaconWorks provides a Layer 3

IP routed WLAN architecture. This architecture can be implemented over several

subnets without requiring the configuration of virtual local area networks (VLANs).

Conventional Wireless LANS

At its simplest, wireless communication between two or more computers requires that

each one is equipped with a receiver/transmitter – a WLAN Network Interface Card

(NIC) – capable of exchanging digital information over a common radio frequency.

This is called an ad hoc configuration. An ad hoc network allows wireless devices to

communicate together. This is an independent basic service set (IBSS).

An alternative to the ad hoc configuration is the use of an access point. This may be a

dedicated hardware router or a computer running special software. Computers and

other wireless devices communicate with each other through this access point. The

802.11 standard defines Access Point communications as devices that allow wireless

devices to communicate with a “distribution system”. This is a basic service set (BSS)

or infrastructure network.

For the wireless devices to communicate with computers on a wired network, the

access points must be connected into the wired network, and provide access to the

networked computers. This is called bridging. Clearly, there are security issues and

management scalability issues in this arrangement.

BeaconWorks User Guide – The Chantry BeaconWorks Solution

RADIUS

Authentication Server

DHCP

Server

Router

Wireless

Device

Eth ern et S witch

Wireless

Device

Access

Point

Figure 1: Standard wireless network solution

The wireless devices and the wired networks communicate with each other using

standard networking protocols and addressing schemes. Most commonly, Internet

Protocol (IP) addressing is used.

While this topology works well enough for small installations, as the network grows

the difficulty of setting up and administering all the individual access points expands

as well. When the expanding network has to cope with a large number of wireless

users all signing on and off at random times, the complexity grows rapidly. Imagine,

for example, a university library filled with professors and students – all equipped

with laptops. Or a conference full of delegates and exhibitors.

Clearly, there must be a better way than setting up each access point individually.

The Chantry BeaconWorks Solution

The Chantry Networks BeaconWorks solution consists of two devices:

The BeaconMaster controller is a rack-mountable network device designed to be

integrated into an existing wired Local Area Network (LAN). It provides centralized

control over all access points (both BeaconPoints and third-party access points) and

manages the network assignment of wireless device clients associating through access

points.

The BeaconPoint is a wireless LAN thin access point (IEEE 802.11) provided with

unique software that allows it to communicate only with a BeaconMaster. (A thin

access point handles the radio frequency (RF) communication but relies on a

controller to handle WLAN elements such as authentication.) The BeaconPoint also

provides local processing such as encryption.

This architecture allows a single BeaconMaster to control many BeaconPoints,

making the administration and management of large networks much easier.

BeaconWorks User Guide – The Chantry BeaconWorks Solution

There can be several BeaconMasters in the network, each with its set of registered

BeaconPoints. The BeaconMasters can also act as backups to each other, providing

stable network availability.

In addition to the BeaconMasters and BeaconPoints, the solution requires two other

components, which are standard for enterprise and service provider networks:

•RADIUS Server (Remote Access Dial-In User Service) (RFC2865 and RFC2866),

or other authentication server. Assigns and manages ID and Password protection

throughout the network. Used for authentication of the wireless users.

•DHCP Server (Dynamic Host Configuration Protocol) (RFC2131). Assigns IP

addresses, gateways and subnet masks dynamically. Also used by the

BeaconPoints to discover the location of the BeaconMaster during the initial

registration process.

BeaconPoint

RADIUS

Authentication Server

DHCP

Server

Router

Wireless

Device

Ethernet Switch

Wireless

Device

BeaconMaster

Figure 2: Chantry BeaconWorks Solution

The BeaconMaster appears to the existing network as if it were an access point, but in

fact one BeaconMaster controls many BeaconPoints.

The BeaconMaster has built-in capabilities to recognize and manage the

BeaconPoints. The BeaconMaster activates the BeaconPoints, enables them to receive

wireless traffic from wireless devices, processes the data traffic from the

BeaconPoints and forwards or routes that data traffic out to the network. This

processing includes authenticating requests and applying access policies.

Simplifying the BeaconPoints make them:

• cost-effective

• easy to manage

• easy to deploy.

BeaconWorks User Guide – The Chantry BeaconWorks Solution

Putting control on an intelligent centralized BeaconMaster enables:

• centralized configuration, management, reporting, maintenance

• high security

• flexibility to suit enterprise

• scalable and resilient deployments with a few BeaconMasters controlling hundreds

of BeaconPoints.

Here are some of the BeaconWorks system advantages:

Scales up to Enterprise

capacity

One BeaconMaster controls as many as 200 BeaconPoints. In turn

each BeaconPoint can handle up to 254 wireless devices. With

additional BeaconMasters, the number of wireless devices the

Chantry system can support is in the thousands.

Integrates in existing

network

A BeaconMaster can be added to an existing enterprise network as

a new network device, greatly enhancing its capability without

interfering with its existing functionality. Integration of the

BeaconMasters and BeaconPoints does not require any

reconfiguration of the existing infrastructure (e.g. VLANs).

Offers centralized

management and

control

An administrator accesses the BeaconMaster in its centralized

location and uses its user interface to monitor and administer the

entire wireless network. The BeaconMaster has functionality to

recognize, configure and manage the BeaconPoints and distribute

new software releases.

Provides easy

deployment of

BeaconPoints

The initial configuration of the BeaconPoints on the centralized

BeaconMaster can be done with an automatic “discovery”

technique.

Provides security via

user authentication

BeaconWorks uses existing authentication (AAA) servers to

authenticate and authorize users.

Provides security via

filters and privileges

BeaconWorks uses virtual networking techniques to create

separate virtual networks with defined authentication and billing

services, as well as access policies and privileges.

Supports seamless

mobility and roaming

BeaconWorks supports seamless roaming of a wireless device

from one BeaconPoint to another on the same BeaconMaster or on

a different BeaconMaster.

Integrates third-party

access points

BeaconWorks can integrate legacy third-party access points, using

a combination of network routing and authentication techniques.

Prevents rogue devices Rogue devices will not be authenticated by the BeaconMaster,

preventing unproved devices from masquerading as valid

BeaconPoints.

Provides accounting

services

The BeaconMaster has software to track and log wireless user

sessions, user group activity, and other activity reporting, enabling

the generation of consolidated billing records.

Offers troubleshooting

capability

The BeaconMaster software logs system and session activity and

provides reports to aid in troubleshooting analysis.

BeaconWorks User Guide – BeaconWorks and Your Enterprise Network

BeaconWorks and Your Enterprise Network

Network traffic flow in the BeaconWorks System

The diagram below shows a simple configuration with a single BeaconMaster and two

BeaconPoints, each supporting a wireless device. A RADIUS server on the network

provides authentication, and a DHCP server is used by the BeaconPoints to discover

the location of the BeaconMaster during the initial registration process. Also present

in the network are routers and ethernet switches.

BeaconPoint

RADIUS

Authentication Server

DHCP

Server

Router

Wireless

Device

Ethernet

Switch

Ethernet

Switch

802.11

IP packet transmission

BeaconMaster /

BeaconPoint

tunnelling

802.11 beacon & probe,

wireless device associates

with a BeaconPoint by its SSID.

• BP sends data traffic to BM

through a UDP tunnel

called WASSP.

• BM controls BP through

WASSP tunnel.

• Using WASSP tunnels, BM

allow wireless clients to roam

to BPs on different BMs.

BeaconMaster authenticates

Wireless User, forwards IP

packe t to wire d n etw ork.

BeaconMaster

control & routing

BeaconMaster

Wireless

Device

Figure 3: BeaconWorks Traffic Flow diagram

Each wireless device sends IP packets in the 802.11 standard to the BeaconPoint. The

BeaconPoint uses a UDP (User Datagram Protocol) based tunnelling protocol called

CAPWAP Tunnelling Protocol (CTP) to encapsulate the packets and forward them to

the BeaconMaster.

Note: The CTP protocol defines a mechanism for the control and provisioning of

wireless access points (CAPWAP) through centralized access controllers. In addition,

it provides a mechanism providing the option to tunnel the mobile client data between

the access point and the access controller.

The BeaconMaster decapsulates the packets, and routes these to destinations on the

network, after authentication by the RADIUS server.

The BeaconMaster functions like a standard router, except that it is configured to

route only between its ingress ports (incoming wireless device traffic via

BeaconPoints) and egress ports (traffic out to the wired network). The BeaconMaster

BeaconWorks User Guide – BeaconWorks and Your Enterprise Network

can also be configured to simply forward traffic to a default or static route if dynamic

routing is not preferred.

Network security

The Chantry BeaconWorks system provides features and functionality to control

network access. These are based on standard wireless network security practices.

Current wireless network security methods provide a degree of protection. These

methods include:

• Shared Key authentication, that relies on Wired Equivalent Privacy (WEP) keys

• Open System, that relies on Service Set Identifiers (SSIDs)

• 802.1x that is compliant with Wi-Fi Protected Access (WPA)

• Captive Portal based on Secure Sockets Layer (SSL) protocol

The Chantry BeaconWorks system supports these encryption approaches:

• Wired Equivalent Privacy (WEP), a security protocol for wireless local area

networks defined in the 802.11b standard.

• Wi-Fi Protected Access (WPA) with Temporal Key Integrity Protocol (TKIP), also

known as WPA version 1. (BeaconWorks Release 2.0)

• Advanced Encryption Standard (AES).

Authentication

The Chantry BeaconMaster relies on a RADIUS server, or authentication server, on

the enterprise network to provide the authentication information (whether the user is

to be allowed or denied access to the network).

The BeaconMaster provides authentication using:

• Captive Portal, a browser-based mechanism that forces users to a web page.

• RADIUS (using IEEE 802.1x)

The 802.1x mechanism is a standard for authentication developed within the 802.11

standard. This mechanism is implemented at the port, blocking all data traffic between

the wireless device and the network until authentication is complete. Authentication

by 802.1x standard uses Extensible Authentication Protocol (EAP) for the message

exchange between the BeaconMaster and the RADIUS server.

When 802.1x is used for authentication, the BeaconMaster provides the capability to

dynamically assign per-wireless-device WEP keys (called per-station WEP keys in

802.11).

Note: In BeaconWorks Release 2.0, a RADIUS redundancy feature is provided,

where you can define a failover RADIUS server (up to 2 servers) in the event that the

active RADIUS server fails.

Privacy

Privacy is a mechanism that protects data over wireless and wired networks, usually

by encryption techniques.

BeaconWorks User Guide – BeaconWorks and Your Enterprise Network

Chantry supports the Wired Equivalent Privacy (WEP) standard common to

conventional access points.

It also provides Wi-Fi Protected Access (WPA) encryption, based on Pairwise Master

Key (PMK) and Temporal Key Integrity Protocol (TKIP). This second option is

available when the AAA (802.1x) authentication technique is used.

Interaction with Wired Networks: Virtual Network Services

BeaconWorks provides a versatile means of mapping wireless networks to the

topology of an existing wired network. This is accomplished through the assignment

of Virtual Network Services.

When you set up Virtual Network Services (VNS) on the BeaconMaster, you are

defining subnets for groups of wireless users. This VNS definition creates a virtual IP

subnet where the BeaconMaster acts as a default gateway for wireless devices.

This technique enables policies and authentication to be applied to the groups of

wireless users on a VNS, as well as the collecting of accounting information on user

sessions that can be used for billing.

When a VNS is set up on the BeaconMaster:

• one or more BeaconPoints (by radio) are associated with it

• a range of IP addresses is set aside for the BeaconMaster’s DHCP server to assign

to wireless devices.

If routing protocol is enabled, the BeaconMaster advertises the VNS as a routable

network segment to the wired network, and routes traffic between the wireless devices

and the wired network.

Note: In BeaconWorks Release 2.0, each radio on a BeaconPoint can participate in up

to four VNSs, via the multi-SSID function.

Static Routing and Routing Protocols

Routing can be used on the BeaconMaster to support the VNS definitions.

In the User Interface on the BeaconMaster, you can configure routing on the

BeaconMaster to use one of the following routing techniques:

• Static routes: Use static routes to set the default route of a BeaconMaster so that

legitimate wireless device traffic can be forwarded to the default gateway.

• Open Shortest Path First (OSPF) (RFC2328): Use OSPF to specify the next best

hop (route) of a BeaconMaster.

Open Shortest Path First (OSPF) is a protocol designed for medium and large IP

networks, with the ability to segment routers into different routing areas for routing

information summarization and propagation.

Policy: Packet Filtering

Policy refers to the rules that allow different network access to different groups of

users. The BeaconWorks system can link authorized users to user groups. These user

groups then can be confined to predefined portions of the network.

Questo manuale è adatto per i seguenti modelli

Indice

Manuali Hardware di rete popolari di altre marche

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuale utente

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuale utente

Yudor

Yudor YDS-16 Manuale utente

D-Link

D-Link ShareCenter DNS-320L Manuale utente

Samsung

Samsung ES1642dc Istruzioni per l’uso

Honeywell Home

Honeywell Home LTEM-PV Istruzioni per il montaggio

evertz

evertz 7700 Series Manuale utente

D-Link

D-Link ShareCenter DNS-343 Manuale utente

Asante

Asante AsanteBridge 1012 Manuale utente

FireBrick

FireBrick FB2700 Manuale utente

Audiovox Electronics

Audiovox Electronics ARWH2T Manuale utente

ADC

ADC DSX-1 Manuale

NetComm

NetComm NF2 Manuale utente

Alcatel-Lucent

Alcatel-Lucent 5620 Manuale utente

Dell EMC

Dell EMC XC6420 Series Manuale utente

Lanner

Lanner NCA-1020A Manuale utente

Allied Telesis

Allied Telesis AT-TN121-A Manuale utente

Arista

Arista CCA-ETM-Q12 Manuale utente