Wireless Security.pdf - PDF Archive

556 Chapter 21
●
802.1X. Provides for a method of port-based authentication to LAN ports in a
switched network environment.
These two services are used in combination with other security mechanisms, such as
those provided by the Extensible Authentication Protocol (EAP), to further enhance the
protection of wireless networks. Like MAC filtering, 802.1X is implemented at layer 2
of the Open System Interconnection (OSI) model: it will prevent communication on the
network using higher layers of the OSI model if authentication fails at the MAC layer.
However, unlike MAC filtering, 802.1X is very secure as it relies on mechanisms that are
much harder to compromise than MAC address filters, which can be easily compromised
through spoofed MAC addresses.
Although a number of vendors implement their own RADIUS servers, security
mechanisms, and protocols for securing networks through 802.1X, such as Cisco’s
LEAP and Funk Software’s EAP-TTLS, this section will focus on implementing 802.1X
on a Microsoft network using Internet Authentication Services (IAS) and Microsoft’s
Certificate Services. Keep in mind, however, that wireless security standards are a
moving target, and standards other than those discussed here, such as the PEAP, are being
developed and might be available now or in the near future.
21.6.1 Microsoft RADIUS Servers
Microsoft’s IAS provides a standards-based RADIUS server and can be installed as an
optional component on Microsoft Windows 2000 and Net servers. Originally designed to
provide a means to centralize the authentication, authorization, and accounting for dial-in
users, RADIUS servers are now used to provide these services for other types of network
access, including VPNs, port-based authentication on switches, and, importantly, wireless
network access. IAS can be deployed within Active Directory to use the Active Directory
database to centrally manage the login process for users connecting over a variety of
network types. Moreover, multiple RADIUS servers can be installed and configured so
that secondary RADIUS servers will automatically be used in case the primary RADIUS
server fails, thus providing fault tolerance for the RADIUS infrastructure. Although
RADIUS is not required to support the 802.1X standard, it is a preferred method for
providing the authentication and authorization of users and devices attempting to connect
to devices that use 802.1X for access control.
www.newnespress.com