Answers - 1

• What's the difference between Open System and Shared Key authentication?

Wireless authentication is the process of performing a security check on clients that request access to a wireless network. The 802.11b standard presently supports these two methods of authentication, although many vendor proprietary (and non-interoperable) methods are also in use.

Open System Authentication might better be called No authentication, since it allows any device to join a network without performing any security check.

Shared Key Authentication requires that the Station and the Access Point use the same WEP Key to authenticate. This basically means that WEP must be enabled and configured the same on the AP and client. This article has a good explanation of each method, along with a description of the general weaknesses of 802.11b authentication.

Top

• What's the difference between 40 and 64 bit WEP?

They are the same. The confusion comes from the way different manufacturers interpret the WEP specification. WEP actually has two parts, a "secret key" (user settable), and a 24 bit "Initialization Vector" which is not under user control.

Some manufacturers specify the length of the "secret key", i.e. user programmable, part of the WEP key, and others use the "secret key" plus "initialization vector" length. Curiously, this confusion is only seen on the lowest level, i.e. 40/64 bit, of WEP... probably for historical reasons.

Since all 802.11 products support 128bit (and sometimes higher) levels of WEP, this problem is moot. If you enable WEP, you should always use the highest bit length available, since there's no performance penalty from using the higher number of bits.

Top

• How do I prevent unknown users from using my wireless LAN?

In spite of all the negative things you may have heard, the fastest, easiest, and most effective first step to take is to enable WEP encryption. Although WEP can be broken, it takes time and tools that most folks don't have. Think of it as pushing in the knob-type lock on a door. Yes, someone can break down the door or jimmy the lock, but most 'doorknob rattler' type would-be wireless freeloaders will just move on to the next WLAN that isn't encrypted.

Top

• Is 802.11a more secure than 802.11b?

Not really. Although it can be set to use a non-standard 152 bit WEP encryption (vs. 802.11b's 64 and 128 bit WEP), it's still WEP, and can be broken, given enough time.

Top

• How should I set up 2 routers to provide untrusted wireless users access to WAN but not expose my internal LAN?

The easiest way is to connect your wireless router (#1) to the WAN, then connect the WAN port of Router #2 to one of Router #1's LAN ports. Make sure the two routers are set to different subnets (base addresses).

Setup Tips:

- Router #2 can be either a wired or wireless router.

- If Router #2 is wireless take the following precautions on Router #2:

* Use a different clear channel (1, 6, or 11)
* Use a different, non-obvious, non-descriptive ESSID
* Enable the highest level WEP you have and don't use an easy-to-guess key like all 1's or 0's
* Enable MAC address association control
* Disable ESSID broadcast or use a "closed network" option if you have it

- Set Router #2 to be a DHCP client (obtain IP address automatically) on its WAN port.

- Your wired LAN clients should all connect to the second router, and you can set them to obtain their IP address information automatically, or use static IP addressing if you wish.

- If you forward any ports on the second router, remember that this will allow any computers on the Router #1 LAN to potentially access the computer that the ports are forwarded to.

If you need to run Internet accessible servers, you should connect them to Router #1, but lock them down tightly, i.e. don't keep anything else on them, use strong passwords for admin accounts, don't enable any more services than necessary, etc.

Top