Controller-Based Wireless LAN Fundamentals: An end-to-end reference guide to design, deploy, manage, and secure 802.11 wireless networks

315 Pages·2010·12.98 MB·English

by  Jeff Smith, Jake Woodhams, Robert Marg

Controller-Based Wireless
LAN Fundamentals
Jeff Smith, Jake Woodhams, Robert Marg
Cisco Press
800 East 96th Street
Indianapolis, IN 46240
ii Controller-Based Wireless LAN Fundamentals
Controller-Based Wireless LAN Fundamentals
Jeff Smith, Jake Woodhams, Robert Marg
Copyright© 2011 Cisco Systems, Inc.
Published by:
Cisco Press
800 East 96th Street
Indianapolis, IN 46240 USA
All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying, recording, or by any information storage and retrieval
system, without written permission from the publisher, except for the inclusion of brief quotations in a
review.
Printed in the United States of America
First Printing November 2010
Library of Congress Cataloging-in-Publication data is on file.
ISBN-13: 978-1-58705-825-7
ISBN-10: 1-58705-825-1
Warning and Disclaimer
This book is designed to provide information about controller-based wireless local-area networks. Every
effort has been made to make this book as complete and as accurate as possible, but no warranty or fit-
ness is implied.
The information is provided on an “as is” basis. The authors, Cisco Press, and Cisco Systems, Inc. shall have
neither liability nor responsibility to any person or entity with respect to any loss or damages arising from
the information contained in this book or from the use of the discs or programs that may accompany it.
The opinions expressed in this book belong to the author and are not necessarily those of Cisco Systems, Inc.
Trademark Acknowledgments
All terms mentioned in this book that are known to be trademarks or service marks have been appropriate-
ly capitalized. Cisco Press or Cisco Systems, Inc., cannot attest to the accuracy of this information. Use of
a term in this book should not be regarded as affecting the validity of any trademark or service mark.
Corporate and Government Sales
The publisher offers excellent discounts on this book when ordered in quantity for bulk purchases or spe-
cial sales, which may include electronic versions and/or custom covers and content particular to your busi-
ness, training goals, marketing focus, and branding interests. For more information, please contact: U.S.
Corporate and Government Sales 1-800-382-3419
iii
Feedback Information
At Cisco Press, our goal is to create in-depth technical books of the highest quality and value. Each book
is crafted with care and precision, undergoing rigorous development that involves the unique expertise of
members from the professional technical community.
Readers’ feedback is a natural continuation of this process. If you have any comments regarding how we
could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us
through email at
iv Controller-Based Wireless LAN Fundamentals
About the Authors
Jeff Smith is a wireless consulting systems engineer in the Cisco Systems Borderless
Networking Organization. His 25 years of experience include the planning, analysis,
design, implementation, installation, and support of numerous wireless network-based
solutions for enterprises, municipalities, hospitals, universities, airports, warehouses,
mines, and product manufacturers worldwide. He has developed and instructed dozens of
training courses on wireless networking topics. Prior to joining Cisco Systems, Jeff was an
early employee at several wireless and security startup companies. Jeff’s education
includes a bachelor’s degree in electrical engineering and a master’s degree in telecommu-
nications with emphasis on wireless communications. Jeff’s certifications include CWNE
(Certified Wireless Network Expert), IEEE WCET (Wireless Communications
Engineering Technology Certification), and CISSP (Certified Information Systems
Security Professional).
Jake Woodhams is a senior manager of technical marketing in the Cisco Wireless
Networking Business Unit. In this role, he is responsible for technical product definition
and systems architecture, focusing on Cisco Unified Wireless LAN architecture. He hass
been working with wireless technology at Cisco for seven years and has an intimate
knowledge of the protocols and products in the Cisco wireless portfolio. As a writer, he’s
the author of numerous white papers and design and deployment guides as well as several
contributed articles.
Robert Marg is a wireless consulting systems engineer in the Cisco Systems Borderless
Networks Organization. As a technical leader in wireless, Robert is responsible for plan-
ning, designing, and supporting numerous wireless network–based solutions for enter-
prises, hospitals, universities, manufacturers, and K–12 customers. Prior to his role as a
wireless consulting systems engineer, Robert spent time as a member of the federal, pub-
lic sector, enterprise, and commercial sales organizations as a systems engineer, helping
customers solve business challenges with technical solutions. Mr. Marg holds a bachelor’s
degree in bacteriology from the University of Wisconsin–Madison. As a writer, Robert
has been the author of numerous white papers and a technical editor for the Cisco Press
CCNA Exam Certification Guide.
About the Contributing Author
Jeff DiMaio is a consulting systems engineer in the Cisco Systems Unified
Communications Organization. Jeff specializes in unified communications and wireless
and security technologies. Prior to joining Cisco, Jeff worked for the leading provider of
Voice over WLAN solutions. Jeff has been active in the Wi-Fi Alliance and other indus-
try organizations and has helped develop the Wi-Fi Multimedia (WMM) specification.
Jeff recently finished his graduate work at the University of Colorado, where he earned a
master’s degree in interdisciplinary telecommunications.
v
About the Technical Reviewers
Saurabh Bhasin has been involved with various wireless technologies over the years, since
the first days of 802.11 becoming a standard and, more recently, with the evolution of the
wireless industry to 802.11n. Mr. Bhasin has been with the Cisco Wireless Networking
Business Unit for more than four years, and in this role, he has worked closely with Cisco
technology partners (enabling advanced services over wireless networks), leading key
architectural features and training various members of the Cisco and partner community
in person or through the numerous papers he has authored.
In his past, Mr. Bhasin has authored numerous articles for reputable industry publications.
He has also worked with a packet analysis company, thus completely understanding the
inner workings of a network.
Sujit Ghosh, CCIE No. 7204, is a manager of the technical marketing team in the Wireless
Networking Business Unit of Cisco and has 16 years of experience in the networking
industry. Sujit has extensive customer contact and is responsible for developing and mar-
keting enterprise networking solutions using the Cisco Unified Wireless Network. He has
focused on the areas of wireless LAN security and wireless/wired LAN integration.
Prior to joining the Wireless Business Unit, Sujit worked as a TAC engineer at Cisco for five
years on the Security/VPN team working on security, wireless, and VPN products. Sujit active-
ly speaks at the Networkers Conference on the subjects of deploying secure wireless LANs,
troubleshooting wireless LANs, designing and deploying 802.11 wireless LANs with central-
ized controllers and guest access design, and deploying wired and 802.11 wireless LANs.
Dedications
We dedicate this book to our families, who put up with many nights and weekends spent
on rewrites.
Acknowledgments
We would like to thank the Pearson production team for their time and effort in creating
this book:
■ Thanks to Mary Beth Ray for getting this book contracted and managing the process
from several restarts and changes in authors.
■ Thanks to Christopher Cleveland, Tonya Simpson, and John Edwards for their editing
of the book and perseverance in dealing with the authors’ crazy schedules and miss-
ing of deadlines.
■ Thanks to the many others at Pearson who were part of developing and producing
this book.
■ Thanks to our colleagues at Cisco who have been supportive in this project.
We would like to thank Tom Carpenter for providing technical feedback on the many top-
ics this book covers.
vi Controller-Based Wireless LAN Fundamentals
Contents at a Glance
Introduction xvi
Chapter 1 The Need for Controller-Based Wireless Networks 1
Chapter 2 Wireless LAN Protocols 15
Chapter 3 802.11n 37
Chapter 4 Cisco Unified Wireless LAN Security Fundamentals 79
Chapter 5 Design Considerations 123
Chapter 6 Cisco Unified Wireless LAN Architectures 135
Chapter 7 Troubleshooting 157
Chapter 8 Introduction to WCS 195
Chapter 9 Next-Generation Advanced Topics: Multicast 243
Index 281
vii
Contents
Introduction xvi
Chapter 1 The Need for Controller-Based Wireless Networks 1
Why Wireless LAN Controllers Were Created 4
Why You Need to Use a Wireless LAN Controller 5
Controller-Based WLAN Functional and Elemental Architecture 6
Autonomous AP Issues and the WLC Remedy 9
Problem: WLAN APs Are Difficult to Deploy 9
Problem: WLANs Are Not Secure 10
Problem: Infrastructure Device Configuration and Scaling 10
Problem: Autonomous AP Costs for Configuring Each AP 11
Problem: Autonomous AP Costs for Keeping Each AP’s Software
Up to Date 11
Problem: RF Expertise and Configuration Challenges 12
Mobility Applications Enabled by Controller-Based WLANs 12
WLANs Do Not Provide the Performance and Robustness Needed
for Use as a Primary Access Network 13
Summary 13
Chapter 2 Wireless LAN Protocols 15
Understanding the Relevant Standards 15
Wi-Fi Alliance 16
Cisco Compatible Extensions 18
IETF 18
The Physical Layer 19
Physical Layer Concepts 19
CAPWAP 21
CAPWAP Versus LWAPP 22
CAPWAP Protocol Fundamentals 23
CAPWAP Terminology 23
CAPWAP Control Messages 24
CAPWAP Data Messages 24
CAPWAP State Machine 24
CUWN Implementation of the CAPWAP
Discovery 26
CAPWAP Transport 28
CAPWAP MAC Modes 29
Split MAC Mode 29
Local MAC Mode 30
viii Controller-Based Wireless LAN Fundamentals
Summary of CAPWAP 31
Packet Flow in the Cisco Unified Wireless Network 32
CAPWAP Control 32
CAPWAP Data Path: Centrally Bridged Traffic 32
CAPWAP Data Path: Locally Bridged Traffic 33
Summary of Packet Flow 34
Summary 34
References 34
Chapter 3 802.11n 37
IEEE 802.11n Standard 38
802.11n MAC 39
Other 802.11 Standards Used with 802.11n 41
Frequency Bands Supported by 802.11n 42
Antenna Arrays 42
Transmit Beam Forming (TxBF) 43
Beam Steering 44
Spatial Multiplexing 45
Transmit Diversity 47
Multiple Input, Multiple Output (MIMO) 48
Multipath 48
MIMO Nomenclature 49
Receiver Diversity 51
Branch Selection Diversity 52
Branch-Combining Diversity 53
Diversity Antenna Array, Type, Orientation,
and Spacing 55
Transmit Beam-Forming Types 56
Legacy Beam Forming 57
Implicit Beam Forming 57
Explicit Beam Forming 57
MIMO Antenna Array Coverage and Placement 58
Coding 58
Binary Convolutional Coding (BCC) 59
Low-Density Parity Checking (LDPC) 59
HT PHY and Operation 60
HT Mixed 61
HT-Greenfield Format 61
Channel Bonding/40-MHz-Wide Channels 63
Protection 64
Power Management 66
ix
Packet Aggregation 67
Bursting/Block ACK (BACK) 69
Short Guard Interval (GI) 69
Reduced Inter-Frame Spacing (RIFS) 69
Reverse Direction Protocol (RDP) 71
Modulation and Coding Schemes (MCS) 71
Configuration Requirements to Obtain HT Rates 73
Predicting 802.11 Link Performance 76
Summary 77
Chapter 4 Cisco Unified Wireless LAN Security Fundamentals 79
Understanding WLAN Security Challenges 80
Vulnerabilities Inherent to the Radio Transmission Medium 80
Physical Containment Problem 81
Unlicensed Radio Spectrum Problem 81
Vulnerabilities Inherent to the Standards Definitions 82
Authentication and Encryption Weaknesses 82
Unauthenticated Management Frames 83
Vulnerabilities Inherent to Mobility 84
Misconfigured Wireless Devices and Clients 85
Rogue Access Points and Devices 85
Readily Available Profiling and Attack Tools 86
Addressing the WLAN Security Challenges 86
Background on Strong Authentication and Privacy 87
How WEP Encryption Works 87
How WEP Is Broken 90
802.11 Authentication 90
Addressing the Strong Authentication and Privacy Challenges 92
Authentication Framework 94
Authentication Algorithm 96
Data Privacy and Integrity 102
Alternative Approaches to Authentication and Data Privacy 113
Rogue Access Point Detection and Wireless Intrusion Prevention 114
Secure Management and Security Policies 118
Summary 119
References 119
Chapter 5 Design Considerations 123
100 Percent Wireless Access Layer 123
Client Device Power 124
RF Vulnerability 124
Volume of Network Traffic 125