Please enable JavaScript.

Coggle requires JavaScript to display documents.

WLAN Product Features and Security Configurations - Coggle Diagram

- - - - The STA monitors channel beacons. When it finds new APs, it sends probe requests to the APs. The new APs respond the requests through the channels. The STA evaluates the responses and decides which AP is the best to associate with.
      - Roaming triggering > the roaming is triggered when the station reaches its treshold
        Triggering conditions vary according to the following factors
        
        Ratio of the signal strength of the current AP to the signal strength of neighboring APs: STA roaming is triggered when the ratio reaches a threshold.
        
        Service performance indicators such as packet loss ratio: STA roaming is triggered when the service performance indicators reach the preset thresholds. Roaming triggered this way is slow and less effective.
      - Roaming operation < the STA associates with the new AP and disassociates with org AP
  - - - During Layer 2 roaming, the STA stays within the same subnet. The FAP/FAC processes packets of a Layer 2 roaming STA in the same way as it processes packets of a newly online STA. The FAP/FAP forwards the packets on the local network but not send the packets back to the HAP over the inter-AC tunne
      - Before Roaming
        
        The STA sends a service packet to the HAP
        After receiving the service packet, the HAP sends it to the HAC.
        The HAC forwards the service packet to the upper-layer network
      - After Roaming
        
        The STA sends a service packet to the FAP.
        After receiving the service packet, the FAP sends it to the FAC
        The FAC forwards the service packet to the upper-layer network.
    - - The STA stays in different subnets before and after Layer 3 roaming. To ensure that the STA can still access the original network after roaming, user traffic is forwarded to the original subnet over tunnels.
  - - - Purpose: The most obvious advantage of WLAN networks is that a STA can move within a WLAN network without physical media restrictions. WLAN roaming allows the STA to move within a WLAN network without service interruption. An ESS includes multiple APs. When a STA moves from an AP to another, WLAN roaming ensures seamless transition of STA services between APs
      - Depending on whether a STA roams within the same subnet, WLAN roaming is categorized as Layer 2 and Layer 3 roaming
    - - Packets are lost or servicces are interrupted due to long authentication duration
        Users authorization information remain unchanged
        Users IP addresses must be unchanged
- - - - Moonitoring and Identification
        
        monitor AP works scans channels so monitor all 802.11 frames sent from surroundings ewireless devices
      - Containment
        
        WIPS Supports containment on rogue APs rogue clients and ad-hoc devices
      - Identification Process
        
         The AC extracts surrounding neighbor entries and identifies device types as follows:
        
        Rogue AP identification: APs can be classified based on the MAC address, SSID, or OUI whitelist. APs that are not managed by the AC and not in the whitelist are considered as rogue APs.
        
        Rogue client identification: Clients associated with rogue APs are considered as rogue clients
        
        Wireless bridge identification: the same as rogue AP identification
        
        Ad-hoc: All ad-hoc networks are considered unauthorized.
    - - Working Mode
      - Authentication Technology
        
        To enhance AP security, an AC can authenticate the APs that attempt to connect to the network. Currently, Huawei ACs support MAC address authentication, SN authentication, and non-authentication.
        
        A whitelist can also be configured to allow access from certain APs. The following types of whitelists can be configured:
  - - - STA blacklist and whitelist
      - User Isolation
      - MAC Address authentication
      - AntiSpoofing Technologies such as DHCP snooping , dynamic ARP inspection DAI and IP source guard IPSG
      - Web Portal authentication
        
        Portal authentication is also called web authentication. Generally, portal authentication websites are referred to as portal websites
        
        Portal authentication system architecture
        
        Different Portal authentication methods can be used in different networking modes. Depending on the network layer where Portal authentication is performed, Portal authentication is categorized as Layer 2 authentication or Layer 3 authentication.
  - - - DoS Attacks
      - Address Spoofing Attacks
      - Rogue device Intrusion
        
        A WLAN is facing threats from rogue APs, ad-hoc networks, and
        DDoS attacks. Compared with other attacks, rogue devices pose more severe threats on wireless networks. Take rogue APs as an example. A hacker can deploy unauthorized APs or clients on a WLAN to provide unrestricted access. Then users on the WLAN think they are provided with good signal coverage and do not know their data has been intercepted by the hacker. This information leakage may cause losses to users' fame or wealth.
      - Data Thieft
      - Weak WEP protocol
  - - - Security functions, such as DHCP snooping, DAI, and IPSG, can be configured on interfaces of wired network devices or in WLAN service sets to enhance network security.negotiates with the AC using this IP address to set up the CAPWAP tunnel. UDP packets transmitted in the CAPWAP tunnel are encrypted using DTLS.
      - DTLS supports certificate encryption and PSK encryption.
    - - The user isolation function prevents wireless users associated with the same AP from exchanging Layer 2 packets. These users cannot communicate directly. Instead, user traffic is aggregated to the gateway, facilitating user management.
      - Before user isolation is configured, users associated with the same VAP can communicate with each other. This may threaten network security or cause accounting issues. VAP-based user isolation can solve this problem. VAP-based user isolation disables forwarding of Layer 2 unicast or broadcast packets between users associated with the same VAP. This function ensures service security and accounting accuracy.
    - - User group–based user isolation divides users into different groups and implements user isolation in the following modes:
        
        Intra-group user isolation: Users in the same group cannot communicate with each other
        
        Inter-group user isolation: Users in different groups cannot communicate with each other, and users in the same group can communicate with each other.