Mobility and Collaboration Wireless Networking for Mobility and Collaboration

Wireless with Windows XP

Windows XP Professional has new features and enhancements that make remote and wireless access simple for any wireless user, which in turn provides significant productivity gains for employers. Organizations considering Windows XP Professional find significant value in its ability to automatically enable wireless networking. Such cost reductions are directly related to features, such as the Wireless Zero Configuration service, which allow users to leverage the technology without involving IT support staff. The following list describes scenarios in which Windows XP and the Wireless Zero Configuration service make users more productive:

• 
  With a wireless network adapter installed, Windows XP Professional searches for available networks to which it can connect. When an available network matches a preferred network, Windows XP Professional connects to it. If there are no configured preferred networks or no preferred networks are found, users can also select a specific network to which they want to connect. Users can prioritize the list of preferred networks—Windows XP Professional stores the list and connects to the networks in the chosen order. Connection management is possible without user intervention, but user interaction is sometimes necessary to choose specific networks or prioritize connection order.
  
• 
  Automatic configuration makes wireless networking more practical for mobile users. Because configuring wireless network connections in Windows XP is much easier than in earlier versions of Windows using third-party device drivers, all types of mobile users can easily configure their wireless connections. Estimates are that simplified network configurations save organizations $68 per laptop each year. Wireless networking and simplified network configurations benefit IT professionals, too. Because users are more able to configure their own network connections, they become more self-sufficient. IT professionals no longer have to plan and configure every connection when they deploy the operating system to mobile users. And the Help desk gets fewer calls from mobile users as they change environments and thus need to configure new network connections.
  
• 
  As users physically move their wireless computers from room to room, Windows XP Professional automatically remains connected by finding the best wireless access point (AP) with which to communicate. When it finds a new wireless AP, it automatically negotiates authentication and authorization with that wireless AP without user intervention, which provides a great experience for the mobile user. A user can move anywhere within a given wireless network and remain connected to the network. You can also configure an ad hoc wireless network, which is convenient during meetings when users want to share and collaborate.
  

Wireless Deployment

1. 
   Pre-installation. This phase of a wireless deployment involves three steps. The first is developing a wireless AP location plan, which is based on your own design guidelines. For example, Microsoft’s guidelines specified that 95 percent of the installations could not require specialized antennas. The second step is field verification of proposed wireless AP locations to check for physical interference. The last is to present the final locations for approval prior to beginning installation of the APs.
   
2. 
   Installation. The physical installation of wireless APs involves three steps. First is enclosing the wireless APs and antennas in enclosures that meet fire safety codes. The next is configuring centralized, low-voltage power supplies on backup power using uninterruptible power supplies. The last is building out the authentication infrastructure (Internet Authentication Service—IAS—and a public key infrastructure—PKI—in Microsoft’s case).
   
3. 
   Delivery. Delivery is a testing phase in which technicians spot-check wireless AP installation for conformance to the specifications. These technicians also verify RF coverage and network connectivity of each AP. Last, in this phase, technicians deliver as-built documentation, which reflects the final placement of each wireless AP.
   
4. 
   Rollout. In Microsoft’s case, the rollout involved three steps. The first was to create a Cryptographic API Component Object Model (CAPICOM) script to install certificates. Then, Microsoft created a Web site to host information about instructions, updated drivers, and the CAPICOM script. Last, the company informed users about the Web site with information to obtain wireless access. To get the computer and user certificates required for wireless access, users must connect to the corporate network by using a wired Ethernet connection.
   

• 
  Wireless client computers running Windows XP. Windows XP has built-in support for Wi-Fi wireless networking and 802.1X authentication using Extensible Authentication Protocol (EAP). The section “IEEE 802.1X” contains more information about 802.1X and EAP.
  
• 
  At least two Windows 2000 IAS servers. At least two IAS servers (one primary and one secondary) are used to provide fault tolerance for Remote Authentication Dial-In User Service (RADIUS)-based authentication. If only one RADIUS server is configured and it becomes unavailable, wireless access clients cannot connect. By using two IAS servers and configuring all wireless APs, which are the RADIUS clients, for both the primary and secondary IAS servers, the RADIUS clients can detect when the primary RADIUS server is unavailable and automatically fail over to the secondary IAS server. The Windows 2000 IAS servers require Service Pack 3 (SP3). See the section “RADIUS” for more information.
  
• 
  Active Directory service domains. Active Directory® domains contain the user accounts, computer accounts, and dial-in properties that each IAS server requires to authenticate credentials and evaluate both authorization and connection constraints. While not a requirement, to both optimize IAS authentication and authorization response times and minimize network traffic, IAS should be installed on Active Directory domain controllers. The domain controllers require SP3. See the section “Active Directory” for more information.
  
• 
  A certificate infrastructure. The EAP-Transport Level Security (TLS) authentication protocol is used with locally installed computer and user certificates to authenticate wireless clients. A certificate infrastructure, also known as PKI, is needed to issue and provide validation for certificates. See the section “Certificates” for more information. Alternatively, you can purchase computer certificates from a third-party certification authority (CA) and use it for Protected EAP (PEAP) with Microsoft Challenge-Handshake Authentication Protocol (MS-CHAP) v2 authentication. See the paper PEAP with MS-CHAP Version 2 for Secure Password-based Wireless Access for more information.
  
• 
  Wireless remote access policy. A remote access policy is configured for wireless connections so that employees can access the organization’s intranet.
  
• 
  Multiple wireless APs. Multiple third-party wireless APs provide wireless access in different buildings of an enterprise. The wireless APs must support 802.1X and RADIUS.
  

Figure 1. Secure Wireless Configuration (The Certification Authority—CA—server is optional if you use third-party certificates with PEAP MS-CHAP v2 as described in the article PEAP with MS-CHAP Version 2 for Secure Password-based Wireless Access.)

Performance

• 
  Don’t overload your wireless APs with too many connected wireless clients. Although most wireless APs can support hundreds of wireless connections, the practical limit is 20–25 connected clients. An average of 2–4 users per wireless AP is a good average to maximize the performance while still effectively utilizing the WLAN.
  
• 
  For higher-density situations, lower the signal strength of the wireless APs to reduce the coverage area, thereby allowing more wireless APs to fit in a specific space and more wireless bandwidth to be distributed to more wireless clients.
  

Scalability

• 
  To ensure redundant coverage against the potential failure of a single wireless AP and to provide a seamless roaming experience within a building, design your coverage areas carefully. Microsoft based the company’s WLAN on a 20-meter diameter coverage area for this reason. The company carefully verified coverage and network connectivity for each wireless AP. Microsoft tested for decreased coverage-area size, overlapping coverage areas via channel configuration, and mitigating Bluetooth (BT) interference.
  
• 
  For large amounts of authentication traffic within an Active Directory forest, use RADIUS proxies running Windows .NET Server 2003 IAS between the wireless APs and the RADIUS servers. By default, an IAS RADIUS proxy balances the load of RADIUS traffic across all the members of a remote RADIUS server group on a per-authentication basis and uses failover and failback mechanisms. Members of a remote RADIUS server group can also be individually configured with priority and weight settings so that the IAS proxy favors specific RADIUS servers.
  

Roaming and Mobility

Security

EAP-TLS also helps protect against snooping on Microsoft’s WLAN. EAP messages for 802.1X negotiation are sent as clear text. However, the use of EAP-TLS and public-key encryption prevents the eavesdropper from obtaining the information needed to masquerade as either the wireless client or the authenticating server. After EAP-TLS negotiation is complete, all traffic sent between an authenticated wireless client and its associated wireless AP is encrypted with the Wired Equivalent Privacy (WEP) session key, which is changed for each authentication.

Protection from rogue wireless APs on the Microsoft WLAN is also done through the use of EAP-TLS, which provides mutual authentication of the wireless AP and the authenticating RADIUS server. To masquerade as a Microsoft corporate wireless AP, the AP must have a security relationship with a Microsoft RADIUS server. If a wireless AP doesn’t have this security relationship and configuration, it cannot exchange RADIUS messages with the RADIUS server and, therefore, cannot authenticate 802.1X wireless clients. It’s possible for the rogue wireless AP to be configured as the RADIUS client of a rogue RADIUS server. However, by default, Microsoft wireless clients validate the certificate of the RADIUS server. Therefore, if the RADIUS server of the wireless AP cannot provide a valid certificate and proof of knowledge of its corresponding private key, the wireless client terminates the connection. See the next section, “Wireless Security,” for more information about securing your wireless network.

Wireless Security

• 
  Securing the data passing through the wireless network against eavesdropping
  
• 
  Securing the wireless network against intrusion by using strong authentication
  
• 
  Securing the network against rogue wireless APs
  

The lack of a WEP key management protocol is the primary limitation with securing Wi-Fi, especially in a wireless infrastructure network (a wireless network built using APs to connect to the wired network) with a large number of stations. Some examples of this type of network include corporate campuses and public places such as airports and malls. When manually configured shared keys are used, the keys tend to remain in place for long periods of time, enabling hackers more time to use various attacks to gain access to the network. The lack of authentication and encryption services also effects operation in a wireless, ad hoc network (peer-to-peer wireless network) where users may wish to exchange files or collaborate wirelessly. An example is peers sharing files in conference rooms. As a result, the enhanced importance of authentication and encryption in a wireless environment proves the need for access control and security mechanisms that include a key management protocol specified in Wi-Fi.

• 
  Key Reuse. The technique that WEP uses to allocate keys can result in successful attacks to determine the keys. These attacks require a large number of packets (5 to 6 million) to actually fully derive the WEP key, but on a large, busy network, this can occur in a short time—as quickly as 10 minutes. Some of the largest corporate networks will likely require much more time than this to gather enough packets. In WEP-protected wireless networks, all or some of the stations often use the same shared key, and the network becomes insecure if the WEP keys aren’t changed often, which furthers the need for a WEP key management protocol.
  
• 
  Injecting Malicious Packets. If attackers know the structure of an encrypted packet (known protocol header fields and so on), they can modify the packet by flipping bits to create a malicious packet—changing commands and addresses. The encrypted packet has an integrity check to ensure it hasn’t been tampered with, but because of the way this is implemented in WEP, the integrity check can be modified so that it’s valid for the new packet and accepted at the destination. If the attacker knows the location of the destination address in this packet, the address can be changed on an otherwise unknown packet. The new destination can be a machine controlled by the attacker. If the packet is sent on the wireless network, the AP will decrypt the packet and send it to the rogue destination.
  
• 
  Realtime Decryption. The weaknesses of the WEP algorithm can allow an attacker to decrypt all traffic in realtime.
  
• 
  Other Weaknesses. Other security weaknesses that exist with Wi-Fi include the following:
  

• 
  No user identification and authentication
  
• 
  No central authentication, authorization, and accounting support
  
• 
  No per-packet authentication mechanism to identify the packet source
  
• 
  Implementations that derive WEP keys from passwords, making passwords vulnerable
  
• 
  No support for extended authentication; for example: token cards; certificates and smart cards; one-time passwords; and biometrics
  
• 
  Key management issues, such as rekeying global keys, and no dynamic, per-station, or session-key management
  

IEEE 802.1X

To provide a standard authentication mechanism for 802.1X, IEEE chose EAP. EAP is based on a Point-to-Point Protocol (PPP) authentication mechanism but was adapted for use on point-to-point LAN segments. To adapt EAP messages to be sent over Ethernet or WLAN segments, the 802.1X standard defines EAP over LAN (EAPOL), a standard way to encapsulate EAP messages. For more detailed information about 802.1X, see Wireless Network Security with IEEE 802.1X.

EAP-TLS is an EAP type used in certificate-based security environments. If you’re using smart cards for remote access authentication, you must use the EAP-TLS authentication method. The EAP-TLS authentication process exchanges certificates installed on the access client and the authenticating server, providing mutual authentication, encryption, and secured-secret key exchange and determination. EAP-TLS provides a very strong authentication method.

Windows XP ships with support for 802.1X. All major NIC vendors also support 802.1X and most have released Windows drivers that support it. Likewise, all major enterprise AP vendors are supporting 802.1X. Contact your hardware vendor for more information on their support. To learn more about Microsoft Windows 2000, Windows Millennium Edition, Windows 98, and Windows NT® 4.0 Workstation support for 802.1X, see Microsoft 802.1X Authentication Client.

RADIUS

IAS provided with the Windows 2000 Server and Microsoft Windows .NET Server 2003 families is the Microsoft implementation of a RADIUS server and, for the Windows .NET Server 2003 family, RADIUS proxy. IAS performs centralized connection authentication, authorization, and accounting for many types of network access, including wireless, authenticating switch, dial-up, and VPN-based remote access and router-to-router connections. IAS enables the use of a heterogeneous set of wireless, switch, remote access, or VPN equipment and can be used with the Windows 2000 Server or Windows .NET Server 2003 Routing and Remote Access service.

When an IAS server is a member of an Active Directory -based domain, IAS uses Active Directory as its user account database and is part of a single sign-on (SSO) solution. The same set of credentials is used for network access control (authenticating and authorizing access to a network), logging on to an Active Directory -based domain, and accessing resources. This integration greatly simplifies the planning, configuration, and deployment of user administration for a wireless network.

The following are great resources to starting learning more about using RADIUS servers:

• 
  For an in-depth discussion about RADIUS servers and best practices for deploying them, see the paper RADIUS Protocol Security and Best Practices.
  
• 
  To learn more about IAS, see the paper Internet Authentication Service for Windows 2000.
  
• 
  To learn more about IAS as used for wireless deployment, see the article Enterprise Deployment of IEEE 802.11 Using Windows XP and Windows 2000 Internet Authentication Service.
  
• 
  To learn more about how Microsoft deployed IAS in its own infrastructure and the best practices that resulted, see the paper Microsoft Wireless LAN Deployment and Best Practices.
  

Active Directory

Certificates

Summary

Upgrading enterprise-level network systems is a challenge, but as you have seen in this paper, capabilities built into Windows XP Professional greatly simplify the process of transitioning to a secure wireless network. Additional applications such as Systems Management Server (SMS) facilitate deployment and asset tracking. Features such as unattended installation and Wireless Zero Configuration make Windows XP Professional the choice for an unparalleled wireless network experience.

For More Information

• 
  Business Value of Microsoft Solutions
  
• 
  Enterprise Deployment of IEEE 802.11 Using Windows XP and Windows 2000 Internet Authentication Service
  
• 
  IEEE 802.1X Authentication for Wireless Connections
  
• 
  Microsoft 802.1X Authentication Client
  
• 
  Microsoft Leads in Securing Wireless Networks
  
• 
  Microsoft Wireless LAN Deployment and Best Practices
  
• 
  Microsoft's Wi-Fi Web Site
  
• 
  PEAP with MS-CHAP Version 2 for Secure Password-based Wireless Access
  
• 
  RADIUS Protocol Security and Best Practices
  
• 
  Windows 2000 Security Services
  
• 
  Windows XP Wireless Deployment Technology and Component Overview
  
• 
  Wireless 802.11 Security with Windows XP
  
• 
  Wireless Network Security with IEEE 802.1X
  
• 
  The Windows XP Wireless Zero Configuration Service
  

Glossary

• 
  CDMA. The U.S. military first used Code Division Multiple Access (CDMA) technology during World War II. CDMA encodes radio signals by using a random sequence to define a channel and convert speech into digital signals. It reportedly is more reliable, saves battery life, and is more secure than other wireless transmission technologies. QUALCOMM provided the hardware for the military during WW II and is now applying for patents on the technology that was made public after the war.
  
• 
  GPRS. General Packet Radio Service (GPRS) offers high-speed Internet service over a Global System for Mobile Communication (GSM) network. This process sends packets in bursts so that the user experience is instant connectivity, faster data transmission, and faster response time for roaming users. It’s easy to set up and easy to install.
  
• 
  GSM. GSM was introduced in 1991 and came into service sometime in 1997. This packet technology provides high-speed wireless access over a GSM network for access by mobile devices and allows eight simultaneous calls per radio frequency. GSM is available in more than 100 countries, and the default service is available in Europe, Asia, and Australia. GSM is also available in the Americas at the 1900 MHz frequency.
  
• 
  IEEE 802.11. The IEEE 802.11 protocol is a standard in the wireless industry. It defines a physical layer and a sublayer that manages media access control (MAC). This protocol specifies two authentication methods. Open Systems authentication allows free access to the network, and Shared Key authentication provides security through a prearranged signature. For more information about Open System and Shared Key authentication, see 802.11 Authentication and Configuring Wireless Network Clients.
  
• 
  IEEE 802.11b (Wi-Fi). The IEEE 802.11b protocol enhances and standardizes the physical layer so that it can support higher bit rates, which allows wireless networking at higher speeds. This protocol supports bit rates of 5.5 Mbps and 11Mbps.
  
• 
  IEEE 802.1X. The 802.1X standard defines port-based, network access control used to provide authenticated network access for Ethernet (wired) and wireless networks. 802.1X support is included with Windows XP Professional. 802.1X support for Windows 2000, Windows Millennium Edition, Windows 98, and Windows NT 4.0 Workstation is available with Microsoft 802.1X Authentication Client.
  
• 
  IETF. Internet Engineering Task Force (IETF) is an open organization designed to promote communication among network developers, architects, designers, and basically anyone with an interest in promoting well-designed Internet applications and efficient development for Internet tools and applications.
  
• 
  ITU. International Telecommunication Union (ITU) is located in Geneva, Switzerland, and works with the United Nations to establish standards for global telecommunication networks and services. Its purpose is to act as a free international agent to work with governments to establish telephony and wireless standards worldwide.
  
• 
  TDMA. Time Division Multiple Access (TDMA) technology is used to transmit digital packets from a cell phone to a base station AP. TDMA works by breaking transmissions into smaller chunks and then stacking them into shorter time units so that more calls can be sent simultaneously. GSM is using TDMA to provide the eight calls per frequency as mentioned under “GSM” above.
  
• 
  Wi-Fi Alliance. The Wi-Fi Alliance is a nonprofit international association formed in 1999 to certify the interoperability of WLAN products based on the IEEE 802.11 specification. The goal of the Wi-Fi Alliance's members is to enhance the user experience through product interoperability. Microsoft's Wi-Fi site (Wi-Fi) contains links to a series of technical articles.
  
• 
  WLAN. Wireless local area networks (WLANs) provide wireless network access in a corporate environment. With roaming wireless connections, users can move from building to building and from room to room without disruption of service. Two types of WLANs are available: infrastructure and ad hoc networks. An infrastructure network connects individual PCs (known as stations) to a wired network via a wireless AP. Ad hoc networks allow individual users to form a temporary wireless network for sharing and collaborating without the need for a wireless AP.
  
• 
  WPAN. Wireless personal area networks (WPANs) are designed to provide an individual with wireless connectivity within a personal space. This space surrounds the user up to 10 meters (approximately 30 feet) and provides an ad hoc wireless connection. Typically used for cell phones, laptops, or PDAs, this ad hoc network uses either infrared technology to "squirt" data to another device within 1 meter (3 feet) or takes advantage of Bluetooth technology.
  
• 
  WWAN. Wireless wide area networks (WWANs) are designed to establish wireless connections over a large geographic area. Due to the size of the areas that a WWAN must transmit, WWAN technologies transfer data by using satellites or multiple antenna sites that wireless service providers maintain. Although wireless manufacturers and developers are working toward a wireless world standard, there isn't one today. GSM is widely predominant throughout the world; however, CDMA and its 1xRTT standard are also available.