Networking / Beginners

IEEE 802.11i Considerations

With all the terms and concepts used in this tutorial, you may not be immediately clear about what exactly you, as a wireless network administrator, need to do to deploy a network that is IEEE 802.11i compliant. Table below presents that information in bitesized pieces.

ScenarioSuggested Solutions and Tips
You manage a small wireless network with only a few users and devices and need to use the most current security mechanisms.Consider IEEE 802.11i.
Use IEEE 802.11i with pre-shared keys, which help you avoid the additional overhead of maintaining a public key infrastructure (PKI).
You manage a large to mediumsized wireless network and need to use the most current security mechanisms.Consider IEEE 802.11i.
Consider using IEEE 802.11i with one of the EAP authentication types.
You already use digital certificates for server- or infrastructure-side authentication on your network.Consider using EAP-TTLS with IEEE 802.11i.
EAP-TTLS does not require mutual authentication.
You already use digital certificates for server- or infrastructure-side authentication and for client-side authentication on your network.Consider using EAP-TLS with IEEE 802.11i. EAP-TLS requires mutual authentication.
You are considering using EAP-TLS or EAP-TTLS on the infrastructure side of your wireless network.You need a RADIUS server implementation that supports EAP.
You need a PKI that lets you manage the digital certificates that will be used, which includes the tasks of issuing, revoking, signing, and storing the certificates. Some of this can occur via a certificate authority implementation.
Your WAPs (the authenticator entity) must support 802.1X so that they can communicate with the RADIUS servers via EAP.
You might get 802.1X support in infrastructure hardware via simple firmware upgrades if the vendor doesn't support it.
Consider temporarily allowing legacy authentication mechanism to coexist with new 802.1X-based mechanisms, which will help if things don't work as smoothly as planned.
You are considering using EAPTLS or EAP-TTLS on the client or peer side of the wireless network.You need the wireless clients STAs to be able to talk 802.1X to the access point. The supplicant software on the clients needs to support the EAP type with which the server is configured.
[Previous] [Contents]

In this tutorial:

  1. Securing Wireless Networks
  2. Security Background
  3. Security Services
  4. Cryptographic Concepts and Terms
  5. Encryption and Decryption
  6. Keyspace
  7. Exclusive OR (XOR)
  8. Algorithm
  9. Asymmetric Encryption Algorithms
  10. Public-Private Key Cryptography
  11. Cipher
  12. Concealment Ciphers vs. Running Key Ciphers
  13. Stream Ciphers vs. Block Ciphers
  14. Cipher Examples
  15. Cipher Implementations
  16. Wi-Fi Protected Access
  17. TKIP/WPA
  18. Wi-Fi Protected Access 2 (WPA2)
  19. CCMP/AES
  20. Hash Functions
  21. EAP
  22. EAP Entities
  23. EAP Grammar
  24. EAP Types
  25. EAP-TTLS
  26. EAP-PSK
  27. EAP-SIM
  28. EAP-AKA
  29. IEEE 802.11i
  30. Four-Way Handshake
  31. IEEE 802.11i Considerations