Data Protection On A Wm-Ad - Wep And Wpa - Extreme Networks Summit WM User Manual

WM Access Domain Services
AAA assignment requires that user authentication is completed using the 802.1X/EAP protocol
before a user is granted access to a network resource. Therefor, the enforcement of non-authenticated
traffic rules is not applicable. When authentication is returned, then the filter ID group filters are
applied. A WM-AD can have a subgoup with Login-LAT-Group ID that has its own filtering rules.
The Login-LAT-Group indicates that a user session should be associated with a more specific WM-
AD (a child WM-AD). The sub-WM-AD provides a different topology definition than the parent
WM-AD, as well as having its own set of filter definitions. Filter IDs returned in association with a
Login-LAT-Group definition are applied to the user, in relation to the sub-WM-AD indicated by the
Login-LAT-Group specification. If no filter ID matches are found, then the default filter is applied.
The following is a high-level description of how a Summit WM Controller filters traffic:
Step One - The Summit WM Controller attempts to match each packet of a WM-AD to the filtering
rules that apply to the wireless device user.
Step Two - If a filtering rule is matched, the operation to allow or deny is executed.
Step Three - The next packet is fetched for filtering.

Data protection on a WM-AD - WEP and WPA

On wireless and wired networks, data is protected by encryption techniques. The type of data
protection that is available depends on the WM-AD assignment mode:
SSID - Only WEP and WPA (1 or 2) -PSK privacy types are available
AAA - WEP, Dynamic WEP, and WPA (1 or 2) privacy types are available
Data protection encryption techniques
NOTE
Regardless of the Altitude AP model or WM-AD type, a maximum of 112 simultaneous clients, per radio, are
supported by all of the data protection encryption techniques listed below.
Wired Equivalent Privacy (WEP) - WEP encrypts data sent between wireless nodes. Each node must
use the same encryption key.
Wi-Fi Protected Access Privacy (WPA v.1 and v.2) - Encryption is by Advanced Encryption Standard
(AES) or by Temporal Key Integrity Protocol (TKIP). Two modes are available:
Enterprise - Specifies 802.1X authentication and requires an authentication server
Pre-Shared Key (PSK) - Relies on a shared secret. The PSK is a shared secret (pass-phrase) that
must be entered in both the Wireless AP or router and the WPA clients.
NOTE
The Wireless 802.11n AP does not support WPA v.1 and v.2 encryption. For more information, see
privacy for a WM-AD" on page
148
193.
"Configuring
Summit WM User Guide, Software Version 5.3