Deploying Secure 802.11 Wireless Networks with Microsoft Windows

Wireless LAN Design Considerations

When planning the deployment of wireless APs in an organization, public place, or Small Office/Home Office (SOHO), you should take the following design elements into consideration (as described in the following sections):

• Wireless AP requirements

• Channel separation

• Signal propagation modifiers

• Sources of interference

• Number of wireless APs

Wireless AP Requirements

You must identify the requirements for your wireless APs, which might include the following features:

• 802.1X and RADIUS

  For secure wireless communication for private organizations and public wireless service providers, the wireless AP must support the IEEE 802.1X standard for authentication of wireless connections and authentication, authorization, and accounting using Remote Authentication Dial-In User Service (RADIUS) servers. For a wireless AP in a SOHO, 802.1X and RADIUS support is not required.

• WPA

  For the additional security provided by replacing Wired Equivalent Privacy (WEP) encryption and data integrity with Wi-Fi Protected Access (WPA), the wireless APs must support the new WPA standard. For the SOHO, WPA also provides a more secure authentication method (WPA with preshared key), which does not require a RADIUS infrastructure.

• 802.11a, b, g

  Depending on your budget and bandwidth requirements, you might need wireless APs that support 802.11b (maximum of 11 Mbps in the S-Band Industrial, Scientific, and Medical [ISM] frequency band), 802.11a (maximum of 54 Mbps in the C-Band ISM), 802.11g (maximum of 54 Mbps in the S-Band ISM), or a combination of technologies.

• Plenum rating

  The plenum area (the space between the suspended ceiling and the ceiling) is regulated by fire codes. Therefore, for plenum placement of APs, you must purchase wireless APs that are fire-rated. If you place your wireless APs in the plenum area, you must determine the best method for powering the wireless APs. Consult with the wireless AP manufacturer to determine how to meet the power requirements for the wireless APs. Some wireless APs can receive electrical power through the Ethernet cable that connects them to the wired network.

• Preconfiguration and remote configuration

  Preconfiguring the wireless APs before installing them on location can speed up the deployment process and can save labor costs because less-skilled workers can perform the physical installation. You can preconfigure wireless APs by using the console port (serial port), Telnet, or a Web server that is integrated with the wireless AP. Regardless of whether you decide to preconfigure the wireless APs, make sure that you can access them remotely, configure the wireless APs remotely through a vendor-supplied configuration tool, or upgrade the wireless APs by using scripts.

• Antenna types

  Verify that the wireless AP supports different types of antennas. For example, in a building with multiple floors, an omnidirectional antenna which propagates the signal equally in all directions except vertically might work best.

More Info For information about which type of antenna will work best for your wireless LAN (WLAN) deployment, see the documentation for your wireless APs.

Channel Separation

Direct communication between an 802.11b wireless network adapter and a wireless AP occurs over a common channel, which corresponds to a frequency range in the S-Band ISM. You configure the wireless AP for a specific channel, and the wireless network adapter automatically configures itself to the channel of the wireless AP with the strongest signal.

To reduce interference between 802.11b wireless APs, ensure that wireless APs with overlapping coverage volumes use unique channels. The 802.11b standard reserves 14 frequency channels for use with wireless APs. Within the United States, the Federal Communications Commission (FCC) allows channels 1 through 11. In most of Europe, you can use channels 1 through 13. In Japan, you have only one choice: channel 14.

To prevent the signals from adjacent wireless APs from interfering with one another, you must set their channel numbers so that they are at least five channels apart. To get the most usable channels in the United States, you can set your wireless APs to use one of three channels: 1, 6, or 11. If you need fewer than three usable channels, ensure that the channels you choose maintain the five-channel separation.

Figure 7-1 shows an example of a set of wireless APs deployed in multiple floors of a building so that overlapping signals from adjacent wireless APs use different usable channel numbers.

Figure 7-1. Example of assigning 802.11b channel numbers.

Signal Propagation Modifiers

The wireless AP is a radio transmitter and receiver that has a limited range. The volume around the wireless AP for which you can send and receive wireless data for any of the supported bit rates is known as the coverage volume. (Many wireless references use the term coverage area; however, wireless signals propagate in three dimensions.) The shape of the coverage volume depends on the type of antenna used by the wireless AP and the presence of signal propagation modifiers and other interference sources.

With an idealized omnidirectional antenna, the coverage volume is a series of concentric spherical shells of signal strengths corresponding to the different supported bit rates. For example, for 802.11b and an omnidirectional antenna, the idealized coverage volume is shown in Figure 7-2.

Figure 7-2. Idealized coverage volume.

Signal propagation modifiers change the shape of the ideal coverage volume through radio frequency (RF) attenuation (the reduction of signal strength), shielding, and reflection, which can affect how you deploy your wireless APs. Metal objects within a building, or used in the construction of a building, can affect the wireless signal. For example:

• Support girders

• Elevator shafts

• Rebar reinforcement in concrete

• Heating and air-conditioning ventilation ducts

• Wire mesh that reinforces plaster or stucco in walls

• Walls that contain metal, cinder blocks, and concrete

• Cabinets, metal desks, or other types of large metal equipment

Sources of Interference

Any device that operates on the same frequencies as your wireless devices (in the S-Band ISM, which operates in the frequency range of 2.4 GHz to 2.5 GHz, or the C-Band ISM, which operates in the frequency range of 5.725 GHz to 5.875 GHz) might interfere with the wireless signals. Sources of interference also change the shape of a wireless AP s ideal coverage volume.

Devices that operate in the S-Band ISM include the following:

• Bluetooth-enabled devices

• Microwave ovens

• 2.4 GHz cordless phones

• Wireless video cameras

• Medical equipment

• Elevator motors

Number of Wireless APs

To determine how many wireless APs to deploy, follow these guidelines:

• Include enough wireless APs to ensure that wireless users have sufficient signal strength from anywhere in the coverage volume.

  Typical wireless APs use omnidirectional antennas, which produce a vertically flattened sphere of signal that propagates between floors of a building. Wireless APs typically have an indoor range within a 200-foot radius. Include enough wireless APs to ensure signal overlap between the wireless APs.

• Determine the maximum number of simultaneous wireless users per coverage area.

• Estimate the data throughput that the average wireless user requires. If needed, add more wireless APs, which will:

  • Improve wireless client network bandwidth capacity.

  • Increase the number of wireless users supported within a coverage area.

    Based on the total data throughput of all users, determine the number of users that you can connect to a wireless AP. Obtain a clear picture of throughput before deploying the network or making changes. Some wireless vendors provide an 802.11 simulation tool, which you can use to model traffic in a network and view throughput levels under various conditions.

  • Ensure redundancy, in the event that a wireless AP fails.