CTS 068: Wi-Fi Network Access Control - Clear To Send: Wireless Network Engineering
Summary: In this episode, we welcome Andrew Chappelle from Calgary, Alberta, Canada.<br> We talked about network access control focusing on securing the Wi-Fi network. He shared his experience with complex NAC systems such as Cisco ISE or Aruba ClearPass and also share his view of what the future of access control will look like.<br> Andrew Chappelle (CCIE-W #42377) works as a System Engineer for Aruba HPE out of Calgary. In his previous positions, he worked a lot on complex network access deployments. He is very knowledge about Wi-Fi and will soon be CWNE! I guess, we are going to have to bring him back on the show when he does! You can find him on twitter at <a href="https://twitter.com/@AngryWrelessGuy" target="_blank" rel="nofollow">@AngryWrelessGuy</a>. He blogs at <a href="http://angrywirelessguy.wordpress.com" target="_blank" rel="nofollow">angrywirelessguy.wordpress.com</a>.<br> <br> Wi-Fi Network Access Control<br> The WHY: Why do we need a network access control for the WLAN infrastructure? Let’s talk about customer’s requirements:<br> <br> * Offer different access and level of security for different type of users & devices<br> * Enable easy & secure BYOD<br> * Segment the Wi-Fi network so guest traffic is isolated<br> * Make the user experience is easier<br> <br> The WHAT: What are the solutions to meet these requirements?<br> <br> * SSID for corporate users (would do both BYOD and corporate access) – SSID consolidation<br> * SSID for guest<br> * Profiling<br> <br> The HOW: How do we implement it? What do we need to make it happen?<br> <br> * NAC server<br> * Certificate PKI<br> <br> We talked about the most common EAP methods used today.<br> What is coming next? What can we expect seeing in these NAC solutions in the near future?<br> Resources<br> Links to ISE documentation:<br> <br> * ISE community: https://communities.cisco.com/community/technology/security/pa/ise<br> * ISE Demo videos: <a href="https://communities.cisco.com/docs/DOC-63878">https://communities.cisco.com/docs/DOC-63878</a><br> * ISE YouTube Channel: <a href="https://www.youtube.com/user/CiscoISE/playlists">https://www.youtube.com/user/CiscoISE/playlists</a><br> <br> Links to ClearPass documentation:<br> <br> * ClearPass Documentation: <a href="https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/EntryId/6864/Default.aspx">https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/EntryId/6864/Default.aspx</a><br> * ClearPass Demo (require credentials): <a href="https://clearpass.arubademo.net/tips/tipsLogin.action">https://clearpass.arubademo.net/tips/tipsLogin.action</a><br> <br> Upcoming Episode on Wi-Fi Issue<br> Here is the link to the <a href="http://www.cleartosend.net/wi-fi-issue-submission/" target="_blank">Wi-Fi issues submission form</a> for one of our upcoming episode.<br> This Week In Wireless<br> Cisco – New AireOS version – <a href="http://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn83mr1.html" target="_blank" rel="nofollow">released the 8.3.111.0 </a><br> Adaptive 802.11r<br> 802.11r is the IEEE standard for fast roaming and this concept of roaming is also known as Fast Transition (FT). Here the initial handshake with the new AP is done even before the client roams to the target AP. The feature allows you to set up a network without choosing Enable for Fast Transition (FT). The Apple devices (iOS 10 clients) signal the Cisco APs to identify this functionality. Cisco APs mutually signal that adaptive 802.11r is supported on the network and perform an FT association on the WLAN.<br> Legacy wireless clients that do not support 802.11r can still join the same network however does not benefit from faster FT roaming. Legacy devices that do not recognize the FT AKM’s beacons and probe responses join as an 11i/WPA2 device.<br> This feature is supported on the following Wave2 APs:
