3e Technologies International AirGuard 3e-525A-3 User manual

AirGuard™ Wireless Access Point
User's Guide
Model 3e-525A–3
3e Technologies International
700 King Farm Blvd., Suite 600
Rockville, MD 20850
[phone] www.3eti.com
29000167-001 B
publ. 10/18/05
�

This page intentionally left blank.

3e Technologies International's
AirGuard™ Wireless Access Point
User's Guide
Model 3e-525A–3

Copyright © 2005 3e Technologies International, Inc. All rights reserved. No part of this
documentation may be reproduced in any form or by any means or to make any derivative work
(such as translation, transformation, or adaptation) without written permission from 3e Technologies
International.
3e Technologies International reserves the right to revise this documentation and to make changes in
content from time to time without obligation on the part of 3e Technologies International to provide
noti cation of such revision or change.
3e Technologies International provides this documentation without warranty, term or condition
of any kind, either implied or expressed, including, but not limited to, the implied warranties,
terms, or conditions of merchantability, satisfactory quality, and  tness for a particular purpose.
3e Technologies International may make improvements or changes in the product(s) and/or the
program(s) described in this documentation at any time. Certain features listed may have restricted
availability and/or are subject to change without notice - please con rm material features when
placing orders.
If there is any software or removable media described in this documentation, it is furnished under a
license agreement included with the product as a separate document, in the printed documentation,
or on the removable media in a readable  le such as license.txt or the like. If you are unable to locate a
copy of the license, contact 3e Technologies International and a copy will be provided to you.
___________________________________
UNITED STATES GOVERNMENT LEGEND
If you are a United States Government agency, then this documentation and the product described
herein are provided to you subject to the following:
All technical data and computer software are commercial in nature and developed solely at private
expense. Software is delivered as “Commercial Computer Software” as de ned in DFARS 252.227-
7014 (June 1995) or as a “commercial item” as de ned in FAR 2.101(a) and as such is provided with
only such rights as are provided in 3e Technologies International’s standard commercial license for
the software. Technical data is provided with limited rights only as provided in DFAR 252.227-7015
(Nov 1995) or FAR 52.227-14 (June 1987), whichever is applicable. You agree not to remove or deface
any portion of any legend provided on any licensed program or documentation contained in, or
delivered to you in conjunction with, this User Guide.
___________________________________
3e Technologies International and the 3e Technologies International logo are registered trademarks.
Windows is a registered trademark of Microsoft Corporation. Any other company and product name
mentioned herein is a trademark of the respective company with which they are associated.
___________________________________
EXPORT RESTRICTIONS
This product contains components, software, and/or  rmware exported from the United States in
accordance with U. S. export administration regulations. Diversion contrary to U.S. law is prohibited.

29000167-001 B
iii
Table of Contents
Chapter 1: Introduction
...............................................................
....................................
1
Basic Features
...............................................................
..............................................
2
Wireless Basics
...............................................................
.............................................
3
802.11b
...............................................................
........................................................
3
802.11g
...............................................................
........................................................
3
802.11a
...............................................................
........................................................
3
802.11b/g Mixed
...............................................................
.......................................
3
802.11g Super and 802.11a Turbo
...............................................................
...........
4
Network Con guration
...............................................................
...........................
4
Access Point Con gurations
...............................................................
...................
4
Possible AP Topologies
...............................................................
..........................
5
Bridging
...............................................................
.....................................................
6
Default Con guration
...............................................................
..............................
6
Data Encryption and Security
...............................................................
.................
6
SSID
...............................................................
............................................................
6
WEP
...............................................................
............................................................
6
WPA/WPA2 with TKIP/ AES-CCMP
...............................................................
...
6
AES and 3DES
...............................................................
...........................................
7
FIPS 802.11i
...............................................................
................................................
7
Wireless VLAN
...............................................................
.........................................
9
MAC Address Filtering
...............................................................
.........................
10
DHCP Server
...............................................................
...........................................
10
Operator Authentication and Management
......................................................
11
Management
...............................................................
..............................................
11
3e–525A–3 Navigation Options
...............................................................
..............
12
Chapter 2: Hardware installation
...............................................................
.................
13
Preparation for Use
...............................................................
...................................
13
Installation Instructions
...............................................................
...........................
14
Minimum System and Component Requirements
............................................
14
Cabling
...............................................................
.......................................................
15
Outdoor Protection Kit Installation
...............................................................
........
16
Earth Ground Connection
...............................................................
.....................
17
Lighnting Arrestor Installation
...............................................................
.............
17
The Indicator Lights
...............................................................
...............................
19
External Reset Kit
...............................................................
......................................
20
Chapter 3: Access Point Con guration
...............................................................
.......
21
Introduction
...............................................................
...............................................
21
Preliminary Con guration Steps
...............................................................
............
21
Initial Setup using the “Local” Port
...............................................................
.......
22
System Con guration
...............................................................
...............................
23
General
...............................................................
.....................................................
23
Operating Mode
...............................................................
......................................
24
Submodes
...............................................................
.............................................
24
WAN
...............................................................
.........................................................
26
LAN
...............................................................
..........................................................
27
Wireless Access Point Con guration
...............................................................
.....
28
General
...............................................................
.....................................................
28
Security
...............................................................
....................................................
31
No Encryption
...............................................................
......................................
31
Static AES Key
...............................................................
......................................
32
Static 3DES Key
...............................................................
....................................
33

iv
29000167-001 B
FIPS 802.11i
...............................................................
...........................................
34
Dynamic Key Exchange
...............................................................
......................
35
No Encryption (non-FIPS)
...............................................................
..................
36
Static WEP Encryption (non-FIPS)
...............................................................
....
36
802.11i and WPA (non-FIPS)
...............................................................
...............
38
Wireless VLAN
...............................................................
.......................................
40
MAC Address Filtering
...............................................................
.........................
41
Rogue AP Detection
...............................................................
...............................
42
Advanced
...............................................................
.................................................
43
Wireless Bridge
...............................................................
..........................................
43
Services Settings
...............................................................
........................................
44
DHCP Server
...............................................................
...........................................
44
Subnet Roaming
...............................................................
......................................
45
SNMP Agent
...............................................................
............................................
46
Misc Service
...............................................................
.............................................
47
User Management
...............................................................
.....................................
48
List All Users
...............................................................
...........................................
48
Add New User
...............................................................
........................................
49
User Password Policy (FIPS Mode Only)
..........................................................
50
Monitoring/Reports
...............................................................
.................................
51
System Status
...............................................................
..........................................
51
Bridging Status
...............................................................
........................................
52
Bridge Site Map
...............................................................
......................................
53
Wireless Clients
...............................................................
.......................................
54
Adjacent AP List
...............................................................
.....................................
55
DHCP Client List
...............................................................
....................................
56
System Log
...............................................................
..............................................
56
Web Access Log
...............................................................
......................................
57
Network Activity
...............................................................
....................................
57
Auditing
...............................................................
.....................................................
58
Log
...............................................................
............................................................
58
Report Query
...............................................................
...........................................
59
Con guration
...............................................................
..........................................
59
System Administration
...............................................................
............................
61
System Upgrade
...............................................................
.....................................
61
Firmware Upgrade
...............................................................
...............................
61
Local Con guration Upgrade
...............................................................
............
62
Remote Con guration Upgrade
...............................................................
........
63
Factory Default
...............................................................
.......................................
65
Remote Logging
...............................................................
......................................
65
Reboot
...............................................................
......................................................
66
Utilities
...............................................................
.....................................................
66
Chapter 4: Gateway Con guration
...............................................................
..............
67
Introduction
...............................................................
...............................................
67
Con guring in Gateway Mode
...............................................................
...............
69
WAN
...............................................................
.........................................................
70
Main IP Setting
...............................................................
.....................................
70
IP Aliasing
...............................................................
.............................................
71
LAN
...............................................................
..........................................................
72
Security
...............................................................
....................................................
73
Firewall
...............................................................
.......................................................
73
Content Filtering
...............................................................
.....................................
73
IP Filtering
...............................................................
...............................................
74
Port Filtering
...............................................................
...........................................
74

29000167-001 B
v
Virtual Server
...............................................................
..........................................
75
Demilitarized Zone (DMZ)
...............................................................
...................
76
Advanced Firewall
...............................................................
.................................
77
Chapter 5: Wireless Bridge Con guration
...............................................................
.
79
Introduction
...............................................................
...............................................
79
Wireless Bridge — General
...............................................................
...................
80
Auto-forming Wireless Bridging
...............................................................
.......
80
Manual Bridging
...............................................................
..................................
82
Monitoring
...............................................................
............................................
83
Wireless Bridge — Radio
...............................................................
.......................
83
Wireless Bridge — Encryption
...............................................................
..............
86
Setting Up Bridging Type
...............................................................
........................
87
Point-to-Point Bridge Con guration
...............................................................
...
87
Point-to-Point Bridging Setup Guide - Manual Mode
...................................
88
Point-to-Point Bridging Setup Guide - Auto Mode
.......................................
88
Point-to-Multipoint Bridge Con guration
........................................................
92
Point-to-Multipoint Bridging Setup Guide - Manual Mode
.........................
93
Point-to-Multipoint Bridging Setup Guide - Auto Mode
..............................
93
Repeater Bridge Con guration
...............................................................
............
94
Repeater Bridging Setup Guide - Manual Mode
............................................
94
Repeater Bridging Setup Guide - Auto Mode
.................................................
95
Chapter 6: Technical Support
...............................................................
........................
97
Manufacturer’s Statement
...............................................................
.......................
97
Radio Frequency Interference Requirements
.......................................................
97
Appendix A: Misuse Guidelines
...............................................................
..............
A-1
Glossary
...............................................................
.........................................................
G-a

vi
29000167-001 B

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
29000167-001 B
1
Chapter 1: Introduction
This manual covers the installation and operation of the 3e Technolo-
gies International’s 3e–525A–3 Wireless Access Point. The 3e–525A–3 is
a ruggedized access point/gateway/bridge which is intended for use
in industrial and external environments. It accommodates 802.11a/b/g,
802.11g Super, and 802.11a Turbo WLAN access and uses Power over
Ethernet (PoE) access to the Ethernet WAN to eliminate the need for
internal access point power supply units (AC-DC converters) and 110-
220V cabling installations. The wireless LANs can include mobile devices
such as handheld Personal Data Assistants (PDAs), mobile web pads, and
wireless laptops.
If encryption is desired for the WLAN, you can employ different
encryption depending on the mode you are in. If you are using FIPS 140-2
mode (highly secure) you can set encryption for None, Static AES, Static
3DES, or Dynamic Key Exchange. To support this mode, it is required
that wireless devices have the 3e-010F Crypto Client software installed.
(The 3e-010F Crypto Client software is sold with the 3e-110 long range PC
Card or sold separately for use with other compatible PC Cards.)
If you
are using the 3e–525A–3 in non-FIPS 140-2 mode, you can select None,
Static 3DES, Static AES, Static WEP, or WPA. WPA uses TKIP or AES-
CCMP so you can employ legacy client WEP cards and still secure the
wireless band.
The 3e–525A–3 incorporates Power over Ethernet. The PoE interface
on the 3e–525A–3 is compatible with commercial vendor “injected pow-
er” hub units.
The 3e–525A–3 includes AES/3DES cryptographic modules for wire-
less encryption and HTTPS/TLS, for secure web communication. In
addition, it contains the capability to use the traditional WEP algorithm,
either as static WEP or managed under WPA. The 3e–525A–3 has an
Ethernet WAN interface for communication to the wired LAN backbone,
Ethernet LAN local port for purposes of initial setup and con guration,
and two wireless AP antennas for communicating on the 802.11a/b/g
frequencies. Further, it has the capability for use of an external (remote)
antenna, for bridging, using the 802.11b/g Mixed, 802.11a, 802.11g Super,
802.11a Turbo frequencies.
The cryptographic functionality of the 3e-525A-3 is based upon FIPS
evaluated and certi ed encryption algorithms (AES and 3DES), used
within a FIPS 140-2 Level 2 crypto module. Cryptographic keys are gener-

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
2
29000167-001 B
ated using a FIPS-approved RNG, with the output of the RNG used as in-
put for the creation on non-weak keys for the algorithm. This ensures that
keys are destroyed from storage in accordance with FIPS requirements,
both after use (i.e. when the key is in plaintext for immediate use the tem-
porary space is destroyed) and when the key is speci ed for removal (i.e.
when the Crypto Of cer or the system has determined that the key will
no longer be available). All cryptographic operations are performed using
the FIPS-approved algorithms and cryptomodule. The AES algorithm has
been validated against FIPS 197 for key lengths of 126- 192- and 256-bit.
The 3DES algorithm as been validated against FIPS 46-3 for 168-bit keys.
Basic Features
The 3e–525A–3 is housed in a sturdy case which is not meant to be
opened except by an authorized technician for maintenance or repair.
If you wish to reset to factory settings, use the reset function available
through the GUI-based management module.
The 3e–525A–3 is wall-mountable.
It has the following features:
•
Ethernet uplink WAN port
•
Local Ethernet LAN port (for con guration only)
•
USB port
•
Wireless VLAN
•
Wireless AP with operating range of 2000+ feet
•
Wireless Bridge
•
Power over Ethernet (PoE)
•
Above average temperature range for extreme environments
(with TEC option)
•
AES, 3DES, WEP encryption or WPA/WPA2/AES-CCM
with TKIP, depending on setup
•
HTTPS/TLS secure Web
•
DHCP client
•
Adjustable Radio Power
•
MAC address  ltering
•
Load Balancing
•
Rogue AP Detection
The following security modules have been implemented in the 3e–
525A–3 .
•
AES (128/192/256 bit)
•
3DES (192 bit)
•
WEP
•
WPA/WPA2
•
FIPS 802.11i

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
29000167-001 B
3
Wireless Basics
Wireless networking uses electromagnetic radio frequency waves to
transmit and receive data. Communication occurs by establishing radio
links between the wireless access point and devices con gured to be part
of the
WLAN.
The 3e–525A–3 incorporates WiFi standard FIPS 140-2 security for
wireless communication.
802.11b
The IEEE 802.11b standard rati ed by IEEE, establishes a stable stan-
dard for compatibility. A user with an 802.11b product can use any brand
of access point with any other brand of client hardware that is built to
the 802.11b standard for basic interconnection.
802.11b devices provide
11 Mbps transmission (with a fallback to 5.5, 2 and 1 Mbps depending on
signal strength) in the 2.4 GHz band.
For wireless devices to communicate with the 3e–525A–3 , they must
meet the following conditions:
•
The wireless device and wireless access point must have
been con gured to recognize each other using the
SSID (a
unique ID assigned in setup so that the wireless device is
seen to be part of the network by the 3e–525A–3 );
•
Encryption and authentication capabilities and types en-
abled must conform; and
•
If MAC  ltering is used, the 3e–525A–3 must be con gured
to allow/disallow the wireless device’s MAC address to as-
sociate (communicate) with the 3e–525A–3 wireless inter-
face.
802.11g
Because 802.11g is backwards-compatible with 802.11b, it is a popular
component in LAN construction. 802.11g broadens 802.11b’s data rates
to 54 Mbps within the 2.4 GHz band using OFDM (orthogonal frequency
division multiplexing) technology.
802.11a
The IEEE 802.11a standard is an extension to 802.11 that applies to
wireless LANs and provides up to 54 Mbps in the 5GHz band. 802.11a
uses an orthogonal frequency division multiplexing encoding scheme
rather than FHSS or DSSS.
802.11b/g Mixed
802.11b/g combines 802.11b and 802.11g data rates to offer a broader
range.

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
4
29000167-001 B
802.11g Super and 802.11a Turbo
802.11g Super and 802.11a Turbo technologies provide speed and
throughput of more than double standard wireless LAN technologies in
networking products such as PCs, access points, routers and PC cards.
It is very helpful to users who require additional bandwidth (over stan-
dard WLAN technologies) that results in higher throughput necessary
for a variety of functions such as:
streaming media (video, DVD, MPEG),
VoIP, etc., or for providing multiple users on a single WLAN with optimal
speeds despite network demand.
108 Mbps is the
maximum link speed
available and the
typical MAXI-
MUM end-user throughput ranges from approximately 40 Mbps to 60+
Mbps, depending on application demand and network environment.
NOTE:
Super G’s channel bonding feature can signi cantly degrade
the performance of neighboring 2.4GHz WLANs that don’t use Super G,
because there isn’t enough room in the 2.4GHz wireless LAN spectrum
for the increased spectrum used by channel bonding. Moreover, Super
G doesn’t check to see if 11b or 11g standards-compliant devices are in
range before using its non-standard techniques.
Network Con guration
The 3e–525A–3 is an access point with bridging setup capability:
•
Access point/Gateway plus:
•
Wireless bridging with choice of:
-
Point-to-point setup
-
Point-to-multipoint setup
-
Repeater setup
•
Wireless mesh mode
Bridging actually has more choices, but the above choices are popular
and are discussed later in this user guide (Chapter 4).
Access Point Con gurations
When a 3e–525A–3 is used as an access point, IP addresses for wire-
less devices are typically assigned by the wired network’s
DHCP server.
The wired LAN’s DHCP server assigns addresses dynamically, and the
AP virtually connects wireless users to the host wired network. All wire-
less devices connected to the AP are con gured on the same subnetwork
as the wired network interface and can be accessed by devices on the
wired network.

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
29000167-001 B
5
Possible AP Topologies
1.
An access point can be used as a stand-alone AP without any
connection to a wired network. In this con guration, it simply
provides a stand-alone wireless network for a group of wireless
devices.

2.
There can be multiple APs connected to an existing Ethernet
network to bridge between the wired and wireless environments.
Each AP can operate independently of the other APs on the LAN.
Multiple APs can coexist as separate individual networks at the
same site with a different
network ID (SSID).

 
   
3.
The last and most prevalent use is multiple APs connected to a
wired network and operating off that network’s DHCP server to
provide a wider coverage area for wireless devices, enabling the
devices to “roam” freely about the entire site. The APs have to use
the same SSID. This is the topology of choice today.
 


3e-525A–3 Wireless Access Point
Chapter 1: Introduction
6
29000167-001 B
Bridging
The wireless bridging function in the 3e–525A–3 allows use as a
bridge, in a number of alternate con gurations, including the following
popular con gurations:
•
Point-to-point bridging of 2 Ethernet Links;
•
Point-to-multipoint bridging of several Ethernet links;
•
Repeater mode (wireless client to wireless bridge.)
Default Con guration
The 3e–525A–3's default con guration is an Access Point/Bridge with
FIPS 140-2 submode enabled.
Data Encryption and Security
The 3e–525A–3 Wireless Access Point includes advanced wireless se-
curity features. Over the AP band, you have a choice of no security, Static
WEP, WPA, AES/3DES, depending on your mode of operation. Some
level of security is suggested. Static WEP gives you a choice of 64-bit or
128-bit encryption. WPA includes the option of using a WPA pre-shared
key or, for the enterprise that has a Radius Server installed, con gura-
tion to use the Radius Server for key management with either TKIP or
AES-CCMP. Bridging encryption is established between 3e–525A–3’s and
includes use of AES-ECB or 3DES encryption (approved by the National
Institute of Standards and Technology (NIST) for U.S. Government and
DoD agencies).
SSID
The Service Set ID (SSID) is a string used to de ne a common roam-
ing domain among multiple wireless access points. Different SSIDs on
access points can enable overlapping wireless networks. The SSID can
act as a basic password without which the client cannot connect to the
network. However, this is easily overridden by allowing the wireless AP
to broadcast the SSID, which means any client can associate with the AP.
SSID broadcasting can be disabled in the 3e–525A–3 setup menus.
WEP
WEP is an older encryption standard but is preferable to no encryp-
tion. If the 3e–525A–3 is con gured with WEP encryption, it is compatible
with any 802.11b PC Card con gured for WEP.
WPA/WPA2 with TKIP/ AES-CCMP
WPA, an interim standard developed by the WiFi Alliance, combines
several technologies. It includes the use of the 802.1x standard and the
Extensible Authentication Protocol (EAP). In addition, it uses, for encryp-

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
29000167-001 B
7
tion, the Temporal Key Integrity Protocol (TKIP) and WEP 128-bit encryp-
tion keys. Finally, a message integrity check (MIC) is used to prevent an
attacker from capturing and altering or forging data packets. In addition,
it can employ a form of AES called AES-CCMP.
WPA is a subset of the 802.11i standard and is expected to maintain
forward compatibility.
AES and 3DES
The Advanced Encryption Standard (AES) was selected by National
Institute of Standards and Technology (NIST) in October 2000 as an up-
grade from the previous DES standard. AES uses a 128-bit block cipher
algorithm and encryption technique for protecting computerized infor-
mation. It has the ability to use even larger 192-bit and 256-bit keys, if
desired.
3DES is also incorporated on the 3e–525A–3 . 3DES is modeled on the
older DES standard but encrypts data three times over. Triple-DES uses
more CPU resources than AES because of the triple encryption.
If you intend to use AES or 3DES, you must enable use by purchasing
the 3eTI advanced Crypto Client software (3e-010F) for each client that
will be included in the WLAN. We sell this software with the 3e-110 PC
Card.
The 3e–525A–3 uses AES-CCMP in WPA mode and AES-ECB (or
3DES) for FIPS 140-2 mode and for the bridging channel.
FIPS 802.11i
IEEE 802.11i is a Layer 2 speci cation that focuses on strengthening
IEEE 802.11 security at the MAC sublayer. It is completely separate from
and independent of VPN designs or architectures, which are often imple-
mented at Layer 3. IEEE 802.11i goes beyond the simple,  awed encryp-
tion mechanism of 1999 802.11 WEP to include speci cations on encryp-
tion, authentication and key management in a multi-layered approach to
security. IEEE 802.1X-based authentication mechanisms are used, with
AES in CCMP mode, to establish an 802.11 Robust Security Network
(RSN).
IEEE 802.1X de nes a framework based on the Extensible Authentica-
tion Protocol (EAP) over LANs, also known as EAPoL. EAPoL is used to
exchange EAP messages. These EAP messages execute an authentication
sequence and are used for key derivation between a Station (STA) and an
EAP entity known as the Authentication Server (AS).
IEEE 802.11i de nes a four-way handshake using EAPoL for key
management and group key derivation. 3eTI has been instrumental in de-
veloping an IETF RFC to further standardize the portion of key exchange
that must take place between the Authentication Server and the W
ireless
Access Point (WAP). 3eTI, along with Cisco and Intel, recognizes the merits of
standardizing this technique, so that interoperability among multiple 802.11i-
compliant vendors can be achieved.

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
8
29000167-001 B
Four major categories or primary functions of 802.11i are invoked
within 3eTI products, including the wireless client devices, wireless ac-
cess points (3e-525A2.3), and the security server. These primary functions
of 802.11i include:
•
EAP-TLS: Extensible Authentication Protocol Transport
Layer Security, EAP-TLS was compulsory for WPA2 Enter-
prise products certi ed prior to April 15, 2005; for products
certi ed after this date, EAP-TLS testing is compulsory if
the product can support EAP-TLS. The only products that
might not support EAP-TLS are tightly integrated systems
that do not support software upgrades by a third party, such
as some cell phones intended for, e.g., the 3G market. Non-
tightly integrated products like most laptop and PDU adapt-
ers still must support EAP-TLS to receive WPA2 certi ca-
tion. 3eTI wireless client and wireless access point devices
use standards-based EAP-TLS with no modi cations, for
complete interoperability with 802.11i and WPA2 certi ed
equipment.
•
IEEE 802.1X: also known as port based network access con-
trol, 802.1X provides and authentication framework within
802.11i. 802.11i depends upon 802.1X to control the  ow of
MSDUs between the DS and STAs by use of the IEEE 802.1X
Controlled/Uncontrolled Port model. IEEE 802.1X authen-
tication frames are transmitted in 802.11 Data frames and
passed via the IEEE 802.1X Uncontrolled Port. The 802.1X
Controlled Port is blocked from passing general data traf c
between two STAs until an 802.1X authentication procedure
completes successfully over the 802.1X Uncontrolled Port. It
is the responsibility of the authenticator (3eTI Access Point)
to implement port blocking. 802.11 depends upon IEEE
802.1X and the EAPOL-Key 4-Way and Group Key Hand-
shakes, to establish and change cryptographic keys. Keys
are established after authentication has completed. Keys
may change for a variety of reasons, including expiration
of an IEEE 802.1X authentication timer, key compromise,
danger of compromise, or policy. 3eTI products implement
standards-based 802.1X with absolutely no custom modi-
 cations, again ensuring interoperability with 802.11i and
WPA2 certi ed equipment.
•
4-way handshake: The 4-way handshake de ned in 802.11i
achieves the following important goals within the security
protocol:
–
it con rms the PMK between the supplicant (3e client) and
authenticator (3e Access Point)
–
it establishes the temporal keys to be used by the data-con -
dentiality protocol
–
it authenticates the security parameters that were negotiated

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
29000167-001 B
9
–
it provides keying material to implement the group key
handshake within 802.11i
3eTI implements the 4-way handshake within its wire-
less product line per the 802.11i speci cation, again with
absolutely no custom modi cations, in order to maximize
interoperability with 3
rd
party 802.11i and WPA2 compliant
equipment.
•
AES CCMP: 802.11i and WPA2 employ AES CCM, which is a com-
bination of AES Counter (CTR) mode per packet data encryption,
combined with AES Cipher Block Chaining – Message Authentica-
tion Code (CBC-MAC) per packet data integrity / authentication
of the entire packet including the MAC header. AES CCMP has
been deemed to surpass the RC4 stream cipher, upon which the
older WEP and WPA security protocols are based. 3eTI was the
 rst company to take it’s AES algorithm through the NIST CCM
algorithm certi cation process, thereby ensuring that 3eTI’s AES
CCMP is standards-based, non-proprietary, and ready for wide
WPA2 interoperability usage.
Wireless VLAN
According to the IEEE, VLANs de ne broadcast domains in a Layer
2 network. VLANs have the same attributes as physical LANs with the
additional capability to group end stations physically to the same LAN
segment regardless of the end stations' geographical location
To interconnect two different VLANs, routers or Layer 3 switches are
used. These routers or Layer 3 switches execute inter-VLAN routing or
routing of traf c between VLANs. Broadcast traf c is then terminated
and isolated by these Layer 3 devices (for example, a router or Layer 3
switch will not route broadcast traf c from one VLAN to another).
Wireless VLAN is an extension of Layer 2 wired VLANs in wireless
LAN (WLAN) environment. As with wired VLANs, wireless VLANs
segregate the WLAN network into disjointed sections, each of which
can serve a different purpose or users, such as engineering, accounting
or guest. To get the same network con guration, with VLAN incapable
APs, a set of APs need to be installed for each network section; but with
a VLAN capable AP, like the 3e-525A-3, one AP can serve multiple sec-
tions with traf c segregated inside the AP, so that only one set of APs is
needed.
When wireless VLAN is enabled, an AP can be con gured to have
multiple SSIDs, so that it supports multiple wireless networks. Each net-
work, per con guration, belongs to a VLAN. A wireless client talks with
the AP inside a wireless network de ned by an SSID, so it does not know
the wireless VLAN exists. The mapping between the wireless network
and the wireless VLAN happens inside the AP. Each Wireless VLAN
can set its own security level. For example, the VLAN for an enterprise
network access may use 802.11i with EAP-TLS authentication, while the
VLAN for guest internet access may simply use 802.11i with Pre-Shared
Key.

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
10
29000167-001 B
3e-525A3 supports up to 16 VLANs.
When VLAN is enabled, all data coming out of the WAN port is
VLAN-tagged, which means an external network unit such as a router,
switch, or a VLAN-enabled computer has to be used to terminate the
VLAN traf c. Data originating from or targeting to a wireless network
client is tagged with the VLAN ID corresponding to the SSID to which it
is associated. Data generated by an Access Point itself is tagged with the
management VLAN ID.
MAC Address Filtering
The
MAC address, short for
Media Access Control address,
is a hard-
ware address that uniquely identi es each node of a network. In IEEE 802
networks, the
Data Link Control (
DLC) layer of the
OSI Reference Model
is divided into two sub-layers: the
Logical Link Control (LLC) layer
and the
Media Access Control (MAC) layer.
The MAC layer interfaces directly with
the network media. Consequently, each type of network media requires a
unique MAC address.
Authentication is the process of proving a client identity. The 3e–
525A–3 access points, if set up to use MAC address  ltering, detect an
attempt to connect by a client and compare the client’s MAC address
to those on a prede ned MAC address  lter list. Only client addresses
found on the list are allowed to associate. MAC addresses are pre-as-
signed by the manufacturer for each wireless card.
DHCP Server
The DHCP function is accessible only from the local LAN port to be
used for initial con guration.

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
29000167-001 B
11
Operator Authentication and Management
Authentication mechanisms are used to authenticate an operator ac-
cessing the device and to verify that the operator is authorized to assume
the requested role and perform services within that role. The 3e-525A-3
provides authentication services for all users of the wireless network
when they  rst attempt to connect. While the user must log in, basic non-
user generated information is allowed to pass on the wireless network
prior to authentication, including the authentication data to and from
the authentication server and audit records passed from the client to the
server. The user is not allowed to speci cally send any traf c over the net-
work until successful authentication. Once successfully authenticated, all
actions taken by that user (such as accessing a connected printer) and by
processes created or started by that user, will be associated with that user,
binding the credentials from the user account to all subsequent user pro-
cesses. This ensures that all processes and network traf c are authorized.
User accounts are de ned with three basic attributes: username, role
and authentication credentials (i.e. password). A user account can be
de ned as a normal user or as an administrator. Administrative users can
access the TOE management interface in addition to being able to use the
wireless network, while normal users can only access the wireless net-
work.
The TOE authentication sequence includes a counter for unsuccessful
attempts. When a user or administrator fails to enter the correct creden-
tials after a speci ed number of attempts (the default is 3), the account
will be locked. The account must then be unlocked by a Crypto Of cer in
the case of an administrator locking their account). This is active for ac-
cess to the management website.
Access to the management screens for the 3e–525A–3 requires knowl-
edge of the assigned operator ID and Password. The Factory defaults are:
•
ID: CryptoOf cer
•
Password: CryptoFIPS
The Crypto Of cer initially installs and con gures the 3e–525A–3
after which the
password should be changed from the
default password.
The ID and Password are case sensitive.
Management
After initial setup, maintenance of the system and programming of
security functions are performed by personnel trained in the procedure
using the embedded web-based management screens.
The next chapter covers the basic procedure for setting up the hard-
ware.

3e-525A–3 Wireless Access Point
Chapter 1: Introduction
12
29000167-001 B
Chapter 1: Introduction
3e–525A–3 Navigation Options
ACCESS POINT
GATEWAY
Non FIPS 140-2
FIPS 140-2
Non FIPS 140-2
FIPS 140-2
System Con guration
System Con guration
System Con guration
System Con guration
General
General
General
General
Operating Mode
Operating Mode
Operating Mode
Operating Mode
WAN
WAN
WAN
WAN
LAN
LAN
LAN
LAN
Wireless Access Point
Wireless Access Point
Wireless Access Point
Wireless Access Point
General
General
General
General
Security
• None
• Static WEP
• 802.11i and WPA
• Static AES
• Static 3DES
Security
• None
• Static AES
• Static 3DES
• Dynamic Key Exchange
• FIPS 802.11i
Security
• None
• Static WEP
• 802.11i and WPA
• Static AES
• Static 3DES
Security
• None
• Static AES
• Static 3DES
• DKE
• FIPS 802.11i
Wireless VLAN
Wireless VLAN
Wireless VLAN
Wireless VLAN
MAC Address Filtering
MAC Address Filtering
MAC Address Filtering
MAC Address Filtering
Rogue AP Detection
Rogue AP Detection
Rogue AP Detection
Rogue AP Detection
Advanced
Advanced
Advanced
Advanced
Wireless Bridge
Wireless Bridge
Wireless Bridge
Wireless Bridge
General
• Monitoring
General
• Monitoring
General
• Monitoring
General
• Monitoring
Radio
Radio
Radio
Radio
Encryption
Encryption
Encryption
Encryption
Services Settings
Services Settings
Services Settings
Services Settings
DHCP Server
DHCP Server
DHCP Server
DHCP Server
Subnet Roaming
Subnet Roaming
Subnet Roaming
Subnet Roaming
SNMP Agent
SNMP Agent
SNMP Agent
SNMP Agent
Misc Service
Misc Service
Misc Service
Misc Service
Firewall
Firewall
Firewall
Firewall
Content Filtering
Content Filtering
IP Filtering
IP Filtering
Port Filtering
Port Filtering
Virtual Server
Virtual Server
DMZ
DMZ
Advanced
Advanced
User Management
User Management
User Management
User Management
List All Users
• Edit/Delete
List All Users
• Edit/Delete
List All Users
• Edit/Delete
List All Users
• Edit/Delete
Add New User
Add New User
Add New User
Add New User
User Password Policy
User Password Policy
Monitoring Reports
Monitoring Reports
Monitoring Reports
Monitoring Reports
System Status
System Status
System Status
System Status
Bridging Status
Bridging Status
Bridging Status
Bridging Status
Bridging Site Map
Bridging Site Map
Bridging Site Map
Bridging Site Map
Wireless Clients
Wireless Clients
Wireless Clients
Wireless Clients
Adjacent AP List
Adjacent AP List
Adjacent AP List
Adjacent AP List
DHCP Client List
DHCP Client List
DHCP Client List
DHCP Client List
System Log
System Log
System Log
System Log
Web Access Log
Web Access Log
Web Access Log
Web Access Log
Network Activities
Network Activities
Network Activities
Network Activities
Auditing
Auditing
Auditing
Auditing
Log
Log
Log
Log
Report Query
Report Query
Report Query
Report Query
Con guration
Con guration
Con guration
Con guration
System Administration
System Administration
System Admnistration
System Admnistration
System Upgrade
• Firmware Upgrade
• Local Con guration Upgrade
• Remote Con guration Upgrade
System Upgrade
• Firmware Upgrade
• Local Con guration Upgrade
• Remote Con guration Upgrade
System Upgrade
• Firmware Upgrade
• Local Con guration Upgrade
• Remote Con guration Upgrade
System Upgrade
• Firmware Upgrade
• Local Con guration Upgrade
• Remote Con guration Upgrade
Factory Default
Factory Default
Factory Default
Factory Default
Remot Logging
Remote Logging
Remote Logging
Remote Logging
Reboot
Reboot
Reboot
Reboot
Utilities
Utilities
Utilities
Utilities