Symbol CB3000 User manual

CB3000 Client Bridge
Users Guide

CB3000 Client Bridge
Users Guide
72E-86492-01
Revision A
July 2006

Copyright
Copyright (c) 2006 by Symbol Technologies, Inc. All rights reserved.
No part of this publication can be modified or adapted in any way, for any purposes without permission in writing from
Symbol. The material in this manual is subject to change without notice.
Symbol reserves the right to make changes to any product to improve reliability, function, or design.
No license is granted, either expressly or by implication, estoppel, or otherwise under any Symbol Technologies, Inc.,
intellectual property rights. An implied license only exists for equipment, circuits, and subsystems contained in Symbol
products.
Symbol, the Symbol logo are registered trademarks of Symbol Technologies, Inc.
IBM is a registered trademark of International Business Machine Corporation. Microsoft, Windows, and Windows NT are
registered trademarks of Microsoft Corporation. Novell and LAN Workplace are registered trademarks of Novell Inc. Toshiba
is a trademark of Toshiba Corporation. All other product names referred to in this guide might be trademarks or registered
trademarks of their respective companies and are hereby acknowledged.
Patents
This product is covered by one or more of the patents listed on the website: www.symbol.com/patents

About This Guide
Introduction
This guide provides configuration and setup information for the CB3000 model client bridge.
Document Conventions
The following document conventions are used in this document:
NOTE Indicate tips or special requirements
CAUTION Indicates conditions that can cause equipment damage or
data loss.
!

CB3000 Client Bridge Users Guide
vi
Notational Conventions
The following notational conventions are used in this document:
• Italics are used to highlight specific items in the general text, and to identify chapters and
sections in this and related documents.
• Bullets (•) indicate:
• action items
• lists of alternatives
• lists of required steps that are not necessarily sequential
• Sequential lists (those describing step-by-step procedures) appear as numbered lists.
Service Information
If a problem with is encountered with the CB3000, contact Symbol Customer Support. Before calling,
have the model number and serial number at hand.
If the problem cannot be solved over the phone, you may need to return your equipment for servicing.
If that is necessary, you will be given specific directions.
Symbol Technologies is not responsible for any damages incurred during shipment if the
approved shipping container is not used. Shipping the units improperly can possibly void
the warranty. If the original shipping container was not kept, contact Symbol to have
another sent to you.
WARNING! Indicates a condition or procedure that could result in personal injury or
equipment damage.

Contents
Chapter 1. Introduction
General Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
Within the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Feature Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
CB3000 Operational Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
CB3000 Network Operating Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Infrastructure Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Ad Hoc (Peer-to-Peer) Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4
Media Access Control (MAC) Layer Bridging. . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
DHCP Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Modulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Direct Sequence Spread Spectrum (DSSS) . . . . . . . . . . . . . . . . . . . . . . . 1-5
Orthogonal Frequency Division Multiplexing (OFDM) . . . . . . . . . . . . . . . 1-6
Web Management Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Wireless Security Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
About WEP Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6

CB3000 Client Bridge Users Guide
viii
About WPA1 (TKIP) Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
About WPA2 (CCMP) Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9
About Secure 802.1x Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-9
Chapter 2. Getting Started
Prerequisite Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
Verifying the Package Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
Observing Placement and Range Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
Cabling the CB3000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
Logging into the CB3000. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
Discovery Tool Login. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
Web Interface Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7
Viewing CB3000 Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-9
CB3000 Antenna Selection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-10
Chapter 3. Network Configuration
Understanding and Configuring Wireless Settings . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
Available Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
Network Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
Configuring Infrastructure Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
Configuring Ad Hoc Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5
Security Encryption Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8
Configuring Open Security Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8
Configuring WEP Security Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9
Configuring WPA1 (TKIP) Security Settings. . . . . . . . . . . . . . . . . . . . . . 3-10
Configuring WPA2 (CCMP) Security Settings . . . . . . . . . . . . . . . . . . . . 3-12
Configuring Secure 802.1x Security Settings. . . . . . . . . . . . . . . . . . . . . 3-14
Understanding and Configuring Ethernet Settings . . . . . . . . . . . . . . . . . . . . . . . . 3-17
Client Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-18
Configuring a Wired Ethernet ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-20
Chapter 4. Management Options
Statistics and Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2
Viewing Wireless Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-3
Viewing RF Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5

ix
Viewing Ethernet Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-6
Viewing Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8
Configuring Management Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8
HTTP, HTTPS Configuration Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-9
SNMP Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10
SNMP Trap Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-10
SNMP Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-11
SNMP Destination. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-13
DHCP Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-14
Time Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-15
Logging Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-16
Chapter 5. Administrative Options
Changing the Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1
Rebooting or Restoring a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2
Rebooting the Device. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-3
Restoring the Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-4
Importing or Exporting the Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-5
Using FTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-6
Using HTTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-7
Loading Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-8
Troubleshooting Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-11
Appendix A. CB3000 Specifications
Appendix B. SNMP MIB Support
Appendix C. Customer Support

CB3000 Client Bridge Users Guide
x

Introduction
This chapter introduces the Symbol CB3000 Client Bridge, describing its operational environment and its
primary operating principles and features.
It includes the following sections:
•General Overview
•CB3000 Operational Principles
1.1 General Overview
The CB3000 Client Bridge is an IEEE 802.11a/b/g compliant wireless LAN Ethernet adapter. The CB3000
extends wireless networking capabilities to printers, scales, medical equipment, manufacturing machinery, bar
code readers, time clocks, point-of-sale and other data collection devices. The CB3000 provides a reliable,
cost-effective interface between devices utilizing Ethernet ports and Symbol's wireless LAN switches and
access points.
Multiple devices can share one CB3000 using a 10BaseT Ethernet hub. This feature saves equipment costs
when several devices require wireless Ethernet connectivity. The CB3000 has an on-board TCP/IP stack to

CB3000 Client Bridge User Guide
1-2
provide a reliable transport mechanism. The CB3000 can initiate a permanent client connection to your server
or accept datagrams from multiple sources. Use the CB3000 to network devices that do not have a PC Card slot
or PCI card slot (printers, scanners, Internet appliances etc.).
The CB3000 uses frequency modulation to transmit digital data to the devices within its own subnet. The
transmission begins with a carrier signal that provides the center frequency. The digital data is superimposed
on the carrier signal (modulation). The radio signal propagates into the air as electromagnetic waves.
The receiving antenna, in the path of the airwaves, absorbs the waves as electric signals. The receiving device
demodulates the signal by removing the carrier signal. The CB3000 uses the environment as a transmission
medium. The CB3000 is able to utilize both 2.4 and 5.2 GHz frequency ranges.
1.1.1 Within the Network
A CB3000 establishes an average communication range with its associated device(s) called a Basic Service
Set (BSS) or cell. When in a particular cell, the devices can locate and communicate with the CB3000. Each
cell has a basic service set identifier (BSS_ID). In IEEE 802.11, the CB3000 MAC address represents the
BSS_ID.
Figure 1.1 CB3000 within the Network
The CB3000 appears as an individual mobile unit to an associated access point when operating in
Infrastructure mode. For more information on CB3000 Infrastructure mode operation, see Infrastructure Mode
on page 1-3.
1.1.2 Feature Summary
The CB3000 Client Bridge has the following feature set:
• Device driver free installation
• Multi-functional status LEDs
• Updatable device firmware
• IEEE 802.11a/b/g device interoperability
• Automatic rate selection
• Robust statistical displays
• Advanced event logging capabilities
• Configuration file import/export capability

Introduction 1-3
• Roaming support
• Upgradable device firmware
• DHCP client support
• Password-protected management interface
• 64 and 128-bit WEP encryption for network security
• WPA1 (TKIP) and WPA2 (CCMP) for advanced data protection
• Secure 802.1x authentication
• Discovery Tool support.
1.2 CB3000 Operational Principles
To improve CB3000 management and performance, users need to understand basic network operating mode
functionality and configuration options. These topics are described in the following sections:
•CB3000 Network Operating Modes
•Media Access Control (MAC) Layer Bridging
•DHCP Support
•Modulation
•Web Management Support
•Wireless Security Support
1.2.1 CB3000 Network Operating Modes
The CB3000 can be configured to operate in two different modes depending on the needs of the network.
Select the CB3000 operating mode based on device interoperability requirements and network conditions
(DHCP support, security settings, etc.).
The CB3000 supports the following network modes:
•Infrastructure Mode
•Ad Hoc (Peer-to-Peer) Mode
1.2.1.1 Infrastructure Mode
In infrastructure mode, the CB3000 connects to a LAN through a wireless access point. Ethernet client devices,
such as PCs, printers, POS devices, and other Ethernet-capable devices connect to the CB3000, either directly,
or through a hub connection.
The CB3000 associates with a nearby access point and sees the network device combination as a standard
mobile unit (MU). The access point then forms a wireless bridge between the wired LAN and clients through
the CB3000.
The access point is a dedicated device wired into the LAN backbone, while the CB3000 can be physically
moved throughout the LAN. However, the CB3000 is designed to be placed in a single location for optimal use.
Ethernet clients connected to the CB3000 communicate within the network by routing data through the
associated access point. The 802.11 standard enables CB3000 supported clients to be moved from one location
to another. Reassociation occurs instantly on an open network with DHCP, but IP configuration is necessary for
the CB3000 to communicate within networks that have security settings applied.

CB3000 Client Bridge User Guide
1-4
Warning! Do not connect a Client Bridge set to Infrastructure mode directly
to the LAN (for example, through a wall port). Such a connection could
cause a transmission loop between the client bridge and access point,
disrupting network operation.
Figure 1.2 Infrastructure Mode
1.2.1.2 Ad Hoc (Peer-to-Peer) Mode
Ad Hoc (Peer-to-Peer) mode allows two or more CB3000 units to communicate exclusively with one another
without the use of an access point. In the simplest of terms, this mode uses the CB3000 to bridge two or more
Ethernet devices.
In ad hoc mode, all client devices bridged with the CB3000 share the same subnet and have identical
configurations. More specifically, the wireless LAN service area, channel selection, data preamble settings,
and security settings are required to be the same for the units to communicate.
Figure 1.3 Ad Hoc Mode
Client
Bridge
Access
Point
Printer
Storage
Client
Bridge
Printer
Client
Bridge

Introduction 1-5
1.2.2 Media Access Control (MAC) Layer Bridging
Like other Ethernet devices, the CB3000 has a hardware factory encoded address called a MAC address. The
address consists of a 48-bit number written as six hexadecimal bytes separated by colons.
The CB3000 maintains a list of up to 16 Ethernet clients. Using the CB3000 client list, the administrator can
determine which device is receiving or sending data at any given time.
1.2.3 DHCP Support
The CB3000 can use Dynamic Host Configuration Protocol (DHCP) to obtain a leased IP address and
configuration information from a remote server. DHCP is based on the BOOTP protocol and can co-exist or
interoperate with BOOTP.
Configure the CB3000 to send out a DHCP request searching for a server to acquire the required IP address
information. If DHCP server support is unavailable, an IP address can be assigned to the CB3000 manually
(static).
If CB3000 is configured to use DHCP, but there is no DHCP server to service the request, the CB3000 by default
takes the address 10.10.1.1. If it is not (as per the Ethernet settings) then one needs to set the address
manually.
1.2.4 Modulation
Modulation is the process of modulating an electromagnetic carrier wave. (e.g., radio wave), by imposing
digital information on it, enabling the user to transmit the information in analogue form. The 802.11b standard
uses Direct Sequence Spread System (DSSS), while 802.11a/g use Orthogonal Frequency Division
Multiplexing (OFDM) to accommodate higher data rates.
1.2.4.1 Direct Sequence Spread Spectrum (DSSS)
The 802.11b standard supported by the CB3000 uses DSSS for radio communication. Spread Spectrum
(broadband) uses a narrowband signal to spread the transmission over a segment of the radio frequency band.
Direct-sequence is a spread spectrum technique where the transmitted signal is spread over a particular
frequency range.
DSSS communicates by continuously transmitting a redundant pattern of bits called a chipping sequence. Each
bit of transmitted data is mapped into chips by the CB3000 and rearranged into a pseudo-random spreading
code to form the chipping sequence. The chipping sequence is combined with a transmitted data stream to
produce the output signal used by the CB3000 and its associated access point or peer device (if in Ad Hoc
mode).
Devices receiving a direct sequence signal use the spreading code to map the chips within the chipping
sequence back into bits to recreate the original transmitted data. Intercepting and decoding a direct sequence
transmission requires a predefined algorithm to associate the spreading code used by the transmitting access
point and CB3000 to the receiving device. This algorithm is defined within the IEEE 802.11b specification. The
bit redundancy within the chipping sequence enables the receiving device to recreate the original data pattern,
even if bits in the chipping sequence are corrupted by interference.
The ratio of chips per bit is called the spreading ratio. A high spreading ratio increases the resistance of the
signal to interference. A low spreading ratio increases the bandwidth available to the user. 802.11b supported
devices are capable of an 11 Mbps data transmission rate, but the coverage area is less than 1 or 2 Mbps
(Frequency-Hopping devices) since coverage area decreases as bandwidth increases.

CB3000 Client Bridge User Guide
1-6
1.2.4.2 Orthogonal Frequency Division Multiplexing (OFDM)
Orthogonal Frequency Division Multiplexing (OFDM), sometimes referred to as multiple carrier modulation,
divides the available frequency into multiple sub-carriers. 52 sub-carriers are created. Four of the carriers are
used to shift frequencies or as a recommendation to disregard.
The sub-carriers provide data rates of 6, 9, 12, 18, 24, 36, 48, or 54 Mbps for 802.11a and 802.11g supported
devices. These pathways send information in a parallel fashion with a spacing of 0.3125 Mhz.
Because of the orthogonal nature of this method, sub-channels are allowed to overlap, thus using the whole
spectrum efficiently. The aggregate rate of the sub-channels increases the data rate speed to up to 54 Mbps.
Since OFDM divides one high speed channel into multiple lower speed channels, the effect of multi-path
distortion, or delay spread is greatly reduced. With OFDM, less noise (signal disruption) is experienced, since
the frequency can be altered to channels with less interference.
1.2.5 Web Management Support
Connect to the CB3000 by directly entering the CB3000’s IP address within a Web browser or by using the
Symbol CB3000 Discovery Tool to locate the CB3000 within the network and launch the user interface from the
Discovery Tool.
Note By default, only https access is allowed. However, http can be enabled from
the http management link.
The Symbol CB3000 contains a built-in browser interface for system configuration and remote management
using a standard Web browser such as Microsoft Internet Explorer 5.0 or later or Netscape Navigator 6.0 or
later. The browser interface also allows for system monitoring of the CB3000.
Note Web management of the CB3000 requires either Microsoft Internet Explorer
5.0 or later or Netscape Navigator 6.0 or later.
1.2.6 Wireless Security Support
CB3000 includes numerous wireless security provisions. For more details on the security options, see the
following sections:
•About WEP Security
•About WPA1 (TKIP) Security
•About WPA2 (CCMP) Security
•About Secure 802.1x Security
1.2.6.1 About WEP Security
All WLAN devices face possible information theft. Theft occurs when an unauthorized user eavesdrops to
obtain information illegally. The absence of a physical connection makes wireless links particularly vulnerable
to this form of theft. Most forms of security rely on encryption to various extents.

Introduction 1-7
Encryption entails scrambling and coding information, typically with mathematical formulas called algorithms,
before the information is transmitted. An algorithm is a set of instructions or formula for scrambling the data.
A key is the specific code used by the algorithm to encrypt or decrypt the data.
Decryption is the decoding and unscrambling of received data. WEP may be all that a retail business needs for
the simple encryption of wireless data. However, networks that require more security are at risk from a WEP
flaw and should use a more sophisticated method for securing their CB3000 managed network.
The same device, host computer or front-end processor, usually performs both encryption and decryption. The
data transmit or receive direction determines whether the encryption or decryption function is performed. The
device takes plain text, encrypts or scrambles the text typically by mathematically combining the key with the
plain text as instructed by the algorithm, then transmits the data over the network. At the receiving end another
device takes the encrypted text and decrypts, or unscrambles, the text revealing the original message. An
unauthorized user can know the algorithm, but cannot interpret the encrypted data without the appropriate key.
Only the sender and receiver of the transmitted data know the key.
WEP is an encryption security protocol specified in the IEEE Wireless Fidelity (Wi-Fi) standard, 802.11b and
supported by the CB3000. WEP encryption is designed to provide a wireless device with a level of security and
privacy comparable to that of a wired LAN.
The level of protection provided by WEP encryption is determined by the encryption key length and algorithm.
An encryption key is a string of case sensitive characters used to encrypt and decrypt data packets transmitted
between a mobile unit (MU) and the CB3000. An CB3000 and associated device must use the same encryption
key (typically 1 through 4) to interoperate.
For detailed steps on configuring WEP for the CB3000, see Configuring WEP Security Settings on page 3-9.
1.2.6.2 About WPA1 (TKIP) Security
Wi-Fi Protected Access (WPA) is a robust encryption scheme specified in the IEEE Wireless Fidelity (Wi-Fi)
standard, 802.11i. WPA is a security standard for systems operating with a Wi-Fi wireless connection. WPA is
designed for corporate networks and small-business (retail) environments where more wireless traffic allows
quicker discovery of encryption keys by an unauthorized person.
WPA (referred to as WPA1 within the CB3000 Security Mode menu) provides more sophisticated data
encryption than WEP. WEP’s lack of user authentication mechanisms is addressed by WPA. Compared to WEP,
WPA provides superior data encryption and user authentication.
The CB3000’s WPA encryption scheme can use Temporal Key Integrity Protocol (TKIP). TKIP addresses WEP’s
weaknesses with a re-keying mechanism, a per-packet mixing function, a message integrity check, and an
extended initialization vector with sequencing rules.
WPA also provides strong user authentication based on 802.1x EAP. Two requirements, strong encryption to
prevent eavesdropping and mutual authentication to ensure that sensitive information is transmitted only over
legitimate networks, must drive your wireless authentication strategy.
In practice, only methods based on the IETF's well-known Transport Layer Security (TLS) standard can satisfy
strict encryption and authentication requirements. Three TLS-based protocols have been developed for use
with EAP and are suitable for deployments with wireless LANs:
• EAP-Transport Layer Security (EAP-TLS)
• Tunneled Transport Layer Security (TTLS)
• Protected EAP (PEAP)
For detailed steps on configuring WPA1 for the CB3000, see Configuring WPA1 (TKIP) Security Settings.

CB3000 Client Bridge User Guide
1-8
Table 1.1 summarizes the major differences between the protocols.
Table 1.1 Detailed Comparison of TLS-based EAP Methods
EAP Type
TLS (RFC 2716)a
a.TLS is secure, but the requirement for client certificates is too big a hurdle for most institutions to deal
with.
TTLS (Internet draft)b
b.TTLS, at least initially, is much more widely implemented than PEAP, and therefore has a slight
convenience advantage over the comparable PEAP method.
PEAP (Internet draft)c
c. PEAP uses the TLS channel to protect a second EAP exchange. PEAP is backed by Microsoft.
Software
Supported Client Platforms Linux, Mac OS X,
Windows 95/98/ME,
Windows NT/2000/XP
Linux, Mac OS X,
Windows 95/98/ME,
Windows NT/2000/XP
Windows XP
Authentication Server
Implementations by
Cisco, Funk, HP,
FreeRADIUS (open
source), Meetinghouse,
Microsoft
Funk, Meetinghouse Cisco
Authentication Methods Client certificates Any Generic token card
Protocol Operations
Basic Protocol Structure Establish TLS session
and validate certificates
on both client and server
Two phases:
• Establish TLS
between client and
TTLS server
• Exchange attribute-
value pairs between
client and server
Two parts:
• Establish TLS
between client and
PEAP server
• Run EAP exchange
over TLS tunnel
Fast Session Reconnect No Yes Yes
WEP Integration Server can supply WEP key with external protocol (e.g. RADIUS extension)
PKI and Certificate Processing
Server Certificate Required Required Required
Client Certificate Required Optional Optional
Certificate Verification Through certificate chain or OCSP TLS extension (current Internet draft)
Effect of Private Key
Compromise
Re-issue all server and
client certificates
Re-issue certificates for servers (and clients if using
client certificates in first TLS exchange)
Client and User Authentication
Authentication Direction Mutual: Uses digital
certificates both ways
Mutual: Certificate for
server authentication,
and tunneled method for
client
Mutual: Certificate for
server, and protected
EAP method for client
Protection of User Identity
Exchange
No Yes; protected by TLS Yes; protected by TLS

Introduction 1-9
1.2.6.3 About WPA2 (CCMP) Security
WPA2 is a newer 802.11i standard that provides even stronger wireless security than Wi-Fi Protected Access
(WPA) and WEP. CCMP is the security standard used by the Advanced Encryption Standard (AES). AES serves
the same function TKIP does for WPA-TKIP. CCMP (Counter Mode with Cipher Block Chaining Message
Authentication Code Protocol) is the preferred encryption protocol in the 802.11i standard. CCMP computes a
Message Integrity Check (MIC) using the proven Cipher Block Message Authentication Code (CBC-MAC)
technique. Changing just one bit in a message produces a totally different result.
WPA2-CCMP is based on the concept of a Robust Security Network (RSN), which defines a hierarchy of keys
with a limited lifetime (similar to TKIP). Like TKIP, the keys the administrator provides are used to derive other
keys. Messages are encrypted using a 128-bit secret key and a 128-bit block of data. For detailed steps on
configuring WPA2 for the CB3000, see Configuring WPA2 (CCMP) Security Settings.
1.2.6.4 About Secure 802.1x Security
The Secure 802.1x security option feature provides the CB3000 and its associated clients an additional
measure of security for data transmitted over the wireless network. Secure 802.1x uses the Extensible
Authentication Protocol (EAP) as an authentication mechanism between devices achieved through the
exchange and verification of certificates.
The IEEE 802.1x standard ties the 802.1x EAP authentication protocol to both wired and wireless LAN
applications. EAP provides an effective authentication scheme with or without IEEE 802.1x Wired Equivalent
Privacy (WEP) encryption. EAP supports multiple authentication measures, allowing the authentication server
to exercise full control.
The EAP process begins when an unauthenticated supplicant (client device) tries to connect with an
authenticator (in this case, the CB3000). The CB3000 passes EAP packets from the client to an authentication
server on the wired side of the CB3000. All other packet types are blocked until the authentication server
(typically, a RADIUS server) verifies the MU’s identity.
Using Secure 802.1x, a user requests device connection through the CB3000. The CB3000 then requests the
identity of the user and transmits that identity to an authentication server. The server prompts the CB3000 for
proof of identity (supplied to the CB3000 by the user) and then transmits the user data back to the server to
complete the authentication. A client should not be able to access the network if not authenticated.
For detailed steps on configuring 802.1x for the CB3000, see Configuring Secure 802.1x Security Settings.

CB3000 Client Bridge User Guide
1-10