Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

1-24
Introduction
ProCurve Wireless Edge Services xl Module
Security Features
As a network administrator, you must constantly consider how to secure your
network, particularly as you add wireless access. The Wireless Edge Services
xl Module supports a variety of security features both for wireless traffic and
for the interface between the wireless and wired network.
Authentication Options for WLANs
A key function of the Wireless Edge Services xl Module is to establish settings
for your network’s WLANs. One such setting is the method by which wireless
stations authenticate themselves before associating to a WLAN.
Forcing stations to authenticate themselves protects your network from
unauthorized users, securing both your organization’s data and that of wire-
less users. This security also protects wireless users from connecting to a
rogue AP.
A Wireless Edge Services xl Module supports three types of authentication:
■ 802.1X authentication
■ Web-Auth
■ RADIUS MAC authentication
Alternatively, the Wireless Edge Services xl Module can allow stations to
connect to a WLAN without authenticating formally. In this case, an encryp-
tion key usually acts as a password.
The authentication types are implemented as part of a WLAN’s settings. You
can enable different types of authentication on different WLANs, but each
WLAN can use only one of the three types of authentication.
However, you can also create MAC filters (MAC standard ACLs), which
function as local MAC authentication. You configure these filters globally and
then apply them to a WLAN. The filter is applied in addition to any other
authentication you configure on that WLAN.
802.1X Authentication. 802.1X, an IEEE standard specifically developed
to provide identity-based authentication for users, requires an authenticator
to manage the exchange between a wireless station and an authentication
server. The Wireless Edge Services xl Module acts as this authenticator. When
a wireless user attempts to associate with a WLAN, the module blocks all
traffic from the user’s wireless station until the user authenticates itself to an
authentication server (a RADIUS server).