Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

1-45
Introduction
ProCurve Wireless Edge Services xl Module
Before creating a certificate or certificate request, the Wireless Edge Services
xl Module must generate a public/private key pair. The module can create
Rivest-Shamir-Adleman (RSA) keys of between 1024 and 2048 bytes. Each
certificate can use a unique key pair, or multiple certificates can share a key pair.
The Wireless Edge Services xl Module uses certificates for several purposes:
■ HTTPS access—The module’s server certificate authenticates the mod-
ule to your Web browser.
■ RADIUS authentication services —802.1X authentication with EAP
requires mutual authentication. In other words, the module’s internal
RADIUS server must send a server certificate and authenticate to
supplicants.
■ Autokey authentication for secure Network Time Protocol
(NTP)—The module sends its certificate to the secure NTP server to
authenticate itself and generate keys to secure NTP exchanges.
Because the Wireless Edge Services xl Module can store multiple trustpoints,
you can select different certificates for different functions.
GRE Tunnels
A GRE tunnel is a virtual point-to-point connection between two devices, or
tunnel endpoints. A tunnel endpoint selects traffic for transmission over the
tunnel. It then encapsulates that traffic in a GRE header and in a delivery IP
header, which is addressed to the remote tunnel endpoint. After receiving the
traffic over the tunnel, the remote endpoint decapsulates the traffic and sends
it to its original destination.
A GRE tunnel isolates traffic as it is sent between the two tunnel endpoints.
Intervening devices examine only the delivery header, not the encapsulated
packet. The GRE tunnel thus protects the encapsulated packet to some
degree; however, it does not provide the security of an IP Security (IPSec) or
Secure Sockets Layer (SSL) tunnel.
On the Wireless Edge Services xl Module, you can create GRE tunnels to any
ProCurve Networking device that supports GRE. After creating the tunnel,
you associate it with a particular WLAN. All traffic that arrives on that WLAN
is transmitted over the tunnel.
You might use a GRE tunnel when your wireless network is some distance
from the private network that wireless users should access. For example, you
could tunnel WLAN traffic to a router at a remote site. Remember that a GRE
tunnel does not provide rigorous security and that the module decrypts frames
received from the WLAN before forwarding them over the tunnel.