User's Manual

3/11/05 Cisco SWAN Wired Security
OL-7426-02
- WEP (Wired Equivalent Privacy) keys, with or without Pre-Shared key Passphrase.
• RSN with or without Pre-Shared key.
• Cranite FIPS140-2 compliant passthrough.
• Fortress FIPS140-2 compliant passthrough.
• Optional MAC Filtering.
The WEP problem can be further solved using industry-standard Layer 3 security solutions, such as:
• Terminated and passthrough VPNs (virtual private networks), and
• Terminated and passthrough L2TP (Layer Two Tunneling Protocol), which uses the IPSec (IP
Security) protocol.
• Terminated and pass-through IPSec (IP security) protocols. The terminated Cisco SWAN IPSec
implementation includes:
- IKE (internet key exchange),
- DH (Diffie-Hellman) groups, and
- Three optional levels of encryption: DES (ANSI X.3.92 data encryption standard), 3DES
(ANSI X9.52-1998 data encryption standard), or AES/CBC (advanced encryption
standard/cipher block chaining).
The Cisco SWAN IPSec implementation also includes industry-standard authentication using:
- MD5 (message digest algorithm), or
- SHA-1 (secure hash algorithm-1).
• The Cisco SWAN supports local and RADIUS MAC Address (media access control) filtering.
• The Cisco SWAN supports local and RADIUS user/password authentication.
• The Cisco SWAN also uses manual and automated Disabling to block access to network
services. In manual Disabling, the operator blocks access using client MAC addresses. In
automated Disabling, which is always active, the Operating System software automatically
blocks access to network services for an operator-defined period of time when a client fails to
authenticate for a fixed number of consecutive attempts. This can be used to deter brute-force
login attacks.
These and other Operating System Security
features use industry-standard authorization and authenti-
cation methods to ensure the highest possible security for your business-critical wireless LAN traffic.
For information about Cisco SWAN wired security, refer to Cisco SWAN Wired Security.
About Cisco SWAN Wired SecurityCisco SWAN Wired Security
Many traditional Access Point vendors concentrate on security for the Wireless interface similar to that
described in the Operating System Security
section. However, for secure Cisco Wireless LAN Controller
Service Interfaces (Cisco Wireless Control System
, Web User Interface, and Command Line Interface),
Cisco Wireless LAN Controller-to-Cisco 1000 Series lightweight access point, and inter-Cisco Wireless
LAN Controller communications during device servicing and Client Roaming
, the Operating System
includes built-in security.
Each Cisco Wireless LAN Controller and Cisco 1000 Series lightweight access point is manufactured with
a unique, signed X.509 certificate. This certificate is used to authenticate IPSec tunnels between
devices. These IPSec tunnels ensure secure communications for mobility and device servicing.
Cisco Wireless LAN Controllers and Cisco 1000 Series lightweight access points also use the signed
certificates to verify downloaded code before it is loaded, ensuring that hackers do not download
malicious code into any Cisco Wireless LAN Controller or Cisco 1000 Series lightweight access point.