CCNP Voice FAQ: Introducing 802.1x and Configuring Encryption and Authentication on Lightweight Access Points

Answer: C

Answer: D

Answer: B

Answer: A

Answer: A

Answer: A

Answer: C

Answer: D

Answer: C

Answer: C

Answer: Rogue access points impose threats to wireless LANs. A rogue access point is illegitimate; it has been installed without authorization. If an attacker installs a rogue access point and clients associate with it, the attacker can easily collect sensitive information such as keys, usernames, passwords, and MAC addresses. Unless the client has a way of authenticating the access point, a wireless LAN should have a method to detect rogue access points so that they can be removed. Furthermore, rogue access points are sometimes installed by attackers intending to interfere with the normal operations and effectively launch denial of service attacks.

Answer: Following are the weaknesses of basic 802.11 (WEP) security:

• A lack of mutual authentication makes WEP vulnerable to rogue access points.
• Usage of static keys makes WEP vulnerable to dictionary attacks.
• Even with use of initialization vector (IV), attackers can deduct WEP keys by capturing enough data.
• Configuring clients with the static WEP keys is nonscalable.

Answer: Following are the benefits of LEAP over the basic 802.11 (WEP):

• Server-based authentication (leveraging 802.1x) using passwords, one-time tokens, public key infrastructure (PKI) certificates, or machine IDs
• Usage of dynamic WEP keys (also called session keys) through reauthenticating the user periodically and negotiating a new WEP key each time (Cisco Key Integrity Protocol or CKIP)
• Mutual authentication between the wireless client and the RADIUS server
• Usage of Cisco Message Integrity Check (CMIC) to protect against inductive WEP attacks and replays

Answer: The main improvements of WPA2 to WPA are usage of Advanced Encryption Standard (AES)
for encryption and usage of Intrusion Detection System (IDS). However, WPA2 is more CPUintensive than WPA mostly because of the usage of AES; therefore, WPA2 usually requires a hardware upgrade.

Answer: The important features and benefits of 802.1x/EAP are as follows:

• Usage of RADIUS server for AAA centralized authentication
• Mutual authentication between the client and the authentication server
• Ability to use 802.1x with multiple encryption algorithms, such as AES, WPA TKIP, and WEP
• Without user intervention, the ability to use dynamic (instead of static) WEP keys
• Support of roaming

Answer: The required components for 802.1x authentication are as follows:

• EAP-capable client (the supplicant)
• 802.1x-capable access point (the authenticator)
• EAP-capable RADIUS server (the authentication server)

Answer: The EAP-capable client requires an 802.1x-capable driver and an EAP supplicant. The supplicant might be provided with the client card, be native in the client operating system, or be obtained from the third-party software vendor. The EAP-capable wireless client (with the supplicant) sends authentication credentials to the authenticator.

Answer: Following are the main features and benefits of EAP-FAST:

• Supports Windows single sign-on for Cisco Aironet clients and Cisco-compatible clients
• Does not use certificates or require Public Key Infrastructure (PKI) support on client devices
• Provides for a seamless migration from Cisco LEAP
• Supports Windows 2000, Windows XP, and Windows CE operating systems
• Provides full support for 802.11i, 802.1x, TKIP, and AES
• Supports password expiration or change (Microsoft password change)

Answer: EAP-FAST has three phases:
Phase 0: Provision PAC
Phase 1: Establish secure tunnel
Phase 2: Client authentication

Answer: The important features and facts about EAP-TLS are these:

• EAP-TLS uses the Transport Layer Security (TLS) protocol.
• EAP-TLS uses Public Key Infrastructure (PKI).
• EAP-TLS is one of the original EAP authentication methods, and it is used in many environments.
• The supported clients for EAP-TLS include Microsoft Windows 2000, XP, and CE, plus non-Windows platforms with third-party supplicants, such as Meetinghouse.
• One of the advantages of Cisco and Microsoft implementation of EAP-TLS is that it is possible to tie the Microsoft credentials of the user to the certificate of that user in a Microsoft database, which permits a single logon to a Microsoft domain.

Answer: The important features and facts about PEAP are as follows:

• PEAP was developed by Cisco Systems, Microsoft, and RSA Security to the IETF.
• With PEAP, only the server authentication is performed using PKI certificate.
• PEAP works in two phases. In Phase 1, server-side authentication is performed and an encrypted tunnel (TLS) is created. In Phase 2, the client is authenticated using either EAPGTC or EAP-MSCHAPv2 within the TLS tunnel.
• PEAP-MSCHAPv2 supports single sign-on, but Cisco PEAP-GTC supplicant does not
  support single logon.

Answer: Following are the important features of WPA:
Authenticated key management—WPA performs authentication using either IEEE 802.1x or preshared key (PSK) prior to the key management phase.
Unicast and broadcast key management—After successful user authentication, message integrity and encryption keys are derived, distributed, validated, and stored on the client and the AP.
Utilization of TKIP and MIC—Temporal Key Integrity Protocol (TKIP) and Message Integrity Check (MIC) are both elements of the WPA standard and they secure a system against WEP vulnerabilities such as intrusive attacks.
Initialization vector space expansion—WPA provides per-packet keying (PPK) via initialization vector (IV) hashing and broadcast key rotation. The IV is expanded from 24 bits (as in 802.11 WEP) to 48 bits.

Answer: 802.11i has three key security features:

• 802.1x authentication
• Advanced Encryption Standard (AES) encryption algorithm
• Key management (similar to WPA)

Answer: The important features/facts about WPA2 are as follows:

• It uses 802.1x for authentication. (It also supports preshared keys.)
• It uses a similar method of key distribution and key renewal to WPA.
• It supports PKC.
• It implements AES.
• It uses IDS.

Answer: The services that wireless IDS provides to address RF and standards-based vulnerabilities are as follows:

• Detect, locate, and mitigate rogue devices.
• Detect and manage RF interference.
• Detect reconnaissance.
• Detect management frames and hijacking attacks.
• Enforce security configuration policies.
• Perform forensic analysis and compliance reporting as complementary functions

Answer: WPA and WPA2 have two modes: Enterprise mode and Personal mode. Each mode has encryption support and user authentication. Products that support both the preshared key (PSK) and the 802.1x authentication methods are given the term Enterprise mode. Enterprise mode is targeted at medium to large environments such as education and government departments. Products that only support PSK for authentication and require manual configuration of a preshared key on the access point and clients are given the term Personal mode. Personal mode is targeted at small business environments such as small office, home office (SOHO).