WEPHack

Having done a lot more troubleshooting, and tested many combinations of laptop and WAP, the problem only seems to be with the Lenovo/Intel Centrino chipset and the WG302 running any form of WPA encryption. The Lenovo connects without issue to the WNDAP350 and WPA, and the WG302 and WEP. The built-in WG302 log is pretty useless so I will have to get SYSLOG up and running, which I haven't done for a while. We're changing the key tomorrow, so I'll have to leave a second SSID for WEP enabled until I can figure out what's wrong. Could it be that these (very old) WG302 APs just aren't going to be compatible with this Intel wireless chipset?...

(The poll doesn't show on the iPhone app)

Timbo343: there is a poll at the top of the thread. It requires you to enter some text in the post as well :-/

What wireless network hardware do you use?

I've checked, and you do. The faux pas was that this particular teacher had been given local admin privileges to install some software. Lesson learned. m25man: I think when we renew the wireless, hopefully next April, we will get some expert consultancy to ensure we choose something suitably secure. For now we'll have to go with WPA, if the infrastructure/devices are up to it...

It doesn't seem to differentiate and just has a single field for entry of the key. I'm using a website based generator to create the key. That's good news at least! Although I'm wary of these WAPs as they just seem to behave strangely. Even more so our newer Netgear WAPs, the WNDAP350. Certainly where we are it's just pressure at every level i.e. not enough budget to easily change what's an expensive item (both consulting and hardware) when done properly, and getting training is not easy when you're required most of the time. It's not impossible though, and a wireless replacement was already pencilled in for next FY, although it's still likely to be £10-20k+, even more with a possible change also required to our wired infrastructure (new higher bandwidth switches, VLAN setup etc.). With the tablets I've not had much chance to troubleshoot. It sees the SSID on a scan, but just doesn't connect. SSID is just an alphanumeric string with the name of the school and a "2" at the end. No spaces or symbols.

Education is certainly a difficult environment. You have extremely sensitive data combined with low budgets for hardware, and are then expected to work miracles. A lot of staff, including senior staff, just don't realise the pressure. To boot I've been trying to sort out a mess of an IT department for a couple of years now, replacing hardware that desperately needs sorting, along with all the documentation required to properly support. This is with minimal human resources as well.

I was trying with a 504 bit key. The suggestion is that light is 64 bit, and medium is 160 bit. From what has happened a reasonably long key would be wise in case someone tries to write it down (albeit we'll try and prevent access to the key as best possible). The APs are certainly accepting the 504 bit key, but our Android tablets here don't seem to like it. So many variables though it's hard to know whether it's this, the level of encryption, or AP compatibility.

Could length of WPA key cause compatibility/connection issues with some devices? I'm trying to troubleshoot why some of our mishmash of devices won't connect to WPA.

Having checked, the WAP does offer a joint WPA/WPA2 mode, and that does seem to be working with this wireless chipset. I'm guessing it tries to negotiate at the stronger encryption, then drops lower if it can't make the connection. There was mention above of WPA being hackable with TKIP. How does that compare with WEP hacking for time, ease etc.? One advantage to a longer wireless key is it makes it near impossible to remember if seen, so I may opt for the long key for this reason alone.

So I've confirmed that the Lenovo/Intel Centrino Wireless-N 2230 chipset won't connect to the WG302 (with the latest firmware) using WPA2 AES. It will with WPA TKIP. It's fine with the WNDAP350, so I'm guessing the issue is with the WG302. Is there any huge benefit in switching from WEP to WPA TKIP if we're going to be changing all this in 6 months anyway?

Yep, that's the site I linked to above. Seems slightly heavy handed, so just checking there's not something a little more elegant GP-wise.

Is that the likes of Radius? Beyond me technically, but I can refer to a consultant.

I learnt something new, that you can actually see what wireless key has been entered on your PC by going to the wireless profile's properties, then to the security tab, and then ticking "show characters". I was stunned that MS allow you to do this, and as per my other thread this was how some students got hold of our wireless key. The only method I can find to prevent this via GP is defined in a response here (albeit for Windows Vista, so may not work) How to Disable function "Show Character" in wireless connection? Does anyone know of another mechanism for doing this?

An update to the WG302 has enabled profiles, and the WNDAP350 can do that out of the box. There's still this compatibility issue with the Lenovos/Intel Centrino Wireless-N 2230 which I need to troubleshoot. My concern is that these are just the laptops tested, and we have several more oddballs. I'll see how the compatibility testing goes...