jjx

Here's a quick overview for you... For the full scoop, check out "A Brief History of Wireless Security" at Security Uncorked A Brief History of Wireless Security KNOWING YOUR NEED It really depends on the data you need to protect. In the US, we have specific regulations over data protection for personal information, health and financial. A school network could contain: - Student grades, names, gov ID, addresses <- Personal info - Student health information (mental/clinical) <- Health info - Employee names, addresses, gov ID <- Personal info - Employee health or insurance info <- Health info - Employee salary and benefits <- Financial data THREE MINUTE OVERVIEW Listed most secure to least secure. 1. Enterprise mode 802.11i (WPA2 with 802.1X and AES) > Connects to directory services to authenticate users or machines and uses 802.1X for key rotation. Not currently broken because the encryption is secure (AES) and the key rotation (802.1X) is not broken. 2. WPA or WPA2 with TKIP > Can be broken, but takes much more effort and the keys themselves aren't broken, the checksum is. The vulnerability is in the TKIP encryption (vs AES) and the threats under this type of attack are limited. TKIP was an interim crypto method before all hardware could support AES. 3. WPA2 with PSK > Uses a pre-shared key instead of rotating keys created by 802.1X. Pre-shared keys are more vulnerable, especially when not configured to rotate at all. Even rotating PSKs are not as secure as 802.1X keys. PSKs also do not offer any type of user authentication, since the keys are shared. If someone violates a policy or attacks the network, tracking down the wireless user is much more difficult with PSKs. 4. WEP with PSK > Just don't even do it. -jj

Hi Tim, Actually several models of HP ProCurve switches support 10GbE - 5400 series - 8212 series (core) - 3500 series (stackables) - 2900 series (stackables) HP ProCurve Networking - Network of Choice ProCurve is a great choice for 10 Gig, they actually won the 10Gig shootout by one of the magazines recently. They've also just entered Gartner's Magic Quadrant. Many of our education customers (K12 and higher ed) are using 10GbE for inter-switch links and to key servers. jj

Interesting.. I have the latest version and haven't had a problem so far (yet). I have added this to a list at the dev labs/support to check into. thanks! jj

Hi there, Yeah, I realized JUST after I typed it all that the post was OLD! LOL oh well As for tag/untag- you MUST mix them if you plan to have more than 1 device on a port. For example, a VoIP phone would use the tagged and the PC connected through it untagged... so the port would be Tagged for 1 and Untagged for the other... PCM+ actually does support the ver 13 firmware. I have it here in my labs and several customers are already on 13... however... I'm not recommending they upgrade on 5400 past 12.57 (you can get it here ProCurve Networking by HP - Software Summary) If you want to try it, load the 12.57 into Secondary Flash.. do a reload to secondary.. if it's all working, you can copy Secondary to Primary. THat will likely fix the issues. (If you want CLI commands let me know). PCM is not pretty- they're working on that- but it is useful in reporting and troubleshooting. Personally, I prefer the CLI but when you have a lot of switches, firmware and config mgmt is much easier with PCM+. Good Luck! -jj

Guys, A few things here for you... 1) Tag vs Untag Tagged VLAN assignments are used for a) Uplinks and b) Devices that used Tagging (ie VoIP Phones). Untagged VLANs are used for 'endpoints' such as desktops with NICs that dont talk in 'VLAN'. 2) Mixing You CERTAINLY mix tagged & untagged. Edge ports are untagged (unless you have a 2nd device such as a phone) and uplinks are tagged. (1 exception, we usually untag the default or mgmt VLAN). 3) ProCurve and VLANs Which switches do you have and I'll get the correct CLI reference to you? ProCurve VLANs are very simple (simpler than most) to configure. You create a VLAN by number (ie #VLAN 30 name Students would make a VLAN 30 and name it on the switch, naming is optional). 4) VLANs and Subnets You can think of VLAN-ing similarly to subnetting, but understand they're different. Usually people combine VLAN segmentation with subnetting/IP, which is why VLANs are often mistaken for a Layer 3 technology. Generally, we like to identify the VLAN somewhere in the IP scheme... so with a 16-bit subnet mask, maybe your default VLAN is 10.10.X.X/16... you could create a seperate VLAN '35' and segment that's 10.35.X.X/16. Not required, but usually what's done. 5) ProCurve If you're not used to VLANs, I would suggest using/installing the ProCurve Manager Plus (PCM+) software. It will scout out the network, map out your switches and let you see where VLANs are set in a visual format. If you're missing a link along the way you can clearly identify it from the VLAN network map view. Hope this helps! jj

Just for grins, if you're getting little or no connectivity and the APs are passing through DHCP? (Is that correct?) If so, I would enable the DHCP server on a test AP (choose a scope that will give you access to the network but won't overlap what's already there). If it's a signal issue, there are several other things you can try. (Also FYI, channels 1, 6 and 11 are not the only ones that don't overlap, they're the choices that give you the most selection (3) that don't overlap). -jj

Are you doing WPA or WPA2? If you're looking at AES, you want WPA2, and Windows XP SP2 requires a patch for WPA2 support. If you're using a PSK, it's harder to see why it's not authenticating. If you can set up 1X and test with RADIUS, you'll see more info in the RADIUS log. -jj