Date post: | 16-Jan-2016 |
Category: |
Documents |
Upload: | priscilla-parker |
View: | 214 times |
Download: | 0 times |
CAEN Wireless Network
College of EngineeringUniversity of Michigan
October 16, 2003Dan Maletta
CAEN Wireless Design Goals
• Make system interoperable– Support for multiple platforms: Linux (Intel),
Windows, MacOS. PDAs?– If you have any wireless network card, it will
work!!• Provide seamless wireless coverage• Provide an authentication mechanism for
entire University Community that doesn’t require registration of NIC
• Provide a secure mechanism for transporting data within wireless network
CAEN Wireless Design Goals (cont.)
• Provide easy-use procedure for University community
• Make system scalable• Provide separate solutions for
conference rooms that allows for easy and fast network access
• Treat wireless and security separately.
CAEN Wireless Network System
• Supports the above goals• Coverage now in 11 Buildings (~100APs)• Authentication and data security provided by a
Virtual Private Network (VPN)• System currently supports up to 50Mb/s of
sustained throughput and 1500 simultaneous users.
• Users can access wireless for 1st time 24 hours a day.
• Conference room setup being tested in LEC• Supports TCP/IP only. No IPX or AppleTalk
Overview of Authentication and Security Setup
• VPN server provides authentication and data security services– Server acts as a gateway to “wired” network– Users install an IPSec client (software) to access
VPN server– Users then authenticate to VPN server with
Kerberos ID– Data from client machine to server is encrypted
(3DES)
• IPSec VPN different than Windows and MacOS built-in PPTP VPN client.– Exploring options for how to allow those clients
Wireless system (Diagram)
Wireless
Network
10.213.120.x
UofM NetworkUofM Network
InternetInternet
Border Router
VPN Server
Web ServerWireless Access Point
Auth. Servers
User Associates with Network
Wireless
Network
10.213.120.x
SSID: CAEN Wireless
UofM NetworkUofM Network
InternetInternet
Border Router
VPN Server
Web ServerWireless Access Point
You are now associated with
network CAEN Wireless
Auth. Servers
User Get An IP address from Server
Wireless
Network
10.213.120.x
UofM NetworkUofM Network
InternetInternet
Border Router
VPN Server
Web/IP ServerWireless
Access Point
IP address
10.213.120.52 Auth. Servers
User Tries to open a Web Page
• User is re-directed to Wireless Network Web server– CAEN web page tells user how to gain
access to wired network.– CAEN web page contains software and
instructions for connecting and installing VPN client.
– After trying to use wireless, user installs software and reboots computer.
– Wireless network is now available to user with VPN software.
User Starts VPN Connection and Authenticates with server
Wireless
Network
10.213.120.x
UofM NetworkUofM Network
InternetInternet
Border Router
VPN Server
Web/IP ServerWireless
Access Point
IP address
10.213.120.52
uniqname & PasswordTunnel IP address
Auth. Servers
Tunnel is now Established and User can now communicate on
Internet
Wireless
Network
10.213.120.x
UofM NetworkUofM Network
InternetInternet
Border Router
VPN Server
Web/IP ServerWireless
Access Point
IP address :10.213.120.52
Tunnel Addr: 141.213.120.87
Secure Encrypted Tunnel
Auth. Servers
Support
• The CAEN Hotline is answering questions as users have them
• Web site has an FAQ where we list common problems
• Hotline has laptops running all 3 OS flavors and Wireless cards from 7 vendors!!!
• Access Points have identical configurations so low overhead on configuration issues
• We have redundant servers to handle single machine failures
What We’ve Seen So Far
• We’re average about 500 sessions per day for the last two months. Our peak over that time has been ~110 simultaneous connections
• No complaints about lack of support for MacOS 8 and 9.
• A real demand for PDA support
Wireless deployment costs
• Access Points $600.00• Antennas: $100.00-200.00• Cable to Access Points from
Closets (2 cables): $250.00• Conduit from cable tray to access
point location: $400.00-1500.00
Wireless build-out model for CoE
• CAEN/CoE is currently covering a number of computing labs and public spaces
• CAEN/CoE is doing a limited departmental rollout to cover some classrooms, conference rooms.
• Departments are responsible for purchasing equipment to cover areas within their department.
• CAEN/CoE performs installation and supports installed equipment.
What’s worked well
• Windows boxes with Cisco client work well together
• VPN server is able to keep up and generate good stats.
• Easy to add access points to the system
What hasn’t been great
• Handhelds• Open BSD• Wireless gateways
– Security vs. perceived ease of use
• Guest Access solutions
Guest Access
• Still working on a good guest access solution• Come to Hotline (2320 Media Union)
– Must be accompanied by person representing them. Must provide contact information
– Expiration is set for one business week at start of every week
– Instant access (5 minutes)
• If affiliated with the University, access will be available at Reference desk on a weekly checkout basis
Future Plans
• Continue deployment in buildings ~30-40 APs in next 3 months
• Movian Client support for PDAs (Both Palm and PocketPC)– How are people licensing
• Conversion from 3DES encryption to AES• Support for Native windows VPN protocols??• 802.11g deployment• WebVPN (SSL-based VPN)• SSH pass-through to login machines
Discussion Items
• 802.1x– Is anybody looking to use it?– Microsoft’s announcement of proprietary
replacement
• SSL-based VPNs• 802.11a vs. 802.11g• Wireless for home use
– Is anyone making recommendation to people– VPNs or secure access for broadband
connections
Check out our wireless site
• http://www.engin.umich.edu/caen/network/wireless