WLAN installation policies

Sometimes wireless LANs spring up, willy-nilly, throughout an enterprise. This could be because end users are buying notebooks with WLAN adapters embedded in them and are bringing the technology to their place of work. If your company has a corporate policy against letting end users install a wireless access point in the organization without the blessing of the IT department you should make sure it is well known. End users could face grounds for dismissal if such a policy exists and they don't comply with it.

Policies that exist against individual departments or users installing their own access points have two primary purposes. One, obviously, is to control security. The other is to make sure you get the best coverage and least interference out of your WLAN topology - in other words, to make sure that access points are installed in the spots where they optimize reach with the right amount of coverage overlap so that the channels do not interfere with one another. If you have the budget, it can be beneficial to have a value-added reseller or wireless consultant conduct your RF site survey and strategically install your access points.

On the security front, you may have read an article in the " Chicago Tribune " a few weeks back about how a couple of wireless consultants strolled the streets of the Chicago Loop with a wireless-enabled laptop and were able to tap into 600-plus corporate LANs. Oops! One problem here is that, in accordance with IEEE standards, 802.11b LANs ship with Wired Equivalent Privacy (WEP) encryption disabled. Many organizations simply do not turn it on. This is one simple thing you can do to deter hackers using so-called " security through obscurity. " While we all know that basic WEP, as it stands today, is flawed, if activated, it will stave off the majority of hack attempts. Think of it as choosing to roll up your windows and lock your car door in a public parking lot.

Similarly, when supporting remotely mobile users who might be using a public WLAN service, most companies will do so using an IPSec VPN to encrypt the user's session not only over the radio-access link but over the untrusted public Internet as well. When you are using a VPN, you still need a Dynamic Host Control Protocol (DHCP) server before you can establish your IPSec VPN tunnel. So initial access to the DHCP server is in the clear. In these cases, enabling WEP again provides some baseline protection for this part of the process, so enabling it on your adapters isn't a bad idea.

Joanie Wexler is an independent networking technology writer/editor in Campbell, Calif., who has spent most of her career analyzing trends and news in the computer networking industry. She welcomes your comments on the articles published in this newsletter, as well as your ideas for future article topics. Reach her at joanie@jwexler.com.

Network World Wireless archive
Past newsletters.