Best practice architecture Wireless security

What is the best practice architecture for wireless to the wire network?
Use AP to Firewall and it to a router using RADIUS?
It apply to Control is a safety?
What models Cisco recomend (Hard and Soft?)
Is any place in Cisco that I can use to see Architecture recomendations that integrete Wireless, Radio (Microwave) and Voice over IP com-plete system?

using one of the 802.1x types (i.e. LEAP, EAP-FAST, PEAP) with WPAv2 (AES encryption). Too bad that there are not many wireless adapters support AES.
All Cisco wireless product support AES in 12.3(2)JA recently.
Also, you may want to configure WDS for radio management.

Similar Messages

Best Practice paper for Security

Does anyone have or know of a Best Practice Paper for Security?
Thanks,
Melissa

http://www.petefinnigan.com is another excellent security resource-- he has a couple of different checklists.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC

Hyperion - best practice architecture

we are planning to use the hyperion 11x (HFM and Planning and Financial Reports) and would like to know the best practice architecture and the oracle doucment id on this.
any help would be much appreciated
Thanks

If you want to understand the architecture recommended by Oracle then have a look at the standard deployment guide at - http://docs.oracle.com/cd/E17236_01/nav/portal_1.htm
If you don't want to go down the recommended route then I suggest getting in a consultant to discuss your possible options.
Cheers
John
http://john-goodwin.blogspot.com/

Best practice tast profile security in BPC

Hi,
I'm in the middle of a BPC NW 7.5 implementation project and need to set up the task profiles in BPC. I'm looking for a clear description of the different tasks - does anyone now if this is available?
Furthermore I'm interested in Best Practice experiences with task security in BPC - any input on this matter?
Thanks,
Lars

Hi,
You can extract the information from the Security Guide located on Service MarketPlace at:
https://websmp202.sap-ag.de/securityguide
follow the path to "SAP BusinessObjects (formerly, SAP Business User)" and select
SAP BPC 7.0, version for SAP NetWeaver Security Guide
hope it helps...
regards,
Raju

Best Practice/Standard for Securing and Attaching Files in a Web Service

Thanks in advance.
Being new to Web Services as well as most of my team. I would like to know what is the best practice for transporting files via a Web Service. I know of several methods and one that seems to be the standard, but you can't really tell in this ever changing world of Web Services. Below are the options that I have found.
1. MIME encoded the file and embed in the payload of the SOAP message
2. SwA (SOAP with Attachments) which applies MIME attachments to SOAP. I think this is similiar to the way emails are handled.
3. DIME (Direct Internet Message Encapsulation) similiar to MIME encoding but is more efficient
4. MTOM (Message Transmission Optimization Mechanism) I really not understand this method, but it seems that this is the NEW standard. I just don't understand why.
5. Utilize HTTPS and download the file from an accessible file server w/ a login id and password.
Is there someone out there that understands this problem and can assist me in understanding the pros and cons of these methods? Or maybe there is a method that I'm overlooking altogether.
Thanks

JWSDP supports securing of attachments [1]and will soon support securing MTOM attachments too. [1]http://java.sun.com/webservices/docs/2.0/xws-security/ReleaseNotes.html

Best practice of Wireless settings E4200

I Have a Linksys E4200 router and would like to know what the best practice is for the Wireless settings?
My settings are currently:
This is good or should I change something, for example difference Network name for both or channel ?
Please somebody help/advise me.

Optimal settings. And also be sure to give the network's 2 different names. Example. HomeNetwork and HomeNetwork5G 2.4GHz Mixed: If you have mixed devices. If not. G or N. Channel Width: 20MHz Channel: 1,6 or 11. 5GHz N only. Channel Width: 40MHz Channel: Does not matter on the 5GHz band.

Best practices in wireless configuration?

Hi,
Is there a best practice document that shows 3500 AP with 5508 controllers? The questions I have are below.
1. Do I configure each AP to non overlapping neighbor channels(1,6,11 for 2.4GHz) or leave that to controller to decide? Does controller change the channel of an AP when it sees congestion on a specific frequency?
2. For 5 GHz is it good idea to bond the channels? What frequency to use for neighboring APs? OR again, leave it to controller to shift as needed?
3. For security what's best practices? 802.1x or different?
Thanks,
Sm

1. Do I configure each AP to non overlapping neighbor channels(1,6,11 for 2.4GHz) or leave that to controller to decide?
Let the controller(s) decide. By default the Dynamic Channel Assignment (DCA) verifies the channel for interferrence every 600 seconds. Because you have 3500 then make sure you enable Event Driven RRM (Radio Resource Management) on both channels.
Does controller change the channel of an AP when it sees congestion on a specific frequency?
The controllers will not change the channel when it sees congestion. The controller will change the channel if it sees interference on the same channel. The CleanAir will change the channel when it sees interference from non-AP interference like Bluetooth, Microwave ovens, cordless phones, etc.
2. For 5 GHz is it good idea to bond the channels?
Sure.
What frequency to use for neighboring APs? OR again, leave it to controller to shift as needed?
Leave this option in default.
3. For security what's best practices? 802.1x or different?Sure.

Teststand best practices architecture for communicating with TCP instruments

Hi,
I am using Teststand 2014 and LabVIEW 2013 SP1 as the module adapter.
My Teststand sequence file includes communication with 3-5 different instruments via TCP/IP.
Such as Spectrum analyzer, generator and other RF measurement devices.
There are many steps located in subsequences that implement code to communicated with these devices whether to fetch , query or write.
What is the best architecture to implement this program ?
As I can see it there are many possibilities, such as :
1. Launching a subsequence as a new thread in the Sequence Setup. This subsequence calls a VI that dynamically register for events/queue that can be launched from any step. (in this case there is a VI running in the background that can perform Write/Read/Qurey to the instrument and he is triggered from any step using an event or dequeue element)
This option can be duplicated for any instrument or only once for all of the instrument with prioritizing the event queue.
2. Creating a communication reference in the Setup of the Main Sequence. And passing it to any step that need it. (there is also the question how to pass this reference… in Teststand globals or in LabVIEW queue).
another 2 small questions that I encountered -
Is using LabVIEW queues and notifiers in TS steps and obtaining their reference (in the LabVIEW code) by name is considered best practices ?
If I would like to run only one VI in a new thread, should I use a new subsequnce and set it as a new thread or use the Run VI Asynchronously ? what are the differences ?

I use Action Engines to hold my VISA Sessions and just write my LabVIEW VIs to use those to send commands and read data. Any returned data can be analyzed in the VI or passed on to TestStand as a step result. You just need a sequence to run at start up to initialize your Action Engines and another one to close them.
There are only two ways to tell somebody thanks: Kudos and Marked Solutions
Unofficial Forum Rules and Guidelines

Best practice for Wireless ap vlan

Is there a best practice for grouping lightweight access points in one vlan or allowing them to be spread across several ??

Whether you have multiple sites or not, it's good practice to put your APs in a separate and dedicated VLAN.
If your sites are routed sites, then you can re-use the same VLAN numbers but make sure they are on separate subnets and/or VRF instance.

Best practice for standard security role

Hi, I'd like to know which is the best practice for standard role use, some people tell me that a standard role should never be used, that a copy must be made and assign the users to the copy, but then, why should SAP bother creating the standard role?

They are provided as a template for you, and you can copy them into a different namespace and make changes there before generating the profiles and authorizations.
Why you should use a copy of them is because SAP will also update them sometimes. If transactions change in the standard menues with SP's and upgrades, then you will find them in transaction SU25.
If you do a search on "standard AND roles" in the SDN then you will also find more detailed infos and opinions on the use of them.
Cheers,
Julius

SQL Server Best Practices Architecture UCS and FAS3270

Hey thereWe are moving from EMC SAN and physical servers to NetApp fas3270 and virtual environment on Cisco UCS B200 M3.Traditionally - Best Practices for SQL Server Datbases are to separate the following files on spearate LUN's and/or VolumesDatabase Data filesTransaction Log filesTempDB Data filesAlso I have seen additional separations for...
System Data files (Master, Model, MSDB, Distribution, Resource DB etc...)IndexesDepending on the size of the database and I/O requirements you can add multiple files for databases. The goal is provide optimal performance. The method of choice is to separate Reads & Writes, (Random and Sequential activities)If you have 30 Disks, is it better to separate them? Or is better to leave the files in one continous pool? 12 Drives RAID 10 (Data files)10 Drives RAID 10 (Log files)8 Drives RAID 10 (TempDB)Please don't get too caught up on the numbers used in the example, but place focus on whether or not (using FAS3270) it is better practice to spearate or consolidate drives/volumes for SQL Server DatabasesThanks!

Hi Michael,It's a completely different world with NetApp! As a rule of thumb, you don't need separate spindles for different workloads (like SQL databases & logs) - you just put them into separate flexible volumes, which can share the same aggregate (i.e. a grouping of physical disks).For more detailed info about SQL on NetApp have a look at this doc:http://www.netapp.com/us/system/pdf-reader.aspx?pdfuri=tcm:10-61005-16&m=tr-4003.pdfRegards,Radek

RICEF Security - best practice to develop security specs

Good Morning All,
We have new ECC implementation kicked off, my question is how RICEF security is controlled? What are the standard guidelines practised in industry?
We are encouraging process teams to start use authorizations checks in custom transactions where ever necessary, ABAP team says this is in discreation of BP, ABAP will enforce checks if Business Process(BP) ask.
I not sure if BP will take that extra time to think on authorization checks for RICEFS, we security team offered help to BP saying we can help on finding appropriate auth objects for their RICEF objects.
As we cannot really enforce this or push hard, I am trying to think what is best way to get this in place.
What I think is for some custom tcodes, which are low risk reports there is really no need to induce 2nd level check(1st level being S_TCODE) but my concern is this should not be taken for granted.
I would like to hear suggestions from group.
Thank You.
Edited by: Julius Bussche on Apr 22, 2011 5:46 PM
Subject title made more meaningful.

Their job is to make it work and security is very often seen as a barrier
This is very unfortunate but often true Security can however also offer cool solutions to spagetti code and defunct requirements!
As you correctly state, the reason is often lack of training, awareness and being under pressure from deadlines and complexity. I also suffer under this but have with time learnt that "right first time" is the best way.
The ideal solution IMO would be to integrate the authority-check statement into both the external and internal license meaurement.
- A program without any authority-check is freeware because anyone can run it.
- A program with a display auth check run by a user with display authorizations costs 1 cents each time.
- A program with change / create checks run by a user with change / create authorizations costs 2 cents each time.
- A program with delete checks run by a user with delete authorizations costs 5 cents each time.
- Any program with any checks run by a user with FROM --> TO ranges in authorizations costs 20 cents each time.
- A program with a display auth check run by a user with SAP_ALL costs 100 cents each time.
- etc...
This way, developers will add as many appropriate checks to their code so that it generates revenue from the application. Business process owners will try to restrict the authority-checks to only those really needed and will restict authorizations as much as possible to exact values when testing their roles.
Would work like a charm... but I'm sure there is a catch somewhere...
Cheers,
Julius
Edited by: Julius Bussche on Apr 24, 2011 12:07 AM

Remote Monitoring Latest Best Practice Architecture

Hi guys,
I've developed very few remote monitoring systems in the past. One of them was using a PXI RT and the rest are cRIO. The approach and architecture were based from some of the things I've read from ni.com and this forum. In the process, there were much difficulties and some extensive troubleshooting exercises that I need to do. The results, while the system work and meet the user's requirements, it didn't meet my own expectation. I was hoping that the system can be expanded (adding more cRIO or PXI) with much ease and little or no re-programming effort. Anyway, 2-3 years have passed and opportunities with similar requirements has emerged. So, I would like to get started to think about the architecture at an early stage (ie. now).
In my past systems, I've used Shared Variables (SV) a lot - and it gave much much headache too. Some of the troubles I had were:
1. I can't decide whether to lump all SV in one library and host them in one system, or to separate them into various libraries and systems... neither do I know what's the best approach, as I've read too many 'suggestions' and 'advices',
2. Some of the SV are from custom control and the control is type-def. When running the VI in RT with these SV in development platform, everything works smoothly but when I compiled and deploy, the program didn't run. After extensive troubleshooting, I found out that this had something to do with these SV - because when I removed the type-def from the custom controls and recreate my SV, everything worked fine. I suspect this may have something to do with how I deploy but after I tried several approach, the problem still persist.
3. The best and most common of all is unstable connectivity - it work today but that doesn't guarantee it will work tomorrow. When the host PC changes, the same problems resurfaced again. I read somewhere that I need to read or interface with the .alias file but this work some times and other times, the same problem persist.
Attached is the most common architecture that I've used. I would like to move away from SV as much as possible. If the application is 1:1, there's no problem as I can easily use TCP/IP & Network Stream. However, my doubts and headache comes when the RT:Host communication is either 1:N, N:N or N:1. I've read in ni.com and found out that there are various new approach to this, such as AMC (derivated from UDP), Web Services (or was it HTTP).
I really appreciate it if you guys share your thoughts and advices here, please?
Shazlan
Attachments:
Remote Mon Sys - Arch.pdf ‏27 KB

Nick,
I was not talking about the mgmt0 interface. The vlan that you are testing will have a link blocked between the two 3750 port-channel if the root is on the nexus vPC pair.
Logically your topology is like this:
| |
| Nexus Pair |
3750-1-----------------------3750-2
Since you have this triangle setup one of the links will be in blocking state for any vlan configured on these devices.
When you are talking about vPC and L3 are you talking about L3 routing protocols or just intervaln routing.
Intervlan routing is fine. Running L3 routing protocols over the peer-link and forming an adjaceny with an router upstream using L2 links is not recommended. Teh following link should give you an idea about what I am talking here:
http://bradhedlund.com/2010/12/16/routing-over-nexus-7000-vpc-peer-link-yes-and-no/
HSRP is fine.
As mentioned tracking feature purpose is to avoid block hole of traffic. It completely depends on your network setup. Don't think you would be needing to track all the interfaces.
JayaKrishna

Best options for wireless security

I have an Aironet 1040 access device, no controller. I have an LDAP server with radius in front to allow for username and password authentication(using MS CHAPv2) with mandatory WEP and PEAP.
I was wondering what the strongest security option is that allows me to retain the username and password authentication. The current setup functions but leaves much to be desired.

ill just add. Make sure you use somethin other then your ID for the outter ID becuase this is sent in the clear and can be sniffed. To prevent a man in the middle I would also vaidlate the certificate with PEAP.
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Office Web Apps - Best Practice for App Pool Security Account?

Guys,
I am finalising my testing of Office Web Apps, and ready to move onto deploying it to my live farm.
Generally speaking, I put service applications in their own application pool.
Obviously by doing so this has an overhead on memory and processing, however generally speaking it is best practice from a security perspective when using separate accounts.
I have to create 3 new service applications in order to deploy Office Web Apps, in my test environment these are using the Default SharePoint app pool.
Should I create one application pool for all my office web apps with a fresh service account, or does it make no odds from a security perspective to run them in the default app pool?
Cheers,
Conrad
Conrad Goodman MCITP SA / MCTS: WSS3.0 + MOSS2007

i run my OWA under it's own service account (spOWA) and use only one app pool. Just remember that if you go this route, "When
you create a new application pool, you can specify a security account used by the application pool to be either a predefined Network Service account or a managed account. The account must have db_datareader, db_datawriter, and execute permissions for the content
databases and the SharePoint configuration database, and be assigned to the db_owner role for the content databases." (http://technet.microsoft.com/en-us/library/ff431687.aspx)

Best practice architecture Wireless security

Similar Messages

Maybe you are looking for