Increasing wireless security access to TC

Hi again,
My TC is currently on WPA/WPA2 Personal with 8 characters password. How can I increase wireless security - like adding MAC (or better way of doing it)? I am not expert in this so please advice step by step.
Thanks in advance.

Welcome to the Discussions forums,
Have you tried setting the workgroup name in AirPort Utility? Select Manual Setup, then navigate to Disks > File Sharing and fill in the workgroup name of the XP machine. Make sure it's the exact name you've entered in your network settings of the XP laptop. Then you need to add the TC's IP to the list of trusted networks/zones in any firewalls you have installed on your XP machine. I had to add 10.0.1.1 to my list of trusted networks in my McAfee firewall for my machine to recognize devices connected to my TC (including other computers).
Second, you need to install Bonjour for Windows in order to install the printer on your XP laptop.
Also, if you would rather not go through the workgroup setup, there is a program called AirPort Base Station Agent (included in AirPort Utility for Windows) that loads into your taskbar and mounts and maps the TC's HDD automatically for you.

Similar Messages

WRT54GS2 as second router to increase wireless range

All-
I have a primary Linksys router, WRT110 that works great. I am trying to set up a WRT54GS2 as a downstairs wireless to increase range. I have a CAT5 running from the WRT110 to the WRT54GS2 and is connected from LAN to LAN and have them configured as follows:
Primary WRT110:
I.P: 192.168.1.1
Subnet 255.255.255.0
Start I.P: 10 to 50
DHCP enabled
Wireless mode : mixed
Band: Auto 20/40mz
WPA2 security
=================
WRT54GS2is configured as follows:
I.P: 192.168.1.2
Subnet 255.255.255.0
DHCP Disabled
Advanced Routing / NAT:Enabled
Wireless network = Mixed
Channel = 6 = 2.437mz
============
On both routers I have the same SSID and same security key.
On the Status page of the WRT54GS2 I have the following:
Login Type: DHCP
I.P and Subnet Mask are blank.
Any ideas where I erred? I've read quite a few posts relating to this and can't seem to find the problem.
Thanks!

Is the SSID broadcast enabled on both?
Is the device "within 15 feet" connected to the first router or second router? What happens if you switch off the wireless on that computer and then switch it on again?
What happens if you disable the wireless on the first router completely? (Wireless network mode to Off). Can you see the signal of the second router?
You could also use a network sniffer like Netstumbler http://www.netstumbler.com/downloads/ to scan for networks. It should show you the signals of both access points.
What are your full and exact Wireless and Wireless Security settings on both routers?

Open Wireless Security Questions

I am using a neighbor's wireless to access the internet and have turned on all the available security options in the Preferences Pane. After doing so, the Preferences Pane still states (at the top) that other computers on the network can access my computer. Why does it say this when all the security options are on?
Isn't the the firewall supposed to keep Everyone out of my computer?
Is it safe for me to use a credit card when I am using this network?

Access to https site for e-commerce uses strong encryption that would take the NSA many years to break. So unless you are are a known terrorist, you can be fairly sure that no one, not even Dick Cheney, will expend the resources to snoop on your personal business. With the constantly increasing power of computers, however, codes that were secure five years ago may be insecure five years from now.
E-mail is and has always been quite insecure on the other hand, no matter who your ISP is. An e-mail message probably passes through six to eight computers to get from you to its recipient, and any of those computers can see everything you wrote. In fact, the White House wants the NSA to scan the e-mail of millions of Americans to catch terrorists dumb enough to plan attacks openly.
If you are paranoid about this, you can encrypt your messages yourself with software like PGP, freeware downloadable from the Web. That means that your recipients have to be able to decrypt a message somehow to read it, but then you somehow have to send the key to them securely. To be really safe of course, you also have to change your keys about once a week. So, decide your own tolerance for inconvenience.
Computer security is not hard, but it requires paying attention to details. Fortunately, you put yourself a few steps ahead of 90 percent of people on the Web by not buying a Windows computer. Apple is not 100 percent secure, but it is in fact designed so that you can more easily make the right choices.
One right choice is for your friend to turn on WPA for his wireless router. To get on the network for the first time, you then have know its name (SSID) and the password. After that, your iBook will remember and connect you automatically.
Watch out for open hotspots, whether they are free or charge you an hourly fee. These send information back and forth without encryption, so that the guy next to you in Starbucks can pick up all your communications with the right software, downloadable from the Web of course.
Happy computing!

Wireless Internet Access (Cisco IP NGN or Cisco Wireless Mesh Networkin)??

Dear Cisco Wireless Team
Please educate us on where to start, or the CISCO product we might need to purchase
We are trying to branch out a new Internet wireless access and wireless phone service business in our company, and presently looking for the right Cisco product solution to purchase to enable us offer this service in LAGOS, NIGERIA.
The service will be rendered in Africa, the country NIGERIA, and the city LAGOS.
We would like to mount or install the product in Lagos, Nigeria.
As we are new to this kind of service. We would appreciate if the Cisco wireless team can work with us in pointing or directing on the right product to purchase and what are required. We understand the Cisco Wireless Mesh Networking Solution, Cisco IP Generation Network, Cisco 12416 or 7600 Series Router might be the right products to purchase, but we are not sure on what needed or what are required to meet our service need.
Possibly we would like to offer Wireless Internet Access to unlimited subscribers, and also Wireless or Mobile Phone service to unlimited subscribers in Nigeria.
Anticipating your reply

I suppose Cisco Wireless Mesh Networking would be a good choice.The Cisco mesh architecture makes it easy to scale coverage as capacity needs dictate, including increasing access point density; adding wired connections, controllers, and radios; and using dual high-powered, high-sensitive radios and a selection of high-gain antennas.Refer the document for IP NGN in the following URL http://www.cisco.com/en/US/netsol/ns537/networking_solutions_solution_category.html

Restrict wireless internet access on certain periods of time

Hello,
We need help on setting up a network with some restrictions for the attached clients.
We're quite new at setting up a network at this size.
Used devices:
1x SRP 540 router
1x SG 300-10P managed switch
4x AP 541N accesspoint
What we want to do:
1. Around 100 laptops and desktop computers need wireless internet access, but some of them on limited times during the day.
2. Not all wireless devices are allowed on using the wireless network.
3. There are also wired desktops that don't need restrictions.
4. We need the possibility to restrict most of the wireless devices to access certain websites or use certain applications on those computers to use internet access during the times that the computers are allowed to access the internet.
5. We want to restrict the clients for using torrents or other possibilities of downloading illegal content.
What we were able to do:
1. The accesspoints (AP 541N) are clustered to achieve 1 large wireless network.
2. Only mac-adresses that are listed in the accesspoints are capable of using the wireless network. Other mac-adresses are not allowed to use the accesspoints.
What we tried already:
1. adding the mac-adresses for the accesspoints to the list of "internet access policy" in the router. Internet access seemed still possible during periods the access wasn't supposed to be possible.
2. adding the mac-adresses from all clients in this internet access policy seemed useless. Only 10 Internet Access Policies seem to be possible to program. 8 mac-adresses per policy. Knowing there are (at least) two policies needed to restrict a group of 8 macs to access the internet in 24 hours (because blocking the internet from f.e. 22u in the evening to 6 in the morning is not possible because 6 is smaller than 22 - or 10PM).
Besides, after blocking internet access, we need also to write policies in blocking some websites or keywords.
Thanks already for your guidelines.
Wim

what about the thoughts of radius for authentication which is connected to active directory for your wireless users. Then have those people you must limit access too during the day in their own security group that's only allowed to login to the domain during certain times of the day.
To limit sites or what they can do on the Internet will require a separate solution for content/URL filtering. Then you can make policies and apply to your security groups in active directory block by category, keyword, and so on.
This is all great assuming you can get these clients into AD.
Just a quick thought, hope it helps.
_dschlicht
Sent from Cisco Technical Support iPad App

Wrt160nv2 wireless security help

Hello I'm new to this forum and had some questions regarding the wireless security settings on this router (WRT160Nv2) I have the security mode set to: WPA2 and what I need to know is which Encryption is better AES or the other setting which is TKIS or AES shouldint it be just TKIS? Any info would be great thanks still trying to figure out the router...

AES offers a higher level of encryption than TKIP, or "TKIP or AES".
Here are my other tips for setting up wireless security:
To set up wireless security, you must use a computer that is wired to the router.
Where to find the router settings: The router's login password is usually on one of the "Administration" pages. The other settings are all found in the "Wireless" or the "Security" section of the router's setup pages, located at 192.168.1.1
First, give your router a unique SSID. Don't use "linksys".
Make sure "SSID Broadcast" is set to "enabled".
Next, leave the router at its default wireless settings (except for the unique SSID), and then use your pc to connect wirelessly to the router. Test your wireless Internet connection and make sure it is working correctly. You must have a properly working wireless connection before setting up wireless security.
To implement wireless security, you need to do one step at a time, then verify that you can still connect your wireless computer to the router.
Next, encrypt your wireless system using the highest level of encryption that all of your wireless devices will support. Common encryption methods are:
WEP - poor (see note below)
WPA (sometimes called PSK, or WPA with TKIP) - good
WPA2 (sometimes called PSK2, or WPA with AES) - best
WPA and WPA2 sometimes come in versions of "personal", "enterprise" or "radius". Most home users should use "personal". Also, if you have a choice between AES and TKIP, and your wireless equipment is capable of both, choose AES. With any encryption method, you will need to supply a key (sometimes called a "password" ).
The wireless devices (computers, printers, etc.) that you have will need to be set up with the SSID, encryption method, and key that matches what you entered in the router.
Retest your system and verify that your wireless Internet connection is still working correctly.
And don't forget to give your router a new login password.
Picking Passwords (keys): You should never use a dictionary word as a password. If you use a dictionary word as a password, even WPA2 can be cracked in a few minutes. When you pick your login password and encryption key (or password or passphrase) you should use a random combination of capital letters, small letters, and numbers, but no spaces. A login password, should be 12 characters or more. WPA and WPA2 passwords should be at least 24 characters. Note: Your key, password, or passphrase must not have any spaces in it.
Most home users should have their routers set so that "remote management" of the router is disabled. If you must have this option enabled, then your login password must be increased to a minumum of 24 random characters.
One additional issue is that Windows XP requires a patch to run WPA2. The patch is located in SP3, so you will need SP3 to run WPA2.
Note:
WEP is no longer recommended. The FBI has demonstrated that WEP can be cracked in just a few minutes using software tools that are readily available over the Internet. Even a long random character password will not protect you with WEP. You should be using WPA or preferably WPA2 encryption.
Message Edited by toomanydonuts on 06-25-2009 03:43 AM

Trying to secure my wireless security

I am trying to secure my wireless security and I keep getting the following error message "Execption has been thrown by the target of an invocation" can someone please help me with this? Thanks

yup. we need more details as to what's the router you're using, what settings you've done (or if you are trying to access the GUI of the router you're using), etc. so we could help you.
"Don't fix it if it ain't broken."

Facetime works with wireless security disabled, dropped otherwise

On a D-Link DIR-615 wireless router, configured as an access point.
Security mode: WPA-Personal
WPA mode: WPA2 Only
Cipher type:AES
I tried inserting a 1.3 Mb file, to no avail.
I have an iPad mini with OS 8.1.2
Please let me know if more information is req'd.
To have facetime with my son and grandchildren I have change the security mode to 'none' during the session! Really? If I do not, we have about a one minute session that is dropped.
Any ideas will be explored!
Thanks in advance,
Grandpa Pete

Three answers:
1-The router is an access point as it is a 'slave' to the wired router. The wired router assigns the ip addresses and is connected to the Comcast-Arris modem.
2-Security mode options: None, WEP, WPA-Personal, WPA-Enterprise and
the password options are Auto (WPA or WPA2), WPA2 Only, WPA only. I chose the WPA2 only as some other place I'd seen something about a problem with the TKIP cipher. I'm a novice, though. What you're suggesting makes sense and I'll try to go to WPA only.
3-I tried inserting a file showing the wireless router setup page, via a screen shot. I can't even insert a half Mb file, for whatever reason. The error page says to keep it to less than 2 Mb.
-As above, the wireless device must be an access point. It's in the living room, where wireless devices are mostly used. The wired router is in one corner of the house, with the main winxp pc.
-I can't make the wireless router security mode WPA2, so I used WPA for everything and see if it works for the next facetime session. All the other wireless devices are now functional.
-I'm not understanding the third option. Is that for my tower, each wireless device?
(No, winxp is not a joke. I use it as my main pc os and have no need to replace it. I'm posting my problem in this forum because we now have an apple product, the mini iPad, and I'd sure like to use it for the facetime with the wireless security setting on during the session. So far, it's REQUIRED to turn the wireless security off to keep the facetime session longer than about 60 seconds.)
Thank you very much for your time! I really appreciate it. As a novice, routers are still mysterious to me, what with all the settings inside of them.
Grandpa Pete
btw: my question is not solved. Not at all! I still believe I have an unsolved question. I don't know why the green box and checkmarks exist! Did I miss something?

Wireless guest access

Hi Guys, I have a wireless requirement from a customer and the customer is looking for the below: 1. Wireless guest access that requires user to input email into the captive portal. But the email address must be verified that it contains certain selected domain names (e.g. example.com or example.org). Any other domain names will be rejected. 2. Customer is looking to add their own logo and change the formatting of the captive portal. Questions: 1. For email verification, does this feature come straight from the WLC standalone box or must ISE be purchased? 2. If the WLC is able to do this without ISE, any online guides that is able to do this? 3. For security reasons, am I able to limit the number of concurrent users using this captive portal? 4. How do a configure the age-out for each connected users after they have successfully logged into the captive portal? 5. Can I customize the captive portal page on the WLC and how do I go about doing it?

Hi Mohanak,
It looks like the formatting ran out. Anyway, not sure if we are on the right topic here but let me get this straight. Customer has a Cisco 2504 Wireless LAN Controller. So, they would like to achieve the below features:
1. Wireless guest access that requires user to input email into the captive portal. But the email address must be verified that it contains certain selected domain names (e.g. example.com or example.org). Any other domain names will be rejected.
2. Customer is looking to add their own logo and change the formatting of the captive portal.
So, some of the questions I have are:
Questions:
1. There is a configuration on the WLC that allows guest users to login using email verification only. Does this feature come straight from the WLC standalone box or must ISE be purchased.
2. If the WLC is able to do this without ISE, is the WLC able to check if the inputted field is a valid email? And can I configure in such a way a particular domain is allowed? (e.g. example.com is permitted but example.org and anything else is reject).
3. For security reasons, am I able to limit the number of concurrent users using this captive portal?
4. How do a configure the age-out for each connected users after they have successfully logged into the captive portal?
5. Can I customize the captive portal page on the WLC and how do I go about doing it?

Wireless Guest Access with 802.1X (PEAP/MSCHAPv2) and ISE?

Hi,
I have a setup based on WLC 5508, Catalyst 3750-X and AP3600i.
The WLCs are running 7.3 and ISE is 1.1.1
I'm trying to setup wireless guest access, where the guests connect to a SSID with 802.1X using PEAP/MSCHAPv2.
They should receive their username/password either from a sponsor directly (corporate AD user which prints the credentials) or through a SMS.
The credentials will be created by the sponsor, using the sponsor portal on the ISE.
Now to the questions:
Is it correct that the foreign WLC (i.e. the WLC within the internal corporate network), should be set to no L2 and L3 security on the guest WLAN, to avoid having the foreign WLC contact the ISE and all traffic be forwarded directly to the anchor WLC?
Is it correct that the anchor WLC (i.e. the WLC in the DMZ), should be configured with 802.1X/WPA2 L2 security and the ISE servers as the RADIUS servers on the guest WLAN, to ensure that the client is correctly authenticated/authorized by the ISE?
When a guest logs on, how can I ensure that only one device (MAC address) is allowed per user?
As it is now, a guest is able to log on with (I assume) an unlimited number of devices, using the credentials they have received.
Thankyou very much :-)
Best Regards,
Niels J. Larsen

Hi,
I have a setup based on WLC 5508, Catalyst 3750-X and AP3600i.
The WLCs are running 7.3 and ISE is 1.1.1
I'm trying to setup wireless guest access, where the guests connect to a SSID with 802.1X using PEAP/MSCHAPv2.
They should receive their username/password either from a sponsor directly (corporate AD user which prints the credentials) or through a SMS.
The credentials will be created by the sponsor, using the sponsor portal on the ISE.
Now to the questions:
Is it correct that the foreign WLC (i.e. the WLC within the internal corporate network), should be set to no L2 and L3 security on the guest WLAN, to avoid having the foreign WLC contact the ISE and all traffic be forwarded directly to the anchor WLC?
Is it correct that the anchor WLC (i.e. the WLC in the DMZ), should be configured with 802.1X/WPA2 L2 security and the ISE servers as the RADIUS servers on the guest WLAN, to ensure that the client is correctly authenticated/authorized by the ISE?
When a guest logs on, how can I ensure that only one device (MAC address) is allowed per user?
As it is now, a guest is able to log on with (I assume) an unlimited number of devices, using the credentials they have received.
Thankyou very much :-)
Best Regards,
Niels J. Larsen

Wireless Security & Methods

Hi,
I've some experience on WLAN Networks, but I would like to have your opinion around Wireless Security implemenations.
We have several sites where we have some Cisco Access points running IOS. We are currently doing WEP 128b, with Mac-Authentication against a central ACS Server.
But having fixed WEP, and mac registrations is not very practical.
Do you know about any method to have authentication against Active Directory (passing through the Cisco ACS), and Dynamic WEP Keys ?
Any recommendation is welcome.
Of course with this we would like to bring up our level of security.
Thanks a lot for all,
Best Regards,
Jorge

An ACS server can be used to do authentication based on user logon to AD.
So it would only require a single login if your wireless adapter supports it.
You would just need to enable the wireless vlan to do 802.1x (EAP-FAST) authentication.
This document would answer some of your questions.
http://www.cisco.com/en/US/netsol/ns339/ns395/ns176/ns178/netqa09186a00802030dc.html

Wireless Security & Authentication methods

Hi,
I've some experience on WLAN Networks, but I would like to have your opinion around Wireless Security implemenations.
We have several sites where we have some Cisco Access points running IOS. We are currently doing WEP 128b, with Mac-Authentication against a central ACS Server.
But having fixed WEP, and mac registrations is not very practical.
Do you know about any method to have authentication against Active Directory (passing through the Cisco ACS), and Dynamic WEP Keys ?
Any recommendation is welcome.
Of course with this we would like to bring up our level of security.
Thanks a lot for all,
Best Regards,
Jorge

802.1x/EAP authentication is the most popular authentication method in wireless. The following documents explain how to configure EAP authentication.
http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801bd035.shtml
http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c0912.shtml
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00805e7a13.shtml

Wireless Security Solution

I have heard a lot of talk about Wireless Security. And have at least a working knowledge of the two possible solutions, VPN and EAP. However, how to choose the best possible solution? VPN is expensive and still leaves me vulnerable to Impersonation attacks. EAP is cheaper but nonetheless leaves me vulnerable to Brute Force attacks. Of course the chances of someone walking into our building(s) and stealing a laptop with VPN software on it are probably greater than any of the aforementioned threats. I guess what I'm looking for is a "voice from above" to guide me on which solution I can take to my superiors and say "This is what we are going to do" and why solution X is better than solution Y.
Thanks!
STU...

Stu,
VPN vs WLAN: To what degree do you want to geographically control access? If WLAN is
attractive because youre looking at a LAN bridging solution, then VPN is over-kill. But if the distances are great (connecting from home) WLAN is out. In WLAN terms how big is your proposed "cell" (800m) or is the reach of users measured in miles? I can share with you an outline of WAP security controls for WLAN if what youre leaning toward is a LAN-bridging solution. That should help you get your arms around security for a Cisco-centric WLAN solution. I do security 100% of the time, and I just finished due-diligence for WAP WLAN bridging.
-Mark

Problem with Cisco Secure Access Server 3.0

Hi All,
Please what is my problem? I use Cisco Secure Access Server Version 3.0 for Windows 2000/NT Servers to authenticate users on our wireless network. I however wish to assign monthly time limits to each user after which he/she will no longer have access until next month or the timer is reset. I tried this with the "User Usage Quota" under User setup. I set the Server to "Limit user to X hours of online time per Month" and enabled the "Use these settings" and also checked the box by the side of the option. I saved and restarted my server. Unfortunetly the settings did not work for all the users whose quotas I set.
What Am I doing wrong. Please assist.
Chafe

Do you have your AP's sending accounting data? If not, ACS has no way of knowing how long they've been online?
You can utilize your ACS logging to see what your accounting looks like to confirm whether you are receiving accounting packets or not?
HTH
Jeff

Wireless Security - DOES NOT WORK?

My problem: AEBS works fine UNLESS I use any Wireless Security. If I set security to WEP, WPA/WPA2 Personal, or WPA2 Personal then the following occurs:
-- the AEBS DOES NOT appear as a base station in AirPort Utility
-- the Wireless Network DOES appear as an available Wireless Connection in the Menu Bar
-- I CAN connect to the wireless network but no internet connection is available
-- I CANNOT alter settings of AEBS unless I connect through ethernet (or reset AEBS to factory default)
-- if I set Wireless Security to NONE then everything works fine
Here's my setup:
Airport Extreme Base Station:
-- Wireless Mode: Create a Wireless Network
-- Radio Mode: 802.11n (802.11 b/g compatible)
-- Channel: Automatic
-- Connection Sharing: Off (Bridge Mode) [I am connecting through a pre-existing router - only need the AEBS for 802.11n and disk sharing]
-- IPv6: Link-local only
MacBook Pro Core 2 Duo
-- AirPort Extreme Update 2007-001 installed
-- 802.11n enabler installed
Questions:
1. Any ideas on how to fix?
2. If this is a known bug - any idea how long until it is fixed? Am I expected to run without security until then (this is directed to Apple)?
3. Will a fix likely be via firmware update?
As a recent "switcher" so far I am majorly disappointed in this product.
Thanks for any insight.
MacBook Pro Mac OS X (10.4.8)

Sorry, I forgot to mention something else to try. Open Keychain Access, /Utilities/Keychain Access/, and delete the keychain for the wireless network. Then open System Preferences>Network and remove the wireless network from the Preferred networks list. Now try connecting again, you should be prompted for the wireless network password. Also, make sure that you are using the correct number of characters in your passwords. WEP doesn't seem to be picky about how many characters you use but WPA/WPA2 passwords must be between 8 and 63 ASCII characters.
Other than what I've mentioned above, sounds like you are setting everything up correctly and seeing as you have two Macs both exhibiting the same behaviour then I would definitely lay the blame squarely on the base station. If you're willing, the only other suggestion I have is to reset the base station to factory defaults, hold the reset button down for at least 5 seconds, and start again. Other than that, I would return it for exchange, if your willing to give another base station another chance.
Just so you know, my base station was set up in a matter of minutes and has worked flawlessly. So, they aren't all that bad.

Increasing wireless security access to TC

Similar Messages

Maybe you are looking for