RRM Question - should I turn it on?

Question

Hi community,
I used to work a lot with Cisco WLAN controllers. The last software I really tested was the last 4.2 release. But I still have a question regarding RRM, nobody was able to answer. Maybe some of you guys know it:
I'm never completely sure if I should take the risk of enabling RRM. I always set the channel and transmit power at fixed values. Here is why:
DCA (Dynamic Channel Assignment):
In theory, when an AP performs the RRM algorithm (default: every 10 minutes), and decides to switch the channel, how should an associated client know, that the AP plans to switch the channel. For the client point of view, it's like shutting down its AP, when the AP switches the channel.
With the latest Intel drivers, I recognized a connectivity loss of 5 - 15 seconds, until the client associates to another AP, or the AP which switched the channel.
The client cannot prepare for the roaming (channel changing) process. In the regulatory domain of ETSI (Europe), we have to use an altered standard for 802.11a (802.11h), which introduced DFS (Dynamic Frequency Selection). Within this process, the AP has to change its channel, if it recognized radar in the 5 GHz band.
802.11h has some flags to inform the 802.11h capable clients, that the AP plans to switch the channel - so the clients have the chance to prepare for this event (roam).
Due to the connectivity loss for clients within DCA, I switched off that feature.
Did someone experience the same? Or is my theory totally bugged?
TPC (Transmit Power Control):
The only thing that concerns me, is when I attach something different than the standard 2,2dBi dipole antenna. When doing so, I am not allowed to transmit at 17dBm.
How does the AP know, that it isn't allowed to use the power value of 1 if a 6dBi antenna is attached? Does the antenna gain (0,5 x dBi) field in the AP settings work?
I never found something on CCO, stating this.
Again: Did someone experience the same? Or is my theory totally bugged?
Thank you for your help. I'm looking forward to this discussion :-)
Johannes

Answer 1

Hi.
Am 27.03.2015 um 13:17 schrieb Kirk White:
> I have updated my GroupWise system and questioning should I turn on SSL. It's
> my understanding the GroupWise has it's own encryption from client to server and
> server to server. Especially lately knowing that SSL has it's own set of
> security issues. So why would I want to turn this on?
It really boils down to what type of potential attacks you expect and
what it's ramifications would be.
You're right, Groupwise is encrypted end to end (except internet email
of course) by default. But that's not a documented, open encryption, and
nobody really knows how secure it is. It's most certainly secure enough
to stop an amateur hacker or someone just taking an occasion.
So you would want SSL (on top of it, BTW!), if that's not good enough
for you, and you want a known, open, documented encryption.
> If I were to turn this on, should I be using a commercial certificate and if so
> can it be a wildcard certificate?
It really doesn't matter either way, from a security POV. The
certificates aren't truly enforced (except by the user, which you can't
trust usually), so a man in the middle attack will almost always be
possible, unless you train your users not to click away certificate
warnings. Good luck with that....
And of course, you can still import the self signed certificate into the
client beforehand when you initially install it.
CU,
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de