SECURITY BUG : You're sure your WPA is on ? You may be very wrong !

Question

Here is the problem.
Some networks created on AirPort Extreme base station are wide open with no security on EVEN IF THE AIRPORT UTILITY SAYS SO !
I hard rest my new AirPort Extreme, went throught the setup wizard to create a closed network with WPA2 Personal on. I checked the settings once the base was restarted but, to my surprise, I COULD CONNECT TO MY NETWORK WITHOUT PASSWORD, from my PDA and my neighbourg laptop. The network wasn't even closed !! I double checked the AirPort utility : it said that WPA was ON which is definitely NOT true.
To confirm that, I choose to extend my network with my other base (Express). No problem except for the fact that, to access the Extreme base, the Express setting was : "open network, no security" (in preferred network, network preferences panel)
MY ADVICE : don't trust what the AirPort utility says about security. It MAY be very wrong. You have to check if it is on or off using another device (Wifi PDA, a friend's laptop, whatever)
Others users here found the same issue. I'm definitely not alone here. To me, this is a serious bug requiring a firmware update. Reply to this post if you have a similar problem.
Thanks
Gregory
Toronto, Canada

Answer 1

Hey, me again...
I found the reason of my problem. This is indeed a problem with the AirPort utility. More an interface problem, let's say.
The key is that the AirPort utility can be confusing when extending your network. And what can happens is that you end up with 2 NETWORKS with the SAME NAME, 1 with WPA and 1 with no security. And because of the default setting of the network preferences panel, you will automatically connect to the open one if anything happens on the WPA one. That is what happened to me. When extending the network of my main new Extreme, I somehow got an open network with the same name on my Express. And because this one was always plugged during my tests & hard resets of the Extreme, I always got connected to the open network, by default. So the AirPort was not completely wrong after all.
KEY POINTS to avoid that and have a clean nice new WPA/WPA2 network :
- Hard reset and configure the first base that will be your main one (WDS Main or simply the one connected to the Internet for a non-WDS network)
- Be sure all the others bases are unplugged... Just to be sure
- To set up your network on this first base, in the Airport Utility, don't use the wizard by clicking on "Continue". It is quite bad. Simply double-click on your base station with the weird name : it will open the settings page. Go to Wireless and create your new network with all appropriate options (WPA/WPA2 for example)
- Don't use the "Closed Network" option so far. You'd better wait for your network to be completely extended, with all your bases. Or you will be in pain in the process of adding new bases !! For example, if you want to extend your WDS closed network, you cannot do it with the AirPort Utility Wizard because it will not show it in the list of available networks (and this list does NOT propose the "Other..." option where you can type the name of your network...)
- Still before adding any other extensions base, if you want to set up a WDS network, enter ALL the AirPort IDs of your other "remote" bases now, in the WDS tab.
- In general, don't use the Wizard when it is no necessary. You can do quite everything directly from the Settings page of your base. EXCEPT ONE ! To add a WDS Remote, USE THE WIZARD ! It looks like the complexe procedure to "register" a remote on a WDS main is not complete you enter the settings manually on your remote. And, be carefull, when adding a WDS remote, the AirPort utility will ask you several passwords. The first one is to connect to your (not closed) main network. But after, to complete the registration of your remote on the main, the utility asks for a password. IT IS THE MAIN Base Station password, NOT the network password (the prompt window is so confusing).
- When you're done with all your stations one by one, check that every one has a different IP ! I know, weird, but in my previous problem with 2 networks with the same name, I noticed that both stations had 10.0.1.1 address. at the same time. A good indication that you have 2 networks right ?
- Finally, go to your Network preferences panel, Airport section. Switch automatic to preferred networks and just clean up the mess here Just keep your network and check the level of security.
So AT LAST, here is my situation, in my tiny appartment :
- 1 Extreme connected on my cable modem, WDS Main, closed WPA2 network, 25% power transmition, wireless clients allowed.
- 1 Express plugged in my bedroom (3 meters away...), WDS Remote, 25% power transmition and NO wireless client allowed (so my MacBook Pro connects ONLY on the Extreme base)
- 1 HP Photosmart C5180 Ethernet printer connected on my Express with a ethernet cable.
All lights green...