III. Wireless LAN

Before You Begin

When installing any new network configuration, planning the network design and considering the implications of those decisions, will aid with support and usage after the installation. The features available on DrayTek VigorAP access points such as 802.1X authentication, while beneficial in some uses and network types, may not be ideal to use in all scenarios.

As an example; this network design will utilise 802.1X authentication, which allows wireless clients to authenticate with a username and password. This can speed up the hand-off when moving between two access points, but setting up wireless clients to access this type of network  has additional steps compared to a Pre-Shared-Key (WPA2/PSK) security implementation.

When users connect to a DrayTek Vigor network with 802.1X authentication, their wireless client will need to be aware of these settings:

• Phase 1 / EAP Method: PEAP
• Phase 2: MS-CHAPv2
• CA Certificate / Certificate Validation: Not enabled / Do Not Validate

Many wireless clients will be automatically aware of this but the variation between wireless clients may have implications for supporting a 802.1X authenticated wireless network, if unexpected users such as with a guest wireless network, will be connecting.

Because of this, this setup example utilises 802.1X authentication for the Internal wireless network, where devices are less likely to change and the configuration for each device type would be well known.

The Guest wireless network will be using a standard Pre-Shared-Key (WPA2/PSK) password implementation to simplify the connection process for guest users.

Network Design

This network design example will configure the DrayTek Vigor router and VigorAP access points to operate with two separate networks, with a Guest wireless network kept separate from the internal wired and wireless network.

The 2.4GHz and 5GHz wireless interfaces are configured with the same SSID and security settings to allow dual-band wireless clients to connect to either network.

Band Steering is enabled to guide clients which are 5GHz capable onto the 5GHz band where possible to ensure good usage of the 5GHz band.

Using 802.1X Authentication

The Internal wireless network will use 802.1X authentication for username and password authentication and to allow the usage of the VigorAP Access Point's Fast Mobility features. This can speed up the re-authentication process when moving from one VigorAP to another; DrayTek VigorAP access points can use Pre-Authentication and PMK Caching to share details of authenticated clients. The result is that when a wireless client moves from one access point to another, the handshake process of WPA2/802.1X security needs to perform less steps to authenticate this client.

Using 802.1X authentication requires a RADIUS server to perform the authentication, which is available on the DrayTek Vigor router and will be used in this setup example for the VigorAP access points to provide RADIUS / 802.1X authentication.

This guide demonstrates how to connect Windows 7's built-in wireless client to a wireless network that uses 802.1X authentication:

Connecting a Windows PC to a wireless network with 802.1X / RADIUS security

Other operating systems and wireless clients are typically easier to connect and will prompt to check the network's certificate, which is linked to the DrayTek Vigor router's certificate for SSL & HTTPS management.

Moving Between VigorAP Access Points

When a wireless client moves between two VigorAP Access Points that have the same credentials, the act of disassociating from one access point and re-associating with the next is typically called "Roaming". This is controlled by the wireless client and will depend upon the "Roaming Aggressiveness" and behaviour of the wireless client's network driver / device.

With some wireless clients, the connection may remain with the now more distant VigorAP instead of moving to the closer VigorAP.

DrayTek VigorAP Access Points can help with this situation through the use of AP-Assisted Mobility, which intelligently disassociates wireless clients that have a low signal strength to one VigorAP and better signal strength with another VigorAP.

Using 802.1X does assist with the delay in moving between access points but this does not aid with the wireless client's behaviour of moving between access points.

RADIUS Server Setup

1. Using the Vigor Router as a RADIUS Server

DrayTek Vigor routers that support Central AP Management each support operating as a RADIUS server, which can be used as a central point both to manage and have VigorAP Access Points authenticate users through it, instead of requiring a separate server for RADIUS authentication. The user accounts are managed through the router's User Management section, which allows up to 198 user profiles.

The router's RADIUS server allows for RADIUS user authentication, which is used for Router > AP communication of user credentials, but also allows 802.1X user authentication, which is used for the router's own wireless and wired interface's 802.1X authentication. This is explained in greater detail here.

To enable the RADIUS server on the router, go to [Applications] > [RADIUS/TACACS+] and click on the Internal RADIUS tab:

• Enable the server
• Authentication Port - 1812, which is the default port used for RADIUS authentication
• RADIUS Client Access List - tick Enable for an index
  • Shared Secret - Enter a password which will be used by both the RADIUS server (router) and client (access points).
  • Network Address - Enter a network / IP subnet range that would be allowed to authenticate with it, for instance if the devices are all within the 192.168.1.x network, enter 192.168.1.0 with a subnet mask of 255.255.255.0. To enable client access from a single device, use a /32 subnet mask, i.e. to allow only 192.168.1.64, enter 192.168.1.64 as the IP address and 255.255.255.255 as the subnet mask.
• Authentication
  • Method - PAP/CHAP/MS-CHAP/MS-CHAPv2
  • 802.1X Method - tick Support 802.1X Method. This particular option only needs to be enabled if the router's WiFi or wired interfaces are using 802.1X authentication
• If there are existing User Management accounts configured on the router, they can be moved into the Authentication List to allow those users to authenticate through RADIUS.

Make a note of the 802.1X method listed, which is:

• Phase 1: PEAP
• Phase 2: MS-CHAPv2

Some wireless 802.1X clients such as Android devices may provide a number of different options for authenticating with an 802.1X network, select these options for phase 1 and 2 to connect successfully.

Click OK and the router will prompt to restart to apply the change and enable the RADIUS server:

Click OK again to reboot the router.

Configuring User Accounts for use with RADIUS

The individual user accounts used for RADIUS authentication are configured in the [User Management] > [User Profile] section. To configure an account, go to that section and click on an un-used account. The "admin" and "Dial-In User" accounts are used by the router and cannot be altered.

In this example, Profile 3 will be used, click on the 3. link modify that profile:

In the User Profile, there are three sections:

1. Common Settings - The username and password for the account. Tick "Enable" to use the account
2. Web login Setting - These settings can be ignored, they are only used when the router's firewall is configured to control access with User Management, which is not covered / used in this guide
3. Internal Services - Tick the "Internal RADIUS" and "Local 802.1X" options for the user account

Click OK to save the profile and continue.

If there are user profiles already configured on the router that need to be set to allow usage with RADIUS authentication, this can be quickly set through the [System Maintenance] > [Internal Service User List], which lists the user accounts configured on the router with check-boxes for the services that can authenticate with those credentials. In this example, the existing user accounts are configured to allow RADIUS authentication.

When making changes, click OK to save and apply the changes made.