tailieunhanh - how to cheat at securing a wireless network phần 5

Để có những câu hỏi của bạn về chương này trả lời của tác giả, trình duyệt / giải pháp và click vào hình thức "Ask Tác giả".Nếu tôi cho phép WEP hoặc WPA, sẽ không đủ để bảo vệ mạng không dây của tôi? A: số Mặc dù đó là một khởi đầu tốt và thường được thực hiện, | 164 Chapter 5 Wireless LAN VLANs Figure Per-VLAN Filters As shown in Figure radio interface 0 has been split into and sub-interfaces in which unique access groups 101 and 102 have been dot . in the interface represents a sub-interface. Sub-interfaces are used to accomplish multiple VLAN configurations with unique policies such as filters. According to the drawing the Student group is bound to the interface with access list 101 which is only permitting HTTP access to be sent to the wired network from the Student wireless VLAN. The Teacher group with filter list 102 is allowed to access the World Wide Web WWW mail and the File Transfer Protocol FTP on the wired network. Per-VLAN QOS QOS policies can be applied on a per-VLAN basis. For example you may want to give a higher priority to the wireless IP phone s traffic VLAN than to the student VLAN. VoIP may not work properly during congestion therefore it is important to prioritize it. Or you may want to prioritize teachers communication over students or guests when an access point becomes can specify different QOS policies on a per-VLAN basis where different groups are mapped. Wireless LAN VLANs Chapter 5 165 Per-VLAN Authentication and Encryption Each VLAN can have its own authentication and encryption can support a guest network for your students without an authentication or WEP encryption policy while at the same time use Cisco EAP authentication with WEP TKIP policy for teachers. Also your PDA devices may not support the same authentication policy as the teachers and will require a compatible policy of its own. Just like filters and QOS these settings are configured on per sub-interface VLAN basis. If you need to support two different groups that share identical authentication types but require different restrictions on the wired network you need a way to prevent the wireless user from simply changing its SSID in order to be mapped into the .