Lab 7.3.5 Configuring Wireless Security

* Create a security plan for a home network.
* Configure the wireless access point (AP) portion of a multi-function device using security best practices.


Background / Preparation
A well-planned security implementation is critical to the safety of a wireless network. This lab goes over the steps that must be taken to ensure the safety of the network using the following scenario.

You have just purchased a Linksys WRT300N wireless router, and you want to set up a small network in your home. You selected this router because the IEEE 802.11n specification claims that it has 12 times the speed of an 802.11g and 4 times the range. Because the 802.11n uses 2.4 GHz, it is backward compatible with both the 802.11b and 802.11g and uses MIMO (multiple-in, multiple-out) technology.

You should enable security mechanisms before connecting your multi-function device to the Internet or any wired network. You should also change the default values provided, because they are well-known values that are easily obtainable on the Internet.

The following resources are required:

* Windows-based computer
* Linksys WRT300N
* Straight-through Ethernet cable


Step 1: Plan the security for your home network

1. List at least six security best practices that you should implement to secure your multi-function device and wireless network.

1) Kurangi kekuatan pancar antena WAP
2) Berikan security code
3) Aktifkan MAC address filter.
4) Ganti Password default
5) Disable Broadcast SSID
6) Disable DHCP Server

2. Describe what the security risk is for each item.

1) Kelemahan atau resikonya misalnya disebuah tempat usaha atau perusahaan maka semakin jauh titik akses dari akses point mengakibatkan kecepatan akses sangat terpengaruh atau bahkan tidak menjanjikan sama sekali.
2) Bagi orang yang tidak paham teknologi akan kebingungan dalam memberikan security code.
3) Jika seandainya MAC address seseorang client pernah diblokir pada suatu tempat, akan tetapi belum dibuka kembali maka tidak bisa digunakan pada tempat akses lain.
4) Jika password pada default diganti, akan susah mengetahui paswor yang baru jika tidak dikonfirmasikan terhadap teknisi.
5) Jika tidak diaktifkan kembali, maka titik access tidak dapat diditeksi oleh wireless adapter.
6) Jika di disabledkan maka hanya IP address yang telah diregisterkan yang bisa mengakses jaringan, sehingga jaringan tidak bersifat bebas layaknya wi-fi zone pada umumnya.

Step 2: Connect a computer to the multi-function device and log in to the web-based utility

1. Connect your computer (Ethernet NIC) to the multi-function device (port 1 on the Linksys WRT300N) by using a straight-through cable.
2. The default IP address of the Linksys WRT300N is 192.168.1.1, and the default subnet mask is 255.255.255.0. The computer and Linksys device must be on the same network to communicate with each other. Change the IP address of the computer to 192.168.1.2, and verify that the subnet mask is 255.255.255.0. Enter the internal address of the Linksys device (192.168.1.1) as the default gateway. Do this by clicking, Start > Control Panel > Network Connections. Right click on the wireless connection and choose Properties. Select the Internet Protocol (TCP/IP) and enter the addresses as shown below.
3. Open a web browser, such as Internet Explorer, Netscape, or Firefox and enter the default IP address of the Linksys device (192.168.1.1) into the address field and press Enter.
4. A screen appears, requesting your user name and password.



1. Leave the User name field blank and enter admin for the password. It is the default password on the Linksys device. Click OK. Remember that passwords are case-sensitive.
2. As you make the necessary changes on the Linksys device, click Save Settings on each screen to save the changes or click Cancel Changes to keep the default settings.


Step 4: Change the Linksys device password

a. The initial screen displayed is the Setup > Basic Setup screen.
b. Click the Administration tab. The Management tab is selected by default.
c. Type in a new password for the Linksys device, and then confirm the password. The new password must not be more than 32 characters and must not include any spaces. The password is required to access the Linksys device web-based utility and Setup Wizard.

4. The Web Utility Access via Wireless option is enabled by default. You may want to disable this feature to further increase security..
5. Click the Save Settings button to save the information.


NOTE: If you forget your password, you can reset the Linksys device to the factory defaults by pressing the RESET button for 5 seconds and then releasing it. The default password is admin.

Step 5: Configure the wireless security settings

1. Click the Wireless tab. The Basic Wireless Settings tab is selected by default. The Network Name is the SSID shared among all devices on your network. It must be identical for all devices in the wireless network. It is case-sensitive and must not be more than 32 characters.
2. Change the SSID from the default of linksys to a unique name. Record the name you have chosen:

Jawab:

3. Leave the Radio Band set to Auto. This allows your network to use all 802.11n, g, and b devices.
4. For SSID Broadcast, select the Disabled button to disable the SSID broadcast. Wireless clients survey the area for networks to associate with and will detect the SSID broadcast sent by the Linksys device. For added security, do not broadcast the SSID.
5. Save your settings before going to the next screen.


Step 6: Configure encryption and authentication

1. Choose the Wireless Security tab on the Wireless screen.
2. This router supports four types of security mode settings:

· WEP (Wired Equivalent Privacy)
· WPA (Wi-Fi Protected Access) Personal, which uses a pre-shared key (PSK)
· WPA Enterprise, which uses Remote Access Dial In User Service (RADIUS)
· RADIUS

d. Select WPA Personal Security Mode.
e. On the next screen, choose an Encryption algorithm.
To secure a network, use the highest level of encryption possible within the Selected Security mode.The following Security Modes and Encryption levels are listed from least secure (WEP) to mostsecure (WPA2 with AES)

· WEP
· WPA
· TKIP (Temporal Key Integrity Protocol)
· AES (Advanced Encryption System)
• WPA2
• TKIP
• AES

AES is only supported by newer devices that contain a co-processor. To ensure compatibility with all devices, select TKIP.

f. For authentication, enter a pre-shared key between 8 and 63 characters. This key is shared by the Linksys device and all connected devices.
g. Choose a key renewal period between 600 and 7200 seconds. The renewal period is how often the Linksys device changes the encryption key.
h. Save your settings before exiting the screen.

Step 7: Configure MAC address filtering

1. Choose the Wireless MAC Filter tab on the Wireless screen.
2. MAC address filtering allows only selected wireless client MAC addresses to have access to yournetwork. Select the radio button to Permit PCs listed below to access the wireless network. Click the Wireless Client List button to display a list of all wireless client computers on your network.
3. The next screen allows you to identify which MAC addresses can have access to the wireless network. Click the Save to MAC Address Filter List check box for any client device you want to add, and then click the Add button. Any wireless clients, other than those in the list will be prevented from accessing your wireless network. Save your settings before exiting the screen.


Step 8: Reflection

1. Which feature that you configured on the Linksys WRT300N makes you feel the most secure and why?

Jawab:

aplikasi atau program yang membuat saya merasa lebih aman dan nyaman ketika mengkonfigurasi ialah MAC address filtering. Alasannya karena pada aplikasi ini terdapat sebuah pilihan untuk memberikan izin access kepada client yang telah terlebih dahulu alamat IP dan MAC address nya dicantumkan atau didaftarkan.


2. Make a list of other items that could be done to make your network even more secure.

Jawab:

Pada pengaturan wireless kita pilih wireless security dan security modenya kita ganti dari disabled menjadi WEP sehingga dapat memberikan kunci berlapis. Atau pada system operasi windows biasa kita aktifkn juga menu firewall dan kita aktifkan juga menu SYS.