ULiège over WLAN. Chief Information Security Officer Network infrastructure team leader 13/12/2017

Transcription

1 + ULiège over WLAN 13/12/ Chief Information Security Officer Network infrastructure team leader

2 +.: Agenda :. n IT Dept. and network overview n Radio Frequency Management n WiFi engineering features n Local vs Centralized architectures n WiFi@ULiege n Pitfalls, or why WiFi = Evil n Telecom and server rooms tour 2014 SEGI ULg Simon FRANCOIS

3 2017 SEGI ULiege Simon FRANCOIS

4 +.: University of Liege overview :. n Univ & teaching hospitals n staff n > students n Privately held companies n > 30 remote sites / branch n Wide campus 2017 SEGI ULiege Simon FRANCOIS

5 +.: IT Dept. overview :. n IT staff : 105 n Network & Security : 8 n 100,000 network wall plugs n 2,300 WiFi access points n vservers / 2 DC n Mass storage, NIC n 2x10 Gbps internet BW n Kind of small ISP 2017 SEGI ULiege Simon FRANCOIS

6 +.: Agenda :. n IT Dept. and network overview n Radio Frequency Management n WiFi engineering features n Local vs Centralized architecture n WiFi@ULg n Pitfalls, or why WiFi = Evil n Telecom and server rooms tour 2014 SEGI ULg Simon FRANCOIS

7 +.: RFM in-depth (1) :. Radio Frequency (RF) n Don t deploy wireless infrastructure until you understand RF n Wireless signal main signatures : n Carrier frequency n Signal band (spectrum) width n Signal power at transmitter s antenna n Signal power at receiver s antenna n Signal to noise ratio n Duty cycle n Needed for site surveys, interferences management 2014 SEGI ULg Simon FRANCOIS

8 +.: RFM in-depth (2) :. WiFi Bands and Channels 2,4GHz (UHF) One channel = 20 MHz wide, except for (deprecated) b (22 MHz) 2016 SEGI ULg Simon FRANCOIS

9 +.: RFM in-depth (3) :. WiFi Bands and Channels 2,4GHz (UHF) Warning when using : - Neighbours using Poorly manufactured antennæ overflow out of channel boundaries 2016 SEGI ULg Simon FRANCOIS

10 +.: RFM in-depth (4) :. WiFi Bands and Channels 5GHz (SHF) 2,4 GHz used by b/g 5 GHz used by a Both used by n/ac 2016 SEGI ULg Simon FRANCOIS

11 +.: RFM in-depth (5) :. WiFi Bands and Chans 2,4GHz (UHF) vs 5GHz (SHF) 2016 SEGI ULg Simon FRANCOIS

12 +.: RFM in-depth (6) :. Interferences and obstacles n Obstacles are legion n Walls of course, but what about : n Metal? n Mirrors? n Aquariums (water)? n Wind or fog? n Humans? n Paper? n Bushes and trees? 2014 SEGI ULg Simon FRANCOIS

13 +.: RFM in-depth (7) :. Interferences and obstacles n LBT: WiFi is a polite protocol n Unlicensed frequency bands n Interferences are WiFi s worst enemy n motion sensors, n wireless cameras, n microwave ovens, n other WiFi devices, n false-dect phones, n bluetooth devices, n machinery, n Zigbee, n Fairy lights 2015 SEGI ULg Simon FRANCOIS

14 +.: RFM in-depth (8) :. 2,4GHz (UHF) vs 5GHz (SHF) 2,4GHz n All clients are compliant n Legacy propagation range n Flooded by interferences n 3 to 4 channels max n Less bandwidth n Hard site survey (because of channel assignment) 5GHz n Legacy, low-end/cheap clients don t have 5 GHz antennæ n Slightly shorter range n Much fewer interferences n 19 channels for Europe n Up to 160MHz channels n Easy site survey and channel assignment n Warning : weather-radars + military usage (DFS+TPC) 2017 SEGI ULiege Simon FRANCOIS

15 +.: RFM in-depth (9) :. Bands and Channels future frequency bands & standards? ad : up to 60 GHz à 5Gbps! af : below 1 GHz ah : 700 MHz, 860 MHz, 902 MHz 2015 SEGI ULg Simon FRANCOIS

16 +.: RFM in-depth (10) :. LPWAN n LPWAN (Low-Power Wide-Area Network) practical examples : LoRa ; Sigfox n 868 MHz ; single channel ; UNB (Ultra Narrow Band) ; very slow transmissions by design 2017 SEGI ULiege Simon FRANCOIS

17 +.: Agenda :. n IT Dept. and network overview n Radio Frequency Management n WiFi engineering features n Local vs Centralized architecture n WiFi@ULg n Pitfalls, or why WiFi = Evil n Telecom and server rooms tour 2014 SEGI ULg Simon FRANCOIS

18 +.: WiFi Engineering features (1) :. Challenges n Cables and bandwidth n Bringing a cable is as expensive as buying an AP. n ac and ad claim performances > 1Gbps n Power over Ethernet : PoE, PoE+, UPoE n No need to bring a power cable : power goes through your ethernet n Two cables or mgig? n And bring 1/2,5/5/10Gbps on Cat5e/Cat SEGI ULg Simon FRANCOIS

19 +.: WiFi Engineering features (2) :. Challenges n Crowded places n Imagine auditorium 604 n Each and every student with laptop + smartphone + tablet n More access-points! n Simplest solution to crowded places? n With caution! Mind channel overlaps n è Disable some 2,4 GHz antennæ n Use directional antennæ 2015 SEGI ULg Simon FRANCOIS

20 +.: WiFi Engineering features (3) :. Opera - auditorium SEGI ULg Simon FRANCOIS

21 +.: WiFi Engineering features (4) :. Challenges n (unintentional) selfish users n Consuming all bandwidth n Airtime fairness n Solution to selfish users 2015 SEGI ULg Simon FRANCOIS

22 +.: WiFi Engineering features (5) :. Challenges n Underused access-point n While other neighbor APs have too many clients n Client load balancing n Solution to crowded places and underused Aps 2015 SEGI ULg Simon FRANCOIS

23 +.: Agenda :. n IT Dept. and network overview n Radio Frequency Management n WiFi engineering features n Local vs Centralized architecture n WiFi@ULg n Pitfalls, or why WiFi = Evil n Telecom and server rooms tour 2014 SEGI ULg Simon FRANCOIS

24 +.: WiFi Architecture (1) :. Local Switching vs Centralized n Local = each and every access-point takes decisions and switches traffic. n Only architecture available for 1 st generation WiFi (2005) n Centralized = use of central equipment called controller n All wireless traffic must go through the controller n Controller takes decisions, and switches traffic Possibly back to the access point (think of VoWLAN phones) n Controller can (must!) be duplicated and work in failover to avoid SPoF n While they catch all the traffic, controllers are ideal for accounting 2014 SEGI ULg Simon FRANCOIS

25 +.: WiFi Architecture (2) :. Local vs Centralized Local n Faster, direct switching n Normal bandwidth usage n No bottleneck n No centralized accounting n No correlation between APs n Few management features Centralized n Slower switching by distant controller n Bandwidth waste n Controller is such a bottleneck n Full accounting, security point n Full correlation à faster roaming, easier channel selection n Easier management Winner?? 2014 SEGI ULg Simon FRANCOIS

26 +.: Agenda :. n IT Dept. and network overview n Radio Frequency Management n WiFi engineering features n Local vs Centralized architecture n WiFi@ULg n Pitfalls, or why WiFi = Evil n Telecom and server rooms tour 2014 SEGI ULg Simon FRANCOIS

27 +.: ULiège :. Stats : 2017 (2013) n > 2200 WiFi access points (Uliege+CHU) n Cisco 2602 model n Cisco 2702 model ( ac) n a/b/g/n/ac n 10% (0%) using ac n 55% (72%) using 2,4GHz n n 34,7% (22%) using 5 GHz n n 0,25% (6%) using 2,4GHz g n 0,05% (9) people using a n > 15,000 (4500) concurrent auth users n > 27,000 users per week n > 45,000 users per year n 80% secured connections n > 110TB traffic per month n 3 SSID n Guest n ULg-Secured n eduroam 2017 SEGI ULiege Simon FRANCOIS

28 +.: Agenda :. n IT Dept. and network overview n Radio Frequency Management n WiFi engineering features n Local vs Centralized architecture n WiFi@ULg n Pitfalls, or why WiFi = Evil n Telecom and server rooms tour 2014 SEGI ULg Simon FRANCOIS

29 +.: Pitfalls :. It s a trap! n Wireless communications will NEVER be as reliable as wired is n (intentional) interferences, obstacles n!! VoWLAN n Wireless communications will NEVER be as secured as wired can be n Client load balancing, wayfinding, aso. don t work well! n Most decisions are taken client-side n Network admins are helpless, no global policy n à WiFi was designed as a home technology 2015 SEGI ULg Simon FRANCOIS

30 + Q & A s Telecom room tour Simon.Francois@uliege.be 2017 SEGI ULiege Simon FRANCOIS