Manage

Best practices for AP placement

Offer your customers informed network topology and physical positioning recommendations for access point deployment, and learn to configure incoming and outgoing policies to meet business needs.

Lisa Phifer, Core Competence

Published: 03 Dec 2006

Offer your customers informed network topology and physical positioning recommendations for access point deployment,...

Step 2 of 2:

You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

This email address is already registered. Please log in.

You have exceeded the maximum character limit.

Please provide a Corporate Email Address.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.

and learn to configure incoming and outgoing policies to meet business needs. This tip was originally part of the Wireless Security Lunchtime Learning series on SearchSecurity.com.

Many installers make the mistake of treating 802.11 WLANs just like Ethernet, placing access points (APs) in locations that facilitate outsider access to corporate networks. But, from a security perspective, WLANs should be treated like the Internet -- a network composed of trusted and untrusted users. This tip offers network topology and physical positioning recommendations for safer AP deployment.

Position matters

This approach is straight-forward, but may not optimize cost, performance or security. Desired coverage areas are rarely circular. To fill resulting gaps, you may end up purchasing more APs than your customer really needs and "leaking" quite a bit of signal. Site modeling and/or directional antennas can help avoid this.

Modeling tools try to satisfy user location, density and throughput requirements by combining building material characteristics, AP capabilities and site survey measurements to predict where APs should be placed and verify results. Up-front planning takes more time and effort, but can pay off in the long run, especially for large WLANs. For example, see AirMagnet Surveyor, AirTight SpectraGuard Planner, Network Chemistry RFprotect Survey and Trapeze RingMaster.
Replacing the AP's "rubber ducky" omni antennas with directional antennas can better focus radiated power where it belongs, improving inside coverage and reducing outside signal leakage.

Physical or logical LAN segmentation

For example, cable all of your customer's APs to a new Ethernet switch, rather than connecting them to an existing Ethernet switch used by nearby wired devices. Or you cable "thin" APs to a new wireless switch (e.g., Aruba, Cisco, Trapeze) that's responsible for managing and monitoring them. Clumping all APs into one physical LAN is easy to understand, but it does not scale.
Larger WLANs should create logical workgroups using Virtual LANs (VLANs). VLANs tag packets or ports with identifiers used to control traffic flow. For example, connect your APs to existing Ethernet switch ports, but assign those ports their own new VLAN. You'll probably want at least two new VLANs -- one for AP management and another for wireless users.

Creating network barriers

For this reason, wireless APs should always be separated from trusted subnets using some type of network layer policy enforcement device, like:

Routers
Firewalls
VPN gateways
Wireless gateways and Layer 3 switches
Network access controllers

When creating a network barrier, consider functions that device must perform. To enforce security policies, you may need access controls (based on MAC, VLAN, IP, port or application traffic inspection), station or user authentication, VPN tunneling (with or without subnet roaming), session accounting, virus scanning, content filtering, intrusion detection/prevention and bandwidth limits. A general-purpose firewall can do much of this, but a wireless gateway or Layer 3 switch may fill this role AND provide 802.11-specific functions like AP discovery, provisioning and RF management. Different barriers may be appropriate for different users -- for example, a Web-based access controller for guests and a VPN gateway for employees.

Finally, no matter which device you choose, configure incoming and outgoing policies to meet business needs and deny everything else. For example, there's probably no reason that SNMP requests, routing messages or DNS zone updates should originate from your customer's WLAN. Granular policies may require more effort to maintain, but can reduce the risk of core network compromise by wireless-borne attacks.

About the author
Lisa Phifer owns Core Competence, Inc., a consulting firm specializing in network security and management technology. Core Competence produces The Internet Security Conference (TISC), an annual symposium for network security professionals. Phifer has been involved in the design, implementation, and evaluation of data communications, internetworking, security, and network management products for nearly 20 years.

This tip originally appeared on SearchSecurity.com.

APs with factory-default omni antennas cover an area that's roughly circular, impacted by RF obstacles like walls. It is therefore common to place APs in central locations, or divide an office into quadrants, deploying one AP per cell. Physical placement, and associated steps like transmit power adjustment, can make it harder for intruders to stay connected to your customer's APs. But you should never count on physical placement alone to stop attackers. Next, prevent wireless LAN traffic from mixing with "other" LAN traffic. Stations connected to your Ethernet LAN form a trusted workgroup. They exchange broadcast/multicast traffic and depend on shared resources like Layer 2 hubs or switches, DHCP servers, DNS servers, and Layer 3 switches or routers. Toss untrusted devices onto that LAN and you're putting everyone at risk. Bad actors can cause broadcast storms, poison ARP caches, chew up IP address pools, etc. This risk can be reduced by physically or logically segregating the APs. Note that segmenting LANs can impact both security and performance. For example, Quality of Service measures can be applied to physical or virtual LANs to give employee traffic priority over guests. At some point, WLAN traffic will encounter a network layer device, where it may be forwarded to the public Internet or other internal subnets. This is where many employee-installed APs wreak havoc. Connecting an untrusted device to a trusted subnet creates an unsecured "back door." Security measures enforced at the trusted subnet's "front door" -- firewall rules, VPN tunnels, network antivirus -- are circumvented by stations connected to misplaced APs. For example, your customer's APs could be connected directly to an access router, configured to relay wireless traffic towards the Internet and not their company's network. Or the APs could be connected to a VPN gateway that authenticates VPN clients and blocks all other traffic. Or the APs might be placed on a firewall DMZ, allowing wireless access to a few DMZ-protected servers, but preventing passage through the firewall into trusted networks.

How indoor mesh wireless solved an outdoors problem

Hiding SSIDs doesn't equal PCI DSS wireless compliance

Virtual LANs 101

How to integrate your wired and wireless networks