Enabling Broadcast WEP Key Rotation

© 2003, Cisco Systems, Inc. All rights re

© 2003, Cisco Systems, Inc. All rights re

Broadcast WEP Key rotation interval (sec)

Broadcast key rotation is an excellent alternative to WEP key hashing if the WLAN supports wireless client devices that are not Cisco devices or that cannot be upgraded to the latest firmware for Cisco client devices.

Note When broadcast key rotation is enabled, only wireless client devices using LEAP or EAP-

TLS authentication can use the access point. Client devices using static WEP (with open, shared key, or EAP-MD5 authentication) cannot use the access point when you enable broadcast key rotation.

It is not necessary to enable broadcast key rotation if WEP key hashing is enabled. Use of both key rotation and key hashing provides redundant protection.

On the access point Radio Advanced screen, enter the rotation interval in seconds in the Broadcast WEP Key rotation interval entry field. If you enter 900, for example, the access point sends a new broadcast WEP key to all associated client devices every 15 minutes. To disable broadcast WEP key rotation, enter 0.

Note Set the rotation interval on every access point using broadcast key rotation. Key rotation interval is not configured on the RADIUS server.

Use a short rotation interval if the traffic on the wireless network contains numerous broadcast or multicast packets. Click OK. Broadcast key rotation is enabled.

© 2003, Cisco Systems, Inc. All rights re

In order to enable Authentication and dynamic WEP keying on an IOS AP, it is necessary to enable encryption and authentication settings as well as to define an Authentication Server.

These are configurable from the following Security submenus:

■ Encryption Manager

■ SSID Manager

■ Server Manager

The Security tab on the left menu bar provides a summary view of the configured Security parameters, as well as providing links to the appropriate SSID, Encryption, and Server configuration screens.

Note that these encryption settings are configurable for each radio interface and also may be configured uniquely per VLAN.

© 2003, Cisco Systems, Inc. All rights re

From the AP Encryption Manager screen, it is possible to configure WEP Encryption, any required WEP Encryption Keys, and enable Broadcast Key Rotation.

■ WEP Encryption: Enable or Disable WEP Encryption, and if enabled, set WEP Encryption to Mandatory or Optional.

■ Encryption Keys: enter Encryption Key string in Hex, set Transmit Key, and Key Size.

Encryption key must be entered if using static WEP key clients in addition to dynamically keyed clients.

Under Global Properties, it is possible to enter Broadcast Key Rotation Interval and to specify the interval at the "Enable Rotation with Interval" textbox. Note that broadcast key rotation may not be used when static and dynamic WEP key clients coexist on a single SSID.

S 2003, Cisco Systems, Inc. Aii rights re

S 2003, Cisco Systems, Inc. Aii rights re

To enable Cisco Per-Packet Keying (a.k.a. key hashing or Cisco Temporal Key Integrity Protocol- TKIP) and Message Integrity Check (MIC), WEP Encryption must be enabled.

Select the appropriate checkboxes for:

■ Enable Per Packet Keying

Note These features are only compatible with Cisco client devices.

Note Also, Cisco TKIP (CKIP) and MIC (CMIC) may be enabled via the "Cipher" dropdown menu for use with Cisco Centralized Key Management protocol.

Continue reading here: Wi-Fi Can Be Improved If You Keep Your Router Away From These 7 Objects

Was this article helpful?

0 0