Wireless/Mobile /

VPNs and wireless LAN security

By Joanie Wexler
Network World Wireless in the Enterprise Newsletter, 08/29/01

Because wireless LAN security (or the perceived lack of it) has been a headline-grabber lately, several readers have written in asking for more detail on using Layer 3 VPNs to protect their wireless data.

Using VPN technology for wireless LANs is generally recommended, but it can present one of those situations where you must weigh your need to keep network administration simple against the value of your data. Your decision will depend on the size of your organization, the reach of your wireless LAN installation and your security needs.

From a policy perspective, it makes sense to treat the wireless LAN just as you would the corporate backbone and put your 802.11 access points on the corporate VPN. Wireless LAN users access the network just as remote dial or Internet users would, a process requiring authentication. One way to do this is to place the 802.11 access point behind the corporate firewall, requiring that wireless clients authenticate to the VPN or firewall using third-party software. The benefit here is most of the authentication takes place independently of the wireless network, keeping access point maintenance simple (and keeping equipment costs down).

Some vendors such as Colubris Networks, though, argue that the VPN capabilities should be bundled right into the access point to ensure the highest degree of privacy. Colubris has added L2TP VPN tunneling and IPSec encryption and authentication to its enterprise-strength CN1050 802.11b access points.

The theory here is that in a wireless LAN setup, as traffic volumes grow, you can basically just add new access points, which serve as repeaters that automatically forward traffic from one access point to another. So communication hitting an access point could be repeated to another access point before authentication takes place. (In other words, a user must gain access to the network in order to be authenticated in the first place.)

Access points without integrated VPN capabilities, then, are viewed as creating a security hole. Anyone with an IEEE 802.11b network interface card in their client device who is in the transmission range of the access point can connect to that access point and hop on the wireless network. The unauthenticated user cannot easily penetrate a corporate backbone secured by a firewall and VPN, but can gain access to the data traversing unsecured access points.