#Mac security settings mac

A large network might already have a RADIUS authentication server in place, making it relatively easy to extend its use to support the wireless network. The use of one approach over the other often depends on the network infrastructure. After establishing a secure channel with their PTKs, they can then generate keys to secure multicast traffic. They use the PTKs to secure wireless unicast traffic. The wireless client and Aerohive device use their PTKs to encrypt unicast traffic transmitted between themselves.) from this preshared key, which acts like the PMK.

#Mac security settings mac

The PTK is generated by performing a cryptographic hash on the concatenation of the PMK, nonces from the Aerohive device and client, and the Aerohive device and client's MAC addresses. They derive their PTKs ( pairwise transient keys A PTK (pairwise transient key) is a temporary key that a wireless client and Aerohive device derive from their PMKs (pairwise master keys).

Preshared keys (Personal): A device and its wireless clients have the same key string defined.

The devices and clients use the keys from the RADIUS server to generate the keys they will use to secure traffic between themselves.

802.1XВ (Enterprise): A centralized RADIUSВ authentication server stores user accounts (name, password, and optional RADIUS attributes) and generates and distributes a master key to supplicants (wireless clients) and pairwise master keys to authenticators ( Aerohive devices).

WPA and WPA2 define two approaches for key management and user access control: Aerohive devices use different frame fields to advertise the use of WPA or WPA2 capabilities to their clients. The goal of these two features is to accelerate roaming from one access point to a neighboring access point (by preauthenticating the client to the neighbor in advance of roaming and then caching the PMK on both the client and neighbor) and to accelerate reconnecting with the first access point if the client roams back to it again (again by caching the PMK on both the client and access point). The PMK lasts for the entire session between the Aerohive device and client.) caching and preauthentication. The Aerohive device and client use the PMK to derive PTKs (pairwise transient keys), which they then use to encrypt unicast traffic transmitted between themselves. (It is encrypted using the RADIUS shared secret.) When using WPA/WPA2 with preshared keys, the Aerohive device and client use their preshared keys like PMKs. The RADIUS server then transports the PMK to the Aerohive device in an encrypted RADIUS packet. The RADIUS server uses the same procedure that the client uses to derive an identical PMK from its master key. When using WPA/WPA2 with a RADIUS server, the server sends a master key to the client, which uses it to derive a PMK. WPA2 supports a superset of WPA and includes support of PMKВ ( pairwise master key The PMK (pairwise master key) is a shared secret key that both the Aerohive device and wireless client have. (For information about setting interfaces in various modes and what the modes mean, see 'Aerohive AP Settings'.)

If hive members need to support wireless backhaul communications with each other and you want both interfaces to provide client access, then one of the wireless interfaces must be in dual mode so that it provides both access and backhaul links. In this case, both of the wifi interfaces-wifi0 and wifi1-must be in access mode or dual mode.

Mapping an SSID to both types of radio is a good approach if the devices need to interoperate with some wireless clients that only support 802.11n/b/g and others that only support 802.11n/a. (The AP110 and BR100 are single radio devices.) Radio 1 operates in the 2.4 GHz band and supports IEEE 802.11n/b/g standards, and radio 2 operates in the 5 GHz band and supports IEEE 802.11n/a standards. Most Aerohive devices have two radios-radio 1 and radio 2. 2.4 GHz (11n/b/g): This binds the SSID to an interface linked to a radio operating at 2.4 GHz for the IEEE 802.11n, 802.11b, and 802.11g standards.ДҐ GHz (11n/a): This binds the SSID to an interface using an antenna operating at 5 GHz for the IEEE 802.11n and 802.11a standards.Дў.4 GHz &В 5 GHz (11n/a + 11n/b/g): This binds the SSID to two interfaces, each linked to a different radio operating in separate frequency bands.