Bank's Security Team asks about Identify...

  • 0
  • 1
  • Question
  • Updated 11 months ago
  • Answered
Hello, everybody,

what could I aswer to security guys:

They've asked:

- list of opened port at V2110 by default;
- does V2110 have standard (RFC) realisation of WEP, WPA and WPA2 or there is something vendor-specific?
- how CAPWAP tunnel between V2110 and AP works and what kind of encryption does it provide? Does Identify use RFC CAPWA or something vendor-specific?
- how safe RADIUS (Active Directory over NPS) authorization? Is there any encryption?

Many thanks in advance for your comments,

Ilya
Photo of Ilya Semenov

Ilya Semenov

  • 4,610 Points 4k badge 2x thumb

Posted 11 months ago

  • 0
  • 1
Photo of Ronald Dvorak

Ronald Dvorak, Embassador

  • 48,894 Points 20k badge 2x thumb
1) Ports
are listed in the release notes page#43
http://documentation.extremenetworks.com/release_notes/extremewireless/9035197_ExtremeWireless_v10.4...

2) 802.11
yes that is per standard or clients wouldn't be able to connect

3) CAPWAP
As per the datasheet "Pre-standard (CAPWAP)"
http://bit.ly/2kP8vjG

4) RADIUS
as per RFC
https://tools.ietf.org/html/rfc6614
Photo of Ostrovsky, Yury

Ostrovsky, Yury, Employee

  • 3,050 Points 3k badge 2x thumb
Hi Ilia , as I remember , those ports are used by controller (some of them can be disabled) :
- ssh (22) - for the ssh
- https (5825) - for the GUI management
- 13910/13907 - for AP registration . That can be changed to 4500 (typical GRE port) for the IPSec registration
- 161 - snmp - for security you need to change it to snmpV3

- all encryption types (WEP/WPA/WPA2 PSK and ENT) are all standard based , not a proprietary. For now we do not support PPSK (which can be considered proprietary).
- CAPWAP tunnel - we do not use this standard , insted we are using our proprietary tunnel type (WASSP) . That can be used for both AP registration/management as well as user traffic (data plane) if traffic goes back to the controller. 
- RADIUS communication between controller and RADIUS server is used as everybody else using it - with MD5 (shared secret), which is not very secure . But that is the standard for now , and so far I never seen any other RADIUS server which would support something different.  
Photo of Ilya Semenov

Ilya Semenov

  • 4,610 Points 4k badge 2x thumb
Thanks, gentlemen!