Bank's Security Team asks about Identify...

  • 0
  • 1
  • Question
  • Updated 5 months ago
  • Answered
Hello, everybody,

what could I aswer to security guys:

They've asked:

- list of opened port at V2110 by default;
- does V2110 have standard (RFC) realisation of WEP, WPA and WPA2 or there is something vendor-specific?
- how CAPWAP tunnel between V2110 and AP works and what kind of encryption does it provide? Does Identify use RFC CAPWA or something vendor-specific?
- how safe RADIUS (Active Directory over NPS) authorization? Is there any encryption?

Many thanks in advance for your comments,

Photo of Ilya Semenov

Ilya Semenov

  • 3,622 Points 3k badge 2x thumb

Posted 5 months ago

  • 0
  • 1
Photo of Ronald Dvorak

Ronald Dvorak, Embassador

  • 42,280 Points 20k badge 2x thumb
1) Ports
are listed in the release notes page#43

2) 802.11
yes that is per standard or clients wouldn't be able to connect

As per the datasheet "Pre-standard (CAPWAP)"

as per RFC
Photo of Ostrovsky, Yury

Ostrovsky, Yury, Employee

  • 2,280 Points 2k badge 2x thumb
Hi Ilia , as I remember , those ports are used by controller (some of them can be disabled) :
- ssh (22) - for the ssh
- https (5825) - for the GUI management
- 13910/13907 - for AP registration . That can be changed to 4500 (typical GRE port) for the IPSec registration
- 161 - snmp - for security you need to change it to snmpV3

- all encryption types (WEP/WPA/WPA2 PSK and ENT) are all standard based , not a proprietary. For now we do not support PPSK (which can be considered proprietary).
- CAPWAP tunnel - we do not use this standard , insted we are using our proprietary tunnel type (WASSP) . That can be used for both AP registration/management as well as user traffic (data plane) if traffic goes back to the controller. 
- RADIUS communication between controller and RADIUS server is used as everybody else using it - with MD5 (shared secret), which is not very secure . But that is the standard for now , and so far I never seen any other RADIUS server which would support something different.  
Photo of Ilya Semenov

Ilya Semenov

  • 3,622 Points 3k badge 2x thumb
Thanks, gentlemen!