Home Blog

WLPC 2018 Phoenix

0

WLPC 2018

Attending my first wireless conference was a rewarding experience. Conference check in was Monday night with food trucks. It was great getting to meet the people you converse with on twitter and slack.

WLPC 2018 started with Keith Parsons welcoming everyone. Followed by 55 minute sessions, 30 minute sessions, Ten Talks, and Deep Dive Sessions. These were all very informative and it would take a book to cover them all so I will just share some of my notes.

RRM and You Blake Krone
Cisco
– Uses Neighbor Discovery Protocol
– Elect RF Group Master
– Build RF Neighborhoods =/> 80dBm
– Cost Metric: RSSI based AP load, CCI, ACI, Spectrum metric for DCA
– Cover Overlap Factor: used with Flexible Radio Assignment
Frames sent at highest power and lowest supported data rate
RRM is not a replacement for design or proper configuration
Configure RRM & Test
– Power levels – set max & min
– Use Profiles – HD areas vs non-HD areas

WPA3 Heather Williams
– Protected Management Frames (IEEE 802.11w) now mandatory
– Devices required to validate network authentication server certificates appropriately
– Standardizes the cryptographic suite (still 128-bit)
– Simultaneous Authentication of Equals (SAE)
– Opportunistic Wireless Encryption (OWE) RFC8110
– Device Provisioning Protocol (DPP) to secure IoT

Does it Matter What AP You Buy? Wes Purvis
– Know your requirements
– Consider your clients
– Number of Transmitters affects AP Tx Power
– Know PoE Draw for your power budget
– Decide which model AP is best for your environment

Wi-Fi Pros Slack Manon Lessard & Samuel Clements
– Great resource to converse with other Wireless Network Engineers
– Allows more characters than Twitter

Filtering and Coloring Frames with Wireshark Joel Crane
– Operators – &&(if it’s this and this); ==(if it’s this); !=(if it isn’t this)
– Right click on something in a frame you can – apply as filter; prepare as filter; or colorize with filter

What to Blog About Lee Badman
– Take the first step
– Be yourself
– Have something to say, but don’t force it
– Put a fresh angle on the topic, whatever it is
– Write often enough to stay relevant
– Blogs aren’t novels
– Promote, and be promoted
– Don’t be thin-skinned, and keep your ego in check
– Any comments/feedback are worth responding to (almost).

My main goal was to learn more about packet capturing so I signed up for the Wireshark & WLAN Troubleshooting deep dive session. I thought I was prepared. I went into the session with Wireshark loaded on my Windows laptop to learn how to capture packets. Little did I know I was about to use Linux for the first time. It may seem strange that I’ve never used Linux in my career but I had managed to avoid it until now. After a brief moment of panic, I started the exercises and proceeded to learn a bit of Kali. It is a good thing I have a programming background even if it has been a decade since I programmed anything and that was C++ and Visual Basic. After the first deep dive session I went back to my hotel room, ordered room service, and started going over the material to get up to speed for the next day’s session. The way I approach my weak areas is to study until proficiency. I now have what I need to begin analyzing packets thanks to James Garringer!

Main takeaway from the conference for me was to start blogging. I thought it would be appropriate for this to be my first blog. I will be treating this as a technical journal for me. There have been many times that I found a solution to a problem and didn’t document. When the problem occurs again a year or two later I find myself struggling to remember the solution.

Flash Aerohive AP

0
  1. Connect the AP to a console cable.
  2. Plug AP into a PoE switch.
  3. On your laptop or PC, start the TFTP Server. Must be on the same subnet. I used Solarwinds TFTP Server.
  4. Hit the space bar to get into bootloader before the 4 seconds counting down is over.

The password is “administrator

  1. Set the TFTP server IP using command “set_bootparam” you only need to set:

-the TFTP server IP (your laptop or PC)
-boot file location (C:/tftp-boot)
-other settings just press enter and jump.

The set_bootparam should look similar to this:

ar7240> set_bootparam
Change boot parameter, ENTER to skip the item
Device IP        : [0.0.0.0]
TFTP Server IP   : [0.0.0.0] 10.0.0.3 (this is the IP of your TFTP server)
VLAN ID          : [0]

NVLAN ID         : [0]
Boot File        : [] AP121-6.5r4.img.s (the name of the image you’re installing to AP)
Netboot after flashboot failed [1 for yes, 0 for no] : [0]

Netdump after crash [1 for yes, 0 for no]: [0]
Are you sure to save? [Y/N] y (make sure to answer ‘Y’)

  1. Then you can install the HiveOS image to the device flash, using command “image_flash“. It will try to get the OS from the TFTP server you set.
  2. After the loading and programming is done, use the command “reset” to reboot, your device should be able to start and you can login with the user “admin” and password “aerohive”.

The Dangers of the “Guest” SSID

0

I have setup WiFi at schools, conferences and snooty shindigs where the goal was to make sure everyone had access to open, relatively fast, and secure Guest networks. And no, I did not use a Captive Portal. Firewall and VLANs yes, Captive Portal, no. The goal was to get the users on and out the the InterWebs.

One other thing I never, ever do is create a Guest SSID that is open. I always change the name in some way. Guest-Open, guest-open, Here-a-guest, there-a-guest… Why do I not use the SSIDs Guest, guest, or GUEST or any variation of that word? By the way, SSIDs are case sensitive so that’s why spelled the ‘same’ word different ways. I do not use that word because our devices usually remember SSIDs that we have successfully connected to at some point. “What’s the big deal? That makes it simple when I come back.” And yes it does make it simple. Simple for you, simple for your host, and also simple for the guy with a hotspot or a rogue AP named “guest.” The last thing you want is for Gropnorb to steal your identification and buy a ticket to Elbonia on your dime.

The best practice is to always have your device “forget” any network you use that is open. Even if the open network has some crazy SSID. You never know who is sitting beside you in the coffee shop.

How Did That Happen?

0

I had a customer call and say the PoE board on a switch was down and that 7 APs were impacted. So I make the 2 hour drive to the customer’s site. These are good friends of mine so I don’t mind at all.

Upon arrival I ask the usual questions…

Storms?
Surges?
Reboot the switch?
Area impacted by the outage?

No weather issues. Yes, they rebooted the switch. Half the APs in the area are flashing?

Half are flashing? First thought is the PoE is fine. Why are half the APs acting up?

So we go to the IDF and look at the switch. At first glance the activity lights look great. All AP cables look normal. Time to grab the serial adapter and check the switch.

Time check PoE, just in case. Sh inlinepower showed that it was delivering PoE just fine. I execute sh conf vlan. At first glance it looks ok. I was mostly looking to make sure the switch had a config. I then execute sh conf port ge5.12-33. Whoa! Half the ports have a different PVID. They run the APs on the MGMT VLAN. I get that fixed and then look closer at the VLAN config. The ports for two downstream switches weren’t tagged for the MGMT VLAN. I fix those as well.

Everything comes back up and teachers say they are now working. I make sure to save config, twice. I’m kind of untrusting that way. I capture a copy of the config.

No idea why the config did that. It’s like it reverted to a previous version but that can’t be since the set port vlan command does them all at once, saying that you define all the ports.

 

Chromebook NICs

0

I had a school call and say they had a HP Windows laptop sitting next to a HP Chromebook. The Chromebook was working fine at another school and all WLAN settings were exactly alike. Yet, when they moved the Chromebooks to another school they could only get 1 Mbps compared to the Windows laptop cranking 125 Mbps.

A quick check of the wall revealed a major dB loss. Also, some research showed the Chromebook only has a 5 GHz NIC. The Windows laptop also had a 2.4 GHz NIC. Adding an AP in the room resolved all issues.

Real world proof that a 5 GHz signal attenuates quickly and cannot penetrate walls as well as 2.4 GHz.

Aerohive Commands

0

The 5 commands to move an AP to a new HM

You must SSH to the AP, then …

Capwap client server name hm-useast-XXX.aerohive.com (Where XXX is the server number)

Capwap client VHM-name Name_Of_VHM

Save config

No capwap client enable

Capwap client enable

reboot

MAC Filter in Aerohive

0

If you want to filter MAC addresses of clients that should not be on your network:
Click Configuration
Click Advanced Configuration
Click Security Policies
Click MAC Filters
Click New
Enter a Name
Enter a Description
Click the +
Enter MAC Object Name
Enter MAC Address in MAC Entry
Enter Description
Click Save
Highlight new entry
Click Deny click Apply
Click Save

Add a new entry
Click MAC list
Click Add
Click the +
Enter a MAC Object Name
Enter a MAC Address in MAC Entry
Enter a Description
Click Save
Highlight new entry
Click Deny click Apply
Click Save

Apply the new filter
Click Configuration
Click Network Policy
Click SSID
Click DoS Prevention and Filters
Highlight Available MAC Filters
Move to the right
Leave Default Action at Permit
Save

Forcing an Extreme AP to the right controller

0

SSH and issue a
cset authip 1 x.x.x.x
capply
csave
Reboot

Just wait for csave to give confirmation before reboot