B. Security Filters Guests cannot view other user activity on a shared wireless network due to blocking,” which forbids direct communication or Publicly Secure Packet “Intracell Forwarding (PSPF) which denies all inter-client traffic. Regardless of what the service is called, a dynamic filter prevents any two MAC addresses that enter the same radio interface from going to a destination on the same interface. For example, when USER1 enters interface Radio1, access is allowed on any destination on FA0 / 0 (the uplink port to the Internet), but no access is given to view USER2 who is connected to Radio1 at the same time. This filter provides a level of security to any user connected to this radio. However, a user at this point could still connect to another user who happens to be on another radio (WAP). Types of security for applications on the same infrastructure are given below. 1. User-to-User Security (Port-to-Port) The switches that provide uplinks to each WAP must also support user-to-user security to eliminate the risk of users going to the same destination. This is accomplished with port-to-port security or VLANs. Port protection provides this security as long as the WAPs are all connected to a single switch, however, if multiple switches are used, port protection often does not provide security between WAPs connected to different switches. Using a separate VLAN for each WAP is the most secure method of user-to-user security. 2. User-to-User Security (VLAN) VLANs and multiple SSIDs can provide absolute user-to-user security. Each is in a separate domain” which means that if a user in VLAN1 sends a layer “broadcast three broadcast (such as an ARP broadcast), no user in VLAN2 will see the broadcast because each is in separate domains.” Switches and higher- “broadcast end WAPs are both capable of supporting VLANs. To interconnect a switch that has multiple VLANs and a WAP that has VLANs, a is configured to pass this “trunk” information.
B. Security Filters Guests cannot view other user activity on a shared wireless network due to “Intracell blocking,” which forbids direct communication or Publicly Secure Packet Forwarding (PSPF) which denies all inter-client traffic. Regardless of what the service is called, a dynamic filter prevents any two MAC addresses that enter the same radio interface from going to a destination on the same interface. For example, when USER1 enters interface Radio1, access is allowed on any destination on FA0 / 0 (the uplink port to the Internet), but no access is given to view USER2 who is connected to Radio1 at the same time. This filter provides a level of security to any user connected to this radio. However, a user at this point could still connect to another user who happens to be on another radio (WAP). Types of security for applications on the same infrastructure are given below. 1. User-to-User Security (Port-to-Port) The switches that provide uplinks to each WAP must also support user-to-user security to eliminate the risk of users going to the same destination. This is accomplished with port-to-port security or VLANs. Port protection provides this security as long as the WAPs are all connected to a single switch, however, if multiple switches are used, port protection often does not provide security between WAPs connected to different switches. Using a separate VLAN for each WAP is the most secure method of user-to-user security. 2. User-to-User Security (VLAN) VLANs and multiple SSIDs can provide absolute user-to-user security. Each is in a separate “broadcast domain” which means that if a user in VLAN1 sends a layer three broadcast (such as an ARP broadcast), no user in VLAN2 will see the broadcast because each is in separate “broadcast domains.” Switches and higher- end WAPs are both capable of supporting VLANs. To interconnect a switch that has multiple VLANs and a WAP that has VLANs, a “trunk” is configured to pass this information.
2013-08-08_Wireless_in_Hospitality_v1.1.docx