Cisco 7920 Administration Guide - Page 47

Chapter 2 An Overview of the Wireless Network Components of the VoIP Wireless Network Security Mechanisms in the Wireless Network Before a wireless device can communicate on the network, it must authenticate with the access point or the network by using an authentication method. The Cisco Wireless IP Phone 7920 can use these authentication methods in the WLAN: • Open Authentication-In an Open system, any wireless device can request authentication. The access point that receives the request may grant authentication to any requestor or only to requestors on a list of users. Communication between the wireless device and access point could be non-encrypted or devices can use WEP keys to provide security. Devices that are using WEP only attempt to authenticate with an access point that is using WEP. • Shared Key Authentication-During shared key authentication, the access point sends an unencrypted challenge text string to any device attempting to communicate with the access point. The device that is requesting authentication encrypts the challenge text using a pre-configured WEP key and sends it back to the access point. If the challenge text is encrypted correctly, the access point allows the requesting device to authenticate. A device can authenticate only if its WEP keys match the WEP keys on the access points. Shared key authentication can be less secure than open authentication with WEP because someone can monitor the challenges. An intruder can calculate the WEP key by comparing the unencrypted and encrypted challenge text strings. • WPA Pre-Shared Key (PSK) Authentication-The access point and the phone are configured with the same authentication key. The pre-shared key (or password phrase) is used to create unique pair-wise keys that are exchanged between each phone and the access point. You can configure the password phrase as a 64-character hexadecimal string or as an ASCII password of from 8 to 63 characters in length. Because the pre-shared key password is stored on the phone, it can be compromised if the phone is lost or stolen. • LEAP Authentication-For maximum security, client devices can authenticate to the network by using a Remote Authentication Dial-in User Service (RADIUS) server such as the Cisco Access Control Server (ACS). OL-7104-01 Cisco Wireless IP Phone 7920 Administration Guide for Cisco CallManager Release 4.0 and 4.1 2-13