Print

Securing AirPort Extreme Networks with WPA

by Wei-Meng Lee, author of Windows XP Unwired, and contributor to Mac OS X Unwired
12/18/2003

With the release of Mac OS X 10.3 Panther, Apple provided a firmware upgrade for the AirPort Extreme Base Station and AirPort Extreme clients, which support the WPA (Wireless Protected Access) security standard for securing your wireless network. WPA is far more secure than WEP (Wireless Equivalent Privacy).

However, before you rejoice in this news, make sure you meet the following requirements:

  • You must be running Mac OS X v10.3 or later. If you still have not upgraded, well, time to do so.
  • You must be using an AirPort Extreme wireless network. That means your base station must be an AirPort Extreme one, and so must be your AirPort card. If you are using the 802.11b AirPort network, then you have to stick to WEP.

Upgrading your AirPort Extreme Base Station

Download the firmware upgrade for your AirPort Extreme base station, from Apple's web site. The file to download is AirPort Extreme FW 5.2.bin.

Here are the steps to upgrade your AirPort Extreme base station:

  1. Open the AirPort Admin Utility (located in /Applications/Utilities/).
  2. Select your base station from the list.
  3. Click Configure.
  4. Enter the password of the base station if prompted.
  5. Click the Upload icon in the toolbar or select Upload from the Base Station menu.
  6. Select the file AirPort Extreme FW 5.2.bin and click OK.

When the base station is finished updating, it will restart.

What is WPA?

WPA is an enhanced security standard developed by the Wi-Fi Alliance and IEEE to increase the security of wireless networks. As you probably know by now, WEP is inherently insecure, which means that any person intent on eavesdropping on your network communication can do so with the appropriate tools. To address this concern, WPA was designed as an interim solution (the longer-term solution lies in the 802.11i work group) to protect the privacy of wireless networks.

WPA contains the following components:

  • Use of TKIP (Temporal Key Integrity Protocol) for encrypting wireless packets.
  • Use of 802.1X and EAP (Extensible Authentication Protocol) for user authentication.
  • Use of MIC (Message Integrity Check) for checking the integrity of the packets sent over the air.

To log on to a WPA-protected network, you first need to supply a network password. TKIP then uses this password to mathematically generate an initial encryption key. All packets sent over the air now use this encryption key. To prevent this key from being discovered (by collecting and analyzing many packets), TKIP routinely changes and rotates this key so that it is never used twice.

In AirPort Extreme, WPA supports two modes:

  • Enterprise mode -- this mode uses a RADIUS (Remote Authentication Dial-In User Service) for user authentication.
  • Personal mode -- this mode uses a network password for user authentication.

802.1X

The 802.1X specification is a port-based network access control mechanism: when a client is authenticated, the port is granted access; if not, access to the port is denied. Although 802.1X was originally designed for ethernet networks, it can be applied to wireless networks as well.

Configuring for WPA Access

Let's now configure our AirPort Extreme base station to enable WPA. As usual, configure your base station using the AirPort Admin Utility.

Click on the Name and Password button on the left. On the right pane, click on the Change Wireless Security... button to change the security standard used for securing your AirPort Extreme network (see Figure 1).

Figure 1. Changing the wireless security mode.

In the Wireless Security drop-down list box, select WPA Personal if you do not have a RADIUS server in your network. This option is useful for home or small business networks (see Figure 2).

Select the Password option and key in the password twice. This password will be used to authenticate you on the network when you log on to the network for the first time. When you enter a password in the configuration dialog, an industry-standard hashing algorithm is applied to generate the full 64 byte pre-shared key.

Figure 2. Using WPA Personal with a password.

You can also select the Pre-Shared Key option to manually enter a key (see Figure 3). This option is really provided just as an additional option in case you are using non-Apple client software that does not do the proper hashing.The Pre-Shared Key is 64 hexadecimal (0-9, A-F) digits.

Figure 3. Configuring a Pre-Shared Key.

You can also click on the Show Options button to review more information about the encryption information. You can change the Group Key Timeout textbox to change the frequency of key rotation (see Figure 4).

Figure 4. Viewing options for changing Group Key Timeout.

For users with a RADIUS server for authentication, you should select the WPA Enterprise option (see Figure 5). Using a RADIUS server, your AirPort Extreme network will use 802.1X authentication to authenticate your wireless users. Your RADIUS server will contain user login credentials.

Figure 5. Using WPA Enterprise mode.

Once the AirPort Extreme base station is configured and updated, you should now be able to see the network on your Mac (see Figure 6).

Figure 6. Connecting to an AirPort Extreme network.

Select the Apple Extreme wireless network and you will be prompted to enter the password to log on to the network (see Figure 7).

Figure 7. Entering the password to connect to an AirPort Extreme network.

WPA Enterprise Mode and MAC Address Filtering Using a RADIUS Server

Note that if you use the WPA Enterprise mode, you will no longer be able to configure your AirPort Extreme base station to use MAC address filtering using a RADIUS server.

Summary

One thing to note about the use of WPA is that it greatly reduces the ability of people to eavesdrop on your wireless conversations. In security terms, it means the integrity of your wireless packets is protected. It does not, however, provide a strong authentication mechanism (since all users have to use a common network password, as shown in our example using WPA Personal). To ensure that only authorized users are connected to the wireless network, you need to use 802.1X authentication together with a RADIUS server.

Wei-Meng Lee (Microsoft MVP) http://weimenglee.blogspot.com is a technologist and founder of Developer Learning Solutions http://www.developerlearningsolutions.com, a technology company specializing in hands-on training on the latest Microsoft technologies.

Return to the Wireless DevCenter