Deploying and securing wireless networks

Why this matters

This is the domain 2 capstone. The previous lesson covered the radio; this one covers the topologies you build with it and the security you put on top — and wireless security is where the exam is least forgiving, because the obsolete options are still offered as answers and still present in real equipment.

If you take one thing from this lesson, take the WPA2/WPA3 and PSK/Enterprise distinctions. They appear constantly, in this domain and in domain 4.

The lesson

Antenna choice in deployment

The previous lesson introduced the two patterns; here is how they get used.

Omnidirectional antennas cover an area from a central point and are the default for indoor APs. Directional antennas concentrate energy into a beam for reach and interference rejection.

The deployment rule: use directional where the shape of the space is long and narrow, or where you are linking two fixed points; use omnidirectional where you are blanketing an area with users moving around in it. Aiming a directional antenna is a real task — a few degrees of error over a long link is the difference between a solid connection and an intermittent one.

Network types

Infrastructure mode is the normal arrangement: clients associate with an access point, and all traffic passes through it, including traffic between two clients on the same AP. The AP bridges to the wired network. Centrally managed, securable, and what essentially every business network uses.

Ad hoc is peer-to-peer with no access point — devices talk directly. Quick to set up with no infrastructure, and it scales badly, is hard to secure, and has no bridge to a wired network. It survives mostly in direct device-to-device transfers.

Mesh networks have APs that connect to each other wirelessly rather than each needing a cable back. One or more nodes have a wired uplink, and the rest relay traffic through their neighbours.

The benefit is coverage where cabling is impractical or expensive — a warehouse, an outdoor site, a listed building. The cost is that every wireless hop consumes airtime twice, once to receive and once to relay, so throughput falls with each hop. Mesh is a solution to a cabling problem, not a performance choice.

Point to point links two fixed locations with directional antennas at each end — most commonly a building-to-building bridge where trenching fibre is not viable. Needs line of sight, and needs mounting stable enough that wind does not move the aim.

Autonomous versus lightweight APs

Autonomous ("fat") APs hold their own full configuration. Fine at small scale; at thirty APs, every change is thirty logins and nothing coordinates channels or power between them.

Lightweight ("thin") APs are managed by a wireless LAN controller. The controller pushes configuration, assigns channels and transmit power across the estate so neighbours do not interfere, coordinates roaming so clients move between APs smoothly, and provides one view of every client and AP.

The exam cue is scale and consistency. A handful of APs, autonomous is defensible. A campus, a controller — and the reason usually given in the correct answer is centralised management and RF coordination.

Encryption: WPA2 and WPA3

The protocols that protect traffic over the air, in the order they arrived.

WEP is broken. It can be cracked in minutes with freely available tools. If it appears as an option, it is wrong.

WPA was the interim fix using TKIP. Also deprecated and also wrong.

WPA2 uses AES with CCMP and has been the baseline for years. It remains acceptable, and it is what most deployed equipment runs.

Its known weakness is the KRACK attack against the four-way handshake, and — for the personal variant — that a captured handshake can be attacked offline, so a weak passphrase eventually falls to brute force.

WPA3 is the current standard, and it fixes exactly that. Its key improvement is SAE (Simultaneous Authentication of Equals), which replaces the pre-shared key handshake with a password-authenticated key exchange. Two consequences matter:

• Offline dictionary attacks stop working. An attacker who captures the exchange cannot take it away and grind at it, because each guess requires a fresh interaction with the network.
• Forward secrecy. Traffic captured today cannot be decrypted later even if the passphrase is eventually learned.

WPA3 also adds protected management frames, which blunt deauthentication attacks, and Enhanced Open (OWE) for open networks — encryption without authentication, so a public hotspot is no longer plaintext to everyone nearby.

The exam ordering: WPA3 > WPA2 > WPA > WEP, and WPA3 is the answer whenever "most secure" is asked.

Authentication: PSK versus Enterprise

Independent of the encryption version, there are two ways to decide who may join. This distinction is examined heavily.

PSK (Pre-Shared Key), also called Personal mode. Everyone uses the same passphrase. Simple, no infrastructure, appropriate for homes and very small offices.

Its problems are all consequences of sharing one secret:

• When an employee leaves, the key must be changed on every device, so in practice it never is.
• Everyone's traffic derives from the same secret.
• There is no per-user identity, so logs show a device, never a person.

Enterprise mode uses 802.1X with a RADIUS server, and every user authenticates with their own credentials — username and password, or a certificate.

The benefits follow directly:

• Per-user accounts, so revoking one person's access affects nobody else.
• Unique keys per session, so users cannot decrypt each other's traffic.
• Real accountability in the logs, tied to an identity.
• Policy per user or group — the finance team can be placed in a different VLAN automatically on association.

The cost is infrastructure: a RADIUS server, a user directory, and certificate management if you use certificates.

The three roles in 802.1X are worth naming because questions use them: the supplicant (the client), the authenticator (the AP or switch), and the authentication server (RADIUS).

Any scenario mentioning employee turnover, per-user access, or accountability wants Enterprise.

Guest networks and captive portals

A guest network gives visitors internet access without giving them the corporate network. Done properly it is:

• On its own SSID and its own VLAN.
• Isolated from internal networks by firewall policy, not merely by being named "Guest".
• Client-isolated, so guests cannot see each other — which matters, because a compromised visitor laptop should not be able to reach the other visitors.
• Rate-limited, so it cannot consume the site's bandwidth.

A captive portal intercepts the first web request and redirects it to a page that must be interacted with before internet access is granted — accepting terms, entering a code, providing an email, or paying. Familiar from hotels, airports and coffee shops.

Two limitations worth knowing. A captive portal is an authorization gate, not an encryption mechanism: the wireless itself is usually open, so traffic is unprotected unless the network also uses Enhanced Open or the user runs a VPN. And portals interact badly with devices lacking a browser — printers, IoT sensors, some media devices — which is why those typically need a separate mechanism such as MAC-based authentication.