CCNA Wireless Cheatsheet

A lot of this is notes from Pearson's CCNA Wireless 200-355 Complete Video Course.

Table of Contents

RF Communications

RF Propagation

Radio Wave - AC Current in Antenna - Electric field radiates radio wave

Amplitude - size of wave bottom to top - amount of energy - created by antenna and electricity that goes through it
Frequency - how often during a second you see a cycle (Hertz)
Wavelength - distance from peak to peak
F = c / lambda (Frequency, c-speedoflight, lambda-wavelength)

2.4ghz - 12cm wave
5ghz - 5.5 cm wave

Absorption - energy of wave partially or completely absorbed by object, wall, etc.
Refraction - angle of wave gets changed by different material
Scattering - some of the light particles get sent in different directions my passing through another material
Reflection
- Angle of reflection is identical to angle of arrival
- Different materials reflect different bandwidths
- Angle of reflection/arrival, material, and a wave's energy, will determine how much of wave will reflect and/or passthrouh
- multipath different reflected paths will take different amounts of time to arrive
Free path loss - as wave spreads out from initiation point, it must cover more space with the original amount of energy
Link budget how much energy you must set up, so it can serve the point farthest away
Slow fading - energy that goes around big obstacle - some loss absorbed - outdoors
Radio line of site - wifi freq can get through(?)
Fresnell zones - zones close to line-of-site (zone 1 closest, zone 2 next closest, and so on)
- Zone 1 should be 60% (or more) free from obstacles

Indoor worry about
- Absorption
- Multipath
- Free path loss

RF math

Watts - measure of electrical energy
- milliwatt - thousandth of a watt - wifi - 1 to 100 mW
- megawatts - broadcast radio
- 1000 watts - microwave oven
Decibals - how far to lose 1/2 of your sound/power
- dB for sound, dBV for volts, dBm for milliwatts
- 0 dB looks exactly like your reference power
  
  +3 dB 2 x reference power - rule of 3s
  
  -3 dB 1/2 reference power
  
  +10 dB 10 x reference power
  
  -10 dB 1/10th reference power
- these #s are approximations - start with 10s for better
  in a worst case scenario ;) , look them up (e.g. dbm to mW conversion table)
- with WiFi dBm reference is 1 mW to measure current power (0dBm diff)
```
what is 30 dBm in mw?
1    x 10 = 10mw	10dBm
10   x 10 = 100mw	+10dBm = 20 dBm
100  x 10 = 1000mw	+10dBm = 30 dBm

36 dBm in mw?
1000 x 2 = 2000mw	+3dBm = 33 dBm
2000 x 2 = 4000mw	+3dBm = 36 dBm
```

-50dBm = 0.00001mw
-90dBm is weakest power doable in wifi

Antenna Power
- dBi (vs. Isotropic - 'perfect' point antenna)
dBd (vs. Dipole antenna/rubber duck - cheap antenna cheap hardware)

donut shaped electromagnetic
0 dBd = 2.14 dBi...add 2.14 to get from dBd to dBi

effective isotropic radiated power (EIRP)

EIRP (dbm) = radio Tx Power (dBm) - cable loss (dB) + antenna gain (dBi)
ERP is same but antenna gain is in dBd

RF signals

Received Signal Strength Indicator (RSSI) shows how much signal was received
- usually a negative number (e.g. -76 dBm)
- is vendor independent depending on chip, wiring, and antenna characteristics, and calculations that vendor uses
- rule of thumb - do not trust a RSSI value more that 4 dBm
SNR - signal to noise - measures how much higher signal level is vs. noise
- < 10db is bad... > 20db is considered good
noise - background signal you cannot use
interference - specific object creating signal in your desired bandwidth
device capabilities - different (EIRPs) depending on antenna and other hardware used by default - design for your weakest devices

antennas

radiation parameter chart

gain - amount more than isatropic radiation pattern
Horizontal Plane (H-plane / Azimuth Plane) - rp 2d view from above or below
Elevation Plane (E-plane / Vertical Plane) - rp 2d view from side
measuring rp - walk around antenna equadistantly (in a circle), and measure signal strength.
- graph on polar chart showing dbm loss from central 0dBi (loss) point
- tool usually automatically measures in controlled (noise/interference/etc.) environment

Antenna Signal and Direction

directional - more energy sends in one direction
- Patch antenna - rp chart shows e-plane and h-plane energy in 1 direction - used in hallways, and large conference room
- Yagi antenna - comb antenna inside tube - even more in one direction, with excessive butterfly effect in radiation pattern - used outdoors, in warehouse - commonly shoot signal 100-200ft
- Dish antenna - rp power very unidirectional to remote power - point to point, outdoor
omni-directional - energy sends in all direction, minimal in backwards connection

omnidirectional AP, 'rubberduck', laptopoon screen side (sometimes robber duck type)
'ceiling mount' or mast mount' (outdoor omnis) - H-plane is pretty unilateral - more coverage90 and 270 degrees - a little butterfly effect - typical 12 or 5 dBi - will radiate pretty far, but only in flat plane
dual omni - 2 directional antennas stuck together - not a real omni antenna - used in large warehouses

Amount of energy doesn't change due to antenna, just direction and dispersion.

Polarization

signal sent has orientation - caused by combo of electric and magnetic field - 90 degrees oriented to each other

if the 2 sides of your ptp directional antenna are out of alignment (vertical or horizontal polarization), you can lose 20 dB
outdoor important, indoor less so because of signal bouncing around off of objects...
typically wifi is vertically polarized...

Antenna effects on EIRP

EIRP (dbm) = radio Tx Power (dBm) - cable loss (dB) + antenna gain (dBi)
ERP is same but antenna gain is in dBd

if you have external antenna, remember to put gain into WLC/IOS/etc, so system will modify output for country regulatory requirements.

RF Transmission regulations

Spectrum

copied from Pearson's CCNA Wireless 200-355 Complete Video Course

2.4GHz not good for communication...ISM - Industrial, Scientific, and Medical bandwidths

2.4 GHz has 11 to 14 channels but they are too close to one another to be used individually by wifi
other non-wifi compatible systems that use 2.4GHz include cordless phone, bluetooth, zigbee, analog camers, xbox fhss, microwave ovens, wifi inverted, super ag

5GHz is preferred bandwidth for wifi - more channels available

diff countries allocate different bands in 5GHz for different purposes
Radar, DFDS channels use UNII-2 and UNII-2 Extended frequencies for non-wifi purposes

wifi uses 22 MHz-wide channels, with powers up to 100mw
other ISM Bands - license free, but not regulation free
diff ISM bandwiths that could be used for wifi (e.g. 900 Mhz, 600Mhz/TV Whitespace, 60GHz-802.11ad) are not consistantly defined in different regions (3 of them) parts of the world

Regulatory Bodies

fcc etsi etc...

each country or region defines its rules about the use of rf space
FCC 2.4 GHz Rules
- for point-to-multipoint link, removing 1 dB in power allows for 1dB to antenna gain
- doe point-to-point links, removing 1 dB in power allows for 3dB added to antenna gain
ETSI 2.4GHz EIRP output rules
- max of 20 dBm EIRP on point to multipoint and point to point installs. also stipulates 17dBm max transmitter power with 3dBi gain attributed to antenna and cable combination
- professional installers allows to increase the gain of an antenna/cable system if transmitter power is reduced below 17dBm in 1:1 ratio

IEEE/wifi alliance

ieee defines 802.11 - no vendor/product implements all of standard
wifi alliance - only company representation - what is missing today in wifi - design certifications - ensures compatibility among vendors

802.11 transmissions

amount of info/data you need to send corresponds to bw
FHSS - freq hopping spread spectrum - sender and receiver follow agreed upon hopping algorithm for transmitting data
DSSS - Direct sequence spread spectrum - send bits over wider band - better for scaling
- use Barker 11 - 1 bit converts to 11 bits or chips to create a symbol - 01001000111
- each bit takes 2mhz frequency width, sending 11 in parallel takes 22 MHz
Binary Phase Shift Keying - BPSK - also called Differential BPSK
- 0 reg wav on clock tick
- 1 reverse direction on clock tick
- supports 1Mbps for wifi
Quadrature Phase Shift Keying - QPSK
- each clock tick represents 2 bits
- 00 - don't change wave
- 01 - restart from bottom or top of wave based on wave direction
- 11 - reverse dir
- 10 - restart from bottom or top of wave based on (opposite of) wave direction
- supports 2Mbps for wifi
Complementary Code Keying (CCK)
- CCK4 - 6 bit chip sequence w/ 90 degree orientations codes 4 bits
- CCK8 - 6-bit chip encodes 8 bits - 11 Mbps
Orthogonal Frequency Division Multiplexing (OFDM)
- Send multiple small bandwidths within the 22 Mhz, polarized so they don't overlap
  - rotate polarization 90 degrees every bandwidth, magnetic and electric at right angles
  - 64 waves (tones or subcarriers),312.5 KHz apart
  - 312.5KHz x 64 = 20 MHz out of 22MHz DSSS
  - 52 of 64 used, 48 carry data, 6 guide the wave w/ predetermined data sequence, 5 more to isolate against neighboring channels...
  - using BPSK - 12Mbps per OFDM wave (actually 6 or 9 with repeating data
  - using QPSK - 24Mbps per OFDM wave (actually 12 or 18 with repeating data
- layer QAM (Quadrature Amplitude Modulation) - play with orientation and power - create a constellation showing what powers and angles can be expected.
  - 16-QAM - each point on a 2d grid represents a code 0-15 (4 bits)
    - 48 Mbps per OFDM wave (actually 24 or 36 with repeating data)
  - 64-QAM - each point on a 2d grid represents a code 0-63 (6 bits)
    - 72 Mbps per OFDM wave (actually 48 or 54 with repeating data)
  - 256-QAM - each point on a 2d grid represents a code 0-255 (8 bits)
    - 96 Mbps per OFDM wave (actually 78 or 86 with repeating data)
- In noisy environment, downgrade signal from 256-QAM to 64-QAM to 16-QAM to QPSK to BPSK
Channels and Overlaps

WiFi Specs

2.4 GHz 11 to 14 channels too close to be used by wifi 22MHz/20MHz(OFDM) channels.
Use 1,6,11. Some areas use 1,5,9,13 w/ 20MHz channels, minor overlap with OFDM. Doesn't work well with voice. Counteracts IEEE channel def saying channels must be separated by 25MHz total.
- When 2 channels are 25MHz apart are 'adjacent'.
- Channels 40 MHz apart are 'alternate-adjacent'.
- Receiving filters - anything 11MHz away must be -30dBr. anything 22MHz away must be -50dBr
5GHz channels 20 MHz apart already.
- still a good idea to leave one channel space if 2 APs are in the same area
  copied from Pearson's CCNA Wireless 200-355 Complete Video Course

Connecting WiFi Devs

IBSS - Independent Basic Service Set - 2 devices talk directly to each other - not used alot today - doesn't scale well beyond 8 to 10 devices. described in 802.11
WiFi Direct - central device communicates to another device to print or display screen or file. Described by WiFi Alliance
Infrastructure mode - WAP at center - 2 laptops send to each other through wap. more efficient because central ap coordinates traffic
- Distribution System (DS) - AP distributes packets to endpoints
- Basic Service Area (BSA) - Area that AP services.
- Basic Service Set (BSS) - Services that WAP provices to BSA
- Service Set Identifier (SSID) - name wap gives out defining network
- BSSID - MAC each WAP IDs itself with- different per SSID
- MBSSID - Multi Basic Service Set ID - used for more than 1 SSID and MBSSID
- Roaming - Moving from one WAP to another. WAPs comm with each other (wired)
- Extended Service Set (ESS) - user roaming between APs, share WLC connectivity
- make sure APs near each other are using different channels
Repeater
Workgroup Bridge (WGB) - device translates to clients that are wired only island
Bridges - connecting bldg to another bldg - root bridge communicate with non-root bridges. non-root bridge cannot talk to other non-root bridges
Mesh - many access points, multiple Root Access Point (RAP)s with access to wired network. Mesh Access Points (MAP)s don't have wired access
- Cisco Adaptive Wireless Path Protocol (AWPP)
- IEEE 802.11s

Wireless Medium

WiFi Specs

CSMA/CA - Carrier Sense Multi Access with Collision Avoidance
- Each device uses temp - slot time
- Standard cells use short silence value called Short Inter Frame Space (SIFS)
- Distributed Inter Frame Space (DIFS is SIFS + 2 slots)
  Protocol SIFS(microsec) Slot time (microsec) DIFS = SIFS+2ST
  
  802.11b 10 20 50
  
  802.11g/n 10 9 28
  
  802.11a/n/ac 16 9 34
- Backoff Timer - initial number picked to count down from
- Contention window - possible values for backoff timer - > CWMin, < CWMax
- Network Allocation Vector - total time you wait before sending
- Once send - send duration
- half-duplex - every frame ack'ed
  - ap waits 1 SIF to ack
  - station than waits 1 DIFs before counting down again
- 802.11e - wifi qos - better countdown - 4 Qs - Voice, Video, BE, Guest
  - AC - access Cat - Platinum (Voice), Gold (Video), Silver (BE), Bronze (Background)
  - AIFS - Arbitration Interframe Space (DIFS equiv when QoS is used)
  - Contention window and DIFS is smaller for higher AC/queue
Frame content
- Data - possibly empty
- Mgmt
  - Beacon, probe req, probe resp
  - Auth req, auth resp
  - Assoc req, assoc resp
  - Deauth, re-assoc req, re-assoc resp
  - Action - e.g. moving to another channel, pls join me; pls scan that chan for intrfrnce
- Ctrl
  - RTS, CTS, ACK, block ACK
- Mgmt
  - Beacon (broadcast) frm WAP every 100ms telling info about network (SSID, Mac addr of WAP, speeds)
  - Probe req - do you/anyone do this type of network
  - Probe resp (from AP - yes I do this type of network, and here is how my ssid is set)
  - Auth req, resp - do you have right chars (and later security)
  - Asssoc req, Assoc resp - I want to join your cell
  - De-auth, followed by Disassoc
  - reassoc req, reassoc resp
- Action
  - 802.11k - what other APs are around here on what channels, here is list
- Control
  - Ack (only unicast packets)
  - Frame to many
  - RTS/CTS - ap says I saw a collision - station sends RTS, if clear AP sends CTS

Protocol	SIFS(microsec)	Slot time (microsec)	DIFS = SIFS+2ST
802.11b	10	20	50
802.11g/n	10	9	28
802.11a/n/ac	16	9	34

Speed and Channel Protocols

WiFi Specs

Frame Speeds

Standards categorize speeds as:

Basic/mandatory - client must support these rates to be allowed in the cell
Supported/optional - client can support or not
Disabled - not allowed in cell

Broadcasts/Beacons sent at 1st mandatory rate
n/ac rates are never mandatory

Unicast frames are sent at best rate for ap to get to particular receiver. Downshift if ap thinks necessary (e.g. no acks)
2 types of frames - l2 mac header & physical header (inform receiver that frame is coming).
Interference Threshold - can only hear lower speeds including physical header
Physical Carrier Sensing Threshold - can't hear anything meaningful

WiFi Site Surveys

App Reqs

Data - not too much for page to load - non-coverage doesn't create > .5-1 sec loss
RT voice - minimize delay, jitter
RT video - tries to save on bw, minimize frame change desc, varies bw
- Interactive (vid conf) - audio more important
- Streaming - one way live - vid & aud qual
- Elastic vs. Inelastic codec
RT coverage rules
1. check bw of expected apps
2. mult by num of concurrent app users in the cell
3. this is bw at edge of cell
Location - triangulation - small cell & edge

Site survey Methodologies

Offsite: Planning ("predictive") - guestimate num of APs to create BOM, Survey duration (8-10/day?)
Onsite: Passive - use spectrum analyzer and 802.11 mapping tool - walk around env
Onsite: Active (AP on a stick)
- design per area
- start from absorption method
- start fr corner
  1. fig edge of cell strength
  2. put ap in corner of floor
  3. use device to measure where edge/ of cell/sig str is
  4. move ap 45 degrees to sig edge/distance - this becomes your cell center
  5. move to new edge of cell, and repeat
  6. 20% overlap for voice roaming handoff -> DistanceBetweenAPs = 1.374 * SignalCoverageRadius
  7. 10% overlap for data -> DistanceBetweenAPs = 1.611 * SignalCoverageRadius
  8. 15% overlap -> DistanceBetweenAPs = 1.486 * SignalCoverageRadius
After deployment: verify

Site survey tools

Planning tools
- Local install - Ekahau, Fluke, TamoSoft
- Server-based - Cisco Prime Infrastructure
- Cloud-based - Cisco RF Planner (Partner focused), Aerohive Planner
Onsite Mapping tools - Ekahau, Flukes
- Passive - let the tool figure out where the APs are as you walk around
- Active - you put in the APs before the walk around...
RF and 802.11 Tools
- L1 - RF - Metageek Chanalyzer, Cisco Spectrum Expert, Ekahau, Meraki, AirMagnet
- L2 - 802.11 WLAN Scanners - inSSIDer, Acrylic, Android and Apple IOS utilities
- L2 PacketCapture tools - Savius Omnipeek, Wireshark - need specific external adapter and driver

WiFi Authentication

Authentication

Something you know
Something you have
Something you are

Auth options

Open - Auth Req/Resp, Assoc Req/Resp, non-encrypted Data
WEP - weak/deprecated - Auth Req, Random Challeng String, WEP-encrypted Result(using shared key), Auth Resp, Assoc req/response
MAC - not 802.11, not very secure (easy to spoof MAC addrs - Auth Req/Resp, Assoc Req, WAP checks if MAC on white list, Assoc Resp, non-encrypted Data
Web Auth
- local web auth (lwa) - local to controller - could be ext user db/radius
- lwa w/ ext web server (pre-auth and/or post-auth redirect)
- cwa - central - wlc restricts access to cwa until auth is accepted. Cisco ICE (Identity Svcs Engine).
PSK
- Personal - Unicast Key - WEP shared key or WPA/WPA2 pre-shared key

802.1X - Supplicant trying to get access via Authenticator (Network Access Server (NAS)) which relays queries via Radius to Authentication Server

w/ EAP - extensible auth proto - header used in auth betw supplicant and authenticator
802.11i
Auth phase can be used to generate key on Supplicant and Auth svr - PMK (pair-wise master key) - Auth svr sends PMK to Authenticator
local EAP activates radius function on controller

Supplicant               Authenticator                Auth Svr
           --AuthReq-->
           <-AuthResp--
           --AssocReq->
           <-AssocResp-
           <------------802.1x/EAP Auth------------->
  Gen PMK                                              Gen PMK
                                       <--Send PMK---
           --PMKisSeed->
           <-4wayHndshk-
           -GenUnicast->
           <----Key-----

PKI (Public Key Infrastructure) and certs
- Give public key to others - they encrypt with this - assymetric - only their private key can decrypt
- use CA to authenticate public keys via CA's private key.
  - See a science partners public key with CA private key
  - client already trusts CA public key, so can view signed partners public key, and believe it
- check revocation list to make sure key has not been revoked...

EAP Types

EAP definitions

EAP-TLS

Encryption

Encryption types

Cipher - encrypt
Key - decrypt
Symmetric vs Asymmetric
clients get individual key and broadcast key

Key Management

PMK is known/generated by clients and authentication server. Authentication server tells WAP PMK.
Pairwise Transient Key used to encrypt packets. Can be regenerated every few packets or hundreds of packets or number of minutes (based on an index).
Group Master Key end Group Temporal Key used to encrypt broadcast traffic. These will be known by all clients and WAP.
After successful authentication, the Master Session Key (MSK) is derived on both the authentication server and the client. The key is then sent from the authentication server to the WLC. A Pairwise Master Key, or PMK (which is an extract of the MSK) is then generated. the PMK his views through the four-way handshake to create the PTK used to encrypt individual unicast frames.

WPAv2 4 way handshake

Client               WAP/Controller
    PMK 		PMK
			ANonce
         <-ANonce--
 SNonce
         --SNonce->
         <-GTK (MIC)-
    --Key installed (MIC)-->

WPAv1 4 way handshake

Client               WAP/Controller
    PMK 		PMK
			ANonce
         <-ANonce--
 SNonce
         --SNonce, WPA IE (MIC)->
         <-GTK (MIC)-
	--PTK installed (MIC)-->
		 <-GTK (MIC)-
    --GTK installed (MIC)-->

IDS/IPS/wIPS

IDS - basic version built into WLC
wIPS (Wireless Intrusion Prevention System) - e.g. Cisco Prime infrastructure with Cisco Mobilty Services engine w/ wIPS - more complete than basic IDS

Wireless Architectures

AP control options

Autonomous mode - Good for one AP
Controller based - good for multiple APs that need to know about each other

Controller can be on an appliance, ap, router, vmware appliance, switch (converged access), or in the cloud
typically centralized
data and control can be separated.
- Flexconnect is one way
- Cloud (Meraki) is another

Converged access (merging WLC into local switch) may or may not make sense depending on where the data flows, through access, distribution, work or levels.

Unified Access Architecture

One Mgmt pane of glass for wired and wireless
one policy for multiple policy and for some points across the network
One network

inside one network, there are multiple deployment models
Distributed wireless
centralized wireless
converged access is one of the deployment models

Wireless deployment options

Autonomous
centralized
Converged
Flex connect
Cloud managed

Most of the time ports connected to a WAP are in access mode.
Link aggregation (LAG)-link multiple trunks between switch and controller

AireOS controllers can only have one LAG
AireOS controllers do not negotiate LAG. Switches have to be 'mode on'
IOS XE controllers can have multiple LAGs, and can negotiate LAGs (LACP or PaGP)

Real time functions- handled by the WAP
system wide functions- handled by controller
data plane and control plane can be treated differently
FlexConnect can keep the data plane local (can be delineated by SSID)

CAPWAP
- Control plane is UDP 5246, and is DTLS encrypted.
- Data plane is UDP 5247, by default not encrypted, but can be

0 dB	looks exactly like your reference power
+3 dB	2 x reference power - rule of 3s
-3 dB	1/2 reference power
+10 dB	10 x reference power
-10 dB	1/10th reference power