WAP settings

[tstaskiewicz]

We are setting up an Internet connection for vendors and customers that come on our premises using a WAP 1130AG. This will be an open connection but we want to prevent or at least substantially reduce the availability to potential connections outside of our walls.

Does anyone know a method to reduce the range of the WAP? There are configuration parameters that appear to address range, but they are not very clear.

I appreciate any assistance you might provide.

Thanks,

Tom

[ethiel]

Hi Tom.

Your only real option (short of lining the walls with lead) is to reduce the power settings of the radios. The following link has some information about your options:

http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_guide_chapter09186a00804194ce.html#wp1017196

Without knowing the size of the building, composition of walls, etc, I would suggest trying different powers and checking if an average client device can see the network from outside. This will not prevent someone from pointing a strong antenna at your building and getting a connection, but it might keep out casual drivers-by.

[tstaskiewicz]

I was thinking that the power setting might be one solution. Another one that I think might work is to remove the options for low bandwidth connections. I'm thinking that as one gets further away from the AP the bandwidth connection reduces or anyway that seems to be my experience. The last option is to not broadcast the AP and for those that we want to provide with access, give them the AP name so they can enter it into their list of APs. By error I have found that this appears to work; I still need to verify for sure, but it might be an option.

Thanks for your great ideas and assistance.

Tom

[ethiel]

You are right, disabling lower data rates is another option as long as you are not using any legacy devices like handheld scanners that might require the 1mb data rate. Disabling broadcast SSID is good to keep people from wandering on to your network, but it is easy to find an SSID even if it is not broadcast.

One thing I usually do for guest networks is enable the highest security supported by the clients (even if it's just wep or wpa-psk). It will not keep determined hackers out, but anyone just looking for a free connection will just move next door to an open network rather than break your security.

Eric

[scottmac]

The other thing you can do, aside from reducing the power, is to use antennas to shape the radiation pattern.

If you need the AP / antenna in an outside corner, look at using a "sector" antenna with a 90 degree pattern.

If you need to shoot down a hallway, look into using a "patch" antenna ....

Unfortunately, the 1130 doesn't give you any of these options; any chance you can use the 1130s somewhere deeper into the building, and put something like a 1200 series near the outside walls?

I suppose you *could* mount the 1130 on a metal plate (which would mount to the wall) to block external radiation ... the proverbial "grounded cookie sheet" should work OK.

If you're mathamatically clever, you could stand the AP away from the (ungrounded) cookie sheet and add to your forward ranges somewhat.

You have discovered one of the disadvantages of an integrated system; flexability. IT's convenient for most, but fot this application, IMHO, it was the wrong choice.

Good Luck

Scott

[jackyoung]

In addition to pervious ans., the mouting method of 1130 also affect the coverage. Cisco recommend to mount 1130 on the ceiling to max. the coverage, if you mount it on the wall, the coverage will be less. You may need to use a tool to test the coverage and make it balance w/ performance.

Hope this helps.