Nortel Networks NN47250-500 Managing WEP keys

654 Managing 802.1X on the WSS
NN47250-500 (Version 03.01)
Managing WEP keys
Wired-Equivalent Privacy (WEP) is part of the system security of 802.1X. WSS Software uses WEP to
provide confidentiality to packets as they are sent over the air. WEP operates on the AP.
WEP uses a secret key shared between the communicators. WEP rekeying increases the security of the
network. New unicast keys are generated every time a client performs 802.1X authentication.
The rekeying process can be performed automatically on a periodic basis. By setting the Session-Timeout
RADIUS attribute, you make the reauthentication transparent to the client, who is unaware that reauthentica-
tion is occurring. A good value for Session-Timeout is 30 minutes.
WEP broadcast rekeying causes the broadcast and multicast keys for WEP to be rotated every WEP rekey
period for each radio to each connected VLAN. The WSS generates the new broadcast and multicast keys and
pushes the keys to the clients via EAPoL key messages. WEP keys are case-insensitive.
Use the set dot1x wep-rekey and the set dot1x wep-rekey-period commands to enable WEP key rotation and
configure the time interval for WEP key rotation.
Configuring 802.1X WEP rekeying
WEP rekeying is enabled by default on the WSS. Disable WEP rekeying only if you need to debug your
802.1X network.
Use the following command to disable WEP rekeying for broadcast and multicast keys:
WSS# set dot1x wep-rekey disable
success: wep rekeying disabled
To reenable WEP rekeying, type the following command:
WSS# set dot1x wep-rekey enable
success: wep rekeying enabled
Configuring the interval for WEP rekeying
The following command sets the interval for rotating the WEP broadcast and multicast keys:
set dot1x wep-rekey-period seconds
The default is 1800 seconds (30 minutes). You can set the interval from 30 to 1,641,600 seconds (19 days).
For example, type the following command to set the WEP-rekey period to 900 seconds:
WSS# set dot1x wep-rekey-period 900
success: dot1x wep-rekey-period set to 900
Note. Reauthentication is not required for using this command. Broadcast and multicast
keys are always rotated at the same time, so all members of a given radio and VLAN
receive the new keys at the same time.