Chapter 8. Wireless Wide Area Networks | The Practice of Network Security: Deployment Strategies for Production Environments

Wireless networks have become very popular in recent years , with good reason: They are usually less expensive than traditional wired networks to implement, plus a wireless network can be quickly deployed anywhere , making it attractive to companies with a mobile or rapidly expanding workforce.

As with wired networks, there are two types of wireless networks: LAN and WAN. This chapter covers some of the security issues related to WANs, and the next chapter covers potential security problems with wireless LANs. It is important to understand that wireless networking technologies are rapidly evolving. Some of the concerns raised in these two chapters will undoubtedly be addressed in the near future. As with any other technology, it is important to discuss security concerns with your vendor before implementing a wireless network.

Wireless WAN technology has two primary uses:

Connecting to the Internet
Connecting offices that are dispersed throughout a city

Wireless WANs have emerged as a low-cost alternative to a traditional methods of Internet access. Wireless WAN connections can offer the same amount of bandwidth as a T1, at a fraction of the cost. Wireless connections are also being deployed in areas where cable and DSL access is not available.

From a service provider perspective wireless access is especially nice, because the service provider has end-to-end control of the deployment process. Setting up a DSL account for a customer can involve more than a month of waiting for the ILEC to install and test the line, then direct that line to the service provider's equipment. In addition, if there is a problem, there is often a lot of finger pointing between the service provider and the ILEC as to where the problem lies.

DSL can also be significantly more expensive to deploy than wireless access and provides less reach. When a service provider offers DSL, equipment has to be provisioned in every CO that serves the area in which the provider wants to offer service. Even after installing the equipment, DSL can realistically only be offered to homes and offices within 21,000 feet of the CO. Generally this is enough to serve about 70 percent of the people within the area.

Wireless access, on the other hand, has a much greater service area. Depending on the terrain, and the type of service offered, a receiver placed on a high enough tower could serve a radius of 35 miles, often more than the area covered by four or five COs. This allows a provider to cover the same area with wireless access for one-fifth the cost of deploying DSL.

The contrast is even more apparent when comparing wireless access to a traditional T1. In addition to higher costs associated with T1s in general, there is the local loop charge that has to be paid to the ILEC. Local loop charges can be more than $300 over the cost of the actual T1. With wireless connections the ILEC is out of the picture, so there are no local loop charges. In addition to the lower cost, customers of the service provider benefit from the fact that they only have to deal with one company in the event of a failure. As with DSL, the ISP owns every aspect of the connectivity, so if there is a problem, there is only one point of contact.

The other use of wireless networking is connecting offices that are dispersed throughout a city. It is not uncommon for a company to outgrow its existing office and look for additional space. Often the company does not want to interrupt business by moving everyone, or the company is unable to find enough space in a single location to accommodate all employees . The company may also be unable to get out of their existing lease. Whatever the reasons, a company may find itself with three or four offices spread throughout a relatively small area.

In situations like this, you still want the employees in the remote office to have access to the servers and facilities in the main office, where server administrators reside. Creating a VPN, as discussed in Chapter 7, is the generally accepted way to do this. Unfortunately, with a VPN and three offices, you are generally paying for three Internet connections, maintaining three firewalls, and administering three routers. Alternatively the company has to pay a monthly fee for two private lines to the main headquarters.

Wireless connectivity can be especially useful in this situation. Rather than paying a monthly fee for private lines, a company can run its own wireless connections, which bypass both the ILEC and the ISP. This type of VPN often has a higher initial cost, but because there are no recurring monthly costs to outside organizations ” assuming the company has the in-house expertise to manage the wireless network devices ”the overall cost savings is substantial.

Wireless networks do have their problems; the most notable and often talked about is their inability to function in severe weather conditions. Depending on the technology used, wireless networks have a tendency to fail, or significantly reduce their capacity and distance capabilities during rain, fog, or snow. The second most commonly mentioned problem is their lack of compatibility, and how quickly the architecture is progressing. The speed and distance capabilities of wireless WANs have increased dramatically in the last couple of years, and growth is expected to continue. Unfortunately, this often means buying new equipment every couple of years to keep pace with the new technology. Contrast this with Ethernet, or frame relay, both of which have remained relatively constant.

Given the importance of an interoffice VPN, or a company's Internet connection, a wireless network may not be the best solution. Check with your wireless equipment vendor, and follow up with independent sources to determine how their equipment will perform during extreme weather conditions, how it interoperates with other equipment, and what sort of upgrade paths the vendor offers to avoid equipment obsolescence after a couple of years.