IP Filters URL Blocking MAC Filters Domain Blocking Virtual Server MAC Filters Use MAC address to allow or deny computers access to the network Application Disabled MAC Filters Filter Only allow computers with MAC address listed below to access the network Only deny computers with MAC address listed below to access the network Firewall Blocked computer 2 MAC Address DHCP Client select one Clone Apply Cancel Help Performance MAC Filter List MAC Address Blocked computer 1 00-40-05-7A-AA-40 Figure 8-14: Enabling MAC Address Filtering commonly used authentication protocol, providing centralised authentication, authorisation and accounting services. Kerberos is another authentication protocol, developed by the Massachusetts Institute of Technology, and provides tools for authentication and strong encryption particularly for client/server applications. The source code is freely available from MIT and has also been incorporated into a range of commercial products. Intrusion Detection Intrusion detection software can be run to continuously monitor activity on the WLAN and generate an alarm when any unauthorised device, such as a rogue access point, is detected. Typically intrusion monitoring is based on specifying parameters that identify normal, authorised WLAN devices and traffic, as shown in Table 8-10. When devices or network activity is identified that deviates from the specified parameters, an alarm is generated that can either be used to Chapter Eight Table 8-9: WLAN Operational Security Measures Operational security measure Description Use an encrypted protocol, such as SNMP v3 provides encryption of access point SNMP v3, for access point management messages, whereas SNMP v1 configuration and v2 do not provide the same level of security. Consider other forms of user If a risk assessment identifies unauthorised authentication for the wireless access as a key risk, authentication services or network such as RADIUS and protocols, such as RADIUS and Kerberos, can Kerberos provide a high degree of access security to p