3com 6.0.4.6 Manuel D’Utilisation

W

IRELESS

 LAN S

WITCH

 

AND

 C

ONTROLLER

 MSS V

ERSION

 6.0.4.6 R

ELEASE

 N

OTES

If you require the same MAC user to be able to con-
nect to more than one SSID, you can use encryption 
assignment to enforce the type of encryption a user 
or group must have to access the network. When you 
assign the Encryption-Type attribute to a user or 
group, the encryption type or types are entered as an 
authorization attribute into the user or group record 
in the local WX switch database or on the RADIUS 
server. Encryption-Type is an MSS VSA. Clients who 
attempt to use an unauthorized encryption method 
are rejected. In this way, a client could connect to any 
WEP encrypted SSID, but not a clear SSID. (See the 
Wireless LAN Switch and Controller Configuration 
Guide for more information.)

MSS and 3WXM provide robust options for securing 
management access, to WX switches and to the 
3WXM client and 3WXM monitoring service. To opti-
mize security for management access, use the follow-
ing best practices. 

When anyone attempts to access a WX switch, the 
switch authenticates itself by presenting a signed cer-
tificate to the management application that is 
requesting access. The switch’s certificate can come 
from a certificate authority (CA) or it can be gener-
ated and signed by the switch itself. 

3Com recommends that you use certificates assigned 
by a CA. Certificates from a trusted CA are more 
secure than self-signed certificates. Here are some 
trusted CAs:

If you use a self-signed certificate, configure the cli-
ents to not validate server certificates. If a client is 
configured to validate server certificates, the client 
will not be able to validate a self-signed certificate 
from the WX switch.

3Com recommends that you do not create usernames 
that have the same spelling but use different case. For 
example, do not create both username dang and 
username DANG. 

The CLI, as well as 3WXM, can be secured using pass-
words. By default, the following access types do not have 
passwords configured. Each uses a separate password.

■

■