3com WX1200 Nota De Lançamento

access are authorized to join the same VLAN from dif-
ferent SSIDs. This configuration might allow a hacker 
to more quickly discover keys by listening to both the 
encrypted traffic and unencrypted traffic for compari-
sons. You can either use the MSS SSID VSA or the 
encryption assignment VSA to prevent this problem.

If you only have one VLAN that each MAC-auth client 
should connect to, add the SSID VSA to the account 
for the MAC-address (either local or RADIUS). This 
will force the WX switch to only allow that MAC 
address to connect to the specified SSID.

If you require the same MAC user to be able to con-
nect to more than one SSID, you can use encryption 
assignment to enforce the type of encryption a user 
or group must have to access the network. When you 
assign the Encryption-Type attribute to a user or 
group, the encryption type or types are entered as an 
authorization attribute into the user or group record 
in the local WX switch database or on the RADIUS 
server. Encryption-Type is an MSS VSA. Clients who 
attempt to use an unauthorized encryption method 
are rejected. In this way, a client could connect to any 
WEP encrypted SSID, but not a clear SSID. (See the 
Wireless LAN Switch and Controller Configuration 
Guide for more information.)

MSS and 3WXM provide robust options for securing 
management access, to WX switches and to the 
3WXM client and 3WXM monitoring service. To opti-
mize security for management access, use the follow-
ing best practices. 

When anyone attempts to access a WX switch, the 
switch authenticates itself by presenting a signed cer-
tificate to the management application that is 
requesting access. The switch’s certificate can come 
from a certificate authority (CA) or it can be gener-
ated and signed by the switch itself. 3Com recom-
mends that you use certificates assigned by a CA. 
Certificates from a trusted CA are more secure than 
self-signed certificates. Here are some trusted CAs:

■

http://www.verisign.com

■

http://www.entrust.com

■

http://www.microsoft.com

The CLI, as well as 3WXM, can be secured using pass-
words. By default, the following access types do not 
have passwords configured. Each uses a separate 
password.

■

Console access to the CLI. To secure console 
access, configure a username and password in the 
WX switch’s local database, using the set user 
command. After you configure at least one user-
name and password, access to the CLI through the 
console requires a password. (Access through 
Telnet or SSH is not possible without a password, 
even on an unconfigured switch.) 

■

Access to the enable (configuration) level of the 
CLI, through the console, or through Telnet or SSH. 
To secure enable access, configure the enable pass-
word using the set enablepass command.