6.4 Secure Wireless

Ace your homework & exams now with Quizwiz!

What are potential causes of low link rates (5)

-Low SnR (causes clients to use low link rates even if signal is high) -low station signal (higher link rates require high signal strength) -high frame retry or loss rate (if there are a large number of collisions because of neighboring APs the radio will reduce it's link rate to make transmissions more reliable) -client cannot support latest wireless standard -link rates will be reduced if client enters power save mode

Captive portal(4)

-Mostly used for guest access -used as landing page when accessing resources on a network (Disclaimer, auth page, terms of use, etc) -system grants user access only after they have accepted disclaimer is successfully authenticates -applied to wired or wireless

What is required to perform local 802.1X on fortigate for wireless (3)

-PEAP as EAP method -local user database -use group applied to SSID

Fortiplanner premium features (2)

-Site survey Install AP in site survey mode to confirm wireless coverage by walking around floor and collecting real time information Transmit power levels, client loss, received signals strength, BSSID/SSID Planning stage -Live services Can evaluate and monitor the performance of a wireless network by creating real time heat map Requires floor plan and placement of APs to gather proper display info

Where can you find key information to start troubleshooting poor wireless performance and connection reliability (7)

-The Wifi dashboard widgets in the GUI -managed fortiaps -Wifi maps -Wifi events -Wifi client monitor -controller CLI -AP CLI

Bridge mode SSID (4)

-Traffic will be bridged directly to local lan that AP is connected to -both wired and wireless stations can be in the same layer 3 subnet -wireless traffic will be subject to the same firewall policies as the AP broadcasting the wireless network -local traffic is switches at the fortiswitch only CAPWAP control traffic does to wireless controller -useful when deploying an AP that connects to a wireless controller over a WAN link at remote location -some FortiAP models can perform inspection on wireless traffic without forwarding to wired network

How to maintain good wireless health (6)

-Utilization- <75% -Client count- <30 -temporary peaks are expected. -best possible link rates -be aware of clients capabilities -ensure the client is connected to the most suitable interface

What security mode supports local standalone AP (2)

-WPA2 -WPA3

How does 5ghz frequency compare to 2.4ghz frequency (4)

-Wavelengths are shorter -have shorter range -penetrate objects less -have less interference

WIDS detection includes: (5)

-Weak WEP encryption -Null SSID probe response that cause wireless cards and devices to stop responding -spoofed deauthentication broadcaststjat are a DoS attack causing clients to disconnect from AP -invalid MAC organizationally unique identifier (OUI) -various management, EAP, authentication, and beacon floods

How does AP frequency handoff work (5)

-When a client asks to join the 2.4ghz channel, the controller can evaluate if the AP is a dual band device and verify if the RSSI is strong. -If so the controller would not reply to the clients request and forcing the client to retry until it attempted to join the same SSID on the other band 5ghz. -After the controller sees the request on the 5GHz band the controller measures the RSSI again. -If the RSSI is acceptable the controller allows the client to join. -Otherwise the controller updates the device table and waits for the client to Time out then accepts it on 2.4ghz.

coherent frequency interference and how it cant be identified as such

-a co-channel or adjacent channel wifi signal produced by neighboring APs. Aps and clients can recognize it but it is still an issue because it reduces utilization/performance -channel utilization measures are a good indication

WPA3

-address KRACK vulnerability -features SAE which provides more resilient password based authentication for users that have passwords lacking complexity -mitigates dictionary attacks by using a secure handshake

Managed AP topology - connection over WAN/remote connection (6)

-aka datacenter remote management deployment -FortiOS wireless controller is remote -best to configure APs with the static IP of the Wifi controller (can be configured with 3) - ports 5246 and 5247 must be open for CAPWAP control and data -must be a routable path between FortiAP and the fortigate device -can also use DHCP or DNS option (static IP is best option)

Managed AP topology - switched/indirect connection (5)

-aka gateway deployment -fortiAP is connected to fortios through a layer 2 switch or layer 3 router. -automatic wireless controller discovery using static IP, DHCP, or DNS -ports 5246 and 5247 must be open for CAPWAP control and data traffic -there must be a routable path between the APs and fortigate -great for edge gateway deployments or enterprise campus/HQ deployment

Managed AP topology - distributed connection (4)

-aka wireless mesh deployment -One AP is the root of the mesh and is directly connected to the Wifi controller. root can be FortiAP or fortiwifi -one radio for backhaul SSID (CAPWAP control) and one radio for client SSID -best practice is to use 5GHz for backhaul SSID

For manual rogue AP suppression to work what three things must be enabled (3)

-ap or radio in dedicated monitor mode -enable sensor mode in WIDS profile -enable rogue AP detection in WIDs profile

what affects channel utilization in a wireless network (3)

-associated clients -neighboring clients -neighboring APs

what stages will you see when logging the step by step process of a client connecting to an AP diagnose wireless-controller wlac sta_filter <AP station mac> 2

-association request and response -PSK key exchange -DHCP phase

Captive portal types (3)

-authentication: users will be prompted for credentials -disclaimer + authentication: users must accept a disclaimer and authenticate using valid credentials -disclaimer only: users will need to accept a disclaimed

Pros of bridged mode SSID (3)

-both wired and wireless stations can be in the same subnet -potential 1GBps or more (if using link aggregation supported on APs) LAN throughput per FortiAP -certain FAP models can perform security profile inspection

Fortiplanner post deployment planning (3)

-can use the Wifi adapte in a windows laptop or tablet to detect the signal level from the deployed APs in order to confirm wireless coverage in real world analysis -measurements can be made while walking around environment -fortiplanner uses this to report coverage holes

Causes of channel over utilization (5)

-caused by a high number of station connections -poorly connected stations with low link rates -high throughput application a -can also be caused by a smaller number of stations transmitting a large amount of traffic -high numbers of neighboring wireless networks on the same channel Does not matter if the stations and APs are your own or if they are neighboring devices

Pros of tunnel mode SSID(2)

-central play to enforce security -L3 traffic segmentation

After an AP is authorized, what tasks can you perform on the fortigate GUI managed fortiAP page (5)

-change the status of an AP (deauthorize) -perform firmware upgrade -change assigned AP profile -restart fortiAP -telnet to fortiAP CLI to execute commands on the AP

what 5 measurements can you look at to determine wireless health

-channel noise -signal strength -link rates -retry rate -loss rate

what 3 measurements can you look at to determine wireless capacity

-channel utilization -association count -data throughput

What settings can be change if APs are experiencing Co-channel interference (CCI) (3)

-check the automatic radio power and if needed reduce it from the default 10 to lower -or instead of reducing the radio power change the channel (more difficult in the 2.4 range) -if you cant do either of these then consider disable the radio interface

Possible causes of signal strength issues in wireless connectivity (3)

-client is far from AP -AP may be down -may be a sticky client

Fortiplanner controls- display properties (6)

-contour in DBM -frequency band -coverage metrics -gradient of color spectrum -units of measurements -signal to floor

How can you access the AP CLI (5)

-controller GUI -console cable to AP -direct over SSH -through controller using SSH/telnet -through CAPWAP tunnel

What is the easiest AP deployment mode and why

-direct connection: -Ap is directly connected to fortigate -no need to preconfigure AP -automatic wireless controller discovery using broadcast

on computers and phones what can you do to enhance client connectivity if they are having connection issues

-disable OS or driver power saving -experiment with the roaming aggressiveness -experiment with band preference if the client is failing to connect to the correct band

problem: client type, configuration, and drivers, or changes in client configuration and drivers can cause compatibility issues. incompatibility can lead to performance or connection reliability issues. solution: (2 examples)

-driver change, update driver or OS -driver change, downgrade driver or OS

why is it NOT recommended to have more than five SSIDs broadcasted by APs

-each SSID broadcasted by an AP requires a quantity of management frames -these frames take airtime/wireless capacity example - if 1 AP broadcasts 10 SSIDs/networks aprox 32% of available airtime would be used sending and receiving management frames

What settings do you configure on a WIDS profile

-enabling rogue AP detection -intrusion detection settings with intrusion type, enable | disable, threshold, intervals

why does fortigate automatically put load balancing vlans in a Zone (2)

-ensures all load balancing vlans are configured with identical access -makes it easier to manage firewall policies

The on-wire can use two rogue detection methods (2)

-exact MAC address match- if the same MAC address is seen in frames on the wired lan and on the Wifi network this means that the wireless client is connected to the lan. If you did not authorize the AP FortiOS will treat that AP as a rogue AP -Mac adjacency: if an ap is a wireless router, it applies NAT to Wifi packets. This can make rogue ap detection more difficult because the frames in the wired and wireless traffic won't have the same MAC address. However the Wifi interface Mac of an AP is similar to it's wired MAC address. So the Mac adjacency rogue detection method matches the MAC address that have close hex numbers.

What is required for WSSO (4)

-fortigate locally defined user groups -RADIUS server configured on fortigate -RADIUS server must be configured to send FORTINET-GROUP-NAME as a RADIUS attribute back to fortigate. -SSID for RADIUS server

Cons of tunnel mode SSID (2)

-fortigate must be sized according to traffic -if controller goes down wireless network will go down

Fortiplanner real time coverage heat map and performance visualization (2)

-fortiplanner connects directly to any fortigate devices to provide real time visualization of wireless coverage, connected clients, and failed APs -simplifies troubleshooting, deep visibility to uncover holes and congestion

What does channel selection depend on

-frequencies permitted for a particular region

Fortiplanner controls- floor plan tab (2)

-import bit map image of plan -select wall type and draw walls which will effect absorption, refraction, and reflection of radio waves

Three properties of the fortigate secure wireless solution.

-integrated -unified management -scalable

What are the first few questions to ask to begin troubleshooting wireless client connectivity: (6)

-is it connected? -is there an IP? -can I ping or reach network resources? -has there been a change to the client? -is the basic channel Config acceptable? -are there too many SSIDs being broadcasted?

Preshared key recommendations (4$

-length: at least 12 characters long -complexity: mix of upper case, lower case, numbers -ease of use: three random words and numbers at end -some IoT devices may not support special characters

Fortiplanner controls- Wifi planner tab

-let's use choose AP models to use in automatic or manual placement -customize AP parameters such as name, device radios, frequency, transmit power, orientation, and azimuth (North=0, E=90, S=180,W=270)

Possible causes of high client association (4)

-many connected devices -a higher than expected count can be caused by: -nearby AP or interface down -unexpected client mix (2.4ghz favored over 5GHz or the other way around)

What does wireless health measure (3) and what 5 measurements can you look at to determine wireless health

-measures of factors that affect connection reliability, how healthy the RF is around a specific interface, and how well wireless frames are being transmitted from APs to clients -channel noise of interface -signal strength of client -link rates the client is using -retry rate -loss rate

non-coherent frequency interference and how it cant be identified as such

-non-wifi interference such as bluetooth, microwave, cordless phone, etc. can also be distant AP or client signals that are no longer decodable. Causes the noise floor to rise -most aps and all clients cannot analyze non-coherent interference and specialist equipment is usually required

AP overloading - poorly connected clients and how to avoid it (3)

-poor link rates can cause poor performance -this typically occurs when the client has a slow signal strength or SnR or if the client is connecting to the wrong AP or AP radio -solution is usually to add additional APs if additional coverage is needed or to -use a spectrum analyzer to locate the interference that is increasing the noise floor -you can also enable band steering to encourage clients to connect to the best radio

What three things does fortiplanner help with during wireless planning process

-predeployment planning -post deployment planning -real-time coverage heat map and performance visualization

Source of information - Wifi events (3)

-provides a historical log of wireless related events -view specific station information by adding the band, data rate, and physical AP columns -to monitor a specific AP add the physical AP column

What is required to use remote 802.1X authentication for wireless (2)

-radius server configure -apply to SSID

access point channelization (3)

-review the channel map and identify adjacent APs that are on the same channel (next to, above , and below) - review the adjacent AP in the wifi heath monitor -sort the table to show the strongest interfering neighbor on the same channel -APs that have radios in the same channel that are stronger than -80 has the potential to cause issues

What two configurations do you need on the fortigate interface that the FortiAPs connect to

-security fabric connection -DHCP

Interfering SSID widget on dashboard

-see the interface with the most RF issues -APs must have WIDs profile or Radio Resource Provision enabled

Channel utilization widget on wireless dashboard

-see the most utilized wireless interfaces -interfaces must be enabled to monitor channel utilization in the Ap -click widget for more detail

how to use a fortiAP for dedicated packet sniffing

-set one AP to monitor mode (radio can only listen to one frequency at a time) by creating a packet capture profile and applying it to the AP -use one radio for one frequency and the other radio for the other frequency - try to use the same AP model as the sniffer that is being used for the aps whose traffic is being captured

What two problems can a rogue AP cause

-signal interference preventing clients from being able to use your wireless network -if it's connected to your network it could provide unauthorized access

What three SSID deployments does FortiOS offer

-tunnel -bridge -mesh

Wireless health- link rates

-upstream RX and downstream TX link rates - a measure taken by the AP interfaces when sending and receiving data from a client

Wireless health- link rates (3$

-upstream RX and downstream TX link rates - a measure taken by the AP interfaces when sending and receiving data from a client -fundamental measure of link quality

what is a reason to use VLAN pooling based on fortiAP group

-useful in large deployments to breakdown the broadcast domain rather than putting all wireless clients in a single subnet -* another reason to assign vlans based on APs is to apply security inspections and firewall rules based on the location of wireless clients (such as guests in lobby)

accessing AP CLI through CAPWAP tunnel (7)

-usually when an AP is remotely based behind a NAT device -can be used when SSH is not available -currently not supported by the FAP-U series -feature allows an AP shell command up to 127bytes to the FAP and the FAP will run this command and return results to controller -the FAP report only runs results to the controller after the command is finished -if the new command is sent to the AP before the previous command is finished then the previous command is cancelled -the maximum output from a command is limited to 4M the default output is set to 32k

Tunnel mode SSID (4)

-wireless Traffic will be tunneled back to wireless controller using CAPWAP data channel before it is allowed on the LAN or internet -default SSID -dedicated subnet for wireless network -requires separate firewall policy for SSID subnet

What are the two most important measures for wireless troubleshooting

-wireless health -wireless capacity

How many WIDS profiles can be assigned to an AP profile

Explain the fortigate CAPWAP discovery process (7)

1) FortiAP request sends discovery request 2) fortigate responds with discovery response 3) both devices establish a secure DTLS tunnel 4) fortigate authorizes the fortiAP 5) FortiAP sends a join request 6) fortigate responds with a join response 7) fortigate sends all management and WLAN-related configuration to the AP

FortiAP devices cycle through 6 methods to locate and connect to fortigate. What are they?

1) Static - configure FortiAP with a static controller IP 2) DHCP -default uses DHCP option 138 to get controller IP 3) DNS -fortiAP can discover the controller by using a host named configured in the AC_HOSTNAME_1 parameter 4) FortiCloud -uses the host name apctrl1.fortinet.com for forticloud mgmt 5)Multicast -discovers the controller using the multicast address 224.0.1.140 6)broadcast -it broadcasts a discovery request to locate the controller

How does fortipresence work? (5)

1) a smartphone emits a Wifi probe signal (even if not connected to network) 2) fortiAP or fortiWifi captures the MAC address and signal strength info from the smart phone 3) on-site FortiAPs, fortiWLC, or forticloud summarizes and forwards the data records 4) fortipresence service receives data 5) fortipresence analytics engine processes and correlates the data and displays it in a dashboard

How do you configure the AP controller to forward traffic to a host running wireshark (3 include commands)

1) configure server where CAPWAP traffic is forwarded -diagnose wireless controller wlac sniff-cfg x.x.x.x <port> 2) choose which traffic to capture, the interface to which fortiAP connects, and the fortiAP serial number - diagnose wireless-controller wlac sniff <port> <AP serial#> 2 WTP 3)run wireshark on server to capture CAPWAP traffic from controller

how to create an unencrypted test network to isolate client connection issues

1) create a temporary, open, unencrypted wireless network on an AP interface and broadcast it from the same AP the client is trying to connect to 2) failure to connect to an open network indicates an RF issue or AP overload issue 3) if the client is dualband capable, broadcast the network on both interfaces one-at-a-time to identify which frequency has the problem 4) connecting to an open network but not an auth network on the AP might indicate a client configuration or compatibility issue (assuming the credentials were correct and theres no 802.1X issues)

Fortigate supports what 5 AP topologies to connect FortiAP to fortigate

1) direct connection (wire closet deployment) 2) indirect connection (gateway deployment) 3) remote connection (Datacenter remote management deployment) 4) wireless mesh (Wireless mesh deployment) 5)cloud wireless deployment

how to capture a log of station connection to isolate client connection issues

1) enable client debug on controller for problematic clients to check at what stage a client fails to connect 2) try to connect from a problematic client 3) on the controller CLI issue the command: diagnose wireless-controller wlac sta_filter <AP station mac> 2

Authorizing FortiAP on fortigate process (3)

1) fortigate discovers the AP on the security fabric connection interface (CAPWAP) 2) the AP will be Breyer out until right click > authorize. It will appear offline as it receives the configuration from the fortigate 3) green check mark in status column indicates CAPWAP tunnel is established

Wireless design process (5)

1) project information 2) high level scope 3) gather information 4) site survey 5) predictive model

If you are using an external captive portal server how can you exempt certain source/destinations from having to authenticate or accept disclaimer of captive portal

1) select the destination and services on the SSID or interface configuration page in the exempt source/destination/services section 2)create a firewall policy on the captive portal interface to interface where the external captive portal server is located. You do not have to specify destination objects on the firewall policy

What are the useable non-overlapping channels in 2.4ghz range in US

1,6,11

What SSID option let's you set the maximum number of clients that can connect to a given SSID

How many operational channels does 2.4 have in the United States and how many in Europe

11 in US 13 in EU

By default what Dhcp option does FortiAP use to get the controller IP (DHCP method) and what do you specify with the option

138 When you configure the DHCP server, you can configure Option 138 to specify the WiFi controller IP address either on the Fortigate FortiWifi Controller or on an external DHCP serve You can change this if you are already using this option on your network if you configure the AP units to match

How many channels are there for 2.4 GHz for IEEE 802.11b and g

As a guide, a healthy SnR should maintain rates of:

15 at minimum 25 or more is preferable

As a best practice what should the handoff-sta-thresh value be set to

15-20

How many channels are there for 5ghz using IEEE 802.11a and n

16 channels

What layer of OSI does four way handshake occur ar

For every discovery type, FortiAP sends out discovery requests and sets a timer for an interval between ____. What is the default interval.

2-180 Default is five seconds Change behavior- Config wireless-controller timers Set discovery-interval 5 End

what frequency range is majorly used by IoT devices

2.4GHz

which frequency is more susceptible to interference

2.4GHz

Radio Setting on AP profile: Channel width

20,40,80 ghz this is configurable for 5ghz

How many non overlapping channels does 5GHz have and how many are useable on FortiAP profile

24 23

Each FortiAP can be configured with how many Wifi controller IP address for redundant failover?

3 Best to do this when you are using the static discovery method with the datacenter remote management AP deployment (remote connection)

for networks that have clients that regularly transfer large files or stream, you should aim for _____clients per radio -for networks that have clients that require only basic file, print, and Internet access, you should aim for ___ clients per radio

30 50

By default how long till the AP CLI timeouts and how can you increase it

5 min cfg -a ADMIN_TIMEOUT=mins Cfg -c

What ports need to be open for the remote connection and indirect connection AP deployment options to work

5245 and 5247

What is the best practice frequency to use for the backhaul SSID in a mesh AP deployment

5GHz because it's faster

How many APs does a 60E/60F/100FULL support

60E = 30 total / 10 tunnel 60F = 64 total / 32 tunnel 100F = 128 total/ 64 tunnel

if channel utilization is regularly exceeding ____ then additional radio capacity is needed

75%

How does a busy AP with AP handoff enabled signal to a client to connect to another AP

802.11 association response frame with status code 17 which indicates AP is busy

what IEEE standard defines VLANs

802.1Q

What happens first? 802.1X authentication or the WPA2 handshake

802.1X authentication

802.1X

802.1X standard uses an Extensible Authentication Protocol (EAP) for a challenge and response-based authentication protocol that allows a conversation between a Supplicant (the wireless/wired client) and the RADIUS (the authentication server), via an Authenticator (a wired switch or wireless access point which acts as a proxy) provides layer 2 authentication

How often does DARRP reevaluate channel selection (Optimizations), what is this, and what is the range

86400 This is a channel reevaluation 0-86400

how is a load balancing vlan zone named when the vlans are put in it

<ssid interface name>.zone

What CLI configuration mode is used to configure a new SSID A. Config wireless-controller vap B. Config wireless-controller wtp

What does DARRP do A helps reduce interference between APs B helps suppress rogue APs

What does WIDS stand for? A wireless intrusion detection system B wireless information distribution system

What does ap handoff accomplish? A load balancing among managed APs B load balancing between available frequencies

What is defined first in the fortipresence site management process? A. Site location B. Country information

What is the default encryption used by WPA2-enterprise A AES B elliptical curve

What is the default traffic mode when an SSID is created? A. Tunnel B. Bridge

What is the recommended signal strength for a client A. -64 B -92

What type of SSID traffic mode can scan the traffic for security threats on supported FortiAPs A. Bridge mode B. Tunnel mode

Where do you enable wireless load balancing? A AP profile B WIDS profile

Which SSID security mode can guest accounts authenticate A captive portal B WPA3 enterprise

Which of the following is a wireless health measure: A link rate B association count

Which suite does the fortipresence cloud solution belong to A. Forticloud B. Public cloud security

what type of server can you upload the packet capture that is temporarily saved on the fortiAP? A. TFTP B SMB

which fortigate models come with the wireless controller A. All fortigate and fortiwifi devices B. All fortiwifi devices

Authentication frame flooding

A DoS attack using a large number of association requests Default is 30 in 10 sec

Association frame flooding

A DoS attack using a large number of association requests. Default is 30 in 10 sec

What needs to be root in wireless mesh AP deployment

A FortiAP connected by a physical cable or fortiwifi

What needs to be configured to suppress rogue APs

A WIDs profile

By default, when FortiAP is connected to a fortigate interface that has CAPWAP enabled and fortigate discovers the ap, what does fortigate assign to the fortiAP automatically?

A default ap profile based on the fortiAP hardware model

What is a provisioning account

A local admin restricted to configuring guest accounts only

Wireless health - signal strength (RSSI)

A measure taken by the AP interfaces as they receive data from a client It does not measure the signal strength from the AP to the station. It measures the signal strength of the station as the signal is received by the AP It is an upstream measure not downstream measure

Wireless health - Channel noise(2)

A measure taken by the AP interfaces when not services clients that estimates the noise floor around the AP in the channel that it is configured to use Channel noise is a measure of the background wireless signal that the radio cannot interpret as a wireless LAN signal

Weak WEP IV detection

A primary means of cracking WEP keys is by capturing 802.11 frames over an extended period of time and searching patterns of WEP initialization vectors that are known to be weak. WIDS defects known wan IVs in on-air traffic

What is required in order to use security profiles on the wireless controller (2)

A separate fortiguard subscription per AP And ap must be in bridge mode

How can you connect to wired segments that are not physically connected

A wireless bridge

Fortiplanner(5)

A wireless predictive design tool that you can use to implement a design based on the data collected in the previous phases of the wireless network designing process -RF planning -Live site survey -real time heat map -displays wireless clients and rogue APs -generate reports

What must be defined on the fortiAP profile or overrides on a per AP basis for split tunneling

ACLs

By default what does WPA2 use as it's encryption algorithm

AES

Client load balancing across fortiAPs =

AP handoff

If an AP is found by on-wire detection where will it show uo

AP monitor with in it "On-wire" column

Where is a WIDS profile applied to enable the detection of the intrusion attacks

AP profile

How does an AP using DARRP select the best channel to use

AP selects the best channel available to use based on the scan results of BSSID/received signal stenfth indicator (RSSI) to AC

What must be enabled or applied to AP to detect interfering SSIDs

APs must have WIDs profile or Radio Resource Provision enabled

What APs will participate in WIDS

APs using an AP profile with a WIDS profile

Why enable DHCP on fortigate interface that fortiAPs connect to

APs will receive a dynamic IP assigned by the fortigate. That way you don't have to manually configure APs with IPs.

What types of intrusion detection can be enabled on the WIDS profile (name 5 as example)

ASLEAP attack Association frame flooding Broadcasting deauthentication EAPOL-FAIL flooding Invalid MAC OUI Null SSID probe response Spoofed deauthentication Wireless bridge Etc

ASLEAP attack

ASLEAP is a tool used to perform attacks against LEAP authentication

What can you classify discovered APs that show on the rogue ap dashboard (4)

Accepted, rogue; suppressed rogue, or unclassified

What three devices does the fortinet secure access solution include?

Access points Switches Firewall

Once an area is defined in fortipresence what can you do to enhance the floor plan

Added fixed assets such as printers and cameras and import linked APs

Where do you find the registration information for fortipresence that allows you to link APs

Admin > settings > discovered APs

Where in fortipresence do you create and manage a new site/building

Admin > site management

AP band steering

Aka frequency hand off

With the AP CLI command "iwconfig" what are the two numbers after "wlan" Example Iwconfig Wlan00

All SSIDs are in the form of wlan XY Where X is 0 for 2.4GHz and 1 for GHz Y is incrementing in function of the SSID

What APs does fortipresence support

All fortinet APs whether they are managed by fortigate or cloud wireless controller

Block intra SSID option in tunneled mode AP

All traffic between the SSID is blocked. Clients can access resources based on firewall policies but are unable to communicate with other clients that are connected to the same SSID

Fortigate guest management feature

Allow you to create guest accounts locally and configure setting such as automatic account expiry, collect user info/auto generate, sending passwords via sms or email.

Wireless load balancing

Allows distribution of wireless traffic more efficiently among managed APs and available frequencies

FortiAP cloud wireless deployment

Allows management of remote APs without the need of having an on site fortigate. FortiAP cloud allows you to provision, monitor, troubleshoot, and optimize your FortiAP deployment through a cloud interface. Features zero touch deployment options.

FortiAP group

Allows you to create a logical grouping of APS on the managed fortiAP tab. For example- per floor, per building, etc Facilitates the application of FortiAP profiles to a large number of APs

Thin ap

An AP that is managed by a controller. Sometimes called a controller-based AP.

KRACK

An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack technique to read information that was previously assumed to be safely encrypted

WPA2-Enterprise

An authentication scheme for Wi-Fi networks that combines WPA2 with RADIUS or through a built in local user group that way each user has their own credentials to authenticate to the SSID

Rogue AP

An unauthorized AP connected to your wired network and be an attempt to compromise network security. Sometimes when you do a spectrum analysis you can detect neighboring APs that may be causing interference and may not necessarily be rogue

Anonce

Anonce is a random number generated by an access point (authenticator)

What supported profiles are there for AP security profiles (4)

Antivirus IPS Web filtering App control

If you want to allow some traffic from a particular user group or source through a wireless SSID with a security mode that has captive portal enabled without them needing to authenticate or use a disclaimer what can you do

Apply an exemption

After a guest group and users are created what do you do to allow them to connect to wireless (2)

Apply the guest group to an SSID and set security mode to captive portal

Wireless capacity - association/station count

Association count is a measure of the number of clients associated with each interface(radio) A high client count will always affect performance, but the applications in use and the types of clients also matter

Besides on-wire detection, background scanning, and dedicated monitor what are the other mechanisms that can detect rogue APs that arent specified as rogue ap detection? (4)

Audit grade reports On-wire correlation Automatic suppression Wireless IDS (WIDS)

Three parts of 802.1X wireless authentication

Authentication, association, WPA/2 handshake

By default what discovery method does FortiAP use to discover controller

Auto- which means it will cycle through the 6 discovery methods to locate the wireless controller.

What does the auto-suppress rogue APs in foreground scan for the WIDS profile do

Automates suppressing rogue APs. Whenever a rogue AP is detected On-wire, fortigate automatically suppresses the AP

Radio Setting on AP profile: Radio resource provision

Automatic channel selection on APs in a network to minimize interference

Where is information about wireless performance metrics found

Available in the GUI and CLI Located under dashboard -AP status and client counts -channel utilization widget -interfering SSIDs widget

How many AP profiles can be assigned to an AP A.2 B. 1

WSSO can be used when 802.1X authentication is configured as which of the following? A. Local EAP B. Remote RADIUS server

What function does a rogue AP background scan perform? A. It sends deauthentication frames in the background while serving client B. It serves clients and performs a scan for interfering APs in the environment

What is the most secure form of WPA security A. WPA2-personal B. WPA2-enterprise

What type of SSID is set to broadcast, by default? A. Bridge mode B. Tunnel mode

What type of administrator access is required to manage FortiAP on fortigate? A. FMG-Access B. Security Fabric Connection

Which one is a core fortiplanner feature? A. Offers authentication method for wireless clients B. Allows you to view real-time heat map of FortiOS integrated wireless deployment

what is the recommended maximum channel utilization: A -50% B -75%

which organization evaluates wifi devices for compatibility? A. IEEE B Wifi Aliance

which methods of VLAN pooling are used for load balancing: A. Dynamic VLANs B. Round Robin and Hash

Radio Setting on AP profile: WIDS profile

Background radio scanning and IDS profile settings

What is the default FortiAP profile named

Based on the AP model followed by —default

Why may DARRP not detect interference such as microwave ovens

Because it does not do a continuous spectrum analysis. By default it performs a background scan to measure utilization every 600 seconds by default and a channel reevaluation scan every 86400 seconds

Why shouldnt you share one radio for backhauling and clients in a mesh AP deployment

Because it will decrease performance. Clients will have to compete for airtime with APs

Why is the client connection quality to the AP usually poorer than the AP connection to the client?

Because it's transmits power rate is less than the AP and the antennas on clients tend not to be as good. This results in clients being more susceptible to interference

When choosing APs for your deployment why do you have to choose between universal and standard fortiAPs

Because not all fortiAP models support all types of wireless deployment modes. Universal works with all types of deployment modes including dedicated wireless controller deployment Standard support forticloud deployments and integrated (fortigate) deployment

Why is there a possibility of false positives with the on-wire rogue ap detection mrthod

Because of the nature of the Mac adjacency method Usually Wifi interface max address of an AP is similar to it's wired MAC address but not alway

Why are fortiAPs considered thin

Because they are controlled by either a fortigate or FortiAP cloud service

The lower the channel noise the _____

Better

A higher RSSI means

Better signal strength

What SSID option lets you block communication between devices on the same SSID

Block Intra-SSID traffic

Can captive portals be applied to wired or wireless

Both

Explain the FortiAP controller discovery process

By default FortiAP discovery method is set to auto which means it will go through each discovery method in sequential order until controller is found FortiAP will send discovery requests and sets a timer by default for 5 seconds. After 5 seconds and no response received it will send another request. This is done up to 3 times After 3-15 seconds if no response is received it will move to the next discovery method and repeat until the last discovery process fails. If the last method fails the AP goes into a SULKING state After approx 30 seconds it will enter the AP_IP_DISCVER state After the AC (ap controller) IP is found it will enter the idle state and eventually enter the DISCOVERY state then repeat the process

What is one new way of connecting to the AP CLI and how is it useful

CAPWAP tunnel Useful when AP is remotely based and cannot be reached by any other method (console, ssh, controller gui etc)

Where are the threshold for AP hand off set and what is command

CLI FortiAP profile Config wireless-controller wtp-profile Edit < profile name> Set handoff-sta-thresh 30 Set handoff-rssi 25 Set ap-handoff {enable | disable}

What calculates link rates and what is the rate based on (4)

Calculated by the wireless chipset based on signal strength, the SnR, and the retry and loss of frames

Example of CAPWAP packet capture and what you will see (pic)

Can see: -L2 header -sniffed traffic encapsulated into IP for transport -CAPWAP encapsulated into UDP for sniffer purposes and encapsulated intp IP -CAPWAP control traffic on UDP port 5246 -CAPWAP payload

The higher channel utilization the less ____ there is

Capacity

What security mode is there to provide guest access without authentication and use a disclaimer only

Captive portal

When using guest accounts for wireless access what do you have to set the security mode to

Captive portal

Fortipresence - social wifi

Captive portal configuration for guest wifi and can use social networking logins which can give fortipresence access to additional demographical information such as gender and age

Besides Wifi what other wireless technology does FortiOS support

Cellular with fortiextender

What I the primary indicator of capacity around an interface

Channel utilization

What is the most important indicator of wireless capacity

Channel utilization

What do channels with an asterisks mean on fortigate AP profile

Channels are subject to the rules of dynamic frequency selection (DFS)

What is a great way to check if a client is suffering from RF issues

Check the upstream link rate

What need to occur to get an accurate representation of connection speed from the client to AP (cw_diag ksta) Hint: it has to do with the client

Client should be transmitting data. Often clients will reduce link rate of wireless connections when the device is idle, in order to save battery

If an ap occasionally loses communication to the wireless controller due to network congestion of if the wireless controller becomes temporarily unavailable what happens to the devices connected to a bridged AP

Clients already associated to a bridged AP can still have network access

Why does frequency handoff (band steering) encourage clients to use 5GHz if possible (2)

Clients that support 5GHz band benefit from faster speeds and decreased interference Any clients on 2.4ghz will also have decreased interference

What dBm is considered better

Closer to 0 Usually -50 - -70 dBm is good -70+ is low signal

Two fortipresence platforms available

Cloud based On-premise VM

How to enable wireless controller on entry level models on the CLI

Config sys global Set wireless-controller enable End

Command to enable split tunneling in GUI for fortiap

Config sys settings Set GUI-fortiAP-split-tunneling enable

Enable wireless controller GUI display in CLI for entry level fortigates

Config sys settings Set gui-wireless-controller enable End

Command to configure security profile group for wireless controller

Config wireless-controller UTM-profile Edit <SSID> Set comment Set UTM-log enable Set ips-sensor <""> Set application-list <""> Set antivirus-profile <""> Set webfilter-profile <""> Set scan-botnet-connections monitor Next End

Command to configure WIDs profile in CLI

Config wireless-controller WIDs-profile Edit <name>

4 wireless controller configuration modes in CLI and what are each

Config wireless-controller global Global Config affects all APs and wireless configs Config wireless-controller wtp Configure managed APs Config wireless-controller wtp-profile Configuration of AP profiles Config wireless-controller vap SSID configuration

Command to change geographic location of wireless controller in the CLI, what is default, and why would you need to do this

Config wireless-controller setting Set country US End Default is US the max allowed transmitter power and permitted radio channels for Wifi depends on the region

Command to modify the interval (in s) that FortiAP sends out discovery requests for each discovery method to locate the controller

Config wireless-controller timers Set discovery-interval 5 End

Command to enable split tunneling for SSID

Config wireless-controller vap Edit <> Set split-tunneling enable

Command to apply per-ap configurations in the CLI

Config wireless-controller wtp Edit <AP SN>

Command to preauthorize APs in the CLI

Config wireless-controller wtp Edit <fap serial number>

Commands to configure split tunnel ACLs

Config wireless-controller wtp Edit <wtp name> Set override-split-tunnel enable Set split-tunneling-ACL-path { local | tunneled} Set split-tunneling-acl-local-ap-subnet enable Config split-tunneling-acl Edit 1 Set dest-ip

Command to configure ap profile in the CLI

Config wireless-controller wtp-profile Edit <profile name>

what is the CLI command to set the period that DARRP performs background scans

Config wireless-controller wtp-profile Set ap-bgscan-period <60-3600>

Command to configure DARRP optimization scan (channel reevaluation)

Config wireless-controller wtp-profile Set DARRP-optimize <0-86400>

Config wireless-controller wtp-profile

Configuration of AP profiles. Create or modify profiles that define radio and other settings for fortiAP platforms (models)

Config wireless-controller wtp

Configuration of Managed APs Used to change the configurations that are specific to a wireless termination point (WTP) aka AP Ie. Assigning a profile to an AP or overriding split tunneling configuration for individual AP

What do you need to configure to use the DHCP AP discovery method (2)

Configure option 138 on DHCP server Convert the IP of controller to hexadecimal: Convert each octet separately from left to right and concatenate them. IE. 192.168.0.1 converts to C0A80001

Set split-tunneling-acl-local-ap-subnet enable

Configured under Config wireless-controller wtp Automatically adds the local subnet of FortiAP to split tunneling ACL

In terms of signal strength and connection of a wireless client, the lower the modulation rates the lower the ______ ____ of the client

Connection performance

Fortipresence VM consists of ____ VMs. What are they?

Consists of two VMs Infrastructure server for SQL service Application server to allow GUI access

CAPWAP

Control and Provisioning of Wireless Access Points. Tunneling protocol that encapsulates data between the AP and the WLC. Not encrypted by default. Network protocol that you can use to provision and manage APs using the fortigate.

What happens after the 4 way handshake

Control port unlocked: Once the 4-way handshake is completed successfully virtual control port which blocks all the traffic will be open and now encrypted traffic can flow. Now all unicast traffic will be encrypted with PTK and all multicast traffic will be encrypted via GTK which created in the 4-way handshake process.

After the APa are registered to forticloud what do you do for the cloud wireless deployment option

Create a FortiAP network and then in the network add the APs and create SSIDs

Command to show channel utilization for all allowed channels at the AP CLI

Cw_diag -c all-chutil

Command to show the last minute of channel utilization for the AP radios in AP CLI

Cw_diag -c his-chutil

Command to see station-specific layer 1 metrics on AP CLI and what is is some things it shows

Cw_diag -d sta <mac-address> Rx bytes RX rate Tx discards (lost frames) Tx retires (retry frames) RSSI (SnR)

Command to show associated stations on AP CLI Shows key information that is not available elsewhere such as downstream (AP to client) AND upstream link rate

Cw_diag ksta (sta)

Command to see statistics on a single wlan interface on an AP

Cw_diag stats wlanXY

Dedicated monitoring for rogue APs (option 1)

Dedicated monitoring radios are reserved for scanning and suppression. If enabled they will not broadcast and SSID and will not allow wireless clients to join them. -faster rogue discovery -suppressing rogue APs by sending deauthentication frames -performs continues foreground scans

How does the handoff-RSSI threshold value work

Default is 25. Measured in dB relative to the generic noise level -95dBm. For instance a value of 25 means that the signal level needs to be -70dBm or better and a value of 30 means the signal threshold is -65 dBm or better

What do RSNAs specify (2)

Defined by IEEE 802.11 Robust security network associations specify that two stations must: -establish a procedure to authenticate and associate with each other -create dynamic encryption keys through the process of the four way handshake Utilize a dynamic encryption-key management method that involves the creation of five separate keys. Part of the RSNA process involves the creation of two master keys known as the GMK (group master key) and the PMK pairwise master key

What is an AP profile (5)

Defined radio settings for FortiAP -operating band (g/n/ac/ax) -channels and band settings -SSIDs to broadcast -transmit power -radio settings They are model specific -all FortiAP models have different AP profiles -platform setting defines which ap model the profile supports

Wireless bridge

Device used to connect two wired/wireless network segments together, or to join wireless and wired networks together in the same way that wired bridge devices do.

Command to list connected stations and APs as you would see on the GUI

Diag wireless-controller wlac -d sta | grep -v 0.0.0.0

Radio Setting on AP profile: Channels

Different channels are available by country settings. You can enable channels by selecting the box. The different channels available will depend on the frequency band selected (2.4/5)

Radio Setting on AP profile: Short guard interval

Disabled by default. If enabled it can provide marginally better throughout on an 802.11ac or 802.11n

Source of information - Managed fortiap tables

Displays widgets and detailed information about the APs installed Multiple views: By AP BY radio

Background scanning for rogue APs (option 2)

During idle periods, FortiAP briefly switches the radio from acting as an AP to monitoring) by default the scan periods starts every 600 seconds and each seconds a different channel is monitored for 20 ms until all channels have been checked. During heavy AP traffic, background spectrum analysis can cause packet loss when the radio switches to monitoring. This technique is enabled with DARRP and offers poor rogue ap detectoon -slower rogue discovery -automatic if DARRP is enabled -scans only frequency band of radio

What kind of data does fortipresence display on the dashboard

Dwell time Visit frequency Visit duration Foot traffic Visitor density Location comparison Busiest time of day Etc

DARRP (6)

Dynamic automatic radio resource provisioning -AP selects the best channel availae to use based on the scan results of BSSID/received signal stenfth indicator (RSSI) to AC -Automatically selects channels based on usage and interference. -Can be applied in AP profile -uses background scan every 600 seconds -AP reevaluates channel selection. Every 84600 seconds -clients are signaled to migrate to a new channel -can consume AP resources

What key management method does RSNAs use

Dynamic encryption-key management method involving the creation of five separate keys

what authentication protocol does the 802.1X standard define

EAP and EAP over the lan (EAPOL) and RADIUS

EAP-TTLS

EAP encapsulation method used for client authentication after the TLS session is established with this, AVPs (attribute value pairs) are interchanged and authenticate the client using one of the following: -a native EAP method -a legacy auth proto such as PAP or CHAP EAP-TTLS is not natively supported on many devices so third-party utility may be needed

What type of EAPOL packets are detected by WIDS profile (4)

EAPOL-FAIL EAPOL-LOGOFF EAPOL-START EAPOL-SUCC

Radio Setting on AP profile: Band

Each radio had one of two band available, 2.4ghz or 5ghz. Use the drop down to choose IEEE protocol such as 802.11g/b

When will a four way wireless handshake occur

Each time a client tries to connect to an AP including roaming

EIRP

Effective Isotropic Radiated Power is a calculation used to estimate the radiated output power of an isotropic antenna crucial to understand the power level that will actually end up radiating out of your antenna. This is often for reasons of regulatory compliance, coverage considerations or perhaps matching the power of client devices. To calculate the EIRP of a system, enter the AP transmit power, the loss of any cable and connectors and the gain of the antenna. Note that if you are using an AP with an internal antenna, you can leave the cable loss at 0dB. Finally, hit the 'Calc' button to see the EIRP of the system in expressed in dBm and mW:

What authentication type is the PMK (pairwise master key generated in the RSNA process) generated as a result from (2)

Either 802.1X/EAP PSK authentication

What options are there for a guest account user ID (3)

Email Auto generate Specify

In order to send guest account passwords via sms or email what is required

Email or aka gateway to be configured on fortigate

What fortigates do not have wireless controller enabled by default

Entry-level models

With AP handoff the client that is forced to move to the other AP must have an RSSI that is _____

Equal to or more than the defined RSSI value on the AP this I defined in the AP profile

How often does fortiAP push data to fortipresence

Every 10 seconds but this is configurable

EAP

Extensible Authentication Protocol -The Extensible Authentication Protocol (EAP) is a protocol for wireless networks that expands the authentication methods used by the Point-to-Point Protocol -EAP is used on encrypted networks to provide a secure way to send identifying information to provide network authentication -is not a wire protocol, it only defines message formats -each protocol that uses EAP defines a way to encapsulate EAP messages within that protocols message -has many different versions

EAPOL packet flooding

Extensible authentication protocol over LAN packets are used in WPA and WPA2 authentication. Flooding the AP with these packets can be a DoS attack. Several types can be detected by FortiAP WIDS:

True or false. Only the paid fortipresence license can be hosted on cloud or on premise

False both free and paid licenses can be hosted on cloud or on premise

True or false: can you apply individual security profiles to an SSID like you can with firewall policies?

False you have to apply as a security profile group

True or false The ap can measure the client signal quality directly

False. Only the client NIC can measure this and there is no way for these metric to be sent back to the wireless network

Real time heat map

Feature of fortiplanner- fortiplanner receives real time RF information from installed APs Displays actual coverage area on uploaded maps

RF planning

Feature of fortiplanner- helps determine the number and placement of APs required to cover the desired area

Fortiplanner reporting

Feature of fortiplanner- reports include information such as number of APs required to cover the desired area, channel sections, 2.4GHz and 5GHz coverage

Live site survey

Feature of fortiplanner- requires an AP in site survey mode to check and report any interference in the area. Allows you to check for an interference on the coverage area. Displays the coverage area on uploaded maps

RSNA dynamic key-management process

Five Separate keys created (Two master keys)

Phase 3 of wireless design- gather information (6)

Follows the High level scope: -list of apps and protocols currently in use -number of users to support -type of client devices in use (from high end to least capable) -use case details (VoIP, data, guest access) -number of SSIDs to broadcast -floor plans and area to be covered by wireless network

Do you enable administrative access for directly on the AP (2)

Forti ap profile or by overriding the FortiAP profile settings on a per ap basis

FortiAP shows a "?" On managed fortiAP page

FortiAP is not authorized

traffic flow for an AP with an SSID configured in local bridged mode

FortiAp tags the traffic coming from the wireless clients with the correct VLAN ID. FortiAP the places the traffic on the bridged network The local traffic is switches at Fortiswitch, but CAPWAP control traffic still goes to the wireless controller

When an attacker tries to use a rogue AP for unauthorized access what does FortiOS do

FortiOS automatically detects and lists the ap in the rogue AP monitor. Using the WIDs profile you can suppress the AP to avoid security threats

What fortiap managing devices does fortipresence receive data from (3)

Forticloud Fortigate/wifi FortiWLM

What is a fortiwifi a combination of (3)

Fortigate LAN switch AP

What devices have the FortiOS integrated wireless controller (3)

Fortigate Fortiwifi Fortigate-VM

The forticloud service is separated into two parts:

Fortigate cloud FortiAP cloud

Once a FortiAP is authorized on fortigate what happens? (2)

Fortigate establishes a CAPWAP tunnel to the fortiAPs and pushes the configuration to them based on the assigned AP profile

Fortiwifi

Fortigate with a built in Wifi radio (also called a thick AP) this is suitable in deployments where a single AP can cover all areas

Fortinet integrated wireless solution and what it includes.

Fortigate with an integrated wireless controller for thin aps. It provides a single-pane-of-glass management for security and access. This solution includes fortigate, fortiAPs, and centralized management. It is secure because it consolidated the WLC with the fortigate UTM

Where do fortiAPs get security profile updates

Fortiguard through a fortiguard subscription that is why each AP needs separate subscription

Fortinets Wifi site survey manager

Fortiplanner

What product collects details on site visitors such as devices and locations and then presents information as analytical reports

Fortipresence

Fortiplanner free version vs professional version

Free supports up to 10 APs Paid supports unlimited and enables the site survey and real time heat map features.

Fortipresence licenses are available with two options, what are they and what are the differences between them

Free tier (unlicensed) and paid tier (licensed) Free: 5 sites 7 day data retention 200 captive portal sessions No site reports or user management Social media auth is paid per site Captive portal customization is paid per site Has themes and images from captive portal

What options are there for client loading balancing on forti APs (2)

Frequency handoff Ap handoff

What other key is the GTK depended on

GMK group master key

What key is used to encrypt/decrypt broadcast and multicast traffic in wireless

GTK

What are the final encryption keys in the four way handshake

GTK and PTK

Fortiplanner controls- report tab (2)

Generate reports in PFF or other format. Provides details on device placement, device inventory, propagation analysis for 2.4/5GHz

Command to show RF conditions around all AP radios - shows a list of neighboring APs together with their signal strength, channel, and RF score

Get wireless-controller RF-analysis

Command to list all discovered neighboring APs

Get wireless-controller scan

Command to show client load over time - shows a breakdown of total client load over multiple hours and day

Get wireless-controller status

Config wireless-controller global

Global Config affects all APs and wireless configs Used to configure global parameters like name and max-retransmit

High speed standards require a _____ SnR

Greatwr

You must have at least one user ____ with the type ____ to generate guest accounts

Group Guest

GTK

Group Temporal Key used to encrypt all broadcast and multicast traffic between an access point and multiple client devices. GTK is the key which is shared between all client devices associated with 1 access point. For every access point, there will be a different GTK which will be shared between its associated devices.

What CLI setting in AP profile determines the value after which the handoff protocol is initiated for a new client

Handoff-sta-thresh

what is vlan pooling load balancing hash method

Hash - FortiOS assigned a VLAN based on a hash of the current number of SSID clients and the number of entries in the VLAN pool

What command will provide help and show you available commands in the AP CLI (2)

Help or ?

The lower the signal strength RSSI the lower the ability of the radio to use _____modulation rates

Higher

VLANs use __ ___ to logically separate a LAN into smaller broadcast domains

ID Tags

What standard defines RSNAs

IEEE 802.11-2007

explain the following RADIUS attributes: IETF 64 (tunnel type) IETF 65 (tunnel medium type) IETF 81 (tunnel private group ID)

IETF 64 (tunnel type) - Tells the fortigate that the VLAN information is attached to the RADIUS response IETF 65 (tunnel medium type) - tells the fortigate that the IEEE 802 attribute is attached to the RADIUS response IETF 81 (tunnel private group ID) - tells the fortigate to attach the user to the specified VLAN ID interface

what attributes must the RADIUS server send the fortigate to use dynamic VLAN assignment and what do they need to be set to (3)

IETF 64 (tunnel type) - set to VLAN IETF 65 (tunnel medium type) - set to IEEE 802 IETF 81 (tunnel private group ID) - set to the VLAN ID

Radio Setting on AP profile: Monitor channel utilization

If enabled AP radio is monitored for channel utilization

Why can DARRP cause network issues

If network is being used at capacity it can cause issues because it consumes AP resources with different scans.

AP split tunneling

If split tunneling is configured, only traffic destined for the corporate office networks is routed to the fortigate and other general traffic is routed, unencrypted through the local gateway. It eliminates loading the fortigate with unnecessary traffic and allows direct access to local private networks at the location of the fortiAP even if the connection to the controller goes down

What conditions must be met for a bridged fortiap to continue to authenticate users if the wireless controller is down or disconnected

If the SSID meets the following: -authentication and traffic is handled by FortiAP regardless of the connection status between FortiAP and fortigate "Local standalone" "Local authentication"

Why may it be helpful to exempt sources from the captive portal

If the device needs wireless for internet access but can't accept a disclaimer or authenticate. Such as a printer that needs access to internet for firmware.

What happens if the Last AP discovery method fails

If the last method fails the AP goes into a SULKING state After approx 30 seconds it will enter the AP_IP_DISCVER state After the AC (ap controller) IP is found it will enter the idle state and eventually enter the DISCOVERY state then repeat the process

Bridge mode - security profile support

If the managed FortiAP model (such as U) you can apply a security profile group to the wireless controller which allows you to apply the following security profile features to the traffic over the bridge SSID AV (botnet) IPS APP control Web filter

When is DARRP recommended

In large deployments with many APs to reduce interference. With small deployments that have less risk of interference static channel assignation is fine

Where is the client RSSI threshold defined

In the AP profile

When a new AP is detected that is not authorized this AP appears where?

In the rogue AP list? Dashboard > Wifi > rogue APs

What would a client with good signal strength and a low link rate indicate

Indicates that the noise floor is higher than optimal because the SnR is small. This prevents the client from using the upper link rates regardless of how strong the signal is. A higher level of noise and/or a lower signal reduces the SnR

What does retry rate and percentage of channel utilization measurements indicate for a radio (2)

Indicates the quality and capacity of the air (RF) around the AP Also includes the clients that use the RF

ISM

Industrial, scientific, and medical band 2.4ghz

What will netsh display on windows CLI

Information depending on whether the client is connected or not including the channel connected. You can also see the channel in use and an estimate of the receive and transit rates and the percentage signal strength.

What is it called when FortiAP devices are provisioned and managed using fortigate

Integrated wireless deployment

Why is it recommend to use the integrated wireless solution (8)

Integrating APs with fortigate gives you the ability to perform: -UTM -policy enforcement -authentication -bandwidth control -logging and analysis -rogue AP detection and WIDs -fortiguard services -single pane of glass management Etc

Why is the dedicated monitor for rogue AP preferred over background scanning

It can reduce the load on APs and saves them from switching to AP and monitoring mode, preventing packet loss.

How does fortigate determine if a client can operate on 5GHz frequency for band steering

It continuously probes the clients to identify if they can operate on the 5GHz frequency. Fortigate maintains a table to track which clients support both frequencies and records the RSSI value along with the other information for each frequency.

What is fortipresence

It correlates and displays analaytics from wireless devices in order to improve business and customize experience. Gathers details on site visitors from their Wifi signal. Data such as Dwell time Visit frequency Visit duration Foot traffic Visitor density Loyalty Location comparison Busiest time of day Etc is collected from forti-wireless devices, summarized, and forwarded to fortipresence

Benefit of AP split tunneling

It eliminates loading the fortigate with unnecessary traffic and allows direct access to local private networks at the location of the fortiAP even if the connection to the controller goes down

Why may the cw_diag ksta command on the AP CLI be helpful (3)

It will shows associated stations to the AP with both the upstream AND downstream link rates listed together with SnR These are good indication of connection quality Reviewing the connection capability of the client that's connecting will indicate the max rate the client is capable of. Compare this to it's connection using this command to show how close it is to the maximum connection speed.

Command to show radio interfaces on an AP and what are some other details shown

Iwconfig -Wireless standard -frequency -ESSID -mac -bit rate -tx power -enc key -link quality -SnR -SSIDs in the form of XY "wlan00"

A tunneled SSID is treated as a_____

Layer 3 Interface

The upstream ____ ____ is the best measure of upstream client connection quality

Link rate

_____ _____ are a fundamental measure of link quality

Link rate

What measurement can generally be the prime indicator of connection quality

Link rate (retry and loss rate)

The ultimate indicator of wireless health is _____

Link rates that the client and AP use to communicate with each other

What two options are there for 802.1X on fortigate wireless Config

Local or remote with RADIUS

Captive portal- authentication portal types (2)

Local: fortigate presents the user with a login page and processes authentication requests External: fortigate redirects the user to an external URL. External captive portal server is responsible for presenting the user with the login page and validating authentication

Where is the fortipresence VM deploued

Locally on site

The higher the level of channel noise the ____ the signal-to-noise ratio (SnR)

Lower

MSK

MSK (Master Session Key) The master session is the first key which is generated either from 802.1X/EAP or derived from PSK authentication.

What can make on-wire rogue ap detection more difficult

Mac address spoofing and NAT on the rogue AP can make on-wire detection more difficult because the frames in the wired and wireless traffic won't have the same MAC address.

What type of managed APs can split tunneling be enabled on (2)

Managed by fortigate or forticloud

What two options does TX power control have in the FortiAP profile. What are each

Manual and auto. Manual: a TX slide control appears and you can adjust the TX power. 100% power is based on the maximum permitted in your area Auto: you must define the power range and FortiOS will automatically adjust the power in that range.

To use the static IP or DNS hostname AP discovery method what do you need to do before deploying the APs

Manually configure the APs with the controller IP or hostname in the GUI, CLI, or serial port of AP

Two ways to suppress a rogue AP

Manually on the rogue AP monitor page Enabling auto suppress rogue APs in foreground scan (WIDS profile)

What is one of the most common reasons a laptop can't connect to the wireless network

Many laptops have hardware switches to enable or disable wireless connectivity. Most commonly the switch is disabled preventing connectivity

Set max client vs set handoff-sta-threshold ap profile setting

Max client is max number of clients AP supports. Once reached it will force reject new clients Sta threshold is when the ap handoff is initiated and nearby AP will respond to the client to join it

What is the max command that can be sent to a FAP over the CAPWAP tunnel and what is the max output from the command (and default) that can be sent back from the FAP (3)

Max command sent to FAP- 127bytes MAx output from the FAP back- 4M Default output from FAP back- 32K

Config wireless-controller wtp-profile Edit < profile name> Set max-client

Maximum number of clients this AP supports. After the AP reaches this number of clients it forces a hard rejection. 0 means no limit.

What does more channel noise mean to an AP and client

Means it will be more difficult for the AP and the client to transmit

What is the enable passive scan mode setting on the rogue ap detection settings for the WIDS profile

Means that the AP will not send probe requests on scanned channels

Most of the metrics for performance and diagnostics shown on the controller are measured from what point of view?

Measured from the AP or controller point of view

What does wireless capacity measure (3) and what 3 measurements can you look at to determine wireless capacity

Measures factors that affect the capacity of the interface and the channel capacity around the interface, measure of channel utilization (how busy the interface and spectrum is, and the number of clients on an interface -channel utilization -association count -data throughput

How does DARRP prevent interference between APs

Measures utilization and interference on the available channels and selects the clearest channel at each AP. It uses AP background scans as input (every 600 seconds)

On-wire rogue AP detection and how it works (7)

Mechanism continuously compares wireless and wired client traffic to identify if an unknown AP has joined your network -must be at least one Wifi client connected to suspect AP and continuously sending traffic -rogue AP will probably need to be a layer 2 bridged AP otherwise FortiOS will only see the wireless router Ethernet MAC -if fortigate and FortiAP see the wireless client MAC address on the wired network, then the rogue AP that the client is connected to must be on-wire -can block either exact MAC addresses only or similar (adjacent) Mac addresses -Mac adjacency is configurable -Mac address spoofing and NAT on the rogue AP can make on-wire detection more difficult -false positives are possible

Complete four way handshake

Message1: access point sends EAPOL message with Anonce (random number) to the device to generate PTK. Message2: Once the device has created its PTK it sends out SNonce which is needed by the access point to generate PTK as well. The device sends EAPOL to AP message2 with MIC (message integrity check) to make sure when the access point can verify whether this message corrupted or modified. Once SNonce received by the AP it can generate PTK as well for unicast traffic encryption. Message3: EAPOL message3 is sent from AP to client device containing GTK. AP creates GTK without the involvement of the client from GMK. Message4: Fourth and last EPOL message will be sent from the client to AP just to confirm that Keys have been installed.

Message 1 of 4 way handshake

Message1: access point sends EAPOL message with Anonce (random number) to the device to generate PTK. Don't forget client device knows Ap's MAC because its connected to it. It has PMK, Snonce and its own MAC address. Once it receives Anonce from access point it has all the inputs to create the PTK. PTK = PRF (PMK + Anonce + SNonce + Mac (AA)+ Mac (SA))

Message 2 of 4 way handshake

Message2: Once the device has created its PTK it sends out SNonce which is needed by the access point to generate PTK as well. The device sends EAPOL to AP message2 with MIC (message integrity check) to make sure when the access point can verify whether this message corrupted or modified. Once SNonce received by the AP it can generate PTK as well for unicast traffic encryption.

Message 3 of 4 way handshake

Message3: EAPOL message3 is sent from AP to client device containing GTK. AP creates GTK without the involvement of the client from GMK.

Message 4 of 4 way handshake

Message4: Fourth and last EPOL message will be sent from the client to AP just to confirm that Keys have been installed.

For a large proportion of wireless troubleshooting, it revolves around ensuring that a number of wireless ____ are within acceptable ranges

Metrics

What default FortiAP profile settings are customizable (10)

Mode: disabled (no radio) access point(normal radio) , dedicated monitor (used to monitor and not for clients) WIDS profile: background radio scanning and IDS profile settings radio resource provision: automatic channel selection on APs in the network to minimize interference Band: 2.4/5ghz Short guard interval: disabled by default. If enabled can provide better throughput on 802.11ac or n Channels: different channels are available by country/region TX power control: provides auto or manual control over radio power Monitor channel utilization: if enabled, AP radio is monitored for channel utilization SSID: select auto or manual Channel width: 20,40,80 configurable for 5ghz

why may you need special equipment to identify non-wifi/non-coherent interference

Most APs do not have a built in spectrum analyzer and if they do they may be able to log interference events but cannot pinpoint the exact location since they usually lack directional antennas. Some APs may need to be dedicated to this task

Why may a client capable of high wireless link rates be showing they are only getting around 65mbps (2 examples)

Most likely this means they are connecting to the 2.4GHz radio and not the 5GHz radio Also could mean metrics (loss/retry/signal strength/noise) are impacting

What needs to happen for fortigate and FortiAP to detect a rogue AP on wire (2)

Must be at least one Wifi client connected to the suspected AP and continuously sending traffic. If fortigate and FortiAP see the wireless client MAC address on the wired network then the rogue AP that client is connected to must be on wire -rogue AP will probably need to be a layer 2 bridged AP otherwise FortiOS will only see the wireless router Ethernet MAC

When configuring a guest user group it allows you to select which type of guest information you want selected. What are the options (6)

Name Email SMS Password (auto or specify) Sponsor (auto or specify) Company (auto or specify)

Signal strength is measure in _____ _____

Negative decibels

How to locate client MAC address on windows CLI

Netsh wlan show interfaces

CAPWAP in the fortigate integrated wireless solution and what it provides (3)

Network protocol that you can use to provision and manage APs using the fortigate. Provides: -configuration management -device management -configuration and firmware upgrade to AP

By default, is load balancing applied to roaming clients

Do the AP and controller need to be in the same broadcast domain for the multicast AP discovery method to work

No AP and controller do not need to be in the same broadcast domain if multicast routing is configured correctly.

Benefit of using the fortiAL cloud wireless deployment

No need for a fortigate on site

Possible causes of channel noise and examples

Non-wireless lan devices transmitting in the 2.4 and 5GHz ranges. Examples include: -microwave oven -Bluetooth devices -wireless cameras and alarms -distant wireless aps and devices

What part of 802.1x or PSK auth does the four way WPA/2 handshake start

Occurs in the last four frame during either 802.1X/EAP or PSK authentication

Where is wireless load balancing configured

On AP profile

What two options are there for the start countdown - expiration of a guest account

On account creation (default) After first login

Where is frequency load balancing configured

On the AP profile

Besides dedicated monitor and background scanning what is another useful technique for rogue AP setection

On-wire rogue AP detection

What type of APs can be assigned to an AP group (2)

Only APs of the same model and only ones not assigned to another group

For a fortiap cloud wireless deployment what type of traffic is sent back to forticloud

Only management traffic. All user data traffic remains local

Complete list of supported formats for wireless security modes (13)

Open Captive-portal WPA-personal WPA-personal+captive WPA-enterprise WPA2-only-personal WPA2-only-personal+captive WPA2-only-enterprise WPA3-enterprise WPA3-sae WPA3-sae-transition Owe Osen

What EAP method is supported for 802.1x local authentication

PEAP

PTK is dependent on what other key

PMK PTK = PRF (PMK + Anonce + SNonce + Mac (AA)+ Mac (SA))

What are the two master keys created during the RSNA process

PMK pairwise master key GMK group master key

What key is used to encrypt/decrypt unicast traffic in wireless

PTK

PMK

Pairwise Master Key Generates the PTK Pairwise master is key generated from master session key (MSK). In case of WPA2/PSK when device authenticates with access point the PSK becomes PMK.PMK resides on all stations as in AP and client devices, so we do not need to share this information. We use this information to create PTK which are used for unicast data encryption.

PTK

Pairwise Transient Key Pairwise transit key is used to encrypt all unicast traffic between a client station and the access point. PTK is unique between a client station and access point. To generate PTK, client device and access point need the following information. PTK = PRF (PMK + Anonce + SNonce + Mac (AA)+ Mac (SA))

An ap profile defines the configuration for each AP. If you want to apply different settings for some aps without creating additional profiles what can you do

Per-ap Configuration You can override ap profile configuration for a specific AP Certain options are available only in the cli

How is channel utilization measured

Percentage

Phase 5 of wireless design- predictive design (1)

Performed using a software program to perform AP placement based on RF prolongation algorithms -fortiplanner

What FortiAP profile settings can you Not modify when you use a default FortiAP profile (2)

Platform Country/region

PPP

Point-to-Point Protocol -used for wired network authentication -unencrypted

What would a acceptable signal strength and a low link rate indicate

Potential noise issue An AP and a client will respond to decrease in SnR by reducing link rates. Decrease in SnR means increase in channel noise

Phase 1 of wireless design- project information (4)

Project info is high level input that you can use to implement wireless design. Important to identify use case and primary goals. What industry? What type of structure is it based on? What are the business goals? Compliance requirements?

Pros and cons of mesh AP deployment

Pros: -Eliminates the need to physically cable every AP to the wireless controller -better performance due to fewer clients on backhaul frequency (less collisions) Cons: -wireless not reliable for backhaul connectivity due to interference and quality of signal issues

PEAP

Protected Extensible Authentication Protocol. PEAP provides an extra layer of protection for EAP. PEAP-TLS uses TLS to encrypt the authentication process by encapsulating and encrypting the EAP conversation in a Transport Layer Security (TLS) tunnel. Since TLS requires a certificate, PEAP-TLS requires a certification authority (CA) to issue certificates. (Server side)

Radio Setting on AP profile: TX power control

Provides auto or manual control over radio TX power

Source of information - Wifi Maps (4)

Provides graphical representation of the location of the APs. Useful for visualizing the state of the wireless network. You can see channel configuration, channel utilization, and station load. Allows for the ID of APs that might have incorrect channel settings or are overloaded. It requires a floor plan import and AP placement

Phase 4 of wireless design- site survey (6)

Purpose is to plan and design a wireless network, providing a solution that will deliver the required coverage, link rates, network capacity, roaming capability, and QoS -perform a site walkthrough -type of building or facility -detailed maps or drawings -capture photos of mounting positions, cable drops, and cabinet spots -existing wireless infrastructure (potential interference, spectrum analysis, non Wifi devices) -identify problem areas

What must the RADIUS server send back to fortigate for WSSO

RADIUS server must be configured to send a group name as a RADIUS attribute back to fortigate. It is case sensitive. VSA (vendor specific attribute) is FORTINET-GROUP-NAME

how does dynamic vlan assignment work for SSIDs

RADIUS server will provide the VLAN information through the attributes that it sends to the fortigate upon the authentication request: IETF 64 (tunnel type) - set to VLAN IETF 65 (tunnel medium type) - set to IEEE 802 IETF 81 (tunnel private group ID) - set to the VLAN ID

In the CLI what is the radio referred to as

RLD

The controller maintains a list of ______ for all wireless clients

RSSI

On FortiAP the component on the AP that transmits and receives radio signals is called ______(2)

Radio or wireless interface

What setting need to be enabled in AP profile if you want FortiAP to select channels based on interference

Radio resource provision

What will the following columns indicate on the wifi client monitor: Rate - MIMO - Band -

Rate - link quality indicator MIMO - client capability indicator Band - client capability indicator

RSSI

Received Signal Strength Indication

RSSI

Received Signal Strength Indicator - an index level calcuated from signal strength. If it the connection speed is below the RSSI minimum the wireless adapter will drop the signal

When an attack Is detected by a WIDS profile what does FortiOS do

Records a log message

By default what does fortigate do to traffic from users behind an interface that has the security mode set to captive portal (2)

Redirects HTTP traffic to captive portal and blocks all other traffic

What will lowering the TX power do to FortiAP coverage

Reduce the coverage area and RF signal propagation

How will an AP and client respond to the decrease in SnR

Reducing connection link rates

What can a high number of tx_retries (retry frames) with the command cw_diag -d sta <mac address> indicate

Retries are part of normal wireless LAN network operation but a high number would indicate an issue

How to upgrade fortiAP from the managed fortiAP page and what is required to be able to perform the upgrade from this page

Right click AP > select upgrade FortiOS will find appropriate firmware for AP and upgrade it. This requires you to register FortiAP on fortinet support site and have a valid support contract

From the rogue ap dashboard how can you keep track of APs that are authorized by you or not

Right click and classify the AP as: Accepted, rogue; suppressed rogue, or unclassified

RSNAs

Robust security network associations

How does on wire rogue AP detection work

Rogue AP monitoring of WiFi client traffic builds a table of WiFi clients and the Access Points that they are communicating through. The FortiGate unit also builds a table of MAC addresses that it sees on the LAN. The FortiGate unit's on-wire correlation engine constantly compares the MAC addresses seen on the LAN to the MAC addresses seen on the WiFi network. There are two methods of Rogue AP on-wire detection operating simultaneously: Exact MAC address match and MAC adjacency.

Fortigate RBAC

Role based access control Fortigate let's you create user groups and use remote authentication servers with reference to a group in order to select users based on a different set of policies, SSID, SSL VPN, etc for role based access

what is vlan pooling load balancing round robin method

Round Robin - VLAN with least number of clients is assigned new connections

What are the two VLAN pooling methods available for wireless client load balancing (tunneled only)

Round Robin - VLAN with least number of clients is assigned new connections Hash - FortiOS assigned a VLAN based on a hash of the current number of SSID clients and the number of entries in the VLAN pool

Config wireless-controller vap

SSID configuration Used to set options for VAP (virtual access points) aka SSID. All parameters related to wireless security options will be configured under here.

What protocol needs to be enabled on fortigate interface that AP connects to for CAPWAP

Security fabric connection

How does FortiAP suppress rogue APs

Sends deauthentication frames

What two fields are required when preauthorizing a FortiAP on the fortigate

Serial number and FortiAP profile

What level is traffic processed for a tunneled SSID

Session

What are these settings in the CLI: Config wireless-controller wtp-profile Edit < profile name> Set handoff-sta-thresh 30 Set handoff-rssi 25 Set ap-handoff {enable | disable}

Set handoff-sta-thresh 30 - # of clients before AP handoff is initialized <5-35> Set handoff-rssi 25 - RSSI value threshold sets minimum signal strength that a new client must have at an alternate AP for the overloaded AP to ignore the client. Range 20-30 Set ap-handoff

CLI command to change the max numerical difference between an Ethernet and wireless max value for on-wired rogue AP detection What is the range and default value

Set rogue-scan-Mac-adjacency <0-31> Def is 7

What are wireless security modes

Settings for client authentication and traffic encryption between the wireless client and the AP

What can a high number of tx_discards (lost frames) with the command cw_diag -d sta <mac address> indicate

Shows the AP was unable to successfully send a data frame after numerous retires. This can indicate the station is unable to clearly receive or decode frames from the AP with the result. This can indicate poor signal strength at the client or a high noise floor

SAE

Simultaneous Authentication of Equals SAE is a variant of the Dragonfly Key Exchange defined in RFC 7664,[2] based on Diffie-Hellman key exchange using finite cyclic groups which can be a primary cyclic group or an elliptic curve.[1] The problem of using Diffie-Hellman key exchange is that it does not have an authentication mechanism. So the resulting key is influenced by a pre-shared key and the MAC addresses of both peers to solve the authentication problem.

Types of items to add to fortipresence GUI integrated google maps UI (4)

Sites Buildings Floors Areas

How is channel noise represented

SnR

SNonce

Snonce a random number generated by the client device (supplicant)

What exemptions can be applied to captive portals

Sources and destination/services

Spoofed deauthentication

Spoofed deauthentication frames are a DoS attack. They cause all clients to disconnect from an AP.

802.11s

Standard for wireless mesh networking

What AP discovery method should you use if the AP is not deployed on the same subnet as the wireless controller and cannot be reached by multicast or broadcast (2)

Static IP or DNS hostnames method

What automatic discovery options can you use for the remote connection and indirect connection AP deployment options (3)

Static IP(recommended) DHCP DNS

A high link rate means that both the signal _____ and _____ are good

Strength and quality

After you detect a rogue AP what do you usually want to do to it

Suppress it

TX power mode manual

TX slide control appears and you can adjust the TX power. 100% power is based on the maximum permitted in your area

How is RSSI measure by the fortiAP

Taken by the AP interface when receiving data from a client

How to locate client MAC address on Mac OS

Terminal - networksetup - listallhardwarereports

What can wireless retry rate be an indication of (example)

That the collision rate is high which can occur when there are large numbers of clients on the network (capacity measurement)

What is the wireless four way handshake

The 4-way handshake is the process of exchanging 4 messages between an access point (authenticator) and the client device (supplicant) to generate some encryption keys which can be used to encrypt actual data sent over Wireless medium

Level of AP participation in WIDS depends on?

The AP operating mode. Example: APs that are not in dedicated monitor mode cannot perform foreground scanning.

How does the multicast AP discovery method work?

The AP sends a multicast discovery request and the controller responds with a Unicast discovery response to the AP. AP and controller do not need to be in the same broadcast domain if multicast routing is configured correctly.

In 802.1X local authentication mode what two roles does fortigate play

The Authenticator and the authentication server

When using 802.1X remote authentication what role does fortigate play

The Authenticator only

What does it mean when the managed fortiAP status changes to a greed check mark

The CAPWAP tunnel is established between the controller and the AP

when VLANs are configured with a tunneled SSID what does the SSID interface act as (vlan interface is considered separate interface)

The SSID interface is considered a trunk

What are two key pieces of information needed in order to troubleshoot an issue with a wireless client and where would you get this info from

The client MAC address and IP If this issue lies beyond connecting to the AP then you can get this from the AP or controller If the issue is with connection to the AP you will have to get it from the end user

In order to use rogue AP suppression what rogue ap detection method do you need to use

The dedicated monitor. You can't use background scan. One radio needs to be dedicated since this is an active process

Why are faster link rates good

The faster the data is transferred and the less air time is used for transmissions. Ensuring high performance for the client and allowing max opportunity for other clients to transmit

4-way handshake keys for top to bottom

The first level key is generated is MSK during the process of 802.1X/EAP or PSK authentication. The second level key is generated from MSK is PMK and GMK. PMK is used to generate PTK and GMK is used to create GTK. Third level keys are the actual keys used for data encryption.

How to tell if signal strength is good or bad

The greater the negative number, the weaker the signal

What does a guest provisioning account display when they login

The guest user management pane which limits them to only creating guest accounts

Where does local and CAPWAP control traffic go for an SSID configured in bridged mode with a VLAN

The local traffic is switches at Fortiswitch, but CAPWAP control traffic still goes to the wireless controller

When dragging and dropping the AP into a fortipresence area what are you prompted to enter

The minimum RSSI cutoff value and EIRP values

What is TX power

The power the fortiAP uses when broadcasting RF signals

X.509

The standard format for digital certificates.

Frequency handoff

The wireless controller monitors the usage of 2.4ghz and 5GHz bands and signals clients to switch to the lesser used frequency to prevents congestion and interference

Why can't guest accounts be used for 802.1X local authentication

They are not considered local user accounts

Leaf AP in mesh deployment

They connect normal clients such as laptops, tablets, and mobile phone. They may also connect another leaf AP to the root AP

Long Duration attack

To share radio bandwidth. Wifi devices reserve channels tor brief periods of time. Excessively long reservation periods can be used as a DoS attack. Default threshold is 8200

Block intra SSID option in bridge mode AP

Traffic to and from wireless clients connected to the same SSID and AP is blocked. However wireless clients connected to the same SSID but on a different AP can communicate with each other. To prevent this you must have private VLAN enabled if APs are connected to a fortiswitch

True or false- false positives are possible with on-wire rogue AP detection

True

True or false. A smart phone will emit a Wifi probe even if it is not connected to Wifi network

True

True or false. Guest accounts are not considered local user accounts

True

To achieve one of the four main (not including the cloud deployment) physical AP topologies what two traffic modes can be used

Tunnel Bridge

Default SSID mode

Tunnel mode

Which SSID mode is treated as an interface

Tunnel mode

Three types of SSIDs that can be configured on fortigate

Tunnel mode Bridge mode Wireless mesh

What SSID option makes it so only users who know the name of the SSID can connect to it

Turn off broadcast SSID

Broadcasting deauthentication

Type of DoS attack. A flood of spoofed deauthentication frames forces wireless clients to deauthenticate, then reauthenticate with their AP.

What AP series does not support it's CLI being accessed through the CAPWAP tunnel

U series

What ports does CAPWAP use

UDP port 5246 - control channel UDP port 5247 - data channel

U-NII

Unlicensed National Information Infrastructure for 5ghz

What are the general guidelines during wireless network planning to avoid overlapping

Use every fourth or fifth channel

How do you register fortiAPs managed by FortiAP cloud or fortiWLC on fortipresence

Use the auto generated project name, project secret key, fortipresence IP, and port on the location services

What is the first step in using fortipresence

Use the fortipresence registration information to link discovered APs to fortipresence

Wireless mesh SSID

Used as backhaul SSID in distributed connection to connect to the root AP. The radio receives data for the WLAN from the mesh backhaul SSID

What are cw_diag command for in the AP CLI

Used for monitoring or diagnostics

What type of deployment is security profiles on managed APs ideal for

Used for remote deployments and complex networks

SSID group and where it is configured

Used to simplify management of multiple by grouping SSIDs so that they can be specified together in a FortiAP profile. Kind of like address object group. Configured in wifi&switch controller > SSIDs > create new > SSID group

Why is TX power control useful

Useful to control signal coverage area. You can decrease the power to prevent broadcasting signals to any unwanted area that may pose as a security risk

Where to configure guest accounts

User & authentication > user groups > type guest

The fortigate wireless controller supports two user authentication mechanisms. What are they?

Username and password (WPA enterprise, WPA3, captive portal) Preshared keys (WPA2 personal)

When does DARRP perform background scans and what is the range

Uses background scan every 600 seconds Range is 60-3600 seconds

How does fortiplanner estimate signal loss and bounce (generate heat map)

Uses ray tracing algorithms to estimate signal loss and bounce based on objects that can cause RF interference such as walls, windows, and elevator shafts.

How can CAPWAP communication be secured

Using DTLS encryption

How does fortipresence make locating sites and their respective data simple

Using google maps integrated UI to locate the sites and compare trends across each site

As a guide, a healthy wireless interface should maintain rates of: Utilization- Client count-

Utilization- <75% Client count- <30

What is VLAN pooling?

VLAN pooling is the process of creating several VLANs for a single domain (a single SSID as well) and randomly assigning the wireless clients to a VLAN.

using _____ reduces the need to deploy additional SSIDs

VLAN tagging

What is the VSA and ID for the RADIUS server to send fortigate for WSSO

VSA (vendor specific attribute) is FORTINET-GROUP-NAME. Fortinet vendor ID: 12356

Max number of supported APs on fortigate and fortiwifi

Varies by model

What do you need to do before enabling the suppression of rogue APs

Verify that the operation of suppressing rogue APs is compliant with the applicable laws and regulations of your area

VAP

Virtual access point. AKA SSID

How can fortipresence VM be utilized to allow visitors to login to the wireless infrastructure (3)

Visitor can login using: -Social media authentication with captive portal -SMS-OTP -customized visitor portal

How does fortiAPs collect data to forward to fortipresence

Visitor smart phones and devices probe for wireless APs. APs use this data to detect information about the devices and forward it in the form of station reports to fortipresence

As a best practice what should you set the handoff-RSSI value for voice traffic and for data and video to minimize interruptions (2)

Voice- 25-30 Data/video - 23-37

What security modes does the wireless controller support (7) There is also a complete list with more supported.

WPA WPA2 WPA3 captive portal Open OWE OSEN

What is a more secure form of WPA2 security and why

WPA2 enterprise because each user has their own authentication credentials verifies through an authentication server

WPA2 with a preshared key is called___

WPA2 personal

dynamic vlan assignment can only be enabled for what type of SSID security mode and authentication (2)

WPA2-Enterprise or WPA3-Enterprise using RADIUS for authentication

WPA2-Personal

WPA2-Personal encryption uses a pre-shared key (PSK) to protect the network access. -all user share same static pass phrase -if a user leaves or device is lost the PSK should be changed on all APs and devices

In the CLI what is the AP referred to as

WTP

Where is frequency handoff configured

WTP (AP) profile

Null SSID probe response

When a wireless client sends out a probe request the attacks sends a response with a NULL SSID. This causes many wireless cards and devices to stop responding.

How does the controller measure and display the quality of a a downstream wireless connection

When an AP transmits network traffic to the client, the controller shows the connection quality of the AP when it transmits to the client

What is the multiple preshared keys option for SSID configuration

When enabled you will configfre a preshared key for each user. If a device is ever lost or a user leaves then you only have to change it for that one user or device.

When is FortiAP beneficial

When organizations have a large number of APs

Set split-tunneling-acl-path {local} Vs Set split-tunneling-acl-path {tunneled}

When set to local you can define subnets where traffic will remain local instead of being tunneled When you set to tunnel you can define subnets that are tunneled back to the controller

How does AP suppression work? (4)

While pretending to be the rogue AP, the fortigate Wifi controller uses the dedicated monitoring radio on a nearby AP It send deauthentication messages to the rogue AP clients. This makes it difficult for the clients to maintain a connection with the rogue AP. FortiOS will also mimic the rogue AP clients and send deauthentication messages to the rogue AP.

Phase 2 of wireless design- high-level scope (7)

Why, what, when, how - it it a new or existing install -why are you upgrading -what is the use case -what is the scale of the project -primary applications -big rollout or phased -deadline

After creating a wireless controller security profile group where do you apply the group

Wifi & switch controller > SSIDs Security profile group

Where to create wireless security profile group in gui

Wifi & switch controller > SSIDs > security profile group

Where to configure WIDS profilw

Wifi & switch controller > WIDS profiles

Where do you authorize and see discovered fortiAPs managed by fortigate

Wifi & switch controller > managed APs

How do you preauthorize APs and what is this

Wifi & switch controller > managed APs Allows you to preauthorize APs that will be added to the network. Must add all APs manually, one by one using the AP serial number and assign a forti AP profile After the preauthorize APs come online and are discovered by fortigate will authorize the fortiAPs automatically

Where is the managed FortiAP table

Wifi & switch controller > managed fortiAPs

How to connect to the AP CLI using the controller GUI

Wifi & switch controller > managed fortiAPs Right click the row of the fortiAP that you want to connect to and then select connect to CLI

Where do you configure SSIDs on fortigate

Wifi and switch controller > SSID

Where do you specify wireless security mode for SSIDS

Wifi and switch controller > SSIDs

Where to create a custom ap profile in the GUI

Wifi and switch controller > forti ap profiles > create new

Wireless bridge (WIDS profile)

Wifi frames with both the fromDS and ToDS fields set in are a wireless bridge. This will also detect a wireless bridge that you intentionally configure in your network

WIDS

Wireless Intrusion Detection System Monitors wireless traffic for a wide range of security threats by detecting and reporting on possible intrusion attempts It uses a profile to specify the intrusion detection settings and rogue AP detection

Two lan segments connected together over a wireless link (backhaul SSID)

Wireless bridge

Wireless controller (AP controller)

AP handoff

Wireless load balancing. Wireless controller signals a client to switch to another AP

WSSO (2)

Wireless single sign on -allows fortigate to dynamically map RADIUS users to local groups -allows fortigate to enforce different levels of network access with the use of firewall policies and security profiles based on the user group that user belongs to

WTP

Wireless termination point. Aka AP

How are APs registered to forticloud

With the cloud key that ships with the AP or the forticloud credentials configured on AP

Can you apply captive portal to groups

Yes you can specify groups and even exempt sources and destination application/services

Is it possible to infer the downstream signal from AP to client is stronger than the upstream signal of the client to the AP

Yes, in general the transmission power of the AP can be higher than the transmission power of the client

Using the WAN connection AP topology, do you need to configure a VPN for the AP to contact the controller over the internet

You can but don't have to because the CAPWAP tunnel is secure and encrypted with DTLS

Radio Setting on AP profile: SSIDs

You can select auto or manual for the SSID used by the AP profile

After a local group ID created as type guest what do you do next

You create the guest accounts under guest user management and fill in the details that were configured on the user group

How do you register fortiAPs managed by fortigate on fortipresence (4)

You enter the auto generated project name, project secret key, fortipresence IP, and port numbers when configuring the fortiAP profile

When you look at the performance/diagnostics and metric of a radio what are you looking at?

You look at the health of the radio frequency (RF) around the radio

Why do you need to select the right platform settings and country in a custom FortiAP profile

You must select the correct platform because this is what tells fortigate the type of hardware used by the AP. Country/regio provides RF channels available in the area.

When bridged SSIDs are using VLANs what does the fortiAP ethernet interface act as?

a 802.1Q trunk

Wireless capacity - Channel utilization

a percentage count of used airtime on the interface channel around each AP for all interfaces It does not just account for traffic transmitted by it's own clients, but also account for other wireless traffic on the channels coming from neighboring APs and clients not associated with the network

a VLAN with tunnel mode SSID is treated as ____ ?

a separate virtual interface tied to a physical or tunnel SSID

thick AP

a thick AP has a radio, adds routing features and handles authentication and encryption as well as overall management of the network clients FortiWifi is a thick AP

What does the ap-sniffer-addr do config wireless-controller wtp-profile edit <profile> config <radio-1> set mode sniffer set ap-sniffer-addr 00:00:00:00:00:00 (wildcard)

all 0s will be a wilcard to sniff and decode all traffic on that channel or you can specify to a particular device

Can you apply an ap profile to any FortiAP?

all FortiAP models have different AP profiles -platform setting defines which ap model the profile supports -if the hardware of the AP does not support the specific setting fortigate removes those settings for the AP (ie. Removing 1 radio if the ap only has 1 radio )

inside the TLS session for PEAP what EAP method can be used for client authentication and give two examples

any native EAP method PEAPv0/MSCHAPv2 PEAPv1/EAP-GTC

PEAPv0/MSCHAPv2

authenticates the client using MSCHAPv2 EAP encapsulation method used for client authentication after the TLS session is established

what does the authentication server use to authenticate a client using PEAP

authentication server uses a digital certificate to auth the client

why might a third party utility be needed to use EAP-TTLS for

because it is not natively supported on many devices

How can VLANs enhance the capabilities of a wireless network

because you can separate an SSID into broadcast domains/more manageable subnets, so you dont need multiple SSIDs. Each VLAN is its own broadcast domain. Smaller broadcast domains reduce traffic and increase security

When does background scanning for rogue APs occur

by default the scan periods starts every 600 seconds and each seconds a different channel is monitored for 20 ms until all channels have been checked.

what three parties does 802.1X involve

client (aka supplicant) - device that wants to join the network authenticator - network device such as AP or switch authentication server - the host that supports RADIUS and EAP protocol such as FAC

how does 802.1X work (simple)

client is allowed to access layer 2 network after their identity has been validated and authorized. The client provides credentials to the authenticator (AP and switch) which the authenticator forwards to the authentication server for verification. If the authentication server determines that the credentials are valid, the client device is allowed to access the network

what is one of the biggest sources of wireless network issues

co-channel interference caused by incorrect channel settings

what are the two types of frequency interference

coherent and non-coherent

command to configure vlan pooling with managed AP groups in CLI

config wireless-controller vap edit <ssid> set vlan-pooling wtp-group config vlan-pool edit <vlanid> set wtp-group <groupname>

command to configure AP in sniffer mode

config wireless-controller wtp-profile edit <profile> config <radio-1> set mode sniffer set ap-sniffer-bufsize 32 set ap-sniffer-chan 1 set ap-sniffer-addr 00:00:00:00:00:00 (wildcard) set ap-sniffer-mgmt-beacon en set end set ap-sniffer-mgmt-other en set ap-sniffer-ctl en set ap-sniffer-data en

Radio Setting on AP profile: Mode

disabled (no radio) access point(normal radio) , dedicated monitor (used to monitor and not for clients)

What multicast address does FortiAP use to discover fortigate controller (multicast method)

discovers the controller using the multicast address 224.0.1.140

example: 1 mechanism that can help limit the need to have multiple wireless networks being broadcast

dynamic vlans

AVP (attribute value pairs) with the EAP-TTLS use what to authenticate the client (2)

either a native EAP or a legacy auth proto such as CHAP or PAP

using PEAP what does the client do prior to the authentication request

establishes a TLS session

How does FortiAP use DNS to discover the controller (DNS method)

fortiAP can discover the controller by using a host named configured in the AC_HOSTNAME_1 parameter

if using dynamic vlan assignment with a tunnel mode SSID where is traffic sent

fortigate

By default all traffic from the remote FortiAP is sent to the ____ _____ ____

fortigate Wifi controller

After you create VLANs under VLAN pooling with AP group method what do you need to do?

fortigate will automatically create the vlan interface but you need to apply interface settings such as IP and admin access, DHCP server, etc

Client load balancing across 2.4/5GHz =

frequency handoff

command to transfer AP pcap file to TFTP server

ftftp -1 /tmp/wl_sniff.cap -r sniff.cap -p <IP of TFTP server>

GMK

group master key Group master key is used in a 4-way handshake to create GTK.

dedicated spectrum analyzer

has chipset and software specifically designed to analyze wireless interference. They often come with a highly directional antenna and are mobile allowing a wireless engineer to walk the site and locate interference. It also allows for the classification of interference such as microwaves or bluetooth

Offline Dictionary Attack

ie The attacker obtains the system password file and compares the password hashes against hashes of commonly used passwords. If a match is found, the attacker can gain access by that ID/password combination. Ie An offline dictionary attack is performed by obtaining a ciphertext generated using the password-derived key, and trying each password against the ciphertext. This category of attack is invisible to the KDC and can be performed much faster than an online attack.

why would a client have a 169 address

if the network admin is dumb or if the client cant claim a dhcp lease

if the number of clients is already at the defined threshold and AP handoff is enabled what happens

if the number of clients is already at the defined threshold, new clients are redirected to join the least busy AP nearby. fortigate will request the least busy AP to respond to the join request for any new client that tried to connect to an overloaded AP if the RSSI condition is met.

Why should you disable broadcasting SSID

increases security and reduces management traffic

wireless alliance client certification

independent organization funded by the wireless industry. One service it offers is client certification. The alliance tests wireless clients and wireless Aps to verify compatibility before it issues a cert. cert is not a compatibility but it proves the client has been test in an enterprise environment http://www.wi-fi.org/product-finder

what needs to be configured for a VLAN with tunnel mode SSID

interface settings such as IP address, admin access, and separate firewall policies

what point of view does the wifi client monitor show for signal strength

it shows the signal strength measured by the AP does not show the strength for AP at the client

how to verify an AP is in monitor mode directly from the AP CLI

iwconfig mode:"Master"

problem: client shows as connected in the controller device tables and has a valid IP but cant ping other hosts on the network solution: (3 examples)

key hosts and services on the network shouldbe reachable at layer 3, which you can test using ping. failed connectivity indicates: -a policy is potentially preventing traffic flow -a captive portal is in place but not triggered -routing issue

what layer authentication does 802.1X provide

layer 2

Cons of bridge mode SSID

limited VLAN pooling options

common wireless equipment vendor used by wireless engineers

metageek

What does fortiplanner let you customize about the APS (6)

name, device radios, frequency, transmit power, orientation, and azimuth (North=0, E=90, S=180,W=270)

does the authenticator (AP or switch) need to have any knowledge on the authentication method (PEAP, TLS, etc) for 802.1X and why

no because the authentication is tunneled from the client to the authentication server over the RADIUS protocol

what SSID type is dynamic vlan assignment allowed on

on both tunnels or bridged ssid settings

EAP-TLS

one of the most common native methods that uses TLS and digital certificates on both clients and server to authenticate requires PKI implementation for all your wireless clients (all devices will need to have a valid certificate installed in order to connect to the wireless network) useused for client authentication after the TLS session is establishedd for client authentication after the TLS session is established

when are firewall policies required for a bridged SSID with a VLAN tagged?

only to route traffic between interfaces

if a wireless client is having connectivity issues and you determine it is the individual client by testing on several other clients, what can the issue then be narrowed down to

point to a driver or chipset issue on the individual client or maybe has to do with authentication if using 802.1X or MAC whitelisting/blacklisting

PRF

pseudo-random function which is applied to all the input. Used when generating the keys in the wireless four way handshake

FortiOS automatically adds all load balancing vlans to _____ after they are created in a VLAN pool

puts the VLANs in a zone based on the SSID they were defined in and tied to the VLAN interface. The zone name includes the SSID interface followed by .zone

how do you correctly disable an AP packet capture

remove AP from capture profile and then edit the profile to disable the capture

what does EAP-tLS required to be implemented for all wireless clients

requires PKI implementation for all your wireless clients (all devices will need to have a valid certificate installed in order to connect to the wireless network)

problem: client shows as connected in the controller device tables but doesnt have a valid IP address for the network it is joining solution: (6 examples)

solution: a wireless network is often assigned its own vlan and as a result its own IP schema and DHCP scope -some clients assign themselves a 169 link local address when they cant claim a DHCP address -make sure DHCP is not exhausted -if using a bridged network add a non-fortigate DHCP option -if using dynamic vlans with RADIUS make sure the RADIUS server is returning the correct attribute -if user assigned a static IP and moves to a new AP -fortiWLC stops a client from joining a tunneled wireless network if the clients manually configured IP address doesnt match the IP address range in use on the wireless network

Invalid MAC OUI

some attackers use randomly generated MAC address. The first three bytes of the MAC address are the OUI administered by the IEEE. invalid OUIs are logged

for a bridged SSID with VLANs where is the VLAN tagged?

tagged on the fortiAP and sent out the fortiap ethernet interface acting as a trunk to the switch

what is one way to isolate a wireless connectivity issue to the client instead of the AP

test with multiple wireless clients and see if they have the same problem

If a VLAN pool contains no valid VLAN ID what VLAB will users get assigned to?

the SSID static VLAN ID setting

when you use vlan pooling with the "Managed AP group setting" what do you define in the vlan pool settings?

the VLAN ID and the AP group to apply the VLAN ID to

what is one factor that CCI (co channel interference) is highly dependent on

the amount of traffic being transmitted over the channel. More traffic = more collisions

with dynamic vlan assignment, if the users RADUIS record does not specify a VLAN ID, what VLAN is the suer assigned

the default VLAN specified under: config wireless-controller vap edit <ssid> set vlanid <id> set dynamic-vlan enable

The lower the link rate means...

the more time is required to transmit a given amount of network traffic and the lower the link performance for the client

what is this command for: diagnose wireless-controller wlac sta_filter <AP station mac> 2

this will capture a step-by-step log of connection attempts made to the AP

AP overloading - client count/utilization and how to avoid it (3)

too many clients on a radio -for networks that have clients that regularly transfer large files or stream, you should aim for 30 clients per radio -for networks that have clietns that require only basic file, print, and Internet access, you should aim for 50 clients per radio may required additional APs w/ channel planning

What SSID mode can vlan tagging be used in

tunnel and bridge

VLAN pooling load balancing is only available for SSIDS in ____ mode

tunneled

where is the pcap for wireless packet sniffing temporarily stored

under the tmp directory as wl_sniff.pcap will be removed if AP is rebooted or radio parameter is changed

too many SSIDS can cause _____and why?

unwanted interference b/c wireless is a shared medium and clients will be competing for available airtime

what is dynamic vlan assignment for

used in the SSIDs with RADIUS authentication to assign each user a VLAN based on information provided by the RADUIS authentication server

In what AP deployment scenario would a bridged SSID be useful

useful when deploying an AP that connects to a wireless controller over a WAN link at remote location

PEAPv1/EAP-GTC

uses different identification mechanisms (including one time passwords) for authenticating clients, which makes it flexible. FAC supports it, but not commonly supported by other vendors EAP encapsulation method used for client authentication after the TLS session is established

How does FortiAP use the forticloud method to locate controller for forticloud management (forticloud method)

uses the host name apctrl1.fortinet.com for forticloud mgmt

what is frequency interference

when another wireless signal overpowers or corrupts your signal and causes frame loss, frame retries, and link rate reduction

where is vlan pooling configured

wifi & switch controller > SSIDs > vlan pooling enable > create new

What are the fortiAPs referred to as in FortiOS CLI

wireless termination points (WTP)

why are dual band APs increasingly hard to configure to prevent co-interference

with 5GHz APs are required to be closer due to higher signal strength and greater SnR requirements. This can cause problems with 2.4ghz planning and may require some APs 2.4ghz radio to be disabled

TX power mode auto and how it works in terms of detected interference

you must define the power range and FortiOS will automatically adjust the power in that range. If interference is detected the controller will automatically reduce AP tx power until "auto-power-low threshold" if interference is not detected or is detected and removed, controller increases AP TX power until "auto-power-high threshold"

DTLS

(Datagram Transport Layer Security) TLS used with UDP applications, Used to encrypt CAPWAP communication

What is vlan assignment, for vlan pooling, based on (2)

- The AP fortiAP group (for network config reasons) example: AP in lobby always assigns clients to a guest vlan) -Available VLANs for network load balancing purposes (tunnel mode SSID only)

problem: when a client fails to connect to a wireless network, it can be difficult to identify if the cause is an authentication process, a configuration issue, or issue with the wireless connection solution: (2)

- create an unencrypted test network -capture a log of station connection

A new client joins 5GHz only if: (2) what happens if both of these things are true? (2)

- fortigate uses the table to check: -clients support dual band -RSSI value is strong on 5GHz -if both of the above are true fortigate ignores the clients request to join on 2.4 until client times out -client attempts to connect to same SSID on 5GHz and fortigate responds to request

How does AP handoff work (2)

- if the number of clients exceeds the maximum number of clients configured for an AP the client with the lowest RSSI value will be forced to join another AP (RSSI must meet the signal strength on the nearby AP) -if the number of clients is already at the defined threshold, new clients are redirected to join the least busy AP nearby (least busy nearby AP responds to the clients join request) Basically: If load exceeds threshold client with weakest link will be signaled to join another AP If load at max, controller signals another AP to respond to client

Source of information - Wifi Client Monitor (3)

- widgets and details client information for all clients currently connected - use to assess the client health from the AP point of view -add the Rate, MIMO, and band columns

What is the minimum signal that a voice handset requires

-68dBm

As a guide, a healthy channel noise should maintain rates of:

-92 or weaker (a higher neg number) -high -80s is OK -low -80s or -70s is BAD and indicates an interference that should be investigated with a spectrum analyzer

Tunnel mode SSID interface

-A tunneled SSID is treated as a layer interface 3 -can configure administrative access to wireless interface -must have separate DHCP and DNS setting

Managed AP topology - direct connection (5)

-Aka wire closet deployment -No switches between fortigate and FortiAP -deployment type is used where the number of fortiAPs equal the number of internal ports available on fortigate. -ideal for home or small office -no need to preconfigure AP -automatic wireless controller discovery using broadcast

What two ways are there to configure FortiAP to detect rogue APs.

-As a dedicated monitor (can assign one or both radios ) -in idle periods during AP operation (background scanning)

different EAP method/versions (5)

-Cisco LEAP (lightweight EAP) -EAP-TLS -PEAP (Protected EAP) -EAP-TTLS (EAP Tunneled TLS) EAP-SIM (EAP Subscriber Identity module)

SSID options - name some (3)

-Client limit -broadcast SSID toggle -block intra-ssid traffic

What can you configure in FortiAP cloud under configure menh

-Custom AP profile with all type of AP settings -SSID profile to configure preshared keys, WPA/WPA3 enterprise, captive portals

What settings must be enabled to enable on-wire automatic suppression (4)

-Enable rogue AP detection (WIDS) -sensor mode = foreign and home channels (WIDS) -auto-suppress rogue APs in foreground scan (WIDS) -have an AP or radio in dedicated monitor mode (foreground scanning)

What are the 3 deployment solutions/secure wireless modes offered by fortinet

-FortiOS Integrated wireless controller -fortiAP cloud management -dedicated wireless controller deployment

Fortiplanner pre deployment planning (6)

-Import floor plan -draw obstructions -select AP type -manually or auto place APs -uses ray tracing algorithms to estimate signal loss and bounce -select built in deployment scenarios such as VoIP, high priority data, or normal

6.4 Secure Wireless

Related study sets

MKT 402 Final

Psychology -- Chapter 1

Chapter 9

euler paths and circuits

Nutrition In Community Test 2

AP Euro CH 17

Chapter 12

Calculus

GM 105 - Exam 1 Ch 1 & 2

05. tétel - Rendszerelemzés és -tervezés

C-17-C Mitosis

Human Evolution Final

final accounting

Fundamentals exam 1

CINS study guide EXAM 2

A&P 2 Chapter 18 Blood Vessels Practice

finance final

ALL Ocean Practice Questions 2021

Chapter 9-13 cognitive psychology

Foundations Ch 27 Safety, Security and emergency