Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our small business currently has 3 wireless access points around the building, each with their own SSID. Security is done with WEP (ick) and MAC address filtering (double ick).

We are trying to reconfigure the setup, with these goals:

  • wifi roaming between the access points
  • user-based authentication that isn't as annoying as MAC address filtering.

1) The entire building is hardwired with ethernet, so I assume it should be easy to set up the routers to act as one big network, but I can't figure out how. Can someone point me in the right direction? The routers are consumer-grade linksys routers, is it possible to do this without getting new hardware?

2) For security, we will probably upgrade to WPA2, and I'm thinking of using the Enterprise version so that users can log in with a username, instead of having a single key (so if an employee leaves or something, their access can be removed). We have several on-site Windows servers, can one of them be set up as a RADIUS server, or is that best left to a dedicated machine (again, using existing hardware is good).

share|improve this question

migrated from superuser.com May 3 '10 at 17:40

This question came from our site for computer enthusiasts and power users.

    
possible duplicate of serverfault.com/questions/138070/… –  John Gardeniers May 6 '10 at 1:36

2 Answers 2

up vote 3 down vote accepted
  1. Nothing fancy, just use the same SSID and ensure they are all on the same subnet.

  2. Ensure you use AES, not TKIP. Whether or not you can use an existing server depends on how heavily loaded the existing server is and how much load you'd be adding. A quick bit of searching suggests that Windows server comes with a RADIUS server option (Internet Authentication Service) that can be integrated with Active Directory. That might be your best option if you're already using AD.

share|improve this answer
    
What's wrong with TKIP –  James Watt May 3 '10 at 16:28
    
+1. Just to be more explicit, when @Cry says to make sure they're all on the same subnet, also make sure they're all simply bridging frames between wireless and wired (no NAT, no DHCP). You want all the wireless traffic to pass right through the APs to the existing DHCP server (and NAT gateway, if any) on the wired Ethernet LAN. Also, if the business is small enough that 3 APs suit their coverage needs, then they don't have enough clients to make any kind of dent in the RADIUS server's load. –  Spiff May 3 '10 at 17:16
    
About roaming: we had tried to just set them all to the same SSID/subnet, with different (non-overlaping) channels, but had problems with that because computers would connect to the APs seemingly at random, and often would not pick the best AP. Sometimes the AP/channel that computers picked provided essentially no connectivity. Is there something to be done about that? –  Henry Jackson May 4 '10 at 0:09
    
TKIP is insecure and known to be broken, it was introduced to allow legacy (ie WEP era) hardware to run WPA. –  Cry Havok May 4 '10 at 17:19
    
Henry - that sounds like a client specific problem, not a lot you can do except improve coverage. –  Cry Havok May 4 '10 at 17:20

Depending on the Linksys AP, you might be able to flash them to something like openwrt, dd-wrt and create a wireless mesh (dd-wrt makes this pretty easy).

But like I said, depends on your hardware.

Details go here on dd-wrt: http://www.dd-wrt.com/site/index

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.