Wireless Internet and Municipal Wi-Fi Networks

Wireless Internet-Based Broadband

• This technology transmits and receives data using the unlicensed radio spectrum.
• Anyone with a wireless router and compatible technology can access the unlicensed spectrum.
• Wireless access was limited to a local transmission range, typically within 100 feet of a wireless router with a wired internet connection.

Municipal Wi-Fi

• Many cities are establishing municipal wireless networks.
• These networks often provide high-speed internet access for free or at a reduced cost. Some networks are for city use, allowing police, fire departments, etc. to remotely perform their duties.
• Connecting to municipal Wi-Fi generally requires a wireless modem.
• Wireless modems provide a stronger radio and directional antenna compared to standard wireless adapters.
• Service providers may offer necessary equipment for free or for a fee, similar to DSL or cable modems.

Cellular

• Cellular service provides wireless WAN used to connect users and remote locations.
• Smartphones and tablets can use cellular data for email, web browsing, apps, and videos.
• Devices use radio waves to communicate through a nearby mobile phone tower, with the provider having a larger antenna at the top of the tower within miles of the device.

3G/4G/5G Wireless

• These are mobile wireless technology abbreviations for 3rd, 4th, and 5th generations.
• 4G standards support bandwidths up to 450 Mbps download and 100 Mbps upload.
• Emerging 5G standards should support 100 Mbps to 10 Gbps and beyond.

Long-Term Evolution (LTE)

• LTE is a newer, faster technology and part of the 4th generation (4G).

Satellite Internet

• Typically used in rural or remote areas where cable and DSL are unavailable.
• Accessing satellite internet requires a satellite dish, two modems (uplink and downlink), and coaxial cables between the dish and the modem.
• A router connects to a satellite dish pointed towards a service provider's satellite.
• Signals travel approximately 35,786 kilometers (22,236 miles) to and from the satellite in geosynchronous orbit.
• The antenna needs a clear view toward the equator, where most orbiting satellites are located.
• Heavy rains and trees can affect signal reception.
• Satellite internet offers two-way data communication.
• Upload speeds are about one-tenth of the download speed.
• Download speeds range from 5 Mbps to 25 Mbps.

WiMAX

• WiMAX is a new wireless technology.
• WiMAX is described in IEEE standard 802.16.
• WiMAX provides high-speed broadband service with wireless access and broad coverage, similar to a cell phone network.
• WiMAX operates at higher speeds and over greater distances than Wi-Fi, for more users.
• Accessing a WiMAX network requires subscribing to an ISP with a WiMAX tower within 30 miles of the user's location.
• A WiMAX receiver and encryption code are also needed to access the base station.
• WiMAX has largely been replaced by LTE for mobile access, and by cable/DSL for fixed access.

VPN Technology

• Security risks emerge when teleworkers or remote office workers use broadband to access the corporate WAN over the Internet.
• Broadband services address these risks by providing Virtual Private Network (VPN) connections to a network device at the corporate site.
• A VPN provides an encrypted connection between private networks across a public network like the Internet.
• VPNs use virtual connections called VPN tunnels rather than dedicated Layer 2 connections.
• VPN tunnels route traffic through the internet from the company's private network to a remote site or employee host.

VPN Benefits

• Cost saving: VPNs enable organizations to utilize the global internet to connect remote offices and remote users to the corporate site, eliminating expensive, dedicated WAN links and modem banks.
• Security: VPNs employ advanced encryption and authentication protocols to deliver top-tier security, safeguarding data against unauthorized access.
• Scalability: The internet infrastructure within ISPs facilitates the addition of new users, allowing corporations to scale capacity without substantial infrastructure investments.
• Compatibility - VPN is supported by broadband service providers. VPNs enable telecommuters to utilize their home high-speed internet access to connect across corporate networks

Types of VPN Implementation

• Site-to-site VPN: VPN settings configured on routers, clients remain unaware that data is being encrypted.
• Remote Access: Users initiate remote access connection, such as through HTTPS or with VPN client software.

ISP Connectivity Options

• ISP connectivity options provide various levels of redundancy and resilience for internet access.

Single-Homed

• A single-homed connection uses one link to connect to an ISP.
• The topology provides no redundancy.
• This is the least expensive option.

Dual-Homed

• Dual-homed connectivity uses two links to connect to the same ISP.
• The topology provides redundancy and load balancing.
• If both links are operational, traffic can be load balanced.
• The organization loses internet connectivity if the ISP experiences an outage.

Multihomed

• Multihomed connectivity connects to two different ISPs.
• The design provides increased redundancy and enables load balancing.
• It can be expensive.

Dual-Multihomed

• Dual-multihomed is the most resilient topology.
• The client connects with redundant links to multiple ISPs.
• This topology provides the most redundancy.
• It is the most expensive option.

Broadband Solution Comparison

• Each broadband solution has its own advantages and disadvantages.
• The solution is to have fiber-optic cable to the client network.
• Some locations only have cable or DSL: some only have broadband wireless.

Factors to Consider: Cable

• Cable TV bandwidth is shared by users, resulting in slow upstream data rates during peak hours.

Factors to Consider: DSL

• DSL has limited bandwidth sensitive to distance from the ISP central office, with proportionally lower upload rates compared to download rates.

Factors to Consider: Fiber-to-the-Home

• This option requires fiber installation to the home.

Factors to Consider: Cellular/Mobile

• Cellular and mobile options often have limited coverage and bandwidth within small office or home settings.

Factors to Consider: Municipal Wi-Fi

• Municipal Wi-Fi may not be widely deployed in a mesh network, but is viable if available and in range.

Factors to Consider: Satellite

• A final consideration is that satellite is typically used as a last resort and provides expensive, limited capacity.

Virtual Private Networks

• VPNs are used to secure network traffic between sites/users.
• VPN creates end-to-end private network connections as an encrypted connection across a shared public network.
• Corporate site uses a Cisco Adaptive Security Appliance firewell, and remote and mobile users can use Cisco's AnyConnect software.
• SOHO remote users can connect via VPN connectivity to the corporate main site.

Cisco AnyConnect

• Secure Mobility Client software allows remote workers to establish client-based VPN connections with the main site.

VPNs - Site-to-Site

• VPN devices are preconfigured to establish a secure tunnel.
• The VPN encrypts only the traffic between the VPN terminating devices. The internal data hosts have no knowledge of a VPN being used on a company network.

VPNs - Remote Access

• Remote-access VPNs establish secure connections between clients and a VPN terminating device.
• An example uses SSL VPN to secure your data when banking online.

VPN Enterprise Managed

• Secures enterpise trrafic across internet. Site-to-site and remote accesss VPNs are created via IPsec and SSL VPNs.

VPN Service Provider

• These VPNs, managed over the provider network, use MPLS at Layer 2 or 3. MPLS creates secure channels between sites, segregating traffic. Legacy solutions include Frame Relay and ATM.

Remote-Access VPNs

• Remote-access VPNs encrypted tunnels that enable remote access to the enterprise.
• These allow remote email and other applications with limited security access to contractors and partners.

Clientless VPN and Client-Based

• With clientless VPN connections, connections are secured by SSL web browser connections. SSL is used for HTTP traffic, and secure email protocols such as, IMAP and POP3, with SSL-tunnelling exchange of HTTOP data.
• Client-based VPN connection: VPN client software, like Cisco AnyConnect, has to be installed on the computers. Remote users must initiate with VPN client which authenticats the gateway with access to files and applications.

SSL VPNs

• Clients negotiate an SSL VPN connection with the VPN gateway, it uses TLS.
• TLS is a newer version of SSL and is sometimes expressed as SSL/TLS.
• SSL uses the public key infrastructure and digital certificates to authenticate peers.
• IPsec and SSL VPN technologies offer access to applications.
• Support and ease of implementation issues use SSLs: use Type based upon access requirements of users.

IPsec VPNs

• Supports all IP based applications.
• Uses two way authentication with security keys/digital certs.
• Strong, using key length from 56-256 bits.
• Medium install, from VPN client on host.

SSL VPNs

• Limited applications.
• Moderate one/two way authentication.
• Moderate to strong keys of 40-256 bits.
• No install, uses web browser.

Site-to-Site IPsec tunnels

• Connect networks over the Internet where normal TCP/IP traffic goes through VPN terminating devices and gateways. Cisco ASA is a standalone example with integrated firewall.

IPsec tunnels

• The VPN gateway encrypts outbound traffic and sends traffic to a target site. The VPN gateway then strips the headers before decrypting and relays the packets toward the host on its private network.
• Typical configuration uses IPsec and GRE.

GRE over IPsec

• GRE allows sites to encapsulate data various layers (network) and supports traffic using multicast and broadcast for the routing protocols to operate over a VPN without encryption support.
• IPsec VPN can create unicast traffic routes. Routing protocols can't exchange information over an IPsec VPN where the encapsulation of GRE use many protocols.

Protocol terms

• Passenger - Original packet to be encapsulated with IPv4 and IPv6, updates to its routers, etc.
• Carrier - Encapsulation by passenger packets.
• Transport - Actual protocol to forward the packet using IPv4 or IPv6. For example, displaying a topology with interchanged OSPF protocols using GRE tunneling.