Wireless Security Deep Dive Part 36 – CoA, OpenRoaming, Hotspot 2.0, RADIUS Attributes, Umbrella Integration and Meraki Security Enforcement
Enterprise wireless security is no longer limited to WPA2 passwords and guest access portals. Modern wireless environments operate as distributed identity-driven security systems capable of making authorization decisions in real time based on user identity, device posture, location, application usage, DNS reputation, firewall policy, and behavioral analytics.
In this article we move beyond basic authentication concepts and explore the advanced mechanisms that actually enforce enterprise wireless security after a user connects.
Authentication gets users onto the network. Authorization determines what they can do. Policy engines continuously evaluate risk and can modify access in real time.
Table of Contents
Change of Authorization (CoA)
One of the most important concepts in modern wireless networking is Change of Authorization.
Historically, user permissions were assigned at login and remained unchanged until disconnect.
Modern security architectures require policies to evolve dynamically.
Why CoA Exists
User Connects ↓ Authenticated ↓ Access Granted ↓ Security Posture Changes ↓ Policy Must Change
Without CoA, the session remains unchanged.
With CoA, permissions can be updated immediately.
Examples
- Endpoint becomes non-compliant
- User moves from guest to employee role
- Security team quarantines device
- Malware detected
- Certificate revoked
CoA Packet Structure
Code: CoA-Request (43) Identifier: 0x15 Length: 120 Authenticator: 8FAD9A.... Attributes: User-Name = employee1 Calling-Station-ID = AA:BB:CC:DD:EE:FF Tunnel-Private-Group-ID = 50
The CoA request identifies an active session and instructs the wireless controller to modify authorization attributes without disconnecting the client.
Disconnect Message (DM)
CoA modifies a session.
Disconnect Message completely terminates it.
CoA ↓ Modify Session DM ↓ Terminate Session
If a laptop is reported stolen, the policy server may immediately send a Disconnect Message.
Local Wireless Policies
Local policies are enforced directly on access points or wireless controllers.
These policies operate closer to the endpoint than centralized policy engines.
Common Policy Controls
- ACL Enforcement
- Bandwidth Limits
- Rate Limiting
- Application Visibility
- QoS Enforcement
- Traffic Prioritization
Example Student Policy
SSID: Student Bandwidth: 10 Mbps VLAN: 100 Applications: Allow Web Allow Teams Block Gaming Block Torrent
Local enforcement reduces latency because decisions do not require controller interaction.
Layer 2 Wireless Security
Layer 2 security protects the wireless medium itself.
WPA2 Four-Way Handshake
ANonce ↓ SNonce ↓ PTK Generated ↓ GTK Distribution
The handshake derives encryption keys without transmitting them.
Protected Management Frames (802.11w)
Attackers often exploit management frames.
PMF protects:
- Deauthentication Frames
- Disassociation Frames
- Certain Management Actions
WPA3 and SAE
WPA3 replaces PSK weaknesses using Simultaneous Authentication of Equals.
Offline dictionary attacks become significantly harder.
Password Entropy
Where:
- N = Character Set Size
- L = Password Length
Layer 3 Security Architecture
Layer 3 security focuses on traffic behavior after authentication.
Security Controls
- VLAN Segmentation
- VRFs
- Firewalls
- ACLs
- DNS Security
- Micro-Segmentation
Typical Flow
Client ↓ VLAN ↓ Firewall ↓ DNS Inspection ↓ Application Inspection ↓ Internet
OpenRoaming
OpenRoaming is a global federation framework enabling seamless wireless roaming.
Users authenticate through trusted identity providers rather than local credentials.
Traditional Model
SSID ↓ Password ↓ Access
OpenRoaming Model
SSID ↓ Identity Provider ↓ Certificate Validation ↓ Access
Benefits
- No captive portals
- No shared passwords
- Automatic onboarding
- Global roaming support
- Strong identity assurance
Hotspot 2.0
Hotspot 2.0 provides automatic network discovery and secure authentication.
It uses IEEE 802.11u and Passpoint technologies.
Discovery Process
Client ↓ ANQP Query ↓ Network Advertisement ↓ Credential Match ↓ Automatic Join
Users do not manually select SSIDs.
Advantages
- Secure roaming
- Reduced user interaction
- Improved enterprise mobility
- Carrier Wi-Fi offload
RADIUS Attributes Deep Dive
RADIUS attributes drive authorization decisions.
Common Attributes
| Attribute | Purpose |
|---|---|
| User-Name | User Identity |
| Calling-Station-ID | Client MAC Address |
| NAS-IP-Address | Authenticator Address |
| Tunnel-Type | VLAN Assignment |
| Session-Timeout | Session Duration |
Access Accept Example
Access-Accept Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = 20 Session-Timeout = 3600
These attributes dynamically determine user permissions.
Umbrella Integration
DNS is often the first communication channel used by malware.
Umbrella protects users before TCP sessions are established.
Normal DNS Flow
Client ↓ DNS Query ↓ Resolver ↓ Internet
Protected Flow
Client ↓ Umbrella Resolver ↓ Threat Intelligence ↓ Allow or Block
Blocked Domain Example
Query: malware-example.com Response: Blocked
Threat Defense Architecture
Modern wireless security depends on multiple enforcement layers.
Threat Detection Sources
- DNS Reputation
- Malware Intelligence
- Behavior Analytics
- Endpoint Telemetry
- SIEM Correlation
When risk exceeds thresholds, policy engines can trigger CoA automatically.
Meraki MR Firewall
Meraki access points support integrated firewall functionality.
Capabilities
- Layer 3 Firewall
- Application Restrictions
- SSID-Based Policies
- Group Policies
Example Rule
Deny Source: Any Destination: 10.10.10.0/24 Protocol: Any
This prevents wireless clients from accessing sensitive servers.
Meraki Preconfigured Network Policies
Meraki allows administrators to create reusable policy templates.
Policy Example
| Setting | Value |
|---|---|
| Bandwidth Limit | 10 Mbps |
| Firewall | Internet Only |
| Content Filter | Enabled |
| Application Block | Torrent |
Advantages
- Consistent Enforcement
- Faster Deployment
- Reduced Operational Overhead
- Policy Standardization
Enterprise Design Recommendations
- WPA3 Enterprise
- 802.1X Authentication
- Certificate-Based Access
- OpenRoaming Support
- Hotspot 2.0 Enablement
- Dynamic VLAN Assignment
- CoA Enforcement
- Umbrella DNS Security
- Layer 3 Segmentation
- Meraki Group Policies
- Threat Intelligence Integration
Modern enterprise wireless security is no longer a single control. It is an ecosystem of identity, authorization, DNS intelligence, segmentation, firewall enforcement, and continuous policy evaluation.
The strongest wireless networks continuously evaluate trust and adapt permissions dynamically through policy-driven automation.
📚 Related Articles in This Series
Continue building your enterprise wireless security knowledge with the previous articles in this series. Each article expands on concepts that are referenced throughout this deep dive.
- Part 29 – Wireless Security and Identity
- Part 30 – Wireless Guest Management and Captive Portals
- Part 31 – Wireless Identity Management, PKI and Certificates
- Part 32 – Wireless Intrusion Detection and Prevention
- Part 33 – Secure Wireless Management Access and Control
- Part 34 – Cisco TrustSec and Wireless Group-Based Policies
- Part 35 – Wireless Security and Network Access Policies, Authentication, Authorization, Profiling, Provisioning, ACLs and Trustpoint Management
- Wireless Services, AVC and NetFlow Explained – Enterprise WiFi Visibility Guide (Part 37)
No comments:
Post a Comment