Intel 533ANM Intel Wi-Fi Link 5300 Series User Manual Contents

Intel Mobile Communications Intel Wi-Fi Link 5300 Series Contents

Contents

User Manual 1

Intel(R) PROSet/Wireless WiFi Connection Utility User's GuideSupported wireless adapters:●     Intel(R) WiMAX/WiFi Link 5350●     Intel(R) WiMAX/WiFi Link 5150●     Intel(R) WiFi Link 5300●     Intel(R) WiFi Link 5100 ●     Intel(R) Wireless WiFi Link 4965AGN●     Intel(R) Wireless WiFi Link 4965AG_●     Intel(R) PRO/Wireless 3945ABG Network Connection●     Intel(R) PRO/Wireless 2915ABG Network Connection●     Intel(R) PRO/Wireless 2200BG Network ConnectionWith your wireless network card, you can access wireless networks, share files or printers, or even share your Internet connection. All of these features can be explored using a wireless network in your home or office. This wireless network solution is designed for both home and business use. Additional users and features can be added as your networking needs grow and change.Depending on the model of your Intel wireless adapter, your adapter is compatible with 802.11a, 802.11b, 802.11g, and 802.11n wireless standards. Operating at 5 GHz or 2.4 GHz frequency at data rates of up to 300 Mbps, you can now connect your computer to existing high-speed networks that use multiple access points within large or small environments. Your wireless adapter maintains automatic data rate control according to the access point location and signal strength to achieve the fastest possible connection. All of your wireless network connections are easily managed by the WiFi connection utility. Profiles that are set up through the WiFi connection utility provide enhanced security measures with 802.1X network authentication.Table of Contents●     Use the Intel(R) PROSet/Wireless WiFi Connection Utility●     Connect to a Network●     Use Wi-Fi Protected Setup* ●     Use Profiles●     Set up Security
●     Wireless Network Overview●     Administrator Tool●     Create Administrator Packages ●     Create Profiles for Windows XP*●     Security Overview●     Safety and Regulatory Information●     Specifications●     Troubleshooting●     Glossary●     Customer Support●     WarrantyInformation in this document is subject to change without notice. © 2004–2008 Intel Corporation. All rights reserved. Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497 USAThe copying or reproducing of any material in this document in any manner whatsoever without the written permission of Intel Corporation is strictly forbidden. Intel(R) is a trademark or registered trademark of Intel Corporation or its subsidiaries in the United States and other countries. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Intel disclaims any proprietary interest in trademarks and trade names other than its own. Microsoft and Windows are registered trademarks of Microsoft Corporation. Windows Vista is either a registered trademark or trademark of Microsoft Corporation in the United States and/or other countries.*Other names and brands may be claimed as the property of others.Intel Corporation assumes no responsibility for errors or omissions in this document. Nor does Intel make any commitment to update the information contained herein."IMPORTANT NOTICE FOR ALL USERS OR DISTRIBUTORS:Intel wireless LAN adapters are engineered, manufactured, tested, and quality checked to ensure that they meet all necessary local and governmental regulatory agency requirements for the regions that they are designated and/or marked to ship into. Because wireless LANs are generally unlicensed devices that share spectrum with radars, satellites, and other licensed and unlicensed devices, it is sometimes necessary to dynamically detect, avoid, and limit usage to avoid interference with these devices. In many instances Intel is required to provide test data to prove regional and local compliance to regional and governmental regulations before certification or approval to use the product is granted. Intel's wireless LAN's EEPROM, firmware, and software driver are designed to carefully control parameters
that affect radio operation and to ensure electromagnetic compliance (EMC). These parameters include, without limitation, RF power, spectrum usage, channel scanning, and human exposure.For these reasons Intel cannot permit any manipulation by third parties of the software provided in binary format with the wireless LAN adapters (e.g., the EEPROM and firmware). Furthermore, if you use any patches, utilities, or code with the Intel wireless LAN adapters that have been manipulated by an unauthorized party (i.e., patches, utilities, or code (including open source code modifications) which have not been validated by Intel), (i) you will be solely responsible for ensuring the regulatory compliance of the products, (ii) Intel will bear no liability, under any theory of liability for any issues associated with the modified products, including without limitation, claims under the warranty and/or issues arising from regulatory non-compliance, and (iii) Intel will not provide or be required to assist in providing support to any third parties for such modified products.Note: Many regulatory agencies consider Wireless LAN adapters to be "modules", and accordingly, condition system-level regulatory approval upon receipt and review of test data documenting that the antennas and system configuration do not cause the EMC and radio operation to be non-compliant."April 2008
Back to ContentsUse the Intel(R) PROSet/Wireless WiFi Connection Utility SoftwareUse Intel(R) PROSet/Wireless WiFi Connection Utility as your Wireless Manager Start Intel(R) PROSet/Wireless WiFi Connection Utility Start Intel(R) PROSet/Wireless WiFi Connection Utility from the Taskbar●     Taskbar Icons●     Tool Tips and Desktop AlertsIntel(R) PROSet/Wireless WiFi Connection Utility Main Window●     First Time Connection ●     WiFi Networks list●     Connection Status Icons●     Network Properties●     Connection DetailsIntel(R) PROSet/Wireless WiFi Menus●     Tools Menu ❍     Application Settings❍     Intel Wireless Troubleshooter❍     Manual Diagnostics Tool ❍     Administrator Tool●     Advanced Menu ❍     Adapter Settings❍     Advanced Statistics❍     Use Windows to Manage WiFi●     Profiles Menu ❍     Manage Profiles❍     Manage ExclusionsUse Intel(R) PROSet/Wireless WiFi Connection Utility Profile Features Turn Wireless Radio On or Off Installing Intel(R) PROSet/Wireless WiFi Connection Utility  Install Additional Software Features Remove Intel(R) PROSet/Wireless WiFi Connection Utility
Use Intel(R) PROSet/Wireless WiFi Connection Utility as Your Wireless ManagerIntel(R) PROSet/Wireless WiFi software is used to set up, edit, and manage network profiles to connect to a network. It also includes advanced settings such as power management and channel selection for setting up ad-hoc networks.If you use Microsoft* Windows XP* Wireless Zero Configuration as your wireless manager, you can disable it from the Microsoft Windows Wireless Network tab.To disable Microsoft Windows XP Wireless Zero Configuration as your wireless manager:1.  Click Start > Control Panel.2.  Double-click Network Connections.3.  Right-click Wireless Network Connection.4.  Click Properties.5.  Click Wireless Networks.6.  Verify that the Use Windows to configure my wireless network settings is not selected. If it is, clear it.7.  Click OK. This confirms that the Intel(R) PROSet/Wireless utility is configured to manage your network profiles.NOTE: Verify that the Application Settings option Notify when another application uses the wireless adapter is selected. This option prompts you when Microsoft Windows XP Wireless Zero Configuration starts to manage your network profiles.Start Intel(R) PROSet/Wireless WiFi Connection Utility To start the WiFi connection utility, use one of the following methods:●     Click Start > Programs > Intel PROSet Wireless > WiFi Connection Utility .●     Right-click the Taskbar icon   located in the lower right corner of your Windows Desktop to open the Taskbar menu. Click Configure WiFi .●     Double-click the Taskbar icon.To close the WiFi connection utility from the main window, use one of the following:●     Select File > Exit from the main window.●     Click Close.●     Click the Close button (X) at the top right corner of the window.
Intel(R) PROSet/Wireless WiFi Connection Utility Main Windowthe WiFi connection utility Main Window lets you:●     View the current connection details (signal quality, speed and current network name).●     Scan for available wireless networks.●     Manage profiles.●     Auto-connect profiles to available networks in a specific order defined in the Profile list.●     Connect to Infrastructure and Device to Device (ad hoc) networks.●     Configure adapter settings.●     Troubleshoot wireless connection problems.
Connection Details On the main window, click Details to view detailed parameters of the access point and network adapter. The Connection Details window displays the current network connection information. See Connection Details for a complete description. The Taskbar icon also indicates the current connection status. See Taskbar Icons. Main Window Connection Status Icons The connection status icons indicate the current connection status of your wireless adapter. The connection status icon displays in the WiFi connection utility main window See Connection Status Icons. Profile ManagementOn the WiFi connection utility main window, click Connect on a wireless network. Once connected, a profile is created in the Profiles list. The Profiles List displays the current user profiles in the order that they are to be applied. Use the up and down arrows to arrange profiles in a specific order to automatically connect to a wireless network.You can also add, edit, and remove profiles from the Profiles list. Click Profiles on the WiFi connection utility main window.Different profiles can be configured for each wireless network. Profile settings can include, the network name (SSID), operating mode, and security settings. See Profile Management for more information.MenusUse the File, Tools, Advanced, Profiles and Help menus to configure your network settings.
Name DescriptionFile Exit: Closes the WiFi connection utility main window.Tools Application Settings: Use to set system wide connection preferences. See Application Settings for information.Intel Wireless Troubleshooter: Use to resolve wireless network connection problems. See Intel Wireless Troubleshooter for more information.Manual Diagnostics Tool: The Manual Diagnostics Tool lets you run a set of diagnostics tests that verify the functionality of your wireless adapter. See Manual Diagnostics Tool for more information.Administrator Tool: Used by administrators or the person who has administrator privileges on this computer to configure shared profiles (Pre-logon/Common, Persistent, and Voice over IP [VoIP]). The Administrator Tool can also be used by an Information Technology department to configure user settings within the WiFi connection utility and to create custom install packages to export to other systems. See Administrator Tool for more information.NOTE: The Administrator Tool is available only if it installed during a custom installation of the Intel(R) PROSet/Wireless WiFi software. See Install Additional Software Featuresfor more information on custom installation.Advanced Adapter Settings: Displays Adapter Settings that are equivalent to the settings in the Microsoft Windows Advanced settings. See Adapter Settings for information.To access Adapter Settings from Microsoft Windows:●     Double-click Network Connections from the Windows Control Panel.●     Right-click the Wireless Network Connection.●     Select Properties from the menu.●     Click Configure to display the Advanced settings for the adapter.Advanced Statistics: Select to view detailed information about the wireless adapter and connection. See Advanced Statistics for more information.Use Windows to manage Wi-Fi: Select to enable Microsoft Windows XP as the wireless manager. See Microsoft Windows XP Wireless Zero Configuration for more information.
Profiles Manage Profiles: Select to create or edit profiles.Manage Exclusions: Select to exclude networks from automatic connection. See Manage Exclusions for more information.Help Intel PROSet/Wireless WiFi Help: Starts the online help.About: Displays version information for the currently installed application components.Administrator Tool (Tools menu)The Administrator tool is for administrators or the person who has administrator privileges on this computer. This tool allows the administrator to restrict what level of control the users of this computer have over their wireless connections. This tool is used also to configure common (shared) profiles.Users cannot modify Administrator settings or profiles unless they have the password for this tool. A password should be chosen that is secure and not easily guessed.You can export these settings and profiles as one package to other computers on your network. For more information, See the Administrator Tool section.Name DescriptionAdministrator Packages The Administrator Packages are used to save administrative profiles and other settings. For Windows XP*, you can copy or send this self-extracting executable to clients on your network. When it is run, the contents are installed and configured on the destination computer. See Administrator Tool Packages.Application Settings An administrator can configure the WiFi connection utility Application Settings to control how the application behaves on the user's computer, and to select what level of control users have over various aspects of their wireless connections. See Administrator Tool Application Settings.Administrator Profiles Enable or disable Persistent or Pre-logon/Common profiles and configure Voice over IP (VoIP) settings on the computer. See Administrator Tool Profiles.Adapter Settings An administrator can select which level of control that users have over their wireless network connections. See Administrator Tool Adapter Settings.
EAP-FAST A-ID Groups An administrator can select which Authority Identifier (A-ID) RADIUS server to provision Protected Access Credentials (PACs) for profiles that use EAP-FAST authentication. A-ID groups are shared by all users of the computer and allow EAP-FAST profiles to support multiple PACs from multiple A-IDs. See Administrator Tool EAP-FAST A-ID Groups.Change Password Change the password for the Administrator Tool. See Change Password for more information.Close Closes the page.Help? Provides help information for this page.Use Windows to Manage WiFi (Advanced menu)The Microsoft Windows XP Wireless Zero Configuration feature provides a built-in wireless configuration utility. This feature can be enabled and disabled within the WiFi connection utility. Click Use Windows to manage Wi-Fi on the Advanced menu. If Windows XP Wireless Zero Configuration is enabled, the features in the WiFi connection utility are disabled. To let the WiFi connection utility manage your WiFi connections, click Enable WiFi Control on the main window.
Installing Intel(R) PROSet/Wireless WiFi Connection UtilityTypical Installation The following components are installed in a Typical installation.
●     The WiFi connection utility driver. You can choose to install the driver only if desired. This is the minimal installation. ●     The WiFi connection utility. For a Typical installation, this includes the following: ❍     Wi-Fi Protected Setup*❍     Intel Wireless TroubleshooterNOTE: If you plan to use Novell Client* for Windows, it should be installed prior to installation of the WiFi connection utility. If the WiFi connection utility is already installed, you should remove it prior to installation of Novell Client for Windows.Custom Installation The following features are available to install during a Custom installation. Of these, Wi-Fi Protected Setup* and Intel Wireless Troubleshooter are also installed in a typical installation. ●     Administrator Tool●     WMI Support●     Single Sign On ❍     Pre-logon Connect●     WiFi Protected Setup●     Intel Wireless TroubleshooterAdministrator Tool: Installs the Administrator Tool to the Tools menu. This tool is used to configure common (shared) profiles. The Administrator Tool is also used by an Information Technology department to enable or disable features within the WiFi connection utility.WMI Support: Windows Management Instrumentation functionality allows administrators who do not have the WiFi connection utility installed to manage remotely clients that do have the WiFi connection utility installed.Single Sign On: Installs the Single Sign On Pre-Login Connect feature. This tool is used to configure common (shared) profiles with the Administrator Tool. Single Sign On is targeted to the enterprise environment where users log on to their computer with a user name, password, and typically a domain. Fast User Switching does not support domain log on. The Fast User Switching and the Windows XP Welcome Screen are disabled when Single Sign On support is installed.NOTE: Windows Fast User Switching is enabled by default if you use Windows XP Home Edition. It is targeted for the home user. Fast User Switching is also available on Windows XP Professional if you install it on a stand-alone or workgroup-connected computer. If a computer running Windows XP Professional is added to a domain, then Fast User Switching option is not available.Pre-logon Connect: A Pre-logon/Common profile is active once a user logs onto the computer. Pre-logon Connect establishes a wireless connection prior to user logon to Windows. This feature is installed with Single Sign On.WiFi Protected Setup: Installed as part of a Typical installation, this feature detects when a compatible wireless router is present and provides easy connection to it.
Intel(R) Wireless Troubleshooter: Provides valuable assistance in resolving wireless WiFi connection problems. To install these features, select Custom during installation. Follow the instructions below to install features. If the WiFi connection utility is already installed, see the post-installation instructions.Install Intel(R) PROSet/Wireless WiFi Connection Utility1.  Insert the Installation CD in your CD drive.2.  The installer presents the message:  Welcome to the Intel(R) Wireless Installer Prerequisite Wizard. Click Next.3.  The next message displays:  Welcome to the InstallShield Wizard to Intel(R) PROSet/Wireless WiFi Software. Click Next.
4.  Read the license agreement.5.  Click I accept the terms in the license agreement. You can click Print if you want a printed copy of the agreement. Then click Next. 6.  Click Next to accept the default install destination folder. Otherwise, click Change to specify a different location. Then click OK and Next. 7.  Click Typical or Custom. If you click Typical, proceed to step 9. 8.  If performing a Custom installation, select from the list of features to install. See Custom Installation for an explanation of the available features. For each feature, you can select: ❍     This feature will be installed on the local hard drive.❍     This feature, and all subfeatures, will be installed on the local hard drive. ❍     The feature will not be available. 9.  Click Next.10.  The installation may take several minutes. When the installation completes, the message InstallShield Wizard Completed! displays. Click Finish.11.  You may be asked to reboot the computer. If so, you should reboot you computer now. Click Yes to do so, or No to reboot later. Install Additional Software Features If the WiFi connection utility is already installed, follow the instructions below to add the Administrator Tool and Pre-logon Connect:1.  Click Start > Control > Panel > Add or Remove Programs > Intel PROSet/Wireless WiFi Software.2.  Click Change.3.  The next message displays:  Welcome to the InstallShield Wizard to Intel(R) PROSet/Wireless WiFi Software. Click Next. 4.  Click Modify. Then click Next. 5.  Click the red X next to any of the features not currently installed that you want to install. 6.  For each feature you want to install, click one of the following choices, as appropriate: ❍     This feature will be installed on the local hard drive.❍     This feature, and all subfeatures, will be installed on the local hard drive. 7.  Click Next.8.  The installation may take several minutes. When the installation completes, the message InstallShield Wizard Completed! displays. Click Finish.9.  You may be asked to reboot the computer. If so, you should reboot you computer now. Click Yes to do so, or No to reboot later. Remove Intel(R) PROSet/Wireless WiFi Connection UtilityTo uninstall the WiFi connection utility:1.  Click Start > Control Panel > Add or Remove Programs.
2.  Click Intel PROSet/Wireless WiFi Software.3.  Click Change.4.  The next message displays:  Welcome to the InstallShield Wizard to Intel(R) PROSet/Wireless WiFi Software. Click Next. 5.  Click Remove.6.  Click Next.7.  The next message appears. Make your selection from the list and click Next.  Save User Defined Settings. Choose what to do with your current application:  ❍     Save. Save settings and files applicable to the current version of the application.❍     Convert and Save. Save settings and files in the format compatible with PROSet/Wireless WiFi version 10.❍     Remove. Do not save application settings.8.  The removal may take several minutes. After the software is removed, the message InstallShield Wizard Completed! displays. Click Finish. 9.  A message requests that you restart your computer. Click Yes to restart the computer.Back to TopBack to ContentsTrademarks and Disclaimers
Back to ContentsGet ConnectedConnect to a Wireless Network First Time Connection Using Wi-Fi Protected Setup* Configure an Access Point and set up a Network  Connect an Enrollee to a Network or Access Point  Add an Enrollee to a Network at the Registrar Other Wireless ManagersConnect to a Wireless NetworkYou can connect to a wireless network with one of the following methods.●     Automatic connection: If an existing profile matches an available network, you are automatically connected to that wireless network. ●     Configure a new profile: Select a wireless network from the list of wireless networks in the Intel(R) PROSet/Wireless WiFi Connection Utility main window. Click Connect. If you successfully connect, a profile is created in the Profiles list for future use.●     Connect to a profile in the Profiles list: You can select a profile from the Profiles list. To activate it, click Connect. This lets you connect to a network that is lower in the list (if it is available). ●     Right-click the Taskbar icon located in the lower right corner of your Windows desktop. Right-click Connect to Profile. A list of previously configured profiles is listed. Select a profile.First Time ConnectionThe WiFi connection utility automatically detects wireless networks that are within range of your wireless adapter. When a network is found, a desktop alert notification displays: Wireless networks found. See Taskbar Icons for more information.
 1.  Double-click the desktop alert to open the WiFi connection utility main window. 2.  Select a network from the WiFi Networks list.
3.  Click Connect. If the network does not require security authentication, a desktop alert notifies you that you are connected to the network. See Main Window and Taskbar for more information about the taskbar menu and icons.If you need to add security authentication:1.  The Create Wireless Profile manager opens and guides you through the configuration process. 2.  Specify a Profile Name. The Profile Name is your name for this network. It can be anything that helps you identify this network. For example, My Home Network, Coffee Shop on A Street. 3.  Wireless Network Name (SSID): Contains the network identifier name. 4.  Click Next. The Profile Wizard then attempts to detect the network settings of this network. ❍     If a pre-shared key (PSK) or WEP password are required, you are prompted to enter this information prior to connection. Click Advanced to change or edit the PSK or other security settings. For information on key and passwords, see Network Keys.❍     If you need to add security settings, click Profiles to access the Profiles list and the Profile Features. Use the Profile Wizard Security page to add the required security settings. See Security Settings for more information. 5.  Click OK to connect to the wireless network. See Main Window for more information. Using Wi-Fi Protected Setup* to Configure or Join a Network ●     Configure an access point and set up a network ●     Connect an enrollee (computer) to a network or access point ●     Add an enrollee to a network at the registrarIntel(R) PROSet/Wireless WiFi implements Wi-Fi Protected Setup* to permit easy and secure set up and management of a wireless network. You can use this capability to initially set up a wireless network and to introduce new devices to the network. Wi-Fi Protected Setup simplifies the set up process and at same time helps ensure that the network is configured securely. The following terms are used in this discussion. ●     Access Point: A device that connects wireless devices to a network. The access point is configured with the necessary network name (SSID) and security credentials.●     Enrollee: A device that seeks to join an access point or wireless network, but does not have the password or key for the access point or network. Once the computer obtains the valid password or key, it becomes a member of the wireless network. The WiFi connection utility can be configured to operate as an enrollee for a supported access point.●     Registrar: A registrar is a logical entity (usually a computer) that allows other devices (usually computers) to join the wireless network. The WiFi connection utility can be configured to operate as a registrar for a supported access point(s). The registrar securely transfers the access point key or password automatically.A new wireless network is established by configuring the access point, connecting the desired
computers equipped with wireless adapters, and optionally attaching external network connectivity (i.e. the Internet, typically by connecting the access point to a DSL or cable modem, or equivalent).Configure an Access Point and Set up a NetworkThe following steps will configure this computer as a registrar for a secure network or access point.1.  Locate the device ownership password for the access point. This is set by the manufacturer of the access point. The password is often located on a label on the bottom of the device.2.  Turn on the network access point.3.  At the computer that you want to establish as the registrar, turn on the WiFi connection utility.4.  In the WiFi connection utility, click Tools > Application Settings. 5.  In the Advanced Settings area under Wi-Fi Protected Setup, turn on Enable device registration.6.  The next message tells you that one or more compatible devices are within range of your
computer. Click this message. (Or, you can select the network from the WiFi Networks list in the WiFi connection utility main window.)7.  At the next window, on the Available Networks list, select the network that you want to connect to. The listed network depends on what is detected. Click Next.8.  At the next window, enter the Device Ownership Password that you retrieved from the access point in step 1. Click Next to continue.
9.  The next window shown displays the Network Name, Security Type, and Password. If the access point is already configured, it is grayed out; proceed to step 10. If the access point is not configured (fields are not grayed out), proceed to step 11.10.  After a few seconds the following message is displayed:   The access point is already configured. Do you want to reconfigure it?  If you do not want to reconfigure the access point, select No. The software joins the network, makes the connection, and creates a profile. It then exits and this procedure is completed. If you want to reconfigure the access point, select Yes.11.  The next window is displayed. The first field shows the name of the access point. This is by default the Network Name (SSID). In this example we have reset it to MyWPS. You can name it whatever you want. 12.  In the Security Type field, select the security type you want.  ❍     WPA* Personal requires manual configuration of a pre-shared key (PSK) on the access point and clients. This PSK authenticates a password or identifying code, on both the client station and the access point. An authentication server is not needed.❍     WPA2* is the second generation of WPA security that provides enterprise and consumer wireless users with a high level of assurance that only authorized users can access their wireless networks. Here we have selected WPA2 Personal security. You can use Intel PROSet/Wireless WiFi profiles to obtain the wireless network name (SSID) and WPA2-Personal pass phrase to use for a legacy device.  13.  The third field is the Password (Key). The password shown is randomly generated or pre-configured, you can change it to whatever password you want. However you should use a robust key for improved security. It must have between 8 and 63 characters. When you have
completed this step, click Next. The following windows show the configuration of the access point and the registrar.
The following window appears briefly and shows the configuration of wireless settings for the access point.
14.  After the network receives the Ownership Password, you are notified that you have Successfully connected to <name of wireless network>. Click Finish. This process completes configuration of the access point and the registrar.
15.  If you want to save these settings to a profile for future use by a legacy client, click Save wireless settings. The profile settings are saved to a text file (txt) on your local hard drive. The file is saved to your local C:\ drive by default. Accept the default save location or click Browse to choose another location on your computer.Next, you can connect an enrollee (computer) to the network using the registrar. Connect an Enrollee to a Network or Access Point Perform these steps to connect an enrollee to the network you just created. This assumes that the registrar computer is running the WiFi connection utility. NOTE: To achieve transfer rates greater than 54 Mbps on 802.11n connections, WPA2-AES security must be selected. No security (None) can be selected to enable network setup and troubleshooting.1.  At the enrollee you want to connect the network, a message tells you that one or more access points with Wi-Fi Protected Setup capability is within range of your wireless computer. Click on this message. (Or, you can select the network from the WiFi Networks list in the WiFi connection utility main window.)
2.  The Wireless Network Configuration start up page opens. Use the Available Networks list to select the network that you want to connect to (in this example it is MyWPS). Then click Next.  3.  The Discovery window opens. The enrollee that you want to connect to the network discovers the registrar for the network. Assuming that the Discovery process succeeds, the name of the registrar or access point is displayed.
4.  The next window appears, displaying the Device Password (enrollee password). The password displayed at the enrollee is a unique, randomly generated temporary password for the enrollee. This password is used to ask permission to connect to the network access point. (The password shown below is an example only).
5.  At the registrar, enter the password provided by the enrollee. Then click Next. NOTE: This process assumes that the registrar is running the WiFi connection utility; the process and windows displayed at the registrar may be different for software from other vendors. Some access points may have a built in registrar.
6.  The next window lists the profile for this network. The selected profile will be sent to the enrollee, granting it access to the network. Only supported profiles are displayed. Supported profiles are those based on WPA-PSK, WPA2-PSK, and Open (None) security. Select the profile and click Next to finalize the enrollment process.
7.  The last window shows that the enrollee registration with the registrar is complete. Click Finish.
8.  At the enrollee, click Next. At the enrollee, you are notified when you have Successfully connected to <name of wireless network>. Click Finish. Add an Enrollee to an Existing Network at the RegistrarThis following procedure lets you add an enrollee to an existing network, where the access point is already configured and the registrar has already joined the AP. NOTE: This process assumes that the registrar is running the WiFi connection utility; the process and windows displayed at the registrar may be different for software from other vendors. 1.  Get the Device Password for the enrollee computer that you want to add to the network. 2.  At the task tray icon for the WiFi connection utility, right-click and select Add New Device. 3.  Perform steps 5 through 8 of the procedure Connect an Enrollee to a Network or Access Point. Other Wireless ManagersIf the WiFi connection utility detects another software application trying to communicate with the wireless device, you are notified of this behavior.
Microsoft Windows XP* Wireless Zero Configuration To switch from the Intel(R) PROSet/Wireless WiFi Connection Utility to the Microsoft Windows XP Wireless Zero Configuration, perform these steps: 1.  At the Intel(R) PROSet/Wireless WiFi Connection Utility main window, under the Advanced menu, select Use Windows to manage WiFi. Then click Close. 2.  Right-click on the tasktray icon and select Open Wireless Zero Configuration.NOTE: Any wireless profiles created in the WiFi connection utility are not visible in Microsoft Windows XP Wireless Zero Configuration. If you want to use your Intel wireless profiles, click Enable Intel PROSet/Wireless WiFi on the main window.When you are finished using the Microsoft Windows XP Wireless Zero Configuration, you can switch back to the WiFi connection utility To do this, click Enable Intel PROSet/Wireless WiFi on the WiFi connection utility main window. Third-Party Wireless SoftwareIf you use software provided by a hotspot location (coffee shop, airport terminal), the WiFi connection utility notifies you and then disables itself. It cannot manage the wireless device when another wireless manager communicates with the wireless device. To take advantage of the WiFi connection utility features, you want to disable or remove this software when you leave the hotspot. Back to TopBack to ContentsTrademarks and Disclaimers
Back to ContentsProfile Management●     What is a Profile? ●     Profiles Types ●     Profiles List ●     Profile Icons ●     Connect to a Profile●     Create a New Profile●     Edit an Existing Profile●     Remove a Profile ●     Set a Profile Password ●     Export or Import ProfilesWhat is a Profile?A profile is a saved group of network settings. Profiles are displayed in the Profiles List. Profiles are useful when moving from one wireless network to another. Different profiles can be configured for each wireless network. Profile settings include the network name (SSID), operating mode, and security settings. A profile is created when you connect to a wireless network. 1.  Select a network from the Wireless Networks list.2.  Click Connect. 3.  If the wireless network requires a WEP password or encryption key, you are prompted to enter this information prior to connection. To change the security options, click Advanced to open the Create Wireless Profile Security Settings. 4.  Click OK to connect. A profile is created and added to the Profiles list.The Create Wireless Profile Wizard guides you through the settings required to connect with the wireless network. At completion, the profile is saved and added to the Profiles list. Since these wireless settings are saved, the next time you are in range of this wireless network you are automatically connected. Profile TypesThere are two basic types of profiles that can be used to connect to a wireless network. The profile types are:●     User Profiles: These profiles are created by individual users. If there is more than one user on a computer, each user needs to create their own set of user profiles. User-created wireless profiles are
not accessible by other users of a computer. ●     Administrator Profiles: If one or more profiles need to be shared among users on a computer, the Administrator Tool must be installed to create Administrator profiles. For more information, see Administrator Profiles . Profiles ListThe Profiles list displays a list of existing profiles. When you come in range of a wireless network, the WiFi connection utility software scans the Profiles list to see if there is a match. If a match is found, you are automatically connected to the network. Profiles List Priority Arrows●     Use the up-arrow to move the position of a selected profile up in the profiles list.●     Use the down-arrow to move the position of a selected profile down in the profiles list.Profile IconsThe network profile status icons indicate whether the adapter is associated with a network, the type of
operating mode being used, and whether security encryption is enabled. These icons display next to the profile name in the Profiles list.Name DescriptionProfile Name The Profile Name is your name for this network. It can be anything that helps you identify this network. For example, My Home Network, Coffee Shop on A Street.Network Name Name of the wireless network (SSID) or computer.Connection Icons: The network profile status icons indicate the different connection states of the adapter with a wireless network, the type of operating mode being used, and whether network security is being used. Blue circle: The wireless adapter is associated with an access point or computer (Device to Device [ad hoc] mode). If a profile has 802.1X security enabled, this indicates that the wireless adapter is associated and authenticated.Indicates Network (infrastructure) mode.Indicates Device to Device (ad hoc) mode.Indicates an Administrator profile. The wireless network uses Security encryption.Indicates that this network is on the Exclude list, e.g. is set for manual rather than automatic connection. When on the Exclude list, to connect the user must connect manually. Arrows Use the arrows to position profiles in a preferred order for auto-connection. ●     Up-arrow: Move the position of a selected profile up in the Profiles list. ●     Down-arrow: Move the position of a selected profile down in the Profiles list. Connect  Connect the selected profile for the wireless network.Add  Opens the Create Wireless Profile General Settings, which are used to create a new profile. See Create a New Profile for more information.Remove  Removes a selected profile from the Profiles list. See Remove a Profile for more information.Properties Used to edit the contents of an existing profile. You can also double-click a profile in the Profiles list to edit the profile. See Edit an Existing Profile for more information.Export/Import: Imports and exports user-based profiles to and from the Profiles list. Wireless profiles can be automatically imported into the Profiles list. See Export or Import Profiles for more information.Close Closes the profile management window.Help? Provides help information for this page. Connect to a ProfileWhen you are in range of a wireless network that has a matching profile you are automatically connected to that network. If a network with a lower priority profile is also in range you can force the connection to
that lower profile. This is achieved the from the WiFi connection utility or from the Taskbar icon. Manually connect to a profile from the Intel PROSet/Wireless WiFi software: 1.  Double-click the Taskbar icon to open the Intel PROSet/Wireless WiFi main window.2.  Click Profiles to open the Profiles list.3.  Select the profile from the Profiles list. 4.  Click Connect. Remember that the connection is only made if the wireless network is in range. Manually connect to a profile from the Taskbar: 1.  Right-click the Intel PROSet/Wireless WiFi Taskbar icon. 2.  Click Connect to Profile. 3.  Select a profile.4.  Click to start the connection. Create a New Wireless ProfileSelect a network from the Wireless Networks list. Click Connect. The Create Wireless Profile manager guides you through the necessary steps to create a profile and connect to the network. During this process, the Create Wireless Profile Security Settings attempts to detect the appropriate security settings for you. To create a new profile and connect to a wireless network: 1.  From the Intel PROSet/Wireless WiFi main window, click Profiles. 2.  On the Profiles page, click Add to open the Create Wireless Profile General Settings. (See General Settings for more information.)
3.  Profile Name: Enter a descriptive profile name. 4.  Wireless Network Name (SSID): Enter the wireless network name. 5.  Select the Operating Mode: Network (Infrastructure) or Device to Device (ad hoc). 6.  Click Advanced for the following options: ❍     Auto Connect: Select to automatically or manually connect to a profile. ❍     Auto Import: Network administrator can export a profile on another computer.❍     Mandatory Access Point: Select to associate the wireless adapter with a specific access point. ❍     Password Protection: Select to password protect a profile.❍     Start Application: Specify a program to be started when a wireless connection is made.❍     Maintain Connection: Select to remain connected to a user profile after log off.
7.  From the General Settings, click Next to open the Security Settings.
8.  Select either Personal or Enterprise Security to select the Network Authentication and Data Encryption options. Enter the encryption key settings and configure the 802.1X settings as required.
9.  Click OK when you have completed the profile settings. To change or verify the profile settings, click Back. 10.  If you are not currently connected to a network, Intel PROSet/Wireless WiFi detects that a new profile has been added and automatically attempts to connect to this new profile. 11.  If you want to manually connect to this profile, click Connect. The connection icon displays the current connection status. The network name, transmit and receive speeds, and signal quality are also displayed.Edit an Existing ProfileTo edit an existing profile: 1.  Click Profiles on the Intel PROSet/Wireless WiFi main window.2.  Select the profile to edit from the Profiles List. 3.  Click Properties to open the Wireless Profile Properties General Settings.
4.  Click Next and Back to navigate through the Wireless Profile Properties' General and Security Settings: ❍     General Settings: See General Settings for more information.❍     Security Settings: See Security Settings for more information.5.  Click OK to save the current settings and exit. Click Cancel to exit without saving changes. Remove a ProfileTo remove a profile: 1.  Click Profiles on the Intel PROSet/Wireless WiFi main window.2.  Select the profile from the list.3.  Click Remove. You are notified that Selected profiles will be permanently removed. Do you want to continue? 4.  Click Yes. The profile is removed from the Profiles list. If you are still connected to the network:1.  Click Profiles on the Intel PROSet/Wireless WiFi main window.2.  Select the profile from the list.3.  Click Remove. You are notified that Selected profiles will be permanently removed. Do you want to continue?4.  Click Yes. You are notified that <profile name> is active and will be permanently removed. Do you want to continue? 5.  Click Yes. The profile is removed from the Profiles list. NOTE: If the profile is protected by a password, you cannot remove or edit the profile settings without entering the password. If the administrator or you do not know the password, there is no process available to reset the password.Set a Profile PasswordTo password protect an existing profile: 1.  Click Profiles on the Intel PROSet/Wireless WiFi main window.2.  Select the profile from the list.3.  Click Properties to open the Wireless Profile Properties' General Settings. 4.  Click Advanced to open the Advanced Settings. 5.  Click Password Protection to open the Password Protection settings. 6.  Click Password protect this profile (maximum 10 characters)7.  Password: Enter the password. 8.  Confirm Password: Reenter the password.9.  Click OK to save the setting and return to the General Settings page.10.  Click OK to return to the Intel PROSet/Wireless WiFi main window.
Import or Export ProfilesThis feature lets you import and export user-based profiles to and from the Profiles list. Wireless profiles can be automatically imported into the Profiles list. An administrator can set profiles to be imported automatically into the Profiles list. Intel PROSet/Wireless WiFi monitors the import folder on your hard disk for new profile files. Only profiles that have been enabled through Enable Auto-Import in the Advanced Settings are automatically imported. If a profile of the same name already exists in the Profiles list, you are notified to either reject the imported profile or accept it. If accepted, the existing profile is replaced. All imported user-based profiles are placed at the bottom of the Profiles List. NOTE: To export Administrator profiles, see Administrator Packages. Import Profiles into the Profiles ListTo import profiles manually: 1.  Click Import on the Profiles page.2.  Select the profile files to import.3.  Click Import.4.  You are notified that the profile has been successfully imported.
Export Profiles from the Profiles List1.  Select individual or multiple profiles from the list. 2.  Select Export to export one or more profiles from the Profiles list.3.  Select the destination folder. Click Browse to search your hard disk for the destination directory. The C:\ drive is the default directory. 4.  Click OK to export the selected profile. You are notified: Successfully exported selected profiles to the destination folder: C:\.To select multiple profiles:1.  Use your mouse to highlight a profile.2.  Press Ctrl.3.  Click each profile that you want selected. Follow the instructions from Step 2 above to export multiple profiles. Password Protected ProfilesImport and export password-protected user-based profiles automatically to remote systems. If a profile is password protected, the assigned password must be entered before it can be edited. See Set a Profile Password for more information.Back to TopBack to ContentsTrademarks and Disclaimers
Back to ContentSet Up Profile SecurityUse the Intel(R) PROSet/Wireless WiFi Connection Utility  Personal Security Personal Security Settings Set up Data Encryption and Authentication●     Set up a Client with No Authentication and No Data Encryption●     Set up a Client with WEP 64-bit or WEP 128-bit Data Encryption●     Set up a Client with WPA*-Personal (TKIP) or WPA2*-Personal (TKIP) Security Settings●     Set up a Client with WPA*-Personal (AES-CCMP) or WPA2*-Personal (AES-CCMP) Security SettingsEnterprise Security Enterprise Security SettingsNetwork Authentication●     Configure Profiles for Infrastructure Networks●     Set up a Client with Shared Network Authentication●     Set up a Client with WPA-Enterprise or WPA2-Enterprise Network Authentication802.1X Authentication Types●     Set up a Client with EAP-SIM Network Authentication●     Set up a Client with EAP-AKA Network Authentication●     Set up a Client with TLS Network Authentication●     Set up a Client with TTLS Network Authentication●     Set up a Client with PEAP Network Authentication●     Set up a Client with LEAP Network Authentication●     Set up a Client with EAP-FAST Network AuthenticationUse the Intel(R) PROSet/Wireless WiFi Connection Utility
The following sections describe how to use the WiFi connection utility to set up the required security settings for your wireless adapter. See Personal Security.It also provides information about how to configure advanced security settings for your wireless adapter. This requires information from a systems administrator (corporate environment) or advanced security settings on your access point (for home users). See Enterprise Security.For general information about security settings, See Security Overview.Set up Data Encryption and AuthenticationIn a home wireless network you can use a variety of simple security procedures to protect your wireless connection. These include:●     Enable Wi-Fi Protected Access* (WPA).●     Change your password.●     Change the network name (SSID).Wi-Fi Protected Access (WPA) encryption provides protection for your data on the network. WPA uses an encryption key called a pre-shared key (PSK) to encrypt data before transmission. Enter the same password in all of the computers and access point in your home or small business network. Only devices that use the same encryption key can access the network or decrypt the encrypted data transmitted by other computers. The password automatically initiates the Temporal Key Integrity Protocol (TKIP) or AES-CCMP protocol for the data encryption process.Network KeysWEP encryption provides two levels of security:●     64-bit key (sometimes referred to as 40-bit)●     128-bit key (also known as 104-bit)For improved security, use a 128-bit key. If you use encryption, all wireless devices on your wireless network must use the same encryption keys.You can create the key yourself and specify the key length (64-bit or 128-bit) and key index (the location that a specific key is stored). The greater the key length, the more secure the key.Key Length: 64-bit
Pass phrase (64-bit): Enter five (5) alphanumeric characters, 0-9, a-z or A-Z. Hex key (64-bit): Enter 10 hexadecimal characters, 0-9, A-F.Key Length: 128-bitPass phrase (128-bit): Enter 13 alphanumeric characters, 0-9, a-z or A-Z.  Hex key (128-bit): Enter 26 hexadecimal characters, 0-9, A-F.With WEP data encryption, wireless station can be configured with up to four keys (the key index values are 1, 2, 3, and 4). When an access point or a wireless station transmits an encrypted message that uses a key stored in a specific key index, the transmitted message indicates the key index that was used to encrypt the message body. The receiving access point or wireless station can then retrieve the key that is stored at the key index and use it to decode the encrypted message body.Set up a Client with No Authentication and No Data EncryptionCAUTION: Networks using no authentication or encryption are highly vulnerable to access by unauthorized users. On the WiFi connection utility main page, select one of the following methods to connect to an infrastructure network:●     Double-click an infrastructure network in the WiFi Networks list.●     Select an infrastructure network in the WiFi Networks list. Click Connect. The WiFi connection utility automatically detects the security settings for the wireless adapter.If there is no authentication required, the network connects without a prompt to enter any log-on credentials. Any wireless device with the correct network name (SSID) is able to associate with other devices in the network.To create a profile for a wireless network connection with no encryption:1.  Click Profiles on the WiFi connection utility main window.2.  On the Profiles list, click Add to open the wireless profile General Settings.3.  Profile Name: Enter a descriptive profile name.4.  Wireless Network Name (SSID): Enter the name of your wireless network.5.  Operating Mode: Click Device to Device (ad hoc).6.  Click Next to open the Security Settings.7.  Personal Security is selected by default.8.  Security Settings: The default setting is None, which indicates that there is no security on this wireless network.
9.  Click OK. The profile is added to the Profiles list and connects to the wireless network.Set up a Client with WEP 64-bit or WEP 128-bit Data EncryptionWhen WEP data encryption is enabled, a network key or password is used for encryption.A network key is provided for you automatically (for example, it might be provided by your wireless network adapter manufacturer), or you can enter it yourself and specify the key length (64-bit or 128-bit), key format (ASCII characters or hexadecimal digits), and key index (the location where a specific key is stored). The greater the key length, the more secure the key.To add a network key for a Device to Device (ad hoc) network connection:1.  On the WiFi connection utility main window, double-click a Device to Device (ad hoc) network in the WiFi Networks list or select the network and click Connect.2.  Click Profiles to access the Profiles list.3.  Click Properties to open the wireless profile General Settings. The Profile name and Wireless Network Name (SSID) display. Device to Device (ad hoc) should be selected as the Operating Mode.4.  Click Next to open the Security Settings.5.  Personal Security is selected by default.6.  Security Settings: The default setting is None, which indicates that there is no security on this wireless network.To add a password or network key:1.  Security Settings: Select either WEP 64-bit or WEP 128-bit to configure WEP data encryption with a 64-bit or 128-bit key.When WEP encryption is enabled on an access point, the WEP key is used to verify access to the network. If the wireless device does not have the correct WEP key, even though authentication is successful, the device is unable to transmit data through the access point or decrypt data received from the access point.Name DescriptionPassword Enter the Wireless Security Password (Pass phrase) or Encryption Key (WEP key).
Pass phrase (64-bit ) Enter five (5) alphanumeric characters, 0-9, a-z or A-Z.WEP key (64-bit) Enter 10 hexadecimal characters, 0-9, A-F.Pass phrase (128-bit) Enter 13 alphanumeric characters, 0-9, a-z or A-Z.WEP key (128-bit) Enter 26 hexadecimal characters, 0-9, A-F.2.  Key Index: Change the Key Index to set up to four passwords.3.  Click OK to return to the Profiles list.To add more than one password:1.  Select the Key Index number: 1, 2, 3, or 4.2.  Enter the Wireless Security Password.3.  Select another Key Index number.4.  Enter another Wireless Security Password.Set up a Client with WPA*-Personal (TKIP) or WPA2*-Personal (TKIP) Security SettingsWPA* Personal Mode requires manual configuration of a pre-shared key (PSK) on the access point and clients. This PSK authenticates a user's password or identifying code, on both the client station and the access point. An authentication server is not needed. WPA Personal Mode is targeted to home and small business environments.WPA2* is the second generation of WPA security that provides enterprise and consumer wireless users with a high level of assurance that only authorized users can access their wireless networks. WPA2 provides a stronger encryption mechanism through Advanced Encryption Standard (AES), which is a requirement for some corporate and government users.NOTE: To achieve transfer rates greater than 54 Mbps on 802.11n connections, WPA2-AES security must be selected. No security (None) can be selected to enable network setup and troubleshooting.To configure a profile with WPA-Personal network authentication and TKIP data encryption:
1.  On the WiFi connection utility main window, double-click an infrastructure network in the WiFi Networks list or select the network and click Connect.2.  Click Profiles to access the Profiles list.3.  Click Properties to open the wireless profile General Settings. The Profile name and Wireless Network Name (SSID) display. Network (Infrastructure) should be selected as the Operating Mode.4.  Click Next to open the Security Settings.5.  Select Personal Security.6.  Security Settings: Select WPA-Personal (TKIP) to provide security to a small business network or home environment. A password, called a pre-shared key (PSK), is used. The longer the password, the stronger the security of the wireless network.If your wireless access point or router supports WPA2-Personal, then you should enable it on the access point and provide a long, strong password. The longer the password, the stronger the security of the wireless network. The same password entered in the access point needs to be used on this computer and all other wireless devices that access the wireless network.NOTE: WPA-Personal and WPA2-Personal are interoperable.7.  Wireless Security Password (Encryption Key): Enter a text phrase with eight to 63 characters. Verify that the network key matches the password in the wireless access point.8.  Click OK to return to the Profiles list.Set up a Client with WPA*-Personal (AES-CCMP) or WPA2*-Personal (AES-CCMP) Security SettingsWi-Fi Protected Access (WPA*) is a security enhancement that strongly increases the level of data protection and access control to a wireless network. WPA enforces 802.1X authentication and key-exchange and only works with dynamic encryption keys. For a home user or small business, WPA-Personal uses either Advanced Encryption Standard - Counter CBC-MAC Protocol (AES-CCMP) or Temporal Key Integrity Protocol (TKIP).NOTE: For the Intel(R) Wireless WiFi Link 4965AGN adapter, to achieve transfer rates greater than 54 Mbps on 802.11n connections, WPA2-AES security must be selected. No security (None) can be selected to enable network setup and troubleshooting. To create a profile with WPA2*-Personal network authentication and AES-CCMP data encryption:1.  On the WiFi connection utility main window, double-click an infrastructure network from the WiFi Networks list or select the network and click Connect.
2.  If these are being transmitted, the Profile name and Wireless Network Name (SSID) should display on the General Settings screen. Network (Infrastructure) should be selected as the Operating Mode. Click Next to open the Security Settings.3.  Select Personal Security.4.  Security Settings: Select WPA2-Personal (AES-CCMP) to provide this level of security in the small network or home environment. It uses a password, also called a pre-shared key (PSK). The longer the password, the stronger the security of the wireless network.AES-CCMP (Advanced Encryption Standard - Counter CBC-MAC Protocol) is a newer method for privacy protection of wireless transmissions specified in the IEEE 802.11i standard. AES-CCMP provides a stronger encryption method than TKIP. Choose AES-CCMP as the data encryption method whenever strong data protection is important.If your Wireless access point or router supports WPA2-Personal, then you should enable it on the access point and provide a long, strong password. The same password entered into the access point needs to be used on this computer and all other wireless devices that access the wireless network.NOTE: WPA-Personal and WPA2-Personal are interoperable.Some security solutions may not be supported by your computer's operating system. You may require additional software or hardware as well as wireless LAN infrastructure support. Contact your computer manufacturer for details.5.  Password: Wireless Security Password (Encryption Key): Enter a text phrase (length is between eight and 63 characters). Verify that the network key used matches the wireless access point key.6.  Click OK to return to the Profiles list.Back to TopBack to ContentsTrademarks and Disclaimers
Back to ContentsWireless Network OverviewAbout Wireless Networks What do I Need to Set up a Wireless Network? Wireless Networking Basics ●     What is a Wireless Network Management Utility?●     Network Name●     Profiles●     Security●     Identify a Wireless Network●     Select a Wireless Network ModeHow do I Turn My Radio On and Off?About Wireless NetworksA Wireless Local Area Network (WLAN) connects computers without network cables. Instead, computers use radio communications to send data between each other. In a WLAN, a radio communications device called an access point or wireless router connects network computers and provides Internet or network access. You can communicate directly with other wireless computers, or connect to an existing network through a wireless access point. When you set up your wireless adapter, you select the operating mode for the kind of wireless network you want. You can use your Intel(R) PRO/Wireless Network Connection adapter to connect to other similar wireless devices that comply with the 802.11 standard for wireless networking. What do I Need to Set up a Wireless Network? The most common type of wireless network is an infrastructure network. To set up an infrastructure network, you need the following:●     A wireless router.●     A wireless network adapter for each computer that you want to connect to the
wireless network.●     If you want internet access for your WLAN, you also need broadband internet service such as cable or DSL. This includes a broadband modem.Wireless Networking Basics What is a Wireless Network Management Utility?The WiFi connection utility is a wireless network management utility. It helps you manage your wireless connections. It can help you initially set up your wireless connections and then easily manager those connections, opening and closing connections and managing security as required. Some computers also ship with Microsoft Windows Zero Configuration, which is another wireless network management utility, and you should not use both of these tools. This is because network settings you create with one utility are not applied if the other utility is managing wireless connections. We recommend that you pick one tool to manage wireless connections, and stay with that. See Use Microsoft Windows* to Manage WiFi* and also see Get Connected.Network Name (SSID) Every wireless local area network (WLAN) uses a unique network name to identify the network. This name is also called the Service Set Identifier (SSID). When you set up your wireless adapter, you specify the SSID. If you want to connect to an existing WLAN, you must use the name for that network. If you set up your own WLAN, you can make up your own name and use it on each computer. The name can be up to 32 characters long and contain letters and numbers. The SSID or network name is assigned at the access point or wireless router. ProfilesA profile is used to manage your computer's connection to a WLAN. A profile is a collection of settings that determines how your computer connects to the WLAN. These settings (the profile) are saved on your computer and are used each time you connect to that WLAN. The profile includes all of the network information and security settings. Different profiles are created for different WLANs. For your computer, each WLAN will have its own profile to manage connection to that WLAN. Using the WiFi connection utility, the profiles for your computer are displayed in the Profiles list. From the WiFi connection utility main window you can create, edit, and remove profiles.SecuritySome WLANs are open or unsecure networks, and some are secure networks. A secure WLAN limits who can access the network. There are different levels methods of security. The
WiFi connection utility can easily help you set up a security method for your WLAN. Common security methods for WLANs use keys or passwords, where the computer requesting access must provide the key or password to get access. WLANs can also use encryption to encode the data. With encryption, before a computer transmits data it uses a secret encryption key to scramble the data. The receiving computer uses this same key to unscramble the data. If you connect to an existing network, use the encryption key provided by the administrator of the wireless network. If you set up your own network, you can make up your own key and use it on each computer. The WiFi connection utility can help you do this. The security method used by your computer to get WLAN access is stored in the profile. See Security for more helpful information. Identify a Wireless NetworkDepending on the size and components of a wireless network, there are different ways to identify a wireless network:●     The Network Name or Service Set Identifier (SSID): Identifies a wireless network. All wireless devices on the network must use the same SSID. This is probably the most common method.●     Basic Service Set (BSS): Consists of two or more wireless nodes, or stations, which have recognized each other and have established communications.●     Broadcast SSID: An access point can respond to computers sending probe packets with the broadcast SSID. If this feature is enabled on the access point, any wireless user can associate with the access point by using a blank (null) SSID.●     Basic Service Set Identifier (BSSID): A unique identifier for each wireless device. The BSSID is the Ethernet MAC address of the device.●     Extended Service Set Identifier (ESSID): A special case of SSID used to identify a wireless network that includes access points.●     Independent Basic Service Set (IBSS): A mode of operation in an 802.11 system that allows direct communication between 802.11 devices without the need to set up a communication session with an access point.●     Independent Basic Service Set Identifier (IBSSID): A special case of SSID used to identify a network of wireless computers configured to communicate directly with one another without using an access point.Select a Wireless Network ModeWireless networks can operate with or without access points, depending on the number of users in the network. Infrastructure mode uses access points to allow wireless computers to send and receive information. Wireless computers transmit to the access point, the access point receives the information and rebroadcasts it to other computers. The access point can also connect to a wired network or to the Internet. Multiple access points can work together to provide coverage over a wide area. Device-to-Device mode, also called ad hoc mode, works without access points and allows
wireless computers to send information directly to other wireless computers. You can use Device-to-Device mode to network computers in a home or small office or to set up a temporary wireless network for a meeting. How do I turn my Radio on and off?You will need to turn the wireless adapter radio off (and on) on different occasions. For example, you may be required to turn the radio off when boarding an airplane. You can also turn it off to conserve battery power. There are three methods to turn the radio on and off:●     Using the wireless radio hardware switch (may not be present on all computers). ●     Using the WiFi On / WiFi Off button in the WiFi connection utility.●     Using Windows.Remember that to connect to wireless networks, the wireless radio needs to be turned back on. If you are unable to connect to a wireless network, verify that your radio is turned on at both the hardware switch and the WiFi On / WiFi Off button in the WiFi connection utility.See Turn the Radio on or off for more information.Back to TopBack to ContentsTrademarks and Disclaimers
Back to ContentsAdministrator ToolSet Administrator Password Administrator Tool Settings Administrator Packages for Windows XP*  Administrator Profiles●     Persistent Profiles ●     Pre-logon/Common Connection●     Exclude Networks●     Voice over IP (VoIP) ConnectionApplication Settings Adapter Settings EAP-FAST A-ID Groups Administrator Tasks The Administrator Tool is used by the person who has administrator privileges on this computer. This tool is used to configure Pre-logon/Common profiles, and Persistent Connection profiles. The Administrator Tool can be used by an Information Technology department to configure user settings and to create custom install packages to export to other systems.The Administrator Tool is located on the Tools menu. The Administrator Tool must be selected during a Custom installation of the Intel(R) PROSet/Wireless WiFi Connection Utility or the feature is not displayed.Administrator Packages for Windows XP*An Administrator Package is a self-extracting executable file that generally contains the WiFi connection utility, administrative profiles, and other settings. You can copy or send an administrative package to clients on your network. When the executable runs, the contents are installed and configured on the destination computer. If a profile is part of the package, the profile governs how the destination computer connects to a specific wireless network.NOTE: To create and export a package for a computer running on Microsoft Windows Vista*,
you need to create the package on a computer running Windows Vista. You cannot create a package for Windows Vista on a computer running Microsoft Windows XP*.Create a New Package1.  At the Tools menu, click Administrator Tool.2.  Enter the Administrator Tool password.3.  Open Administrator Package: Click Create a Windows XP package, or Open an existing package. Name DescriptionCreate a Windows XP package  Create a package that can be exported to a user's computer running Microsoft Windows XP* operating system. This package allows export of all 802.1X authentication EAP-type Pre-logon/Common and Persistent profiles.Create a Windows Vista package Not Available. To create and export a package for a computer running on Microsoft Windows Vista*, you need to create the package on a computer running Windows Vista. You cannot create a package for Windows Vista on a computer running Microsoft Windows XP*.
Open an existing package Select to browse for and open an existing package.4.  Click OK.5.  Configure the following options to be included in the package:Name DescriptionProfiles Click Include Profiles in this package. Profiles can be shared with other users. Application Settings Click Include Application Settings in this package. Specify application settings to be enabled.Adapter Settings Click Include Adapter Settings in this package. Specify initial values for adapter settings used on this computer.EAP-FAST A-ID Groups Click Include A-ID Groups. Add A-ID Group to support multiple PACs from multiple A-IDs.6.  Click Close.7.  You are notified: The current package is changed. Would you like to save the changes?8.  Click Yes. Save the executable file to a directory on the local disk drive.9.  Click Save. The file is created. This may take several minutes.10.  Click Finished to view the package contents. ❍     Click Apply this package to this computer if you want to use the package configuration on the Administrator's computer.❍     Copy the executable file to any user's computer to install the configuration that has been saved in the package. When you execute the package file, it is a silent install.11.  Click OK.NOTE: You can also select Save Package on the File menu to save the package.Edit a Package1.  Access the Administrator Tool.2.  On the Open Administrator Package page, click Open an existing package to edit an existing package.3.  Click Browse. Locate the package's executable file.4.  Click Open. Make your updates to the package settings.5.  Click Close.6.  You are notified: The current package is changed. Would you like to save the changes?7.  Click Yes. Save the executable file to a directory on the local disk drive.NOTE: You can also select Open Package on the File menu to edit an
Administrator Package.Administrator ProfilesAdministrator Profiles are managed by the network administrator. These profiles can be exported to other computers. These profiles are common or shared by all users on this computer. However, end users cannot modify these profiles. They can only be modified from the Administrator Tool, which is password protected.There are two types of Administrator Profiles: Persistent and Pre-logon/Common.You can also configure Voice over IP (VoIP) settings for export to a soft-phone application.
Persistent Profiles Persistent profiles are applied at boot time or whenever no one is logged on the computer. After a user logs off, a Persistent profile maintains a wireless connection either until the computer is turned off or a different user logs on.Persistent profile key points:●     The following types of profiles can be created as Persistent profiles: ❍     All profiles that do not require 802.1X authentication (for example, Open authentication with WEP encryption, Open authentication with no encryption).❍     All profiles with 802.1X authentication that have the credentials saved: LEAP or EAP-FAST.❍     Profiles with security settings that include the "Use the following user name and password" option.❍     Profiles that use the machine certificate to authenticate.❍     WPA*-Enterprise profiles that do not use a user certificate.❍     WPA-Personal profiles.●     Persistent profiles are applied at system power up and after a user logs off.NOTE: The WiFi connection utility supports machine certificates. However, they are not displayed in the certificate listings.To create a Persistent profile:1.  Click Include Profiles in this package.2.  Click Persistent.3.  Click Add to open the General Settings.4.  Profile Name: Enter a descriptive profile name.5.  Wireless Network Name (SSID): Enter the name of your wireless network.6.  Operating Mode: Network (Infrastructure) is selected by default.7.  Administrator Profile Type: Persistent: Active when no users are logged on is selected.8.  Click Next.9.  Click Enterprise Security to open the Security Settings. See TLS, TTLS, PEAP, LEAP, or EAP-FAST for 802.1X security configuration information.10.  Click OK.Pre-logon/Common
Pre-logon/Common profiles are applied prior to a user log on. If Single Sign On support is installed, the connection is made prior to the Windows log-on sequence (Pre-logon/Common).If Single Sign On support is not installed, the profile is applied once the user session is active. Pre-logon/Common profiles always appear at the top of the Profiles list. Users can still prioritize profiles that they have created but they cannot reprioritize Pre-logon/Common profiles. Because these profiles appear at the top of the Profiles list, the WiFi connection utility automatically attempts to connect to the Administrator profiles first before any user-created profiles.NOTE: Only administrators can create or export Pre-logon/Common profiles.Pre-logon Connect key points are:●     Pre-logon Connect is active only at the Windows log on.●     The following types of profiles can be created as Pre-logon/Common profiles: ❍     802.1X PEAP, TTLS or EAP-FAST profiles that use either the "Use Windows Logon user name and password" or "Use the following user name and password" credentials when configuring the profile's security settings.❍     LEAP profiles that use the "Prompt for the user name and password." credentials when configuring the profile's security settings.❍     802.1X PEAP or TTLS profiles with user or machine certificates (the user must have administrative rights to use machine certificates).❍     TLS profiles that use digital certificates to verify the identity of a client and a server.❍     EAP-SIM profiles that use a Subscriber Identity Module (SIM) card to validate your credentials with the network.❍     All non-802.1X (Open and WEP) Common or User Based profiles.●     A Pre-logon/Common profile is applied at Windows user log-on time.Pre-logon/Common Connection StatusPre-logon/Common profiles support is installed during a Custom install of the WiFi connection utility. See Install or Uninstall the Single Sign On Feature for more information.NOTE: If the Single Sign On or Pre-logon Connect features are not installed, an administrator is still able to create Pre-logon/Common profiles for export to a user's computer.The following describes how the Pre-logon Connect feature functions from system power-up. The assumption is that a saved profile exists. This saved profile has valid security settings marked with "Use Windows Logon user name and password" that are applied at the time of Windows log on.1.  After a system power-up, enter your Windows log on domain, user name, and password.2.  Click OK. The Pre-logon/Common profile status page displays the progress of the network connection. After the wireless adapter is connected to the network access point, the Status page closes and the Windows user logs on. ❍     If the corresponding access point rejects your credentials during the Pre-logon/
Common connection, you will be prompted for your user credentials.❍     Enter your credentials.❍     Click OK. The profile is applied and the Status page displays the progress of the connection status until you are logged onto Windows.❍     Click Cancel on the Credentials page to select another profile.NOTE: A user certificate can only be accessed by a user that has been authenticated on the computer. Therefore, a user should log onto the computer once (using either a wired connection, alternate profile or local log in) before using a Pre-logon/Common profile that authenticates with a user certificate.When you log off, any wireless connection is disconnected and a persistent profile (if one is available) is applied. Under certain circumstances, it is desirable to maintain the current connection (for example, if user-specific data needs to be uploaded to the server post-log off or when roaming profiles are used).Create a profile that is marked as both Pre-logon/Common and persistent to achieve this functionality. If such a profile is active when the user logs off, the connection is maintained.To create a Pre-logon/Common Profile:1.  Click Include Profiles in this package.2.  Click Pre-logon/Common.3.  Click Add to open the General Settings.4.  Profile Name: Enter a descriptive profile name.5.  Wireless Network Name (SSID): Enter the network identifier.6.  Operating Mode: Network (Infrastructure) is selected by default.7.  Administrator Profile Type: Pre-logon/Common: Active when a user is logged on. This profile is shared by all users. This profile type is already selected.8.  Click Next.9.  Click Advanced to open and configure the Advanced Settings. See Advanced Settings. 10.  Click OK to close the Advanced Settings.11.  Click Enterprise Security to open the Security Settings. See EAP-SIM, TLS, TTLS, PEAP, LEAP, or EAP-FAST for 802.1X security configuration information.12.  Click OK to save the profile and add it to the Administrator profiles list.NOTE: If a Persistent connection was already established, a Pre-logon/Common profile is ignored unless the profile is configured with both Pre-logon/Common and Persistent connection options.Exclude NetworksAdministrators can designate networks to be excluded from connection. Once a network is excluded, only an administrator can remove the network from the Exclude list. The excluded
network is displayed in the Exclude List Management and is indicated by this icon:  To exclude a network:1.  Click Include Profiles in this package.2.  Click Exclude.3.  Click Add to open the Exclude Network (SSID).4.  Network Name: Enter the network name of the network that you want to exclude.5.  Click OK to add the network name to the list.To remove a network from exclusion:1.  Select the network name in the Exclude list.2.  Click Remove. The network is deleted from the list.Voice over IP (VoIP) ConnectionThe WiFi connection utility supports VoIP third-party soft-phone applications. Third-party VoIP applications support voice codecs. Codecs generally provide a compression capability to save network bandwidth. The WiFi connection utility supports the following International Telecommunications Union (ITU) codec standards:Codec AlgorithmITU G.711 PCM (Pulse Code Modulation)ITU G.722 SBADPCM (Sub-Band Adaptive Differential Pulse Code Modulation)
ITU G.723 Multi-rate CoderITU G.726 ADPCM (Adaptive Differential Pulse Code Modulation)ITU G.727 Variable-Rate ADPCMITU G.728 LD-CELP (Low-Delay Code Excited Linear Prediction)ITU G.729 CS-ACELP (Conjugate Structure Algebraic-Code Excited Linear Prediction)An administrator can export VoIP settings to configure various codec data rates and frame rates to improve voice quality in VoIP transmissions.To configure VoIP settings:NOTE: Ensure Voice over IP is not disabled in the Administrator Tool Application Settings. It is enabled by default.1.  Click Include Profiles in this package.2.  Click VoIP.3.  Click Add to open the Create VoIP Profiles page.4.  Select the Codec bandwidth, application usage, and frame rate. For Voice Data:G711 has 10ms frame rate with 64kbps bit rate G722 has 10ms frame rate with 64kbps bit rate G723 has 30ms frame rate with either 5.3kbps or 6.4kbps bit rate G726-32 has 10ms frame rate with 32kbps bit rate G728 has 2.5ms frame rate with 16kbps bit rate G729 has 10ms frame rate with 10kbps bit rateSelect parameters from the drop down menus. Codec Usage Frame Rate
●     G711_64kbps●     G722_64kbps●     G722_56kbps●     G722_48kbps●     G722_1_32kbps●     G722_1_24kbps●     G722_1_16kbps●     G726_16kbps●     G726_24kbps●     G726_32kbps●     G726_40kbps●     G728_16kbps●     G729a_8kbps●     G729e_11_8kbps●     GIPS_iPCM_VARIABLE●     G722_2_VARIABLE●     Interactive Voice●     Audio Conference●     Voice Data●     Video●     Streaming Audio●     20●     305.  Click OK to return to the Profiles list.6.  Click Close to save the profile settings to a package.EAP-FAST A-ID GroupsNOTE: This feature is unavailable if CCXv4 is not selected in the Administrator Tool Application SettingsAn Authority Identifier (A-ID) is the RADIUS server that provisions Protected Access Credential (PACs) A-ID groups. A-ID groups are shared by all users of the computer and allow EAP-FAST profiles to support multiple PACs from multiple A-IDs.The A-ID groups can be pre-configured by the administrator and set up through an Administrator Package on a user's computer. When a wireless network profile encounters a server with an A-ID within the same group of the A-ID specified in the wireless network profile, it uses this PAC without a prompt to the user.To add an A-ID Group:1.  Select Include A-ID Groups.2.  Click Add.3.  Enter a new A-ID group name.4.  Click OK. The A-ID group is added to the A-ID Group list.If the A-ID group is locked, then additional A-IDs cannot be added to the group.
To add an A-ID to an A-ID group:1.  Select a group from the A-ID Groups list.2.  Click Add in the A-IDs section.3.  Select an A-ID.4.  Click OK. The A-ID is added to the list.Once an A-ID group has been selected, the A-IDs are extracted from the PACs on the A-ID group server. The list of A-IDs is automatically populated.Administrator TasksHow to Obtain a Client CertificateIf you do not have any certificates for EAP-TLS (TLS) or EAP-TTLS (TTLS) you must obtain a client certificate to allow authentication.Certificates are managed from either Internet Explorer or the Microsoft Windows Control Panel.Windows XP: When a client certificate is obtained, do not enable strong private key protection. If you enable strong private key protection for a certificate, you need to enter an access password for the certificate every time this certificate is used. You must disable strong private key protection for the certificate if you configure the service for TLS or TTLS authentication. Otherwise, the 802.1X service fails authentication because there is no logged in user to provide the required password.Notes about Smart CardsAfter a Smart Card is installed, the certificate is automatically installed on your computer and is chosen from the personal certificate store and root certificate store.Set up a Client with TLS Network AuthenticationStep 1: Obtain a certificateTo allow TLS authentication, you need a valid client certificate in the local repository for the logged-in user's account. You also need a trusted CA certificate in the root store.The following information provides two methods for obtaining a certificate:●     From a corporate certification authority (CA) implemented on a Windows 2000 server.●     Import a certificate from a file with Internet Explorer's certificate import wizard.
If you do not know how to obtain a user certificate from the CA, consult your administrator for the procedure.To install the CA on the local machine:1.  Obtain the CA and store it on your local drive.2.  Click Import. The Certificate Import Wizard opens.3.  Click Next.4.  Click Browse to locate the certificate on your local drive.5.  Click the exported certificate.6.  Click Open.7.  Click Next.8.  Click Place all certificates in the following store.9.  Click Browse to open the Select Certificate Store.10.  Click Show physical stores.11.  Click OK.12.  From the list of stores, scroll up and expand Trusted Root Certificate Authorities.13.  Click Local Computer.14.  Click OK.15.  Click Next.16.  Click Finish to complete the process.17.  Reboot after a certificate is installed.Use Microsoft Management Console (MMC) to verify that the CA is installed in the machine store.1.  In the Start menu, click Run.2.  Enter MMC.3.  Click OK to open The Microsoft Management Console.4.  Click File.5.  Click Add/Remove Snap-in.6.  Click Add to open the Add Standalone Snap-in page.7.  Click Certificates.8.  Click Add.9.  Click Computer account.10.  Click Next.11.  Click Finish.12.  Click Close.13.  Click OK.14.  In the console, click Certificates (Local Computer).15.  Click Trusted Root Certificate Authorities.16.  Click Certificates.17.  Verify that the CA you just installed is listed.18.  Click File.19.  Click Exit to close the console.Obtain a certificate from a Microsoft Windows 2000* CA:1.  Start Internet Explorer and browse to the Certificate Authority HTTP Service (use an URL, for example, http://yourdomainserver.yourdomain/certsrv with certsrv being the
command that brings you to the certificate authority. You can also use the IP address of the server machine. For example, "192.0.2.12/certsrv."2.  Logon to the CA with the name and password of the user account you created on the authentication server. The name and password do not have to be the same as the Windows log on name and password of the current user.3.  On the Welcome page of the CA, select Request a certificate task and submit the form.4.  Choose Request Type: Select Advanced request.5.  Click Next.6.  Advanced Certificate Requests: Select Submit a certificate request to this CA using a form.7.  Click Submit.8.  Advanced Certificate Request: Select User certificate template.9.  Click Mark keys as exportable.10.  Click Next. Use the provided defaults.11.  Certificate Issued: Click Install this certificate.NOTE: If this is the first certificate you have obtained, the CA first asks you if it should install a trusted CA certificate in the root store. This is not a trusted CA certificate. The name on the certificate is that of the host of the CA. Click Yes. You need this certificate for both TLS and TTLS.12.  If your certificate was successfully installed, you see the message, "Your new certificate has been successfully installed."13.  To verify the installation, click Internet Explorer > Tools > Internet Options > Content > Certificates. The new certificate should be installed in the Personal folder.Import a Certificate from a File1.  Open Internet Properties (right-click on the Internet Explorer icon on the desktop.2.  Select Properties.3.  Content: Click Certificates. The list of installed certificates appears.4.  Click Import to open the Certificate Import Wizard.5.  Select the file.6.  Specify your access password for the file. Clear Enable strong private key protection.7.  Certificate store: Click Automatically select certificate store based on the type of certificate (the certificate must be in the user accounts personal store to be accessible).8.  Proceed to Completing the Certificate Import and click Finish.To configure a profile with WPA authentication with WEP or TKIP encryption that uses TLS authentication:NOTE: Obtain and install a client certificate, See Step 1 or consult your administrator.Specify the certificate used by the WiFi connection utility. 1.  On the Profile page, click Add to open General Settings.
2.  Profile Name: Enter a profile name.3.  Wireless Network Name (SSID): Enter the network identifier.4.  Operating Mode: Network (Infrastructure) is selected by default.5.  Click Next to open the Security Settings.6.  Click Enterprise Security.7.  Network Authentication: Select Open (Recommended).8.  Data Encryption: Select WEP.9.  802.1X Enabled: Selected.10.  Authentication Type: Select TLS.Step 1 of 2: TLS User1.  Obtain and install a client certificate.2.  Select one of the following to obtain a certificate:Name DescriptionStatic Password On connection, enter the user credentials.One-time password (OTP) Obtain the password from a hardware token device.PIN (Soft Token) Obtain the password from a soft token program.3.  Click Next.Step 2 of 2: TLS Server1.  Select one of the following credential retrieval methods: Validate Server Certificate or Specify Server or Certificate Name.2.  Click OK. The profile is added to the Profiles list.3.  Click the new profile at the end of the Profiles list. Use the up and down arrows to change the priority of the new profile.4.  Click Connect to connect to the selected wireless network.5.  Click OK to close the application. Back to TopBack to Contents
Back to ContentsConfigure Profiles for Network (Infrastructure) Operating ModeA Network (Infrastructure) network consists of one or more access points and one or more computers with wireless adapters installed. Each access point must have a wired connection to a wireless network. This section describes how to create various profiles.●     Create a Windows XP* Profile with No Authentication or Data Encryption●     Create a Windows XP* Profile with Shared Network Authentication●     Create a Windows XP* Profile with WPA-Personal or WPA2-Personal Network Authentication●     Create a Windows XP* Profile with WPA-Enterprise or WPA2-Enterprise Network Authentication●     Create a Windows XP* Profile with WEP Data Encryption and EAP-SIM Network Authentication●     Create a Windows XP* Profile with TLS Network Authentication●     Create a Windows XP* Profile with TTLS Network Authentication●     Create a Windows XP* Profile with PEAP Network Authentication●     Create a Windows XP* Profile with LEAP Network Authentication●     Create a Windows XP* Profile with EAP-AKA Network Authentication●     Create a Windows XP* Profile with EAP-FAST Network AuthenticationCreate a Windows XP* Profile with No Authentication or Data Encryption (None)CAUTION: Networks using no authentication or encryption are highly vulnerable to access by unauthorized users.To create a profile for a wireless network connection with no encryption:1.  Click Profiles on the Intel(R) PROSet/Wireless WiFi Connection Utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list/tab, click Add to open the Create Wireless Profile General Settings.3.  Profile Name: Enter a descriptive profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security to open the Security Settings.9.  Network Authentication: Open (Selected).Open authentication allows a wireless device access to the network without 802.11 authentication. If no encryption is enabled on the network, any wireless device with the
correct network name (SSID) can associate with an access point and gain access to the network.10.  Data Encryption: None is the default.11.  Click OK. The profile is added to the Profiles list and connects to the wireless network.Create a Windows XP* Profile with Shared Network AuthenticationWhen shared key authentication is used, each wireless station is assumed to have received a secret shared key over a secure channel that is independent from the 802.11 wireless network communications channel. Shared key authentication requires that the client configure a static WEP or CKIP key. The client access is granted only if it passes a challenge-based authentication. CKIP provides stronger data encryption than WEP, but not all operating systems and access points support it.NOTE: While shared key would appear to be the better option for a higher level of security, a known weakness is created by the clear text transmission of the challenge string to the client. Once an invader sniffs for the challenge string, the shared authentication key can be easily reverse engineered. Therefore, open authentication (with data encryption) is actually, and counter intuitively, more secure.To create a profile with shared authentication:1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list/tab, click Add to open the Create Wireless Profile General Settings.3.  Profile Name: Enter a descriptive profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common.(This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select Shared. Shared authentication is accomplished with a pre-configured WEP key.10.  Data Encryption: Select None, WEP (64-bit or 128-bit), or CKIP (64-bit or 128-bit).11.  Enable 802.1X: Disabled.12.  Encryption Level: 64-bit or 128-bit: When switching between 64-bit and 128-bit encryption, the previous settings are erased and a new key must be entered. 13.  Key Index: Select 1, 2, 3, or 4. Change the Key Index to specify up to four passwords.14.  Wireless Security Password (Encryption Key): Enter the wireless network password (Encryption Key). This password is the same value used by the wireless access point or router. Contact your administrator for this password. ❍     Pass phrase (64-bit): Enter five (5) alphanumeric characters, 0-9, a-z or A-Z.❍     Hex key (64-bit): Enter 10 hexadecimal characters, 0-9, A-F.❍     Pass phrase (128-bit): Enter 13 alphanumeric characters, 0-9, a-z or A-Z. ❍     Hex key (128-bit): Enter 26 hexadecimal characters, 0-9, A-F.
Create a Windows XP* Profile with WPA-Personal or WPA2-Personal Network AuthenticationWi-Fi Protected Access (WPA) is a security enhancement that strongly increases the level of data protection and access control to a wireless network. WPA-Personal enforces key-exchange and only works with dynamic encryption keys. If your wireless access point or router supports WPA-Personal or WPA2-Personal, then you should enable it on the access point and provide a long, strong password. For personal or home networks without a RADIUS or AAA server, use Wi-Fi Protected Access Personal.●     WPA-Personal: A wireless security method that provides strong data protection and prevents unauthorized network access for small networks. It uses Temporal Key Integrity Protocol (TKIP) or AES-CCMP encryption and protects against unauthorized network access through the use of a pre-shared key (PSK).●     WPA2-Personal: A follow-on wireless security method to WPA that provides stronger data protection and prevents unauthorized network access for small networks. NOTE: WPA-Personal and WPA2-Personal are interoperable.Some security solutions may not be supported by your computer's operating system and may require additional software or certain hardware as well as wireless LAN infrastructure support. Check with your computer manufacturer for details.To add a profile with WPA-Personal or WPA2-Personal network authentication: 1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list/tab, click Add to open the Create Wireless Profile General Settings.3.  Profile Name: Enter a descriptive profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select WPA-Personal or WPA2-Personal. See Security Overview.10.  Data Encryption: Select either TKIP or AES_CCMP. 11.  Password: Enter a text phrase from 8 to 63 characters. The longer the password, the stronger the security of the wireless network. The same password entered into an access points needs to be used on this computer and all other wireless devices that access the wireless network.Create a Windows XP* Profile with WPA-Enterprise or WPA2-Enterprise Network Authentication WPA2-Enterprise requires an authentication server.●     WPA-Enterprise: A wireless security method that provides strong data protection for multiple users and large managed networks. It uses the 802.1X authentication framework with TKIP or AES-CCMP encryption and prevents unauthorized network access by verifying network users through an
authentication server.●     WPA2-Enterprise: The follow-on wireless security method to WPA that provides stronger data protection for multiple users and large managed networks. It prevents unauthorized network access by verifying network users through an authentication server.NOTE: WPA-Enterprise and WPA2-Enterprise are interoperable.To add a profile that uses WPA-Enterprise or WPA2-Enterprise authentication: 1.  Obtain a user name and password on the RADIUS server from your administrator.2.  Certain Authentication Types require that you obtain and install a client certificate. See Create a Profile with TLS authentication or consult your administrator. 3.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 4.  On the Profiles list, click Add to open the Create Wireless Profile General Settings.5.  Profile Name: Enter a descriptive profile name.6.  Wireless Network Name (SSID): Enter the network identifier.7.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)8.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)9.  Click Next to open the Security Settings.10.  Click Enterprise Security.11.  Network Authentication: Select WPA-Enterprise or WPA2-Enterprise. 12.  Data Encryption: Select either TKIP or AES_CCMP.13.  Enable 802.1X: Selected by default. 14.  Authentication Type: Select one of the following: EAP-SIM, LEAP, TLS, TTLS, PEAP, or EAP-FAST.Configure a Network Profile with 802.1X Authentication Types Create a Windows XP* Profile with WEP Data Encryption and EAP-SIM Network AuthenticationEAP-SIM uses a dynamic session-based WEP key, which is derived from the client adapter and RADIUS server, to encrypt data. EAP-SIM requires you to enter a user verification code, or PIN, for communication with the Subscriber Identity Module (SIM) card. A SIM card is a special smart card that is used by Global System for Mobile Communications (GSM) based digital cellular networks.To add a profile with EAP-SIM authentication:1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list, click Add to open the Create Wireless Profile General Settings.3.  Profile Name: Enter a profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)
6.  Administrator Profile Type: Select Pre-logon/Common. (This step applies only if you are using the Administrator Tool. EAP-SIM cannot be used for Persistent profiles.) 7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select Open (Recommended).10.  Data Encryption: Select WEP.11.  Click Enable 802.1X.12.  Authentication Type: Select EAP-SIM.EAP-SIM authentication can be used with:●     Network Authentication types: Open, Shared, WPA-Enterprise and WPA2-Enterprise●     Data Encryption types: None, WEP, TKIP, AES-CCMP and CKIPEAP-SIM User (optional) 1.  Click Specify user name (identity): 2.  At User Name: Enter the user name assigned to the SIM card.3.  Click OK.Create a Windows XP* Profile with EAP-AKA Network AuthenticationEAP-AKA (Extensible Authentication Protocol Method for UMTS Authentication and Key Agreement) is an EAP mechanism for authentication and session key distribution, using the Universal Mobile Telecommunications System (UMTS) Subscriber Identity Module (USIM). The USIM card is a special smart card used with cellular networks to validate a given user with the network. EAP-AKA authentication can be used with:●     Network Authentication types: Open, WPA-Enterprise and WPA2-Enterprise●     Data Encryption types: WEP or CKIP for Open authentication, TKIP or AES-CCMP for Enterprise authentication.EAP-AKA uses Enterprise Security and for network authentication, can use Open, WPA Enterprise, or WPA2 Enterprise. To add a profile with EAP-AKA authentication:1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list, click Add to open the Create Wireless Profile General Settings.3.  Profile Name: Enter a profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Pre-logon/Common. (This step applies only if you are using the Administrator Tool. EAP-SIM cannot be used for Persistent profiles.) 7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select Open, WPA-Enterprise, or WPA2-Enterprise.
10.  Data Encryption: Select WEP or CKIP for Open authentication, TKIP or AES-CCMP for Enterprise authentication.11.  Click Enable 802.1X if it is not already selected. 12.  Authentication Type: Select EAP-AKA.EAP-AKA User (optional) 1.  Click Specify user name (identity): 2.  At User Name: Enter the user name assigned to the USIM card.3.  Click OK.Create a Windows XP* Profile with TLS Network Authentication These settings define the protocol and the credentials used to authenticate a user. Transport Layer Security (TLS) authentication is a two-way authentication method that exclusively uses digital certificates to verify the identity of a client and a server.To add a profile with TLS authentication:1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list, click Add to open the Create Wireless Profile General Settings.3.  Profile Name: Enter a descriptive profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select WPA-Enterprise or WPA2-Enterprise (Recommended). 10.  Data Encryption: Select AES-CCMP (Recommended).11.  Enable 802.1X: Selected by default.12.  Authentication Type: Select TLS to be used with this connection.
Step 1 of 2: TLS User1.  Obtain and install a client certificate. See Create a Profile with TLS authentication or consult your system administrator.2.  Select one of the following to obtain a certificate: Use my smart card, Use the certificate issued to this computer, or Use a user certificate on this computer.3.  Click Next to open the TLS Server settings.
Step 2 of 2: TLS Server1.  Select one of the following credential retrieval methods: Validate Server Certificate or Specify Server or Certificate Name. 2.  Click OK. The profile is added to the Profiles list. 3.  Click the new profile at the end of the Profiles list. Use the up and down arrows to change the priority of the new profile. 4.  Click Connect to connect to the selected wireless network. 5.  Click OK to close Intel PROSet/Wireless WiFi. Create a Windows XP* Profile with TTLS Network Authentication TTLS authentication: These settings define the protocol and credentials used to authenticate a user. The client uses EAP-TLS to validate the server and create a TLS-encrypted channel between the client and server. The client can use another authentication protocol. Typically password-based protocols challenge
over a non-exposed TLS encrypted channel.To set up a client with TTLS Authentication:1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list, click Add to open the Create Wireless Profile General Settings.3.  Profile Name: Enter a descriptive profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select WPA-Enterprise or WPA2-Enterprise (Recommended)10.  Data Encryption: Select TKIP or AES-CCMP (Recommended).11.  Enable 802.1X: Selected by default.12.  Authentication Type: Select TTLS to be used with this connection.
Step 1 of 2: TTLS User1.  Authentication Protocol: This parameter specifies the authentication protocol operating over the TTLS tunnel. The protocols are: PAP (Default), CHAP, MS-CHAP and MS-CHAP-V2. See Security Overview for more information.2.  User Credentials: For PAP, CHAP, MS-CHAP, and MS-CHAP-V2 protocols, select one of these authentication methods: Use Windows logon, Prompt each time I connect, or Use the following.3.  Roaming Identity: A Roaming Identity may be populated in this field or you can use %domain%\%username% as the default format for entering a roaming identity.When 802.1X Microsoft IAS RADIUS is used as an authentication server, the server authenticates the device using the Roaming Identity from Intel PROSet/Wireless WiFi software, and ignores the Authentication Protocol MS-CHAP-V2 user name. Microsoft IAS RADIUS accepts only a valid user name (dotNet user) for the Roaming Identity. For all other authentication servers, the Roaming Identity is optional. Therefore, it is recommended to use the desired realm (for example, anonymous@myrealm) for the Roaming Identity rather than a true identity. 4.  Click Next to access the TTLS Server settings.
Step 2 of 2: TTLS Server1.  Select one of the following credential retrieval methods: Validate Server Certificate or Specify Server or Certificate Name.2.  Click OK to save the setting and close the page.Create a Windows XP* Profile with PEAP Network Authentication PEAP authentication: PEAP settings are required for the authentication of the client to the authentication server. The client uses EAP-TLS to validate the server and create a TLS-encrypted channel between client and server. The client can use another EAP mechanism, such as Microsoft Challenge Authentication Protocol (MS-CHAP) Version 2, over this encrypted channel to enable server validation. The challenge and response packets are sent over a non-exposed TLS encrypted channel. The following example describes how to use WPA with AES-CCMP or TKIP encryption with PEAP authentication.To set up a client with PEAP Authentication: Obtain and install a client certificate. See Create a Windows XP* Profile for TLS authentication or consult your administrator.1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list, click Add to open the Create Wireless Profile General Settings.3.  Profile Name: Enter a descriptive profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select WPA-Enterprise or WPA2-Enterprise (Recommended).10.  Data Encryption: Select one of the following: AES-CCMP is recommended. 11.  Enable 802.1X: Selected by default.12.  Authentication Type: Select PEAP to be used with this connection.Step 1 of 2: PEAP UserPEAP relies on Transport Layer Security (TLS) to allow unencrypted authentication types such as EAP-Generic Token Card (GTC) and One-Time Password (OTP) support. 1.  Authentication Protocol: Select either GTC, MS-CHAP-V2 (Default), or TLS. See Authentication Protocols.2.  User Credentials: Select one of the following: Use Windows logon, Prompt each time I connect, or Use the following.3.  Roaming Identity: A Roaming Identity may be populated in this field or you can use %domain%\%username% as the default format for entering a roaming identity.
When 802.1X Microsoft IAS RADIUS is used as an authentication server, the server authenticates the device using the Roaming Identity from Intel PROSet/Wireless WiFi software, and ignores the Authentication Protocol MS-CHAP-V2 user name. Microsoft IAS RADIUS accepts only a valid user name (dotNet user) for the Roaming Identity. For all other authentication servers, the Roaming Identity is optional. Therefore, it is recommended to use the desired realm (for example, anonymous@myrealm) for the Roaming Identity rather than a true identity. Configure Roaming Identity to Support Multiple Users:If you use a Pre-logon/Common profile that requires the roaming identity to be based on the Windows logon credentials, the creator of the profile can add a roaming identity that uses %username% and %domain%. The roaming identity is parsed and the appropriate log on information is substituted for the keywords. This allows maximum flexibility in configuring the roaming identity while allowing multiple users to share the profile.Please see your authentication server user guide for directions about how to format a suitable roaming identity. Possible formats are:%domain%\%user_name% %user_name%@%domain% %user_name%@%domain%.com %user_name%@mynetwork.comIf Roaming Identity is blank, %domain%\%username% is the default. Notes about the credentials: This user name and domain must match the user name that is set in the authentication server by the administrator prior to client authentication. The user name is case-sensitive. This name specifies the identity supplied to the authenticator by the authentication protocol operating over the TLS tunnel. This user identity is securely transmitted to the server only after an encrypted channel has been verified and established.Authentication ProtocolsThis parameter specifies the authentication protocols that can operate over the TTLS tunnel. Next are instructions on how to configure a profile that uses PEAP authentication with GTC, MS-CHAP-V2 (Default), or TLS authentication protocols.Generic Token Card (GTC)
To configure a one-time password:1.  Authentication Protocol: Select GTC (Generic Token Card).2.  User Credentials: Select Prompt each time I connect. (This is only available if you are creating a personal profile. Not available for IT profiles.) 3.  On connection prompt for: Select one of the following: Name DescriptionStatic Password On connection, enter the user credentials.One-time password (OTP) Obtain the password from a hardware token device.PIN (Soft Token) Obtain the password from a soft token program.NOTE: The Prompt each time I connect option is unavailable if an Administrator has cleared the Cache Credentials setting in the Administrator Tool. See Administrator Application Settings for more information.
4.  Click OK.5.  If you are acting as the user, perform the following three steps. 6.  Select the profile on the WiFi Networks list. 7.  Click Connect. When prompted, enter the user name, domain and OTP.8.  Click OK. You are asked to verify your log in information. MS-CHAP-V2: This parameter specifies the authentication protocol operating over the PEAP tunnel. 1.  User Credentials: Select one of the following options: Use Windows logon, Prompt each time I connect, or Use the following.2.  Click Next to open the PEAP Server settings.TLS: Transport Layer Security authentication is a two-way authentication method that exclusively uses digital certificates to verify the identity of a client and a server. 1.  Obtain and install a client certificate. See Create a Windows XP* Profile for TLS authentication or consult your system administrator.2.  Select one of the following to obtain a certificate: Use my smart card, Use the certificate issued to this computer, or Use a user certificate on this computer.3.  Click Next to open the PEAP Server settings.Step 2 of 2: PEAP Server
 1.  Select one of the following credential retrieval methods: Validate Server Certificate or Specify Server or Certificate Name.2.  Click OK. The profile is added to the Profiles list.3.  Click the new profile at the end of the Profiles list. Use the up and down arrows to change the priority of the new profile.4.  Click Connect to connect to the selected wireless network.If you did not select Use Windows logon on the Security Settings page and also did not configure user credentials, no credentials are saved for this profile. Please enter your credentials to authenticate to the network. 5.  Click OK to close Intel PROSet/Wireless WiFi.PEAP-TLS Certificate Auto EnrollmentIn the Application Settings, select Enable TLS rejected certificates notification, if you want a warning issued when a PEAP-TLS certificate is rejected.When a certificate has an invalid field expiration date, you
are notified that you must take one of the following actions:A potential authentication problem for profile has been detected. The expiration date in the associated certificate may be invalid. Choose one of the following options:Control DescriptionContinue with current parameters. Continue with the current certificate.Update certificate manually.  The Select Certificate page opens for you to choose another certificate. Update certificate automatically based on the certificates in the local store. This option is enabled only when the local store holds one or more certificates for which the "issued to" and "issued by" fields match the current certificate and for which the "expiration date" has not expired. If you choose this option, the application selects the first valid certificate.Log off to obtain certificate during logon process (this does not update the profile and only applies to certificates configured for auto enrollment).Logs off the user, who must obtain a proper certificate during the next logon process. The profile must be updated to select the new certificate. Auto enrollment  You are notified to: Please wait while the system is trying to obtain the certificate automatically. Click Cancel to end the certificate retrieval.Do not show this message again.  A user is able to avoid this step in subsequent sessions. The choice selected is remembered for future sessions.Create a Windows XP* Profile with LEAP Network AuthenticationCisco LEAP (Light Extensible Authentication Protocol) is an 802.1X authentication type that supports strong mutual authentication between the client and a RADIUS server. The LEAP profiles settings include LEAP, CKIP with Rogue access point detection integration. To set up a client with LEAP authentication: 1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list, click Add. The Create Wireless Profile General Settings opens.3.  Profile Name: Enter a descriptive profile name.4.  Wireless Network Name (SSID): Enter the network identifier.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select WPA-Enterprise or WPA2-Enterprise (Recommended).10.  Data Encryption: AES-CCMP is recommended.11.  Enable 802.1X: Selected by default.12.  Authentication Type: Select LEAP to be used with this connection. 13.  Click Cisco Options.14.  Click Enable Cisco Compatible Extensions to enable Cisco Compatible Extensions (CCX) security (Allow Fast Roaming (CCKM), Enable Radio Management Support, and Enable Mixed Cells Mode).
15.  Click Enable Radio Management Support to detect rogue access points.16.  Click OK to return to the Security Settings.LEAP User:
 1.  Select one of the following authentication methods listed next. If under Administrator Profile Type you selected Persistent (with or without selecting Pre-logon/Common), then only Use the following user name and password is available. If you only selected Pre-logon/Common, then the following three authentication methods are available.❍     Use the Windows logon user name and password ❍     Prompt for the user name and password ❍     Use the following user name and password2.  Click OK to save the setting and close the page.Create a Windows XP* Profile with EAP-FAST Network Authentication In Cisco Compatible Extensions, Version 3 (CCXv3), Cisco added support for EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling), which uses protected access
credentials (PACs) to establish an authenticated tunnel between a client and a server.Cisco Compatible Extensions, Version 4 (CCXv4) improves the provisioning methods for enhanced security and provides innovations for enhanced security, mobility, quality of service, and network management.Cisco Compatible Extensions, Version 3 (CCXv3)To set up a client with EAP-FAST authentication with Cisco Compatible Extensions, version 3 (CCXv3):1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list, click Add to open the Create Wireless Profile General Settings.3.  Wireless Network Name (SSID): Enter the network identifier.4.  Profile Name: Enter a descriptive profile name.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select WPA-Enterprise or WPA2-Enterprise (Recommended).10.  Data Encryption: AES-CCMP is recommended.11.  Enable 802.1X: Selected by default.12.  Authentication Type: Select EAP-FAST to be used with this connection.NOTE: If CCXv4 Application Setting was not installed through an Administrator Package, only EAP-FAST User Settings are available for configuration. See EAP-FAST User Settings.Step 1 of 2: EAP-FAST Provisioning 1.  Click Disable EAP-FAST Enhancements (CCXv4) to allow provisioning inside a server-unauthenticated TLS tunnel (Unauthenticated-TLS-Server Provisioning Mode).2.  Click Select server to view any unauthenticated PACs that have already been provisioned and reside on this computer.NOTE: If the provisioned PAC is valid, the WiFi connection utility does not prompt the user for acceptance of the PAC. If the PAC is invalid, WiFi connection utility fails the provisioning automatically. A status message is displayed in the Wireless Event Viewer that an administrator can review on the user's computer.To import a PAC:
●     Click Select server to open the Protected Access Credentials (PAC) list.●     Click Import to import a PAC that resides on this computer or a server.●     Select the PAC and click Open.●     Enter the PAC password (optional).●     Click OK to close this page. The selected PAC is added to PAC list.3.  Click Next to select the credential retrieval method or click OK to save the EAP-FAST settings and return to the Profiles list. The PAC is used for this wireless profile.Step 2 of 2: EAP-FAST Additional InformationTo perform client authentication in the established tunnel, a client sends a user name and password to authenticate and establish client authorization policy.1.  Click User Credentials to select one of the following credentials retrieval method: Use Windows logon, Prompt each time I connect, or Use the following.2.  Click OK to save the settings and close the page. Server verification is not required. Cisco Compatible Extensions, Version 4 (CCXv4) To set up a client with EAP-FAST authentication with Cisco Compatible Extensions, version 4 (CCXv4):1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profiles list, click Add to open the Create Wireless Profile General Settings.3.  Wireless Network Name (SSID): Enter the network identifier.4.  Profile Name: Enter a descriptive profile name.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)
6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select WPA-Enterprise or WPA2-Enterprise (Recommended).10.  Data Encryption: AES-CCMP is recommended.11.  Enable 802.1X: Selected.12.  Authentication Type: Select EAP-FAST to be used with this connection.Step 1 of 3: EAP-FAST Provisioning With CCXv4, EAP-FAST supports two modes for provisioning:●     Server-Authenticated Mode: Provisioning inside a server authenticated TLS tunnel.●     Server-Unauthenticated Mode: Provisioning inside an unauthenticated TLS tunnel.NOTE: Server-Authenticated Mode provides significant security advantages over Server-Unauthenticated Mode even when EAP-MS-CHAP-V2 is being used as an inner method. This
mode protects the EAP-MS-CHAP-V2 exchanges from potential Man-in-the-Middle attacks by verifying the server’s authenticity before exchanging MS-CHAP-V2. Therefore, Server-Authenticated Mode is preferred whenever it is possible. EAP-FAST peer must use Server-Authenticated Mode whenever a certificate or public key is available to authenticate the server and ensure the best security practices.Provisioning of Protected Access Credentials (PAC): EAP-FAST uses a PAC key to protect the user credentials that are exchanged. All EAP-FAST authenticators are identified by an authority identity (A-ID). The local authenticator sends its A-ID to an authenticating client, and the client checks its database for a matching A-ID. If the client does not recognize the A-ID, it requests a new PAC.NOTE: If the provisioned Protected Access Credential (PAC) is valid, the WiFi connection utility does not prompt the user for acceptance of the PAC. If the PAC is invalid, the WiFi connection utility fails the provisioning automatically. A status message is displayed in the Wireless Event Viewer that an administrator can review on the user's computer.1.  Verify that Disable EAP-FAST Enhancements (CCXv4) is not selected. Allow unauthenticated provisioning and Allow authenticated provisioning are selected by default. Once a PAC is selected from the Default Server, you can deselect any of these provisioning methods.2.  Default Server: None is selected as the default. Click Select Server to select a PAC from the default PAC authority server or select a server from the Server group list. The EAP-FAST Default Server (PAC Authority) selection page opens.NOTE: Server groups are only listed if you have installed an Administrator Packagethat contains EAP-FAST Authority ID (A-ID) Group settings.PAC distribution can also be completed manually (out-of-band). Manual provisioning enables you to create a PAC for a user on an ACS server and then import it into a user's computer. A PAC file can be protected with a password, which the user needs to enter during a PAC import.To import a PAC:1.  Click Import to import a PAC from the PAC server.2.  Click Open.3.  Enter the PAC password (optional).4.  Click OK closes this page. The selected PAC is used for this wireless profile.EAP-FAST CCXv4 enables support for the provisioning of other credentials beyond the PAC currently provisioned for tunnel establishment. The credential types supported include trusted CA certificate, machine credentials for machine authentication, and temporary user credentials used to bypass user authentication.Use a certificate (TLS Authentication)1.  Click Use a certificate (TLS Authentication)2.  Click Identity Protection when the tunnel is protected.3.  Select one of the following to obtain a certificate: Use my smart card, Use the certificate issued to this computer, or Use a user certificate on this computer.4.  User Name: Enter the user name assigned to the user certificate.5.  Click Next.
Step 2 of 3: EAP-FAST Additional Information If you selected Use a certificate (TLS Authentication) and Use a user certificate on this computer, click Next (no roaming identity is required) and proceed to Step 3 to configure EAP-FAST Server certificate settings. If you do not need to configure EAP-FAST server settings, click OK to save your settings and return to the Profiles page.If you selected to Use my smart card, add the roaming identity, if required. Click OK to save your settings and return to the Profiles page.If you did not select Use a certificate (TLS Authentication), click Next to select an Authentication Protocol. CCXv4 permits additional credentials or TLS cipher suites to establish the tunnel.Authentication Protocol: Select either GTC, or MS-CHAP-V2 (Default).Generic Token Card (GTC)GTC may be used with Server-Authenticated Mode. This enable peers using other user databases as Lightweight Directory Access Protocol (LDAP) and one-time password (OTP) technology to be provisioned in-band. However, the replacement may only be achieved when used with the TLS cipher suites that ensure server authentication.To configure a one-time password:1.  Authentication Protocol: Select GTC (Generic Token Card).2.  User Credentials: Select Prompt each time I connect.3.  On connection prompt for: Select one of the following:Name DescriptionStatic Password On connection, enter the user credentials.One-time password (OTP) Obtain the password from a hardware token device.PIN (Soft Token) Obtain the password from a soft token program.4.  Click OK.5.  Select the profile on the WiFi Networks list.6.  Click Connect. When prompted, enter the user name, domain and one-time password (OTP).7.  Click OK.MS-CHAP-V2. This parameter specifies the authentication protocol operating over the PEAP tunnel.1.  Authentication Protocol: Select MS-CHAP-2.2.  Select the user credentials: Use Windows logon, Prompt each time I connect, or Use the following.3.  Roaming Identity: A Roaming Identity may be populated in this field or you can use %domain%\%username% as the default format for entering a roaming identity.When 802.1X Microsoft IAS RADIUS is used as an authentication server, the server authenticates the device using the Roaming Identity from Intel PROSet/Wireless WiFi software, and ignores the Authentication Protocol MS-CHAP-V2 user name. Microsoft IAS RADIUS accepts only a valid user name (dotNet user) for the Roaming Identity. For all other authentication servers, the Roaming Identity is optional. Therefore, it is recommended to use
the desired realm (for example, anonymous@myrealm) for the Roaming Identity rather than a true identity.Step 3 of 3: EAP-FAST Server Authenticated-TLS-Server Provisioning Mode is supported using a trusted CA certificate, a self-signed server certificate, or server public keys and GTC as the inner EAP method.1.  Select one of the following credential retrieval methods: Validate Server Certificate or Specify Server or Certificate Name.2.  Click OK to close the security settings.EAP-FAST User SettingsNOTE: If an Administrator Package to be exported to a user's computer does not include the Enable CCXv4 Administrator Tool Application Setting, only EAP-FAST User Settings will be available for configuration.To set up a client with EAP-FAST authentication:1.  Click Profiles on the WiFi connection utility main window. Or if you are acting as the administrator, open the Administrator Tool. 2.  On the Profile page, click Add to open the Create Wireless Profile General Settings.3.  Wireless Network Name (SSID): Enter the network identifier.4.  Profile Name: Enter a descriptive profile name.5.  Operating Mode: Click Network (Infrastructure). (This parameter is set to Infrastructure if you are using the Administrator Tool.)6.  Administrator Profile Type: Select Persistent or Pre-logon/Common. (This step applies only if you are using the Administrator Tool.)7.  Click Next to open the Security Settings.8.  Click Enterprise Security.9.  Network Authentication: Select WPA-Enterprise or WPA2-Enterprise.10.  Data Encryption: Select one of the following: ❍     TKIP provides per-packet key mixing, a message integrity check and a rekeying mechanism.❍     AES-CCMP (Advanced Encryption Standard - Counter CBC-MAC Protocol) is used as the data encryption method whenever strong data protection is important. AES-CCMP is recommended.11.  Enable 802.1X: Selected.12.  Authentication Type: Select EAP-FAST to be used with this connection.13.  Click Cisco Options to select Allow Fast Roaming (CCKM), which enables the client wireless adapter for fast secure roaming.Step 1 of 3 EAP-FAST Provisioning (User Settings) EAP-FAST uses a PAC key to protect the user credentials that are exchanged. All EAP-FAST authenticators are identified by an authority identity (A-ID). The local authenticator sends its A-ID to an authenticating client, and the client checks its database for a matching A-ID. If the client does not recognize the A-ID, it requests a new PAC.NOTE: If the provisioned Protected Access Credential (PAC) is valid, the WiFi connection utility does not prompt the user for acceptance of the PAC. If the PAC is invalid, the WiFi connection utility fails the
provisioning automatically. A status message is displayed in the Wireless Event Viewer that an administrator can review on the user's computer.1.  Leave unchecked Disable EAP-FAST Enhancements (CCXv4).2.  Allow authenticated provisioning and Allow unauthenticated provisioning are both checked.3.  Default Server: None selected is the default. Click Select Server to select a PAC from the default PAC authority server. The Protected Access Credentials selection page opens.NOTE: Server groups are only listed if you have installed an Administrator Package that contains EAP-FAST Authority ID (A-ID) Group settings.PAC distribution can also be completed manually (out-of-band). Manual provisioning lets you create a PAC for a user on an ACS server and then import it into a user's computer. A PAC file can be protected with a password, which the user needs to enter during a PAC import.4.  To import a PAC:1.  Click Import to import a PAC from the PAC server.2.  Click Open.3.  Enter the PAC password (optional).4.  Click OK to close this page. The selected PAC is used for this wireless profile.5.  Click Next. 6.  If this is not a Pre-logon/Common profile, then click Next and jump to Step 3 of 3: EAP-FAST Server. 7.  If this is a Pre-logon/Common profile, or if you are not using the Administrator Tool to create this profile, proceed to the next step.Step 2 of 3: EAP-FAST Additional Information1.  Authentication Protocol: Select MS-CHAP-V2 or GTC2.  User Credentials: Select Use Windows Logon or Use the following. 3.  If you selected Use the following, then enter the User Name, Domain, Password, and Confirm Password. 4.  Enter the Roaming Identity: %DOMAIN%\%USERNAME5.  Click Next.Step 3 of 3: EAP-FAST Server 1.  Click Validate Certificate if desired and select the Certificate Issuer from the drop down menu. The default selection is Any Trusted CA. 2.  If desired, click Specify Server or Certificate Name and enter the name. Then click Server Name must match the specified entry exactly or Domain name must end with the specified entry. 3.  Click OK.Back to TopBack to ContentsTrademarks and Disclaimers
Back to ContentsSecurity OverviewThis section describes the various security methods used to help protect wireless networks.Protecting Your Wireless Network●     Authentication●     Encryption●     SSID BroadcastingPersonal Security Methods ●     Open and Shared Key authentication●     WEP Encryption●     WPA-Personal●     WPA2-Personal 802.1X Authentication (Enterprise Security) ●     Overview●     What is RADIUS?●     How 802.1X Authentication Works●     802.1X FeaturesNetwork Authentication Types ●     Open●     Shared●     WPA-Personal ●     WPA2-Personal ●     WPA-Enterprise●     WPA2-EnterpriseData Encryption Types ●     AES-CCMP
●     TKIP●     CKIPAuthentication Types●     TLS●     TTLS●     PEAP●     LEAP●     EAP-SIM●     EAP-FAST●     EAP-AKAAuthentication Protocols●     PAP●     CHAP●     MS-CHAP●     MS-CHAP-V2●     GTC●     TLS Cisco Features ●     Cisco LEAP●     Cisco Rogue Access Point Security Feature●     802.11b and 802.11g Mixed Environment Protection Protocol●     CKIP●     Fast Roaming (CCKM)●     Mixed Cell Mode●     Radio ManagementProtecting Your Wireless NetworkYour wireless network, if left unprotected, is vulnerable to access from other computers. You can easily protect your home and small business network from nearly all forms of unauthorized access with the security methods described in this section. Authentication
Authentication is the process of identifying and approving a request from a client (usually a laptop) to access a network at a network access point. Once authentication is completed and access is granted, the client has access to the network. EncryptionYou can select encryption algorithms to encrypt the information and data that is sent across your wireless network. Only computers equipped with pre-shared keys can encrypt and decrypt the data being transmitted. Encryption keys are available with two levels of security, 64-bit and 128-bit. Use 128-bit keys for greater security.SSID BroadcastingA simple way to improve network security is to set your network access point to not broadcast the Service Set Identifier (SSID). The SSID is needed to gain access. Only those computers with knowledge of the SSID can access the network. (This is not set at the adapter using the Intel(R) PROSet/Wireless WiFi Connection Utility, it is set at the access point.)Personal Security Methods Open and Shared Network AuthenticationIEEE 802.11 supports two types of network authentication methods: Open System and Shared Key.●     When open authentication is used, any wireless station can request authentication. The station that needs to authenticate with another wireless station sends an authentication management request that contains the identity of the sending station. The receiving station or access point grants any request for authentication. Open authentication allows any device to gain network access. If no encryption is enabled on the network, any device that knows the Service Set Identifier (SSID) of the access point can gain access to the network.●     When shared key authentication is used, each wireless station is assumed to have received a secret shared key over a secure channel that is independent from the 802.11 wireless network communications channel. You can share this secret key via a wired Ethernet connection, or by physically using a USB memory stick or CD. Shared key authentication requires that the client configure a static WEP key. The client access is granted only if it passes a challenge-based authentication.WEP
Wired Equivalent Privacy (WEP) uses encryption to help prevent unauthorized reception of wireless data. WEP uses an encryption key to encrypt data before transmitting it. Only computers that use the same encryption key can access the network and decrypt the data transmitted by other computers. WEP encryption provides for two levels of security, using a 64-bit key (sometimes referred to as 40-bit) or a 128-bit key (also known as 104-bit). For stronger security, you should use a 128-bit key. If you use encryption, all wireless devices on your wireless network must use the same encryption keys. With WEP data encryption, a wireless station can be configured with up to four keys (the key index values are 1, 2, 3, and 4). When an access point (AP) or a wireless station transmits an encrypted message that uses a key stored in a specific key index, the transmitted message indicates the key index that was used to encrypt the message body. The receiving AP or wireless station can then retrieve the key that is stored at the key index and use it to decode the encrypted message bodyBecause the WEP encryption algorithm is vulnerable to network attacks, you should consider using WPA-Personal or WPA2-Personal security.WPA-Personal WPA-Personal Mode is targeted to home and small business environments. WPA Personal requires manual configuration of a pre-shared key (PSK) on the access point and clients. No authentication server is needed. The same password entered at the access point needs to be used on this computer and all other wireless devices that access the wireless network. Security depends on the strength and secrecy of the password. The longer the password, the stronger the security of the wireless network. If your wireless access point or router supports WPA-Personal and WPA2-Personal then you should enable it on the access point and provide a long, strong password. WPA-Personal makes available the TKIP and AES-CCMP data encryption algorithms.WPA2-PersonalWPA2-Personal requires manual configuration of a pre-shared key (PSK) on the access point and clients. No authentication server is needed. The same password entered at the access point needs to be used on this computer and all other wireless devices that access the wireless network. Security depends on the strength and secrecy of the password. The longer the password, the stronger the security of the wireless network. WPA2 is an improvement over WPA and implements the full IEEE 802.11i standard. WPA2 is backward compatible with WPA. WPA2-Personal makes available the TKIP and AES-CCMP data encryption algorithms.NOTE: WPA-Personal and WPA2-Personal are interoperable.802.1X Authentication (Enterprise Security)
This section describes security common used by larger companies. Overview What is Radius?  How 802.1X Authentication Works 802.1X Features OverviewThe 802.1X authentication is independent of the 802.11 authentication process. The 802.11 standard provides a framework for various authentication and key-management protocols. There are different 802.1X authentication types and each provides a different approach to authentication, but all employ the same 802.11 protocol and framework for communication between a client and an access point. In most protocols, after completion of the 802.1X authentication process, the client receives a key that it uses for data encryption. See How 802.1X authentication works for more information. With 802.1X authentication, an authentication method is used between the client and a server (for example a Remote Authentication Dial-In User Service (RADIUS) server) connected to the access point. The authentication process uses credentials, such as a user's password, that are not transmitted over the wireless network. Most 802.1X types support dynamic per-user, per-session keys to strengthen the key security. The 802.1X authentication benefits from the use of an existing authentication protocol known as the Extensible Authentication Protocol (EAP).The 802.1X authentication for wireless networks has three main components: ●     The authenticator (the access point)●     The supplicant (the client software)●     The authentication serverThe 802.1X authentication security initiates an authorization request from the wireless client to the access point, which authenticates the client to an Extensible Authentication Protocol (EAP) compliant RADIUS server. This RADIUS server may authenticate either the user (via passwords or certificates) or the system (by MAC address). In theory, the wireless client is not allowed to join the networks until the transaction is complete. (Not all authentication methods use a RADIUS server. WPA-Personal and WPA2-Personal use a common password that must be entered at the access point and at all devices requesting access to the network.)There are several authentication algorithms used with 802.1X. Some examples are: EAP-TLS, EAP-TTLS, Protected EAP (PEAP), and EAP Cisco Wireless Light Extensible Authentication Protocol (LEAP). These are all methods for the wireless client to identify itself to the RADIUS server. With RADIUS authentication, user identities are checked against databases. RADIUS constitutes a set of standards that addresses Authentication, Authorization, and Accounting (AAA). RADIUS includes a proxy process to validate clients in a multi-server environment. The IEEE 802.1X standard provides a mechanism for controlling
and authenticating access to port-based 802.11 wireless and wired Ethernet networks. Port-based network access control is similar to a switched local area network (LAN) infrastructure that authenticates devices attached to a LAN port and prevents access to that port if the authentication process fails.What is RADIUS?RADIUS is the Remote Authentication Dial-In User Service, an Authorization, Authentication, and Accounting (AAA) client-server protocol that is used when a AAA dial-up client logs in or out of a Network Access Server. Typically, a RADIUS server is used by Internet Service Providers (ISP) to perform AAA tasks. AAA phases are described as follows:●     Authentication phase: Verifies a user name and password against a local database. After credentials are verified, the authorization process begins.●     Authorization phase: Determines whether a request is allowed access to a resource. An IP address is assigned for the dial-up client.●     Accounting phase: Collects information on resource usage for the purpose of trend analysis, auditing, session-time billing, or cost allocation.How 802.1X Authentication WorksFollowing is a simplified description of how 802.1X authentication works.1.  A client sends a "request to access" message to an access point. The access point requests the identity of the client. 2.  The client replies with its identity packet, which is passed along to the authentication server.3.  The authentication server sends an "accept" packet to the access point.4.  The access point places the client port in the authorized state and data traffic is allowed to proceed.802.1X FeaturesThe following authentication methods are supported on Windows XP:●     802.1X supplicant protocol support●     Support for the Extensible Authentication Protocol (EAP) - RFC 2284●     Supported Authentication Methods on Windows XP: ❍     EAP TLS Authentication Protocol - RFC 2716 and RFC 2246 ❍     EAP Tunneled TLS (TTLS) ❍     Cisco LEAP
❍     PEAP❍     EAP-SIM ❍     EAP-FAST❍     EAP-AKANetwork Authentication OpenSee Open Authentication.SharedSee Shared Authentication. WPA-PersonalSee WPA-Personal.WPA2-PersonalSee WPA2-Personal.WPA EnterpriseEnterprise Mode authentication is targeted to corporate or government environments. WPA Enterprise verifies network users through a RADIUS or other authentication server. WPA uses 128-bit encryption keys and dynamic session keys to ensure your wireless network's privacy and enterprise security. An authentication type is selected to match the authentication protocol of the 802.1X server. WPA2 EnterpriseWPA Enterprise authentication is targeted to corporate or government environments. WPA2 Enterprise verifies network users through a RADIUS or other authentication server. WPA2 uses 128-bit encryption keys and dynamic session keys to ensure your wireless network's privacy and enterprise security. An authentication type is selected to match the authentication protocol of the 802.1X server. Enterprise Mode is targeted to corporate or government environments. WPA2 is an improvement over WPA and implements the full IEEE 802.11i standard.

Navigation menu