2. WPA-LEAP 1. WPA - PSK

WPA - Setup for the Wireless Printers

Tabletop printers with the Wireless Option can be configured to use WPA-PSK or WPA-LEAP. When configuring the printers for WPA one needs to remember that the settings on the printer need to match those on the access point. The first scenario uses PSK (Pre-Shared Key): WPA-PSK is a special mode of WPA ,usually for the home users without an enterprise authentication (radius) server. PSK uses encryption where the keys are automatically changed and authenticated between devices after a specified time or after a specified number of packets have been transmitted.

_______________________________________________________________________________

The following is an example setup using WPA-PSK , a Cisco 1200 Access point and a Zebra printer. Cisco 1200 Access point setup: Under Encryption manager Choose Cipher then TKIP (Temporal Key Integrity Protocol) The Temporal Key Integrity Protocol takes over after the initial shared secret is entered in the wireless devices (printer and access point) and handles the encryption and automatic “re-keying”

Typical setup for the Security/ Encryption manager parameters below:

Under SSID Manager Choose the corresponding SSID and click on WPA under authenticated Key management. Enter a key (This is the key that the printer needs to be configured with)

After making these changes REBOOT the Access point

________________________________________________________________________ The printer needs to match the settings of the Access Point. The Wireless Setup Wizard in Zebra Net Bridge Enterprise v1.2 or higher is the typical way of configuring the wireless connectivity options on a tabletop printer. Click on Tools – Wireless Setup Wizard. See the ZebraNet Bridge User’s Guide for full details on using the Wireless Setup Wizard. Enter the same data as you did with the access point. (In this example, the printer is configured to use WPA-PSK, an ASCII Pre-shared key is entered and the Access points’ ESSID is entered)

The following is a typical successful association entry in the log on the Access point showing the printer successfully associated using WPA PSK

The next example is using WPA with LEAP: LEAP is a Cisco-proprietary 802.11 wireless encryption technology designed around mutual authentication between a wireless client and RADIUS server. A typical radius server in use today is FUNK STEEL BELTED RADIUS. Radius servers require a username and password from the wireless client that is passed to the radius server via the access point. LEAP requires clients to re-authenticate frequently and provides dynamic per-user/per-session encryption keys. LEAP is typically used by enterprise customers, and LEAP security is widely implemented in large-scale IT environments. http://www.cisco.com/en/US/products/hw/wireless/ps4555/products_qanda_item0900aecd801764f1.shtml Configuring the Access point for WPA –LEAP one needs to modify the Authentication method to include “with EAP”

LEAP uses an authentication server to verify usernames/passwords and the authentication server (RADIUS server) information needs to be entered into the access points settings. ( In this example the Radius servers IP address is 10.3.50.10 and a “secret key” has been entered. This “secret key” must match that of the RADIUS server. ) By default many radius servers use port 1645 for authentication.

Wireless Setup Wizard setup of WPA with LEAP authentication

This username/password needs to be entered in the radius servers user table. The following screenshots are utilizing Funk Steel Belted Radius. Note: ZebraNet Bridge Version 1.2 also turns on standard LEAP when setting up WPA-LEAP. This is incorrect. The Cisco card will work with this but not the Symbol LA-4137 CF card. After sending the ZPL to the printer, one can correct this by sending the following to the printer. ! U1 setvar "wlan.leap.mode" "off"

Version 5.02 below Note: The examples from Steel Belted Radius server were taken from the setup of a mobile printer but the key points remain the same.

The radius server needs to include the Access point as a client and the “secret key” on the radius server must match that that was entered on the access point.

Version 5.02 below

If one is utilizing FUNK Steel Belted Radius Server, insure that the EAP.INI file contains the following entries [Native-User] EAP-Only = 0 First-Handle-Via-Auto-EAP = 0 EAP-Type = LEAP The EAP setup with version 5.02 can be done through the GUI

Troubleshooting with steel belted radius can be done by modifying the radius.ini file Loglevel = 1 Tracelevel = 1 (Anytime these .ini files are modified the service needs to be restarted) The (date) .log file can be used as a troubleshooting tool.