Appropriate IEEE 802.11 standards for Wireless Local Area Networks (WLANs) should be implemented.

Control Type: Technical

Control Function: Preventive

Today, everybody has an idea of what Wi-Fi is. It allows network connectivity from a wired infrastructure to be provided to clients via radio waves. Most if not all organizations today have a heavy wireless presence. The first part of deploying a stable and secure wireless network is understanding the components and standards at play.

A Basic Service Set (BSS) is a specific instance of a WiFi network where clients connect to a central Wireless Access Point (WAP) providing connectivity. Wireless networks follow the IEEE 802.11 industry standard. All access points providing wireless access make up an organization’s Wireless Local Area Network (WLAN).

Most small office and home networks use a single wireless access point as part of a single “wireless router”. These routers are multi-purpose devices that provide routing, WiFi, unmanaged switching, NAT, and QoS. In a small, contained office space with only a few clients, a single wireless access point can suffice. Larger business networks require a wireless network with more capacity and reach. This involves purchasing multiple individual access points for deployment across the organization’s facilities. In enterprise networking, there are two categories of wireless access points:

  1. Autonomous: these access points perform all services associated with wireless connectivity and management on their own. Every feature needed to run the WiFi network is built into the device.
  2. Lightweight: these access points are standalone devices that pass wireless signals to clients while offloading management to a larger system called a Wireless LAN Controller (WLC).

Enterprises typically use a wireless architecture composed of many lightweight access points managed by a central WLC. The access points are typically powered by Power over Ethernet (PoE) and deployed in a variety of locations, such as on ceilings, walls, and outdoors. The wireless network settings are managed on the WLC, where admins assign an Enterprise Service Set Identifier (ESSID). A regular SSID is the human readable name that lets clients identify the WiFi network. An ESSID allows multiple access points to serve the same WiFi name rather than each providing their own unique WiFi network. Now, users can move throughout the organization and keep using the same WiFi network through roaming. When a client moves out of the proximity of one access point, they seamlessly connect to the next closest one without leaving the network. In addition, admins can specify more granular settings on the WLC, such as pointing the access points to a RADIUS Server for 802.1x authentication and mapping individual SSIDs to specific VLANs (Company Enterprise mapped to Production VLAN, Company Guest mapped to Guest VLAN, Company BYOD mapped to BYOD VLAN).

When procuring wireless access points, organizations need to ensure that the access points meet the appropriate IEEE WiFi standard. Each 802.11 standard provides a different max speed, signal range, and frequency. If an organization is paying for 10GB Internet but only purchases access points that meet standards for 1GB, they will not be able to utilize their internet connectivity to its full capacity. The 802.11 standards for Wi-Fi are listed below.

Wi-Fi StandardGenerationRelease YearFrequencyMax SpeedRange
802.1119972.4GHz2 mbps20m indoor, 100m outdoor
802.11a19995 GHz54 mbps35m indoor, 120m outdoor
802.11b19992.4GHz11 mbps35m indoor, 140m outdoor
802.11g20032.4GHz54 mbps38m indoor, 140m outdoor
802.11nWi-Fi 420092.4/5 GHz600 mbps70m indoor, 250m outdoor
802.11acWi-Fi 520135 GHz6.9 gbps35m indoor
802.11ad201260 GHz6.8 gbps10m indoor
802.11ah2016Sub-1 GHz347 mbpsup to 1km
802.11axWi-Fi 6/6E20212.4/5/6 GHz9.6 gbps30m indoor, 120m outdoor
802.11ay202160 GHz176 gbps10m indoor, 100m outdoor
802.11beWi-Fi 720242.4/5/6 GHz46 gbps30m indoor, 120m outdoor