Archive for December 2005

We'll Need Really Good Software

Posted by: rkassissieh
December142005

If the $100 laptop becomes a reality, it will raise the bar for software performance. This article on preliminary specifications contains some refreshing, non-hysterical commentary on the issues. Two take-away messages include: 1) the $100 laptop will require a new display technology that will likely take longer than people think to invent and test; 2) software developers will have to write more disciplined, innovative software than is currently the standard. The minimal hardware specs will not allow for memory leaks, wasted display real estate, or processor hogs. It's a noble ambition that I truly hope will meet with success.

A/V Equipped Classrooms

Posted by: rkassissieh
December072005

eSchoolNews reports
At least half of the nation's higher-education classrooms will be equipped with digital projectors, control systems, audio or video conferencing equipment, or other audio-visual (AV) technology within the next five years...

The same thing is happening at UHS. Our new building on Sacramento St. will include a data projector, control panel, and speakers in each classroom. The same is true for remodeling classrooms in the main campus. Within two years, we will have A/V systems in all of our classrooms.

Support for A/V systems in classrooms starts with teachers but does not end there. Data projectors are more securely fastened to a difficult-to-reach part of the room than any other A/V device. They also solve the problem of TV carts clogging the hallways and violating fire hazards. Finally, they are multipurpose devices, suitable for all kinds of computer and video presentations.

Now that we have about 15 setups in our school, the maintenance needs of these systems have become clearer. Projector air filters needs to be cleaned regularly, as often as every few months in a dusty environment. The devices also need manufacturer service a lot more often that I had imagined would be the case. We are acquiring a spare mounting bracket so that a loaner may immediately be put in place when a projector must be sent out for service.

As recently as last year, I did not have to concern myself often with projector maintenance and repair. Now I need to count on it, in terms of time, equipment, and budget.

[Edit 12/9/2005]

One more thought. There has been some listserv discussion recently regarding running video over Ethernet to data projectors. Since the network cards increase projector cost by a few hundred per unit, I have decided to wait until the technology is proven. I bet that video over wireless will be much improved not too long from now, eliminating the need to use wires at all. In the meantime, we will use video cables and remote control technology if we choose to display student screens on data projectors.

RADIUS with IAS and Netgear WG302

Posted by: rkassissieh
December022005

Here is the full documentation for our successful integration of Netgear WG302 wireless access points with Windows 2000 IAS server. Thank you to Richard Bender for writing this up and those who sent me requests for these notes.

Notes on Setting up RADIUS on IAS to use MAC addresses as User IP's

Equipment:
Netgear WG302 ProSafe 802.11g Wireless Access Point
Windows 2000 Server running IAS (Internet Authentication Service)

Situation:
The Netgear ProSafe WG302 provides MAC address filtering for up to 256 MAC addresses. However, if you use multiple WAP's updating them and managing the address list becomes very time consuming. Having a central management point (ie a RADIUS server) would be a perfect solution to this problem.

Why lAS?
If you are running a Win2K server based network it's free and it ties into AD.

The Problem:
Make the WG302 interface with the IAS server so that you can control wireless network access via MAC address filtering.

How to set this up:
Install IAS
On the Win2K server that you intend to use for this add the LAS service
Add/Remove Programs/Windows Components/Networking Services
The IAS MCC will then show up in the Administrative Tools Window

Configure IAS
Register Service in AD so that it can authenticate users and computers
Right-click the root of the tree pane, Internet Authentication Service (Local), and select Register server in Active Directory
Add Clients
Open the IAS MCC\Clients folder
Add your WAP's as clients
Need IP address of each WAP and "shared secret" authentication key
Set up Log File
Don't neglect this, these files can get huge quickly.
Set up Remote Access Policies
At least look at the default policy
(our policy is to grant anyone in the Wireless Access security group remote access)

Configure AD (the tricky part)
Create an OU for MAC Addresses (recommended)
Create a new User in that OU
The user name is the MAC address you wish to add without spaces, hyphens, or periods
Advice: put the MAC address in using lower case letters, then copy it to the clipboard

****CRITICAL STEP****
The user password is the MAC address and you must use lower case letters.
The WG302 sends the MAC address to the IAS server in lower case. If you use upper case letters in the password authentication will fail. Finish tocreate the new account.
Tweak the New Account
Important:
Set membership into a security group that will have remote access (we put all these accounts into a Wireless Access group) or grant user Dial Up access
Optional:
Add the users name in the Description field on the General tab. Add some sort of sorting info into the Office field on the General tab.

Configure the WG302 WAP units Browse to each unit and: Go to the RADIUS Server Settings screen
Set the IP address of the RADIUS server
The port should be 1812 unless you are doing something custom
The "shared secret" authentication phrase is the one you put in earlier on the
IAS server. Go to the Access Control screen
Turn Access Control on
Select Access Control Database: RADIUS MAC Address Database
Reboot the unit

Now when you bring a wireless system, that has an address you have put into the Win2K AD, into range of the WAP it should transparently authenticate against the LAS RADIUS server and get an IP address from your DHCP server. You should see entries like this in your event log:
User 009099blf732 was granted access.
Fully Qualified User Name = domain name/OU/009099blf732
NAS-IP-Address = WAP IP Address
NAS Identifier = WAP MAC Address (don't use this as a template, it is lower case but it uses hyphens)
Client-Friendly Name = WAP name
Client-IP-Address = WAP IP Address
NAS-Port-Type = 19
NAS-Port = 47
Policy-Name = This is the name of the policy set in LAS for remote access users
Authentication-Type = PAP (in our case)

This is useful because it allows you to scan the log and see if each WAP is working. We have found that the new firmware for the WG302 is not perfect (but hey, the first round wouldn't even talk to a RADIUS server) and that occasionally a WAP will "hang" and not communicate with the RADIUS server. Rebooting the unit fixes the problem. For extra style points you could probably write a script that would reboot the units every night to be proactive.