Honeywell 7900LU0, 7900BU0, 7900LUP, 7900BUP User Guide

Client Configuration Area

Each user account needs to define the protocol and the credentials used to authenticate a user. Because Windows Mobile
devices are usually small devices with a single NIC and, usually, a single user, the initial configuration is usually the only time
the software needs to be set up. The Client will need to be reconfigured if the device is used on multiple networks, or if different
users share the computer.

Note: Fields are be grayed out if not relevant to the selected protocol.

Accessing the Client Configuration Area

On the main screen, tap Client > Configure (see Client Menu on page 9-17). The Client Configuration screen opens displaying
the User tab.

On this tab, You…
User Settings Tab Configure authentication credentials and profiles.
System Settings Tab Set the level of detail that the Client will provide in the system log and zero-config options.
Server Identity Tab Control how the Client authenticates the server that handles the 802.1X protocol on the network side.

This applies only to the TLS, TTLS, and PEAP authentication methods and is used to tell the Client
what server credentials to accept from the authentication server to verify the server.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 21

User Tab

The User settings tab defines the protocol and the credentials used to authenticate a user.

Field Description
Profile

Multiple user credential profiles can be created for use when the user roams from one network to another.
The drop-down list contains existing authentication credential profiles. Select a profile from the list to edit
it in the fields that follow.

Tapping Add permits new profiles to be added to the list. A
screen appears where you can enter a name for the new
profile.

Enter a Profile name and tap OK. The name entered appears
in the Profile drop-down list.

Tapping Delete deletes authentication profiles. To be deleted,
a profile cannot be assigned to a configured network.

Identity

This is the 802.1X identity supplied to the authenticator. The identity value can be up to 63 ASCII
characters and is case-sensitive.

For tunneled authentication protocols such as TTLS and PEAP, this identity (called the Phase 1 identity)
is sent outside the protection of the encrypted tunnel. Therefore, it is recommended that this field not
contain a true identity, but instead the identity “anonymous” and any desired realm (e.g.
[e-mail]). For TTLS and PEAP, true user credentials (Phase 2 identity) are entered
in the Tunneled authentication section.

Note: When used with PEAP and the .NET Enterprise Server Version 5.2, this field must contain the

identity used in both Phase I and Phase II. The Phase II identity field is ignored.

Password

Authentication
type

This is the password used for MD5-Challenge or LEAP authentication. It may contain up to 63 ASCII
characters and is case-sensitive. Asterisks appear instead of characters for enhanced security.

This is the authentication method to be used - MD5-Challenge, LEAP, PEAP, TLS, or TTLS.
Your network administrator should let you know the protocols supported by the RADIUS server. The

RADIUS server sits on the network and acts as a central credential repository for Access Servers that
receive the radio signals and ultimately block or allow users to attach to the network.

9 - 22 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

Field Description
Use certificate

This is the certificate to be used during authentication. A certificate is required for TLS, optional for TTLS
and PEAP, and unused by MD5 and LEAP. Therefore, this option becomes active only when TLS, TTLS,
or PEAP is selected as the Authentication type.

If Use certificate is enabled, the client certificate displayed in the field is the one that is passed to the
server for verification.

To select a client certificate, tap Change and select the
certificate from the list that appears.

To appear in this list, certificates must be installed in the
system, for a description of this process see Installing

Certificates with CertAdd on page 9-32.

The Issued to field should match the Identity field and the user
ID on the authentication server (i.e., RADIUS server) used by
the authenticator.

Your certificate must be valid with respect to the authentication server. This generally means that the
authentication server must accept the issuer of your certificate as a Certificate Authority.

Note: When obtaining a client certificate, do not enable strong private key protection. If you enable

strong private key protection for a certificate, you will need to enter an access password for the
certificate each time this certificate is used.

Tunneled authentication area

Tunneled authentication parameters are used by only by TLS, TTLS and PEAP protocols, in Phase 2 of authentication, and
after the secure tunnel has been established. The fields in this section are active only if the TLS, TTLS, or PEAP is selected
as the Authentication type.

Identity

The user identity used in Phase 2 authentication. The identity specified may contain up to 63 ASCII
characters, is case-sensitive and takes the form of a Network Access Identifier, consisting of <name of
the user>@<user’s home realm>. The user’s home realm is optional and indicates the domain to which
the tunneled transaction is to be routed.

Note: Because Microsoft .NET Enterprise Server Version 5.2 does not use this parameter for PEAP,

This field will have no effect for PEAP at this time. Phase 1 identity is used instead.

Password

Protocol

The password used for the tunneled authentication protocol specified. It may contain up to 63 ASCII
characters and is case-sensitive. Asterisks appear instead of characters for enhanced security.

This parameter specifies the authentication protocol operating within the secure tunnel.
The following protocols are currently supported for TTLS: EAP-MD5, CHAP, PAP, MS-CHAP and MS-

CHAP-V2.
The following protocols are currently supported for PEAP: EAP-MS-CHAP-V2, TLS/SmartCard, and

Generic Token Card (EAP-GTC).

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 23

System Tab

The System Settings tab controls logging and the port manger timeout period.

Field Description
Log Level

Defaults Tap this button to return log settings to the default settings.
Disable Wireless

Zero Config

Port Manager
Timeout

These settings control the detail of the log messages generated by the Client. Each level is cumulative.
By default, all errors, warnings, and information events are logged. Each entry records a severity code
(of one [debug message] to four [error] asterisks), a time stamp, and a message.

Errors - only the most severe conditions are logged.
Warnings - less severe conditions are logged.
Information - all errors, warnings, and information events are logged. This is the default setting.
Debugging - creates a log message each time the Client detects or reacts to an event. Be advised

that log entries fill memory quickly if the Debugging level is chosen. Do not use the Debugging option
for a significant length of time because most internal operations generate messages.

Use this option only as directed by technical support.
Selecting this option disables other wireless utilities whether the Client is running or not. If not selected,

other wireless utilities cannot apply their settings to the wireless card while the Client is running
(although their status displays are usually unaffected). You will need to perform a soft reset whenever
this setting is changed.

The interval at which the client polls the ports. This is used under different circumstances, for instance
after physical changes such as card removal or insertion have been detected. This value should not
be changed from the 10-second default unless so advised by technical support.

9 - 24 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

Server Tab

The Server identity tab defines the credentials the client uses to authenticate the server during TLS/TTLS/PEAP authentication
message exchange. The Client uses this information to verify that the Client is communicating with a trusted server.

Field Description
Do not validate server

certificate chain
Certificate issuer

must be

If this option is selected, the server certificate received during the TLS/TTLS/PEAP message
exchange is not validated.

This is the certificate authority used during TLS/TTLS/PEAP message exchange. Any Trusted
CA is the default selection and means that any certificate authority can be used during
authentication.

Allow intermediate
certificates

Server name must be

Must match exactly

Must contain domain
name

Both trusted intermediate certificate authorities and root authorities whose certificates exist in
the system store are available for selection in the drop-down list.

This option is selected by default and enables unspecified certificates to be in the server
certificate chain between the server certificate and the certificate authority selected in the
Certificate issuer must be field.

When selected, this option allows the server certificate received during negotiation to be issued
directly by the certificate authority or by one of its intermediate certificate authorities.

If disabled, then the selected Certificate issuer must have directly issued the server certificate.
This is either the server name or the domain the server belongs to, depending on which option

is selected below the text field.
During authentication, this name will be compared to the server certificate’s Subject: CN field.

When selected, the server name entered must match the server name found on the certificate
exactly.

When selected, the server name field identifies a domain and the certificate must have a server
name belonging to this domain or to one of its sub-domains (e.g., zeelans.com, where the
server is blueberry.zeelans.com).

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 25

Port Settings Area

In the Port Settings area, you configure network parameters for each port listed on the main screen; see Main Screen on page

9-17.

1. On the main screen, tap and hold on a port. The Port popup menu appears; see Port Menu on page 9-20.

2. Tap Configure. The Port Settings Configuration screen opens displaying the Wireless Networks tab.

On this tab, You…
Wireless Networks Tab Set the parameters for Network APs and underlying protocol.
Protocol Tab Configure common protocols that apply to any network the port connects to.

9 - 26 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

Wireless Networks Tab

Field Description
Available Networks Section

This section displays the networks the terminal recognizes as available to connect to. When the Client is first installed, there
are no entries in the Available Networks list.

Scan

Tap this button to see a list of networks broadcasting their availability.

Note: You can also attach to networks who are not broadcasting.

Move to
Configured

Configured Networks section

This section displays the networks your terminal is connected to. This section enables you to add or remove networks as well
as review and edit the properties of existing configured networks.

Default

Up Tapping this button moves a selected network up one place in the list.

This button activates only after Scan has been tapped and available networks have been retrieved.
In the list of networks retrieved, select the network you wish to connect to, and tap Move to Configured.

This selects the network, which now appears in the Configured Networks section.

When the Client is first installed, there is a Configured Network named "default" in the list. This profile has
Associate with any network selected in its Properties selection screen.

If you are going to be in a location with only one AP (or more than one AP that attaches to the same
network), the default profile may be sufficient for you needs, without necessitating the selection of a specific
network or networks.

If default is last in the list, it can act as a wildcard should you be out of the range of your primary networks
(which are listed first). Do not place default at the top or middle of the list because, if it is, connection to the
other list entries will never be attempted.

Down Tapping this button moves a selected network down one place in the list.

Note: The order of the networks in this list is the exact order that connections will be attempted. The

network listed first will be attempted first and so on. Place your primary networks first.

Add

Remove Tap this button to remove a selected network in the list.

Tap this button to manually add a network to the Configured Networks list if

• the AP does not broadcast its SSID or

• you are pre-configuring the client for an AP that is not currently in range.
For more information, see Adding a Wireless Network Configuration on page 9-29.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 27

Field Description
Properties

Protocol Tab

The Protocol tab enables you to configure parameters that will apply to all the networks the selected port connects to.

Tap this button to review the properties of a network selected in the list. This button opens the same network
configuration screen as the Add button does; use it to edit network configuration properties.

Field Description
Protocol

Settings

Display EAP
notifications

Renew IP
address

These are the timer intervals and retry settings defined in the 802.1X standard. They determine how long
the supplicant state machine will wait in a given state. These parameters shouldn’t be modified without
an understanding of the supplicant state machine. For more information about the supplicant state
machine, obtain its 802.1X protocol specification.

The parameters are:

• Authentication Timeout - The period of time the Client remains in the authenticating or acquired
state without receiving a response from the AP or switch.

• Held Timeout - The period of time the Client remains in the held state after failing authentication.

• Start Timeout - The period of time the Client remains in the connecting state before restarting when
there is no response.

• Number of Start Attempts - The number of times the Client restarts before giving up. At that point,
the Client then defaults to the authenticated state, but there will be no network connectivity because
the protocol exchange was never completed.

This option specifies that the EAPOL notification message will be displayed to the user. An authenticator
may use such notification to inform you, for example, about a near password expiration. However, some
authenticators send chatty and annoying notifications that may, for the convenience of the user, be
suppressed. Note that all notifications are written to the event log even if they are not displayed.

Select this option to initiate a DHCP request to obtain a dynamic IP address after a successful
authentication, but only if the client detects that the connected network (the SSID) has changed. The
result is that renewal should not occur upon re-authentication, but does occur at boot or when connecting
to a different network. If you have a slow authenticator, you may wish to enable this option when
configuring the service because a slow authenticator may prevent you from getting a DHCP-assigned IP
address upon boot-up. This option is ignored if the given adapter has a static IP address.

9 - 28 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

Adding a Wireless Network Configuration

To add a wireless network configuration, on the main screen, tap and hold on the port, tap Configure on the Port popup menu,
then tap Add in the Network Configurations section of the Wireless Networks tab. The Network Profile screen opens displaying
the Profile Info tab.

Profile Info Tab

Field Description
Network Profile

Network Name

Peer-to-Peer
Group (ad hoc
mode):

Do active scan
Authentication

Profile

Enter the name of this record. This is the name that appears in the Configured Networks list and, by
default, is the same as the broadcast SSID. Note that there is nothing special about the name "default".
You could configure any other record similarly and it would behave the same way.

This is the SSID of the AP. If the AP broadcasts its SSID, then this value may be derived from the
Available Networks list. If the SSID does not broadcast, then you must manually enter the value here.

Select this option to have two or more client workstations communicate with each other without the
benefit of an AP. You should also select Do Active Scan and, in the WEP Management page, enable
Use key for data encryption while entering a common key for both sides . WPA is not supported in this
mode.

Select this option whenever the AP (or client, for ad hoc mode) is not broadcasting its SSID.
Select the Client Configuration (user) profile associated with this network. The drop-down list contains

client profile names created in the User tab of the Client Configuration Area; see User Tab on page 9-

22.

To open the selected profile, select it in the drop-down list and tap View. The User tab opens displaying
the profile details. If you tap OK (to save changes) or Cancel, you are returned to the Profile Info tab.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 29

WEP Mgmt Tab

The WEP Mgmt tab enables you to set WEP parameters for each port.

Note: The settings on this tab window are interrelated. This means that selecting one may disable access to others.

Field Description
Provide encryption

key dynamically
Use key for data

encryption
Use key to

authenticate with AP

Key

Key Index/Transmit
Key

This option is selected by default. If this option is selected, the other WEP settings on this page
are disabled. To enter a custom WEP, de-select this option. The other fields become active.

Select this option to manually enter a WEP key to encrypt your data to the AP. You enter that
key in the Key field below.

Select this option if your network does not support 802.1x authentication and you need to
connect to the AP without username and password authentication. The key entered below is
used to authenticate instead.

In this field, enter the WEP key:
ASCII - 5 or 13 characters
Hexadecimal - 10 or 26 characters.
When the key entered is in the correct format, the

screen changes to display the type - ASCII or
Hexadecimal.

The Key Index drop-down list contains the available keys. You may enter up to four keys for
reception; the Client will try all four to find one that works with the AP.

From the drop-down list, select the key to be used for transmission as well. If the key selected is
the transmit key, the Transmit key box is checked.

To change the transmit key, select another key and check the Transmit key box. The check box
of the original transmit key will be automatically de-selected.

9 - 30 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

WPA Settings Tab

The WPA Settings tab enables you to configure WPA settings.

Field Description
WPA Mode

PSK pass-phrase

This drop-down list contains the following options:

• Disabled - Do not enable WPA mode. This is the default selection.

• WPA 802.1x - Enable WPA and obtain key information through the 802.1x protocol.

• WPA PSK - Enable WPA with Pre-Shared Key (PSK) information entered in the field below.
This mode is used if the 802.1x protocol is not being used for authentication.

This field activates if you select WPA PSK in the WPA Mode drop-down list.
Enter between 8 and 63 characters for your pass phrase. Asterisks appear as you type for

increased security.

Logging

The event log is an ASCII text file named “LOG8021X.TXT” located in the directory defined by the WINDIR environment variable
(usually the Windows directory). The information the log records is determined by the log settings on the System tab of the Client
Configuration Area; see System Tab on page 9-24.

The format of the entries is

Time Stamp Message Text

The Refresh button at the bottom of the screen is used to update the log file while you are reading it. If the file gets too large, old
entries are automatically deleted.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 31

If you wish to start with a blank file, exit from the Client (so the icon no longer appears at the lower right of the screen) and delete
the log file (log8021x) in File Explorer; see Finding and Organizing Information on page 4-12.

When you restart the Client, a new log file is created.

Installing Certificates with CertAdd

Certificate Requirements

During configuration, you may have specified one or two certificates to use during the authentication process. The specified
identity should match the Issued to field in the certificate and should be registered on the authentication server (i.e., RADIUS
server) that is used by the authenticator. In addition, your certificate must be valid on the authentication server. This requirement
depends on the authentication server and generally means that the authentication server must know the issuer of your certificate
as a trusted Certificate Authority.

If the selected certificate does require a password or pass phrase to decode the private key, enter this value in the “Certificate
Pass Phrase” field. This value will be encrypted when the configuration is saved. However, on some systems, there may not be
a certificate. If that is the case, you can use the section below as a primer on OS X certificate management.

About CertAdd

CertAdd is a stand-alone utility included with the Client that allows certificates to be selected and installed on a Windows Mobile
device.

Installing Certificates with CertAdd

Client or Certificate Authority (CA) certificates can be imported from *.cer (same as *.der), *.p7b, or *.pfx files.

1. Download the certificate file to the My Documents folder. The location isn’t critical, although you may want to create a stan­dard folder for consistency.

9 - 32 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

2. Go to Start > Programs > Meetinghouse Certificate Installer. The opening screen is displayed. All valid certificate file
types located in the My Documents folder appear in the list.

3. Tap and hold on a certificate in the list. A pop-up appears asking if you want to install the certificate.

4. Tap OK. The certificate is loaded into the correct certificate store.

Advice and Workarounds

Issue Possible Causes and Solutions

The Client will not start on the device with an
error message about missing files.

The wireless network interface (port) does not
appear in the main AEGIS screen.

The wireless network interface appears, but
when I select it and go to the "configure" menu,
the Scan button is disabled.

The client is not attaching to the correct AP. The default network profile instructs the client to attach to the first

Perform a soft reset.

• The license is not valid (If you have entered a time-limited license, is
your clock on the device correct?).

• Restart the client - on the main screen tap Client > Restart.

• Perform a soft reset.

• If the radio is turned off or the radio card is not present, this will
sometimes cause the port name to not appear.

• If the radio driver is very old and does not support NDIS 5.1
commands, the Client may not be able to detect it.

Power up the radio; see Enabling Radios and Radio Combinations on
page 4-7.

available AP. You must select a network, move it to the Configured
Networks list, and then move it above default in the list using the up
arrow buttons.

For more information, see Wireless Networks Tab on page 9-27.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 33

Advice and Workarounds

Issue Possible Causes and Solutions

The Client is failing authentication even though
all my information was entered correctly.

My AP does not broadcast its SSID. Even
though I have manually configured an AP with
that name, the Client won't associate with it.

I am authenticated, but I don't get an IP
address through DHCP.

I cannot attach to my old network that does not
support 802.1x authentication, but is using
WEP encryption.

I made changes, but they do not appear to ha ve
taken effect.

How do I enable peer-to-peer (ad-hoc) mode to
have two clients communicate without an AP?

1. Verify that the network profile for the AP corresponds to the authenti-

cation profile you created for it.

• Select the network profile in the Configured Networks list.

•Tap Properties. The Profile Info tab opens - see page 9-29.

• In the Authentication profiles drop-down list, select the profile
you want to review.

•Tap View. The User tab appears displaying the profile’s
information.

2. Verify that you have configured the identity and password into the
correct fields on the User tab (page 9-29) in the authentication
profile. If you are using PEAP or TTLS, the username and password
are entered in the Tunneled authentication section.

• Make sure that the desired SSID is listed as the Network Name, not

the Network Profile (which is a screen label)

• Verify that Do Active Scan is selected on the Profile Info tab; see Do

active scan on page 9-29. Otherwise, the Client will not attempt to find

the AP.

On the main screen, tap and hold on your AP, tap Configure on the
popup menu, and select the Protocol tab. Verify that Renew IP Address
is selected; see Renew IP address on page 9-28.

• Verify that you can see your SSID in the Available Networks list on the

Wireless Networks tab. Move the SSID to the top of the Configured
Networks list so that it is accessed first. If the SSID is not there, you
can add it manually and enter the SSID as the network name - page

9-27

• Select the SSID and tap Properties.

• On the Profile Info tab, select Do active scan if your AP does not

broadcast its SSID.

• On the WEP Mgmt tab, select Use key for data encryption and Use

key to authenticate with AP.

• Enter the WEP Key - see Key on page 9-30.

• On the Protocol tab, select Renew IP Address (unless you have

entered one manually separate from the Client)

• Note that the port status indicator in the main screen reads

"Associated," not "Authenticated" when the connection is complete;
although the log file will indicate "Entered AUTHENTICATED state."

Always tap OK before exiting a screen you have changed. Then restart
the Client from the Client menu on the main screen.

• On the Wireless Networks tab, add a new profile to the Configured

Network list.

• On the Profile Info tab, give each side the same network name (SSID).

•Select Peer-to-Peer Group (ad hoc mode) and Do active scan.

• On the WEP management section, select Use key for data encryption

and enter an identical key for both clients.

• Verify that this network profile is the first (or only) one in the

Configured Network list and try to restart both clients at roughly the
same time.

9 - 34 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

How 802.1X Works

The network elements in the above graphics are those involved in a typical wireless LAN. When 802.1X is running, a wireless
device must authenticate itself with the AP in order to get access to the Existing LAN. With respect to the terms used in the 802.1X
standard, APs (APs) function as authenticators and wireless devices function as supplicants. The authenticator keeps a control
port status for each Client it is serving. If a Client has been authenticated, its control port status is said to be Authorized, and the
Client can send application data to the LAN through the AP. Otherwise, the control port status is said to be Unauthorized, and
application data cannot traverse the AP.

Typical Message Exchange Using MD5 or TLS

The above graphic displays the typical message exchange when the device and the AP support 802.1X. When an AP acting as
an authenticator detects a wireless station on the LAN, it sends an EAP-Request for the user's identity to the terminal. In turn,
the terminal responds with its identity, and the AP relays this identity to an authentication server, which is typically an external
RADIUS server.

The RADIUS server can then act as a central repository of user profile information. Such use of a centralized authentication
server allows the user to access wireless LANs at many different points, but still be authenticated against the same server. In
response to the Access-Request, the RADIUS server sends an Access-Challenge to the AP, which is then relayed in the form of
an EAP-Request to the device. The device sends its credentials to the AP, which in turn relays them to the RADIUS server. The
RADIUS server determines whether access to the network is accepted or denied based on the Client's credentials.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 35

Typical Message Exchange Using TTLS and PEAP

The above graphic shows a typical message flow for a TTLS transaction. TTLS authentication comprises two phases. In Phase
1, TLS is used to authenticate the TTLS server to the client. The TTLS server may optionally request authentication of the client's
certificate, but by default the client verifies only the server's certificate. The TLS handshake is negotiated between the client and
the TTLS server. Following the TLS handshake, Phase 2 may proceed using a secure channel (tunnel) provided by the TLS
record layer. The secure tunnel is then used to exchange information for the negotiation of the following legacy protocols: EAP­MD5, PAP, CHAP, MS-CHAP, or MS-CHAPV2 (subject to support by the AAA server). A TTLS server may perform the
authentication, or the information may be de-tunneled and passed on to an AAA server. The AAA server is the server in the user's
home domain where authentication and authorization are administered.

PEAP works in the same manner as TTLS. However, supports different legacy protocols within the encrypted Phase 2 tunnel.
Currently the tunneled protocols are EAP-MSChapV2 and EAP-TLS/SmartCard. Like TTLS, the use of a client certificate is
optional, if one is used, the same certificate is used for Phase 1 and Phase 2. The client certificate is optional for both phases.

Benefits of 802.1X

Central User Administration

The Client allows network administrators to continue to use RADIUS or another AAA server as their centralized authentication
server. In 802.11b, where authentication took place between the AP and the station, there was no concept of passing credentials
from the AP to an authentication server. For LANs this was fine. However, as users began to use their devices in remote
locations, the security provided became inadequate. 802.1X solves this problem by allowing APs to pass client credentials to the
appropriate authentication server.

9 - 36 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

For example, the following graphic displays the authentication flow for a mobile
user who wishes to create a virtual private network with his home office.

By using the Client, the user can associate with a wireless network provided by
a third party, in this case the ISP. We assume that the company and the ISP
have established a service relationship beforehand. When the ISP receives the
user's credentials, the ISP proxies the credentials to the company's AAA server,
which returns a message telling the ISP to either accept or deny the user
access. This response is then propagated to the remote user.

Dynamic Session Specific Wireless Encryption Keys

There have been many published reports recently about the lack of security provided by the Wired Equivalent Privacy (WEP)
protocol. One of the problems with WEP is that the shared key used by the station and the AP is inherently static. That is, this
shared key will only change if it is manually reconfigured on both devices. The Client remedies this by supporting the Transport
Layer Security (TLS) protocol. TLS ensures that a new shared key is generated each time a station associates itself with an AP.
TLS has proven itself an excellent authentication and encryption protocol in commercial environments. The Client also supports
the MD5 and TTLS security protocols.

Additional Advantages of TTLS and PEAP

The Client provides the advantage of Tunneled TLS (TTLS) and PEAP support. These protocols provide the security of TLS
with greatly reduced administrative load. Security is enhanced by never passing user ID and password in the clear. No "real" user
ID or password is required in Phase 1. After the secure tunnel is established, Phase 2, user credentials are passed in safe,
encrypted form. To further enhance security, the WEP keys, which encrypt the data between the wireless card and the AP, may
be automatically changed on a per-session basis, limiting the time available to an unauthorized sniffer to crack the keys. By
limiting the session time (the reauthentication period), the keys can essentially be made uncrackable.

Administration is eased by greatly reduced certificate requirements in comparison to TLS. In TLS, each client must have a client
certificate to pass to the server, and a CA certificate with which to verify a server certificate, while the server must have a client
certificate from each user and CA certificates for each possible CA chain and its own server certificate. TTLS and PEAP require
only that a single server certificate be created for the server to present to the client, and that the client have a CA certificate to
verify the server. Because these are the same for each client on the network, they are easily managed, unlike TLS, where every
client certificate is unique. TTLS and PEAP thus provide the security of a TLS channel without the need for managers to distribute
and manage client certificates. Lastly, TTLS allows for the use of existing legacy authentication protocols. Administrators may
continue to use established authentication databases.

Cisco LEAP

The message exchange used by Cisco LEAP is proprietary. This protocol is not a standard EAP type, but is supported by the
Client through a licensing arrangement with Cisco.

Relative Merits of Authentication Protocols

MD5 is the least secure of the EAP protocols as it only does a one-way authentication, and does not support automatic
distribution and rotation of WEP keys, increasing the administrative burden of manual WEP key maintenance.

TLS, while the most secure EAP protocol, requires client certificates to be installed on each wireless client. Establishing and
maintaining this PKI infrastructure is normally a burden most administrators do not feel is worth the extra level of security gained.

TTLS and PEAP bypassed the certificate issue by tunneling TLS, and thus eliminating the need for a certificate on the client side.
PEAP supports only EAP-compliant authentication protocols within the tunnel structure, and is rapidly becoming the most widely
supported of the EAP methods. TTLS supports pre-EAP authentication protocols within the tunnel structure, and should be used
in those circumstances when pre-EAP interior protocols are desirable.

LEAP is a pre-EAP, Cisco-proprietary protocol, with many of the features of EAP protocols. Cisco controls the ability of other
vendors to implement this protocol, so it should be selected for use only when limited vendor choice for client, access-point, and
server products is not a concern.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 9 - 37

Differences Between Protocols

Security Feature MD5

Challenge

Client -side certificate required? No Yes No No No
Server-side certificate required? No Yes No Yes No
Dynamic WEP Re-keying No Yes Yes Yes Yes
Mutual or One-way Authentication? One-way Mutual Mutual Mutual Mutual
Support of non-EAP protocols within

a secure tunnel?
Relative Deployment Complexity Simple Difficult Moderate Moderate Moderate
Relative Security Poorest Highest High High High

N/A N/A Yes No N/A

TLS TTLS PEAP LEAP

9 - 38 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

10

Wireless PAN Communications with Bluetooth

Overview

Dolphin 7900 terminals are available with a Bluetooth radio for WPAN (Wireless Personal Area Network) usage. When the mobile
computer is first initialized, the *.cab file and module for Bluetooth are installed.

Enabling the Bluetooth Radio Driver

Before using the radio, make sure that the Bluetooth radio is enabled. When the radio driver is enabled, the Bluetooth icon
appears in the task tray on the Today screen.

Radios are enabled in the Radio Manager utility; see Enabling Radios and Radio Combinations on page 4-7.

Setting Up Your Bluetooth Card

Note: If you use the Get Connected! Wizard, which is recommended for normal usage, then this step is not necessary. This step

would be used to change the friendly name of your mobile computer.

1. Tap the Bluetooth icon that appears in the task tray on the Today screen.

2. In the pop-up menu, select Advanced Features, then My Bluetooth Device. (If you installed OBEX, the menu also lists
Transfer via Bluetooth.)

3. In the My Bluetooth Device screen, you can modify the Friendly Name and make any desired configuration changes.
When done, tap OK.

• In normal phone connect operation, Discoverable mode is not needed and should be disabled.

• If you do enable Discoverable mode (e.g., for ActiveSync), note that it does not shut off by itself. To save power, remember

to disable it when not needed.

• Connectable, Use Authentication, and Use Encryption are also not required for printing or dial-up networking applications.

• Check Use Authentication to enable the Use Encryption option.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 10 - 1

Assign COM Ports

Follow these steps to view and/or modify the Bluetooth COM ports. If you are not going to use the IrDA port, you can disable it
to free up a port for Bluetooth devices; see Using Infrared on page 8-5.

1. Tap on the Bluetooth icon on the Today screen. Select Advanced Features then My Bluetooth Device.

Note: If you installed OBEX, the menu also lists Transfer via Bluetooth.

2. The My Bluetooth Device screen appears. Tap on the COM Ports tab.

3. As needed, view and/or enable/disable the Bluetooth COM port assignments. Tap OK.

Note: The Bluetooth Phone port cannot be disabled. For more information about COM ports, see Com Port Assignment Table

on page 7-20.

Discover Bluetooth Device(s)

Follow these steps to discover other Bluetooth devices nearby, including non-phone devices. The Device Discovery Wizard is a
more detailed alternative to using the Bluetooth “Get Connected!” Wizard or Bluetooth ActiveSync or Bluetooth LAN Access
options. The Device Discovery Wizard allows you to discover any type of Bluetooth device.

1. If not open, launch the Bluetooth Devices folder. Tap on the Bluetooth icon on the Today screen. Select Advanced Fea-
tures then Bluetooth Devices.

2. In the Bluetooth Devices Folder, tap on the Device Discovery icon. Or you can tap on Tools. In the pop-up menu, select
Device Discovery.

10 - 2 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

3. Follow the Bluetooth Device Discovery Wizard to search for Bluetooth devices nearby. When prompted, select the device
type you seek.

4. When the search is complete, a screen reports the discovered Bluetooth devices. Check the box next to any device you
wish to save information about, (i.e., any devices you wish to connect to). Tap Next.

5. A service discovery phase begins, 5-10 seconds per chosen device.

6. In the next screen, tap Finish.

Bond With Discovered Device(s)

Follow these steps to bond with an already discovered Bluetooth device. In most cases, bonding is for establishing secure
communications with a Bluetooth-enabled phone. This is a more detailed alternative to using the Bluetooth “Get Connected!
Wizard.”

Important!

• Do not try to bond with a Motorola Timeport 270C or Nokia 6310!

• Do not use this method to bond with a printer! The third-party printing software included on the installation CD also handles

bonding.

1. If not open, launch the Bluetooth Devices folder. Tap on the Bluetooth icon in the Today screen. Select Advanced Fea-
tures, then Bluetooth Devices.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 10 - 3

2. Tap and hold your stylus on the Bluetooth device you want to bond with. In the pop-up menu, select Bond.

3. Alternatively, after selecting a device, tap on the Bond icon. Or tap on Device, then select Bond.

4. The Bluetooth Device Bonding Wizard launches. Follow the wizard to bond with your selected device.

10 - 4 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

5. As prompted, make sure the Bluetooth device that you want to bond with is in

6. If the remote device is set up to accept bonding, a Bluetooth Passkey screen appears. To continue bonding, enter the
correct passkey and tap Reply.

Bondable

mode.

7. When you have successfully bonded with the other device, tap Finish.

View Device Properties

Follow these steps to view the properties of an already discovered device.

1. If not open, launch the Bluetooth Devices folder. Tap on the Bluetooth icon on the Today screen. Select Advanced Fea-
tures then Bluetooth Devices.

2. Select a device. Tap on the Properties icon, or tap on Device then select Properties. Alternatively, you can tap and hold
your stylus on the Bluetooth device you want to view information about. In the pop-up menu, select Properties.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 10 - 5

3. Use the General and Services screens to research device properties. If needed, assign a new device type icon by tapping
on the arrow buttons in the General screen. You can also use the Device name field to rename the device. When done, tap
OK for the setting to take effect.

Set Up Your Favorite Device

Follow these steps to set up default devices in the Bluetooth Devices folder. Please note that the Get Connected! Wizard
automatically assigns the favorite phone.

Complete these steps:

1. Tap on Tools and select My Favorites.

2. Tap on the tab for the type of device you would like to set a favorite for. If needed, use the arrow buttons to scroll and find the
tab you need.

Note: Tabs appears only for COM ports you have enabled. To enable a port, refer to the “Assign COM Ports” section earlier in

this chapter.

3. To select a favorite device, select Use the favorite selected above. In the drop-down list, select your device. Tap OK.

4. After setting a device as your favorite, its icon appears in the Bluetooth Devices folder with a heart next to it.

Change Views

You can switch between the Large Icons or Details views for the Bluetooth Devices folder.

1. In Bluetooth Devices, tap on View.

10 - 6 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

2. In the pop-up menu, choose between Large Icons or Details.

Large Icons Details

Note: In Details view, you can see the Device Class and scroll right to see the current Bonded status.

Delete a Device From the Folder

If you no longer plan to connect with it, you can delete a device from the Bluetooth Devices folder.

1. If not open, launch the Bluetooth Devices folder.

2. Tap and hold your stylus on the device you wish to delete. In the pop-up menu, select Delete.

3. Alternatively, after selecting a device, tap on the Delete icon. Or tap on Device then select Delete.

4. A Confirm screen appears. Tap Yes.

Turn Radio Transmitter ON/OFF

You may want to turn off the radio transmitter to save power or if you are entering an area with radio restrictions (e.g., an airplane).

1. The Bluetooth icon should appear in the task tray on the Today screen. Tap on the icon.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 10 - 7

2. In the pop-up menu, select Turn Transmitter OFF.

3. The Bluetooth Card radio transmitter shuts off. The Bluetooth icon in the task tray becomes gray, as well as relevant menu
options (e.g., Get Connected!).

4. To turn the radio transmitter back on, tap on the gray Bluetooth icon. In the pop-up-menu, select Turn Transmitter ON.

Bluetooth ActiveSync

This section explains how to use the Bluetooth ActiveSync feature. It helps you quickly and easily ActiveSync to a notebook or
desktop computer with ActiveSync v3.x installed.

1. Tap on the Bluetooth icon. In the pop-up menu, select Bluetooth ActiveSync.

2. The next screens varies depending on if your Bluetooth Devices folder contains any computers, and if one is chosen as your
favorite. Please refer to the appropriate scenario:

SCENARIO #1: Your Bluetooth Devices folder contains a favorite desktop computer.

(a) When you tap Bluetooth ActiveSync, your mobile computer automatically tries to connect to your favorite computer.
(b) The Connect To screen appears, reporting that it is trying to connect to Wireless ActiveSync.

(c) After a successful connection is made, the status screen reports Connected. Now you are ready to synchronize files, if

desired.

SCENARIO #2: Your Bluetooth Devices folder contains no favorite desktop computer.

10 - 8 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

(a) When you tap on Bluetooth ActiveSync, a screen appears that allows you to choose which computer to connect to in

your Bluetooth Devices folder. Choose a computer from the list and tap Select, or tap Find to search for another computer.

Note: If the computer you want to connect to is not listed, tap

Find

to begin a search. Proceed as described in Scenario #3 on

page 10-9.

(b) Your mobile computer attempts to connect to your selected computer.

(c) After a successful connection is made, the status screen reports Connected. Now you are ready to synchronize files, if

desired.

SCENARIO #3: Your Bluetooth Devices folder contains no computers.

(a) When you tap on Bluetooth ActiveSync, a Bluetooth Device Search automatically begins.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 10 - 9

Note: You can also start the device search by tapping Find in the Bluetooth Devices screen.

(b) After the search is complete, select the computer you wish to ActiveSync with and tap Select. If the computer is not listed,

make sure the computer is discoverable and tap Refresh to search again.

(c) After you tap Select, a service discovery phase begins.
(d) The Connect To screen appears, reporting that it is trying to connect to Wireless ActiveSync.

(e) After a successful connection is made, the status screen reports Connected. Now you are ready to synchronize, if desired.

Bluetooth LAN Access

This section explains how to use the Bluetooth LAN Access feature to quickly and easily connect to a Bluetooth-enabled LAN AP.

1. Tap on the Bluetooth icon. In the pop-up menu, select Bluetooth LAN Access.

2. The next screens varies depending on if your Bluetooth Devices folder contains any APs, and if one is chosen as your
favorite. Please refer to the appropriate scenario:

SCENARIO #1: Your Bluetooth Devices folder contains no favorite AP.

10 - 10 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05

(a) When you tap Bluetooth LAN Access, a screen appears that allows you to choose which AP to connect to in your

Bluetooth Devices folder. Choose an AP from the list and tap Select.

Note: If your AP is not listed, tap Find and proceed as described in Scenario #3.

(b) Your mobile computer tries to connect to the selected AP.

(c) If your LAN requires a passkey, a screen appears asking for the passkey. Enter the passkey, then tap OK.
(d) After a successful connection is made, the status screen reports Connected.

(e) Now you are ready to access your LAN for Internet access, files, etc.

SCENARIO #2: Your Bluetooth Devices folder contains a favorite AP.

(a) When you tap Bluetooth LAN Access, your mobile computer automatically tries to connect with your favorite AP.

(b) If your LAN requires a passkey, a screen appears, asking for the passkey. Enter the passkey, then tap OK.
(c) After a successful connection is made, the status screen reports Connected.

Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim. Rev (c) 4/11/05 10 - 11

(d) Now you are ready to access your LAN for Internet access, files, etc.

SCENARIO #3: Your Bluetooth Devices folder has no APs.

(a) When you tap Bluetooth LAN Access, the mobile computer automatically begins to search for new Bluetooth devices.

Note: You can also start the device search by tapping Find in the Bluetooth Devices screen. See Scenario #2 on page 10-8.

(b) After the search is complete, select the AP you wish to connect to. Tap Select. If the AP is not listed, tap Refresh to

search again.

(c) After you tap Select, a service discovery phase begins.

(d) If the LAN requires a Passkey, a screen appears, asking for the Passkey. Enter the passkey, then tap OK.
(e) After a successful connection is made, the screen reports Connected.

(f) Now you are ready to access your LAN for Internet access, files, etc.

OBEX

This section explains how to use the OBEX (object exchange) application to trade business cards, contacts or files with another
Bluetooth device that supports OBEX.

Bluetooth OBEX application supports five operations:

• Exchange Business Cards

• Send a Contact

• Send a File

10 - 12 Dolphin® 7900 Series Mobile Computer User’s Guide-Prelim.

Rev (c) 4/11/05