11B/WEP Cameras in an 11G/WPA Network

I have converted my entire WLAN to 11G with WPA security. There is a glut of
11B/WEP cameras available on the market nowadays at low prices, certainly
compared to new 11G cameras. I'm looking for suggestions on ways in
integrate several into my home and/or office WLAN and still retain the
security of the 11G/WPA network.

Obviously I could use a separate 11B access point to support them but I
think the security issue remains, doing this obviates the advantage of the
WPA for the rest of the WLAN as the network is only as secure as the weakest
security in the entire system. I'm curious if anyone has any suggestions on
how to do something like this while avoiding the security problem created by
WEP devices regardless of how they are connected.

"John Steele" <(E-Mail Removed)> writes:
> Obviously I could use a separate 11B access point to support them but I
> think the security issue remains, doing this obviates the advantage of the
> WPA for the rest of the WLAN as the network is only as secure as the weakest
> security in the entire system.

Even if you made a secure connection from the WEP access point to the
computer you still have the issue of the pictures streaming from the
camera being relatively easy to view. Are all the cameras really
going to be in places that have no security implications (or provide
voyeristic entertainment for the neighborhood kids?)

If you get a second AP and only attach it to a second interface on
your computer you should be able to treat this two-host net as a black
"outside" network that you don't trust. If you provide no substantive
services on the computer end of this interface you should be
relatively safe. Thats effectively what I did in the days of WEP. I
didn't want to put the AP inside the firewall since it was insecure
and I didn't want to put it outside the firewall on the internet side
of things because I didn't want to have random folks to get to the
internet via my AP either. The solution was to add a third interface
that was "outside" but not directly on the internet.

-wolfgang
--
Wolfgang S. Rupprecht http://www.wsrcc.com/wolfgang/