The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Your software release may not support all of the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Cisco 1260, 3500, 3600, 801, 1140, 1310, and 1520 series access points support Datagram Transport Layer Security (DTLS) data encryption.
You can use the switch to enable or disable DTLS data encryption for a specific access point or for all access points.
Non-Russian customers who use the Cisco switch do not need a data DTLS license.
Encryption limits throughput at both the switch and the access point, and maximum throughput is desired for most enterprise networks.
If your switch does not have a data DTLS license and if the access point associated with the switch has DTLS enabled, the data path will be unencrypted.
In images that do not have a DTLS license, the DTLS commands are not available.
The switch enables you to encrypt Control and Provisioning of Wireless Access Points (CAPWAP) control packets (and optionally, CAPWAP data packets) that are sent between the access point and the switch using DTLS. DTLS is a standards-track Internet Engineering Task Force (IETF) protocol based on TLS. CAPWAP control packets are management packets exchanged between a switch and an access point while CAPWAP data packets encapsulate forwarded wireless frames. CAPWAP control and data packets are sent over separate UDP ports: 5246 (control) and 5247 (data). If an access point does not support DTLS data encryption, DTLS is enabled only for the control plane, and a DTLS session for the data plane is not established.
| Command or Action | Purpose | |||
|---|---|---|---|---|
| Step 1 |
configure terminal Example: |
Enters global configuration mode. |
||
| Step 2 |
ap link-encryption Example: |
Enables data encryption for all access points or a specific access point by entering this command. The default value is disabled. Changing the data encryption mode requires the access points to rejoin the switch. |
||
| Step 3 |
end Example: |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
||
| Step 4 |
show ap link-encryption Example: |
Displays the encryption state of all access points or a specific access point. This command also shows authentication errors, which track the number of integrity check failures and replay errors. Relay errors help in tracking the number of times the access point receives the same packet. |
||
| Step 5 |
show wireless dtls connections Example: |
Displays a summary of all active DTLS connections.
|
| Step 1 |
Choose . The All APs page is displayed. |
||
| Step 2 |
Click the name of the access point for which you want to enable data encryption. The AP > Edit page is displayed. |
||
| Step 3 |
Click the Advanced tab. |
||
| Step 4 |
Select or unselect the Data Encryption check box.
|
||
| Step 5 |
Click Apply. |
||
| Step 6 |
Click Save Configuration. |
This example shows how to display the encryption state of all access points or a specific access point. This command also shows authentication errors, which track the number of integrity check failures and replay errors. Relay errors help in tracking the number of times the access point receives the same packet:
Switch# show ap link-encryption
Encryption Dnstream Upstream Last
AP Name State Count Count Update
------------------ ---------- -------- -------- ------
3602a Enabled 0 0 Never
This example shows how to display a summary of all active DTLS connections:
Switch# show wireless dtls connections
AP Name Local Port Peer IP Peer Port Ciphersuite
--------------- ------------ ------------- ---------- --------------------
3602a Capwap_Ctrl 10.10.21.213 46075 TLS_RSA_WITH_AES_128_CBC_SHA
3602a Capwap_Data 10.10.21.213 46075 TLS_RSA_WITH_AES_128_CBC_SHA
Feedback