Layer 2 Security
This section contains the following subsections:
Prerequisites for Layer 2 Security
WLANs with the same SSID must have unique Layer 2 security policies so that clients can make a WLAN selection based on the information advertised in beacon and probe responses. The available Layer 2 security policies are as follows:
-
None (open WLAN)
-
Static WEP or 802.1X
Note
-
Because static WEP and 802.1X are both advertised by the same bit in beacon and probe responses, they cannot be differentiated by clients. Therefore, they cannot both be used by multiple WLANs with the same SSID.
-
WLAN WEP is not supported in Cisco Aironet 1810w Access Points.
-
-
WPA+WPA2
Note
-
Although WPA and WPA2 cannot be used by multiple WLANs with the same SSID, you can configure two WLANs with the same SSID with WPA/TKIP with PSK and Wi-Fi Protected Access (WPA)/Temporal Key Integrity Protocol (TKIP) with 802.1X, or with WPA/TKIP with 802.1X or WPA/AES with 802.1X.
-
A WLAN configured with TKIP support will not be enabled on an RM3000AC module.
-
-
Static WEP (not supported on Wave 2 APs)
-
WPA2+WPA3
-
Enhanced Open
MAC Filtering of WLANs
When you use MAC filtering for client or administrator authorization, you need to enable it at the WLAN level first. If you plan to use local MAC address filtering for any WLAN, use the commands in this section to configure MAC filtering for a WLAN.
MAC Filtering with Centrally Authenticated WLANs
After the initial 802.11 authentication exchange between the AP and the clients, the AP sends the client association request in CAPWAP to the controller. If the controller is using a local MAC filter list, it will immediately send a successful or failed association response. If external RADIUS is used, the controller sends an Access-Request to the AAA server, and based on the response from RADIUS, sends its association response to the client.
![]() Note |
Wireless clients may time out their wait for association response within as little as 300 ms. Therefore, if you use an external RADIUS server with MAC filtering, ensure that the server responds within this timeframe. |
Restrictions for MAC Filtering
-
MAC filtering cannot be configured for Guest LANs.
-
Interface mapping and profile precedence—MAC filtering for the WLAN set to any WLAN/Interface requires a mandatory profile name, followed by the interface name for the traffic to work properly.
Enabling MAC Filtering
Use these commands to enable MAC filtering on a WLAN:
-
Enable MAC filtering by entering the config wlan mac-filtering enable wlan_id command.
-
Verify that you have MAC filtering enabled for the WLAN by entering the show wlan command.
When you enable MAC filtering, only the MAC addresses that you add to the WLAN are allowed to join the WLAN. MAC addresses that have not been added are not allowed to join the WLAN.
When a client tries to associate to a WLAN for the first time, the client gets authenticated with its MAC address from AAA server. If the authentication is successful, the client gets an IP address from DHCP server, and then the client is connected to the WLAN.
When the client roams or sends association request to the same AP or different AP and is still connected to WLAN, the client is not authenticated again to AAA server.
If the client is not connected to WLAN, then the client has to get authenticated from the AAA server.
Local MAC Filters
Controllers have built-in MAC filtering capability, similar to that provided by a RADIUS authorization server.
Prerequisites for Configuring Local MAC Filters
You must have AAA enabled on the WLAN to override the interface name.
Configuring Local MAC Filters (CLI)
-
Create a MAC filter entry on the controller by entering the config macfilter add mac_addr wlan_id [interface_name] [description] [IP_addr] command.
The following parameters are optional:
-
mac_addr —MAC address of the client.
-
wlan_id —WLAN id on which the client is associating.
-
interface_name —The name of the interface. This interface name is used to override the interface configured to the WLAN.
-
description —A brief description of the interface in double quotes (for example, “Interface1”).
-
IP_addr —The IP address which is used for a passive client with the MAC address specified by the mac addr value above.
-
-
Assign an IP address to an existing MAC filter entry, if one was not assigned in the config macfilter add command by entering the config macfilter ip-address mac_addr IP_addr command.
-
Verify that MAC addresses are assigned to the WLAN by entering the show macfilter command.
![]() Note |
For ISE NAC WLANs, the MAC authentication request is always sent to the external RADIUS server. The MAC authentication is not validated against the local database. This functionality is applicable to Releases 8.5, 8.7, 8.8, and later releases via the fix for CSCvh85830. Previously, if MAC filtering was configured, the controller tried to authenticate the wireless clients using the local MAC filter. RADIUS servers were attempted only if the wireless clients were not found in the local MAC filter. |
Protected Management Frames (802.11w)
Wi-Fi is a broadcast medium that enables any device to eavesdrop and participate either as a legitimate or rogue device. Control and management frames such as authentication/deauthentication, association/disassociation, beacons, and probes are used by wireless clients to select an AP and to initiate a session for network services.
Unlike data traffic which can be encrypted to provide a level of confidentiality, these frames must be heard and understood by all clients. They therefore must be transmitted as open or unencrypted. While these frames cannot be encrypted, they must be protected from forgery to protect the wireless medium from attacks. For example, an attacker could spoof management frames from an AP to tear down a session between a client and an AP.
The 802.11w protocol applies only to a set of robust management frames protected by the Management Frame Protection (PMF) service. These include Disassociation, Deauthentication, and Robust Action frames.
Management frames that are considered as robust action and therefore protected are the following:
-
Spectrum Management
-
QoS
-
DLS
-
Block Ack
-
Radio Measurement
-
Fast BSS Transition
-
SA Query
-
Protected Dual of Public Action
-
Vendor-specific Protected
When 802.11w is implemented in the wireless medium, the following occur:
-
Client protection is added by the AP adding cryptographic protection (by including the MIC information element) to deauthentication and disassociation frames preventing them from being spoofed in a DOS attack.
-
Infrastructure protection is added by adding a Security Association (SA) teardown protection mechanism consisting of an Association Comeback Time and an SA-Query procedure preventing spoofed association request from disconnecting an already connected client.
This section contains the following subsections:
Restrictions for Protected Management Frames (802.11w)
-
With PMF settings set to Optional or Enabled, a wireless client may intermittently fail temporarily to reassociate to an access point. This impact will be mitigated by enabling Fast Transition Over the Air, and by setting the PMF Comeback Timer value to 1 second.
-
The 802.11w standard is not supported .
-
802.11w cannot be applied on an open WLAN, WEP-encrypted WLAN, or a TKIP-encrypted WLAN.
-
PMF is not supported in Cisco Aironet 1810, 1815, 1832, 1852, 1542, and 1800 series APs in FlexConnect mode prior to Release 8.9.
Configuring Protected Management Frames (802.11w) (GUI)
Procedure
Step 1 |
Choose WLANs > WLAN ID to open the WLANs > Edit page. |
||
Step 2 |
In the Security tab, choose the Layer 2 security tab. |
||
Step 3 |
From the Layer 2 Security drop-down list, choose WPA+WPA2. The 802.11w IGTK Key is derived using the 4-way handshake, which means that it can only be used on WLANs that are configured for WPA2 security at Layer 2.
|
||
Step 4 |
Choose the PMF state from the drop-down list
|
||
Step 5 |
If you choose the PMF state as either Optional or Required, do the following:
|
||
Step 6 |
In the Authentication Key Management section, follow these steps:
|
||
Step 7 |
Click Apply. |
||
Step 8 |
Click Save Configuration. |
Configuring Protected Management Frames (802.11w) 802.11w (CLI)
Procedure
Fast Secure Roaming
802.11r Fast Transition
802.11r, which is the IEEE standard and generally recommended in order to speed roaming when using EAP, introduces a new concept of roaming where the initial handshake with the new AP is done even before the client roams to the target AP, which is called Fast Transition (FT). The initial handshake allows the client and APs to do the Pairwise Transient Key (PTK) calculation in advance. These PTK keys are applied to the client and AP after the client does the reassociation request or response exchange with new target AP.
802.11r provides two methods of roaming:
-
Over-the-Air
-
Over-the-DS (Distribution System)
The FT key hierarchy is designed to allow clients to make fast BSS transitions between APs without requiring reauthentication at every AP. WLAN configuration contains a new Authenticated Key Management (AKM) type called FT (Fast Transition).
How a Client Roams
For a client to move from its current AP to a target AP using the FT protocols, the message exchanges are performed using one of the following two methods:
-
Over-the-Air—The client communicates directly with the target AP using IEEE 802.11 authentication with the FT authentication algorithm.
-
Over-the-DS—The client communicates with the target AP through the current AP. The communication between the client and the target AP is carried in FT action frames between the client and the current AP and is then sent through the controller. Note
Over-the-Air is the preferred and recommended method compared to the Over-the-DS method.
![](/c/dam/en/us/td/i/300001-400000/350001-360000/351001-352000/351714.eps/_jcr_content/renditions/351714.jpg)
![](/c/dam/en/us/td/i/300001-400000/350001-360000/351001-352000/351715.eps/_jcr_content/renditions/351715.jpg)
This section contains the following subsections:
Restrictions for 802.11r Fast Transition
-
This feature is not supported on mesh access points.
-
In 8.1 and earlier releases, this feature is not supported on access points in FlexConnect mode. In Release 8.2, this restriction is removed.
-
For APs in FlexConnect mode:
-
802.11r Fast Transition is supported in central and locally switched WLANs.
-
This feature is not supported for the WLANs enabled for local authentication.
-
802.11r client association is not supported on access points in standalone mode.
-
802.11r fast roaming is not supported on access points in standalone mode.
-
802.11r fast roaming between local authentication and central authentication WLAN is not supported.
-
802.11r fast roaming works only if the APs are in the same FlexConnect group.
-
-
This feature is not supported on Linux-based APs such as Cisco 600 Series OfficeExtend Access Points.
-
802.11r fast roaming is not supported if the client uses Over-the-DS preauthentication in standalone mode.
-
EAP LEAP method is not supported. WAN link latency prevents association time to a maximum of 2 seconds.
-
The service from standalone AP to client is only supported until the session timer expires.
-
TSpec is not supported for 802.11r fast roaming. Therefore, RIC IE handling is not supported.
-
If WAN link latency exists, fast roaming is also delayed. Voice or data maximum latency should be verified. The controller handles 802.11r Fast Transition authentication request during roaming for both Over-the-Air and Over-the-DS methods.
-
This feature is supported on open and WPA2 configured WLANs.
-
It is not possible to enable WPA1 encryption along with Fast Transition on a WLAN using the controller GUI. The workaround is to configure it using the controller CLI. For more information, see https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp05137.
-
Legacy clients cannot associate with a WLAN that has 802.11r enabled if the driver of the supplicant that is responsible for parsing the Robust Security Network Information Exchange (RSN IE) is old and not aware of the additional AKM suites in the IE. Due to this limitation, clients cannot send association requests to WLANs. These clients, however, can still associate with non-802.11r WLANs. Clients that are 802.11r capable can associate as 802.11i clients on WLANs that have both 802.11i and 802.11r Authentication Key Management Suites enabled.
802.11i Opportunistic Key Caching (Proactive Key Caching) is supported only by Microsoft Windows clients. It is always enabled and cannot be disabled.
The workaround is to enable or upgrade the driver of the legacy clients to work with the new 802.11r AKMs, after which the legacy clients can successfully associate with 802.11r enabled WLANs.
Another workaround is to have two SSIDs with the same name but with different security settings (FT and non-FT).
-
Fast Transition resource request protocol is not supported because clients do not support this protocol. Also, the resource request protocol is an optional protocol.
-
To avoid any Denial of Service (DoS) attack, each controller allows a maximum of three Fast Transition handshakes with different APs.
-
Disable the fast transition padding option for keys setting in the client to prevent the client from getting de-authenticated from an SSID with 802.11r Fast Transition enabled.
-
Non-802.11r capable devices will not be able to associate with FT-enabled WLAN.
-
802.11r FT + PMF is not recommended.
-
802.11r FT Over-the-Air roaming is recommended for FlexConnect deployments.
-
In a default FlexGroup scenario, fast roaming is not supported.
-
As part of a fix for CSCvk64674, Adaptive mode for 802.11r Fast Transition is not supported for open WLANs. That is, if you choose Layer 2 security as None for a WLAN, ensure that you disable the Adaptive mode for 802.11r Fast Transition; else, WLAN cannot be enabled.
Configuring 802.11r Fast Transition (GUI)
Procedure
Step 1 |
Choose WLANs to open the WLANs window. |
||
Step 2 |
Click a WLAN ID to open the WLANs > Edit window. |
||
Step 3 |
Choose Security > Layer 2 tab. |
||
Step 4 |
From the Layer 2 Security drop-down list, choose WPA+WPA2. The Authentication Key Management parameters for Fast Transition are displayed. |
||
Step 5 |
From the Fast Transition drop-down list, choose Fast Transition on the WLAN. |
||
Step 6 |
Uncheck the Over the DS check box to enable Fast Transition Over the Air. Fast Transition Over the Air is the recommended configuration for this feature. This option is available only if you enable Fast Transition or if Fast Transition is adaptive. |
||
Step 7 |
In the Reassociation Timeout field, enter the number of seconds after which the reassociation attempt of a client to an AP should time out. The valid range is 1 to 100 seconds.
|
||
Step 8 |
Under Authentication Key Management, choose FT 802.1X or FT PSK. Check or uncheck the corresponding check boxes to enable or disable the keys. If you check the FT PSK check box, from the PSK Format drop-down list, choose ASCII or Hex and enter the key value.
|
||
Step 9 |
From the WPA gtk-randomize State drop-down list, choose Enable or Disable to configure the Wi-Fi Protected Access (WPA) group temporal key (GTK) randomize state. |
||
Step 10 |
Click Apply to save your settings. |
Configuring 802.11r Fast Transition (CLI)
802.11r-enabled WLAN provides faster roaming for wireless client devices. However, if 802.11r is enabled on a WLAN and advertises fast transition (FT) and non-FT AKMs in Beacon and Probe RSN IE, some of the devices with bad implementation may not recognize FT/WPA2 authentication key-management (AKM) in RSN IE and fails to join. As a result, customers cannot enable 802.11r on the SSID.
To overcome this, Cisco Wireless infrastructure introduces adaptive 802.11r feature. When FT mode is set to adaptive, WLAN advertises 802.11r Mobility Domain ID on an 802.11i-enabled WLAN. Apple iOS10 client devices identifies the presence of MDIE on a 80211i/WPA2 WLAN and does a proprietary handshake to establish 802.11r association. Once the client completes successful 802.11r association, it will be able to do FT roaming as in a normal 802.11r enabled WLAN.
The FT adaptive is applicable only to selected Apple iOS10 devices. All other clients will continue to have 802.11i association on the WLAN.
Procedure
Step 1 |
To enable or disable 802.11r fast transition parameters, use the config wlan security ft { adaptive | enable | disable} wlan-id command. Fast Transition adaptive option is enabled by default when you create a new WLAN, from the controller, Release 8.3, onwards. However, the existing WLANs will retain its current configuration when the controller upgrades to Release 8.3 from an earlier release. Enable Fast SSID feature for allowing client devices a smother switching smoother switching from one WLAN to another.. |
||
Step 2 |
To enable or disable 802.11r fast transition parameters over a distributed system, use the config wlan security ft over-the-ds { enable | disable} wlan-id command. |
||
Step 3 |
To enable or disable the authentication key management for fast transition using preshared keys (PSK), use the config wlan security wpa akm ft psk { enable | disable} wlan-id command. By default, the authentication key management using PSK is disabled. |
||
Step 4 |
To enable or disable authentication key management for adaptive using PSK, use the config wlan security wpa akm psk { enable | disable} wlan-id command. |
||
Step 5 |
To enable or disable authentication key management for fast transition using 802.1X, use the config wlan security wpa akm ft-802.1X { enable | disable} wlan-id command. By default, authentication key management using 802.1X is enabled. |
||
Step 6 |
To enable or disable authentication key management for adaptive using 802.1x, use the config wlan security wpa akm 802.1x { enable | disable} wlan-id command.
|
||
Step 7 |
To enable or disable 802.11r fast transition reassociation timeout, use the config wlan security ft reassociation-timeout timeout-in-seconds wlan-id command. The valid range is 1 to 100 seconds. The default value of reassociation timeout is 20 seconds. |
||
Step 8 |
To view the fast transition configuration on a WLAN, use the show wlan wlan-id command. |
||
Step 9 |
To view the fast transition configuration on a client, use the show client detail client-mac command.
|
||
Step 10 |
To enable or disable debugging of fast transition events, use the debug ft events { enable | disable} command. |
What to do next
-
The tech support command output and xml config will not display fast transition information when it is disabled.
-
The tech support command output and xml config will display Adaptive 802.11r information when it is enabled.
-
To display a comprehensive view of the current controller configuration, use the show run-config all command.
-
The fast transition adaptive mode is not supported on Releases prior to Release 8.3, the fast transition adaptive WLANs default to fast transition disable when the controller is downgraded from Release 8.3 to a previous release, and the fast transition adaptive configuration is invalidated.
Troubleshooting 802.11r BSS Fast Transition
Symptom | Resolution |
---|---|
Non-802.11r legacy clients are no longer connecting. | Check if the WLAN has FT enabled. If so, non-FT WLAN will need to be created. |
When configuring WLAN, the FT setup options are not shown. | Check if WPA2 is being used (802.1x / PSK). FT is supported only on WPA2 and OPEN SSIDs. |
802.11r clients appear to reauthenticate when they do a Layer 2 roam to a new controller. | Check if the reassociation timeout has been lowered from the default of 20 by navigating to WLANs > WLAN Name > Security > Layer 2 on the controller GUI. |
802.11i Sticky Key Caching
The controller supports sticky key caching (SKC). With sticky key caching, the client receives and stores a different PMKID for every AP it associates with. The APs also maintain a database of the PMKID issued to the client.
In SKC, the client stores each Pairwise Master Key ID (PMKID) against a Pairwise Master Key Security Association (PMKSA). When a client finds an AP for which it has the PMKSA, it sends the PMKID in the association request to the AP. If the PMKSA is alive in the AP, the AP provides support for fast roaming. In SKC, full authentication is done on each new AP to which the client associates and the client must keep the PMKSA associated with all APs. For SKC, PMKSA is a per AP cache that the client stores and PMKSA is precalculated based on the BSSID of the new AP.
SKC is useful only in cases where you have a small number of clients, which roam among a small number of APs.
This section contains the following subsections:
Restrictions for Sticky Key Caching
-
The controller supports SKC for up to eight APs per client. If a client roams to more than 8 APs per session, the old APs are removed to store the newly cached entries when the client roams. We recommend that you do not use SKC for large scale deployments.
-
SKC works only on WPA2-enabled WLANs.
-
SKC does not work across controllers in a mobility group.
-
SKC works only on local mode APs.
Configuring Sticky Key Caching (CLI)
Procedure
Step 1 |
Disable the WLAN by entering this command: config wlan disable wlan_id |
||
Step 2 |
Enable sticky key caching by entering this command: config wlan security wpa wpa2 cache sticky enable wlan_id By default, SKC is disabled and opportunistic key caching (OKC) is enabled.
You can check if SKC is enabled by entering this command: show wlan wlan_id Information similar to the following appears:
|
||
Step 3 |
Enable the WLAN by entering this command: config wlan enable wlan_id |
||
Step 4 |
Save your settings by entering this command: save config |
Cisco Centralized Key Management (CCKM)
Cisco Centralized Key Management (CCKM) is an older proprietary method of fast secure roaming that was supported with dynamic WEP, WPA1 & WPA2 EAP security. With WPA2, CCKM is supported only by Cisco wireless phones and Cisco WGBs. It has been superseded by the 802.11r FT standard.
CCKM uses a fast rekeying technique that enables clients to roam from one AP to another without going through the controller, typically in under 150 milliseconds (ms). CCKM reduces the time required by the client to mutually authenticate with the new AP and derive a new session key during reassociation. CCKM fast secure roaming ensures that there is no perceptible delay in time-sensitive applications such as wireless Voice over IP (VoIP), enterprise resource planning (ERP), or Citrix-based solutions. CCKM is a CCXv4-compliant feature. If CCKM is selected, only CCKM clients are supported.
If you enable CCKM, the functionality of APs differs from the controller's for fast roaming in the following ways:
-
If an association request sent by a client has CCKM enabled in a Robust Secure Network Information Element (RSN IE) but CCKM IE is not encoded and only PMKID is encoded in RSN IE, then the controller does not do a full authentication. Instead, the controller validates the PMKID and does a four-way handshake.
-
If an association request sent by a client has CCKM enabled in RSN IE but CCKM IE is not encoded and only PMKID is encoded in RSN IE, then AP does a full authentication. The access point does not use PMKID sent with the association request when CCKM is enabled in RSN IE.
For more information, see https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116493-technote-technology-00.html#anc24.
Wi-Fi Protected Areas (WPA)
WPA1 and WPA2
Wi-Fi Protected Access (WPA or WPA1) and WPA2 are standards-based security solutions from the Wi-Fi Alliance that provide data protection and access control for wireless LAN systems. WPA1 is compatible with the IEEE 802.11i standard but was implemented prior to the standard’s ratification; WPA2 is the Wi-Fi Alliance's implementation of the ratified IEEE 802.11i standard.
![]() Note |
WPA1 is deprecated. It may not be configured by itself, but only enabled if WPA2/CCMP128 (AES) is also enabled. WPA2 is the default. WPA3 is the emerging standard. These standards provide for an authentication method and a cipher management method. The authentication methods supported are: 802.1X (a.k.a WPA Enterprise) and PSK. |
By default, WPA1 uses Temporal Key Integrity Protocol (TKIP) and message integrity check (MIC) for data protection while WPA2 uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). Both WPA1 and WPA2 use 802.1X for authenticated key management by default. However, these options are also available:
-
802.1X—The standard for wireless LAN security, as defined by IEEE, is called 802.1X for 802.11, or simply 802.1X. An access point that supports 802.1X acts as the interface between a wireless client and an authentication server, such as a RADIUS server, to which the access point communicates over the wired network. If 802.1X is selected, only 802.1X clients are supported.
In the 802.1X(Enterprise) authentication method, the clients use EAP (extensible authentication protocol) to authenticate with an authentication server. The authentication server can be an external RADIUS or LDAP server, or a local auth server running within the controller.
To speed up roaming, a fast secure roaming method may optionally be deployed to bypass the authentication and key exchange phases.
-
PSK—When you choose PSK (also known as WPA preshared key or WPA passphrase), you need to configure a preshared key (or a passphrase). This key is used as the pairwise master key (PMK) between the clients and the authentication server.
-
CCKM—Cisco Centralized Key Management (CCKM) uses a fast rekeying technique that enables clients to roam from one access point to another without going through the controller, typically in under 150 milliseconds (ms). CCKM reduces the time required by the client to mutually authenticate with the new access point and derive a new session key during reassociation. CCKM fast secure roaming ensures that there is no perceptible delay in time-sensitive applications such as wireless Voice over IP (VoIP), enterprise resource planning (ERP), or Citrix-based solutions. CCKM is a CCXv4-compliant feature. If CCKM is selected, only CCKM clients are supported.
When CCKM is enabled, the behavior of access points differs from the controller's for fast roaming in the following ways:
-
If an association request sent by a client has CCKM enabled in a Robust Secure Network Information Element (RSN IE) but CCKM IE is not encoded and only PMKID is encoded in RSN IE, then the controller does not do a full authentication. Instead, the controller validates the PMKID and does a four-way handshake.
-
If an association request sent by a client has CCKM enabled in RSN IE but CCKM IE is not encoded and only PMKID is encoded in RSN IE, then AP does a full authentication. The access point does not use PMKID sent with the association request when CCKM is enabled in RSN IE.
-
-
802.1X+CCKM—During normal operation, 802.1X-enabled clients mutually authenticate with a new access point by performing a complete 802.1X authentication, including communication with the main RADIUS server. However, when you configure your WLAN for 802.1X and CCKM fast secure roaming, CCKM-enabled clients securely roam from one access point to another without the need to reauthenticate to the RADIUS server. 802.1X+CCKM is considered optional CCKM because both CCKM and non-CCKM clients are supported when this option is selected.
On a single WLAN, you can allow WPA1, WPA2, and 802.1X/PSK/CCKM/802.1X+CCKM clients to join. All of the access points on such a WLAN advertise WPA1, WPA2, and 802.1X/PSK/CCKM/ 802.1X+CCKM information elements in their beacons and probe responses. When you enable WPA1 and/or WPA2, you can also enable one or two ciphers, or cryptographic algorithms, designed to protect data traffic. Specifically, you can enable AES and/or TKIP data encryption for WPA1 and/or WPA2. TKIP is the default value for WPA1, and AES is the default value for WPA2.
This section contains the following subsections:
Configuring WPA1+WPA2 (GUI)
Procedure
Step 1 |
Choose WLANs to open the WLANs page. |
||||
Step 2 |
Click the ID number of the desired WLAN to open the WLANs > Edit page. |
||||
Step 3 |
Choose the Security and Layer 2 tabs to open the WLANs > Edit (Security > Layer 2) page. |
||||
Step 4 |
Choose WPA+WPA2 from the Layer 2 Security drop-down list. |
||||
Step 5 |
Under WPA+WPA2 Parameters, select the WPA Policy check box to enable WPA1, select the WPA2 Policy check box to enable WPA2, or select both check boxes to enable both WPA1 and WPA2.
|
||||
Step 6 |
Select the WPA2 Policy-AES check box to enable AES data encryption .
|
||||
Step 7 |
Choose one of the following key management methods from the Auth Key Mgmt drop-down list: 802.1X, CCKM, PSK, or 802.1X+CCKM. |
||||
Step 8 |
If you chose PSK, choose ASCII or HEX from the PSK Format drop-down list and then enter a preshared key in the blank text box. WPA preshared keys must contain 8 to 63 ASCII text characters or 64 hexadecimal characters.
|
||||
Step 9 |
Save the configuration. |
Configuring WPA1+WPA2 (CLI)
Procedure
Step 1 |
Disable the WLAN by entering this command: config wlan disable wlan_id |
||||
Step 2 |
Enable or disable WPA for the WLAN by entering this command: config wlan security wpa {enable | disable} wlan_id |
||||
Step 3 |
Enable or disable WPA1 for the WLAN by entering this command: config wlan security wpa wpa1 {enable | disable} wlan_id |
||||
Step 4 |
Enable or disable WPA2 for the WLAN by entering this command: config wlan security wpa wpa2 {enable | disable} wlan_id |
||||
Step 5 |
Enable or disable AES or TKIP data encryption for WPA1 or WPA2 by entering one of these commands:
The default values are TKIP for WPA1 and AES for WPA2.
When you have VLAN configuration on WGB, you need to configure the encryption cipher mode and keys for a particular VLAN, for example, encryption vlan 80 mode ciphers tkip . Then, you need configure the encryption cipher mode globally on the multicast interface by entering the following command: encryption mode ciphers tkip . |
||||
Step 6 |
Enable or disable 802.1X, PSK, or CCKM authenticated key management by entering this command: config wlan security wpa akm {802.1X | psk | cckm} {enable | disable} wlan_id The default value is 802.1X. |
||||
Step 7 |
If you enabled PSK in Step 6, enter this command to specify a preshared key: config wlan security wpa akm psk set-key {ascii | hex} psk-key wlan_id WPA preshared keys must contain 8 to 63 ASCII text characters or 64 hexadecimal characters. |
||||
Step 8 |
Enable or disable authentication key management suite for fast transition by entering this command: config wlan security wpa akm ft {802.1X | psk} {enable | disable} wlan_id
|
||||
Step 9 |
Enable or disable randomization of group temporal keys (GTK) between AP and clients by entering this command: config wlan security wpa gtk-random {enable | disable} wlan_id |
||||
Step 10 |
If you enabled WPA2 with 802.1X authenticated key management or WPA1 or WPA2 with CCKM authenticated key management, the PMK cache lifetime timer is used to trigger reauthentication with the client when necessary. The timer is based on the timeout value received from the AAA server or the WLAN session timeout setting. To see the amount of time remaining before the timer expires, enter this command: show pmk-cache all If you enabled WPA2 with 802.1X authenticated key management, the controller supports both opportunistic PMKID caching and sticky (or non-opportunistic) PMKID caching. In sticky PMKID caching (SKC), the client stores multiple PMKIDs, a different PMKID for every AP it associates with. Opportunistic PMKID caching (OKC) stores only one PMKID per client. By default, the controller supports OKC. |
||||
Step 11 |
Enable the WLAN by entering this command: config wlan enable wlan_id |
||||
Step 12 |
Save your settings by entering this command: save config |
Wireless Encryption Protocol (WEP)
WLAN for Static WEP
You can configure up to four WLANs to support static WEP keys. Follow these guidelines when configuring a WLAN for static WEP:
-
When you configure static WEP as the Layer 2 security policy, no other security policies can be specified. That is, you cannot configure web authentication. However, when you configure static WEP as the Layer 2 security policy, you can configure web authentication.
Restrictions for Configuring Static WEP
-
The controller software supports CCX versions 1 through 5. CCX support is enabled automatically for every WLAN on the controller and cannot be disabled. The controller stores the CCX version of the client in its client database and uses it to limit client functionality. Clients must support CCXv4 or v5 in order to use CCKM. For more information about CCX, see the Configuring Cisco Client Extensions section.
-
In a unified architecture where multiple VLAN clients are supported for a WGB, you also need to configure encryption cipher suite and WEP keys globally, when the WEP encryption is enabled on the WGB. Otherwise, multicast traffic for wired VLAN clients fail.
Configuring Dynamic WEP (CLI)
Controllers can control 802.1X dynamic WEP keys using Extensible Authentication Protocol (EAP) across access points and support 802.1X dynamic key settings for WLANs.
![]() Note |
WEP is deprecated and is only supported in Cisco Wave 1 (IOS-based) APs; not supported on Cisco Wave 2 or 802.11ax (Wi-Fi 6) APs. |
![]() Note |
To use LEAP with lightweight access points and wireless clients, make sure to choose Cisco-Aironet as the RADIUS server type when configuring the CiscoSecure Access Control Server (ACS). |
-
Check the security settings of each WLAN by entering this command:
show wlan wlan_id
The default security setting for new WLANs is 802.1X with dynamic keys enabled. To maintain robust Layer 2 security, leave 802.1X configured on your WLANs.
-
Disable or enable the 802.1X authentication by entering this command:
config wlan security 802.1X {enable | disable} wlan_id
After you enable 802.1X authentication, the controller sends EAP authentication packets between the wireless client and the authentication server. This command allows all EAP-type packets to be sent to and from the controller.
Note
The controller performs both web authentication and 802.1X authentication in the same WLAN. The clients are initially authenticated with 802.1X. After a successful authentication, the client must provide the web authentication credentials. After a successful web authentication, the client is moved to the run state.
-
Change the 802.1X encryption level for a WLAN by entering this command:
config wlan security 802.1X encryption wlan_id [0 | 40 | 104]
-
Use the 0 option to specify no 802.1X encryption.
-
Use the 40 option to specify 40/64-bit encryption.
-
Use the 104 option to specify 104/128-bit encryption. (This is the default encryption setting.)
-
MAC Authentication Failover to 802.1X Authentication
You can configure the controller to start 802.1X authentication when MAC authentication for the client fails. If the RADIUS server rejects an access request from a client instead of deauthenticating the client, the controller can force the client to undergo an 802.1X authentication. If the client fails the 802.1X authentication too, then the client is deauthenticated.
If MAC authentication is successful and the client requests for an 802.1X authentication, the client has to pass the 802.1X authentication to be allowed to send data traffic. If the client does not choose an 802.1X authentication, the client is declared to be authenticated if the client passes the MAC authentication.
![]() Note |
WLAN with WPA2 + 802.1X + WebAuth with WebAuth on MAC failure is not supported. |
This section contains the following subsections:
Configuring MAC Authentication Failover to 802.1x Authentication (GUI)
Procedure
Step 1 |
Choose to open the WLANs > Edit page. |
Step 2 |
In the Security tab, click the Layer 2 tab. |
Step 3 |
Select the MAC Filtering check box. |
Step 4 |
Select the Mac Auth or Dot1x check box. |
Configuring MAC Authentication Failover to 802.1X Authentication (CLI)
Procedure
To configure MAC authentication failover to 802.1X authentication, enter this command: config wlan security 802.1X on-macfilter-failure {enable | disable} wlan-id |
Identity PSK
This feature is designed to provide a simple and secured way for the growing number of devices to connect to the network. Some devices such as Internet of Things (IoT) clients may not support the 802.1x security protocol. These devices can connect to the network using the PSK authentication mechanism.
If all the clients are using the same key and if the key is shared with unauthorized users, then it leads to security breach.
The IPSK feature enables the administrator to configure WPA-PSK protocol-based unique pre-shared keys in the same SSID. This pre-shared key can be issued to an individual or group of users for their devices to connect to the network easily and safely. This also helps in identifying and managing a set of devices without affecting the other pre-shared key devices connected to the network. These keys can be configured with rules to authenticate and provide the appropriate level of access in the network.
Here, the AAA RADIUS server key is used to authenticate the client.
For documentation on Cisco ISE configuration, see the relevant administration guide at https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-installation-and-configuration-guides-list.html.
This section contains the following subsections:
Prerequisites for Identity PSK
The RADIUS server must be configured to return the following Cisco AV pairs in its response to the MAC-filtering authentication request:
-
psk-mode=ascii
-
psk=cisco123
Key length must be between 8 and 63 characters for ASCII and 64 characters for HEX. If the key configured on the RADIUS server does not meet the length requirement, the client can be authenticated with PSK configured on the WLAN.
Configuring Identity PSK (GUI)
Procedure
Step 1 |
Choose WLAN to open the WLAN page. |
Step 2 |
Create a new WLAN or click an existing WLAN. |
Step 3 |
Check the Status Enabled check box. |
Step 4 |
Choose tab. |
Step 5 |
Choose WPA+WPA2 or WPA2+WPA3 from the Layer 2 Security drop-down list. |
Step 6 |
In the Security Type drop-down list, select Personal. |
Step 7 |
(Optional) Check the MAC Filtering check box. |
Step 8 |
Check the AutoConfig iPSK check box. |
Step 9 |
Choose tab. |
Step 10 |
Check the Authentication Servers Enabled check box. |
Step 11 |
Select the Server IP address and port number from the drop-down list. If the RADIUS server is not configured, the RADIUS server is selected from the global list. |
Step 12 |
Choose Advanced tab. |
Step 13 |
Check the Allow AAA Override Enabled check box to enable AAA override. The default value is disabled. |
Step 14 |
Click Apply. |