SSID Configuration

Just as you use the Express Setup page to assign basic settings, you can use the Express Security page to create unique SSIDs and assign one of three security types to them. The Express Security page helps you configure your basic security settings. You can use the web-browser interface's main Security page to configure more advanced security settings. Because the Express Security page is designed for simple configuration of basic security, the options available are a subset of the access point's security capabilities. Refer to the Cisco IOS Software Configuration Guide for the limitations when using the Express Security page.

SSID

In Cisco IOS Release 12.3(7)JA, there is no default SSID. You must create an SSID before you can enable the radio interface. The SSIDs that you create appear in the SSID table at the bottom of the page. You can create up to 16 SSIDs on the wireless device. On dual-radio wireless devices, the SSIDs that you create are enabled on both radio interfaces. Refer to Configuring Multiple BSSIDs for further procedural information.

Note: In this text field, the following characters are not allowed: TAB, ?, $, +, [. In addition, the following three characters cannot be the first character: !, #, and ;.

Broadcast SSID in Beacon

This setting is active only when the device is in the Root AP mode. When you broadcast the SSID, devices that do not specify an SSID can associate to the bridge when it is a root access point. This is a useful option for an SSID used by guests or by client devices in a public space. If you do not broadcast the SSID, client devices cannot associate to the access point unless their SSIDs match this SSID. Only one SSID can be included in the beacon.

VLAN

If you use VLANs on your wireless LAN and assign SSIDs to VLANs, you can create multiple SSIDs using any of the four security settings on the Express Security page. However, if you do not use VLANs on your wireless LAN, the security options that you can assign to SSIDs are limited because, on the Express Security page, encryption settings and authentication types are linked. Without VLANs, encryption settings (WEP and ciphers) apply to an interface, such as the 2.4-GHz radio, and you cannot use more than one encryption setting on an interface.

No VLAN

Select this setting if you are not using VLANs.

Enable VLAN ID

Select this setting if you want to specify the virtual Ethernet LAN identification number tied to the SSID.

Native VLAN

Select this setting if you want this VLAN ID to be the native VLAN.

Security

You can assign four security types to an SSID.

• No Security - This is the least-secure option. You should use this option only for SSIDs used in a public space and assign it to a VLAN that restricts access to your network.
• Static WEP Key - This option is more secure than no security. However, static WEP keys are vulnerable to attack. If you configure this setting, you should consider limiting association to the access point based on MAC address or, if your network does not have a RADIUS server, consider using an access point as a local authentication server. This security feature enables mandatory WEP. Client devices cannot associate using this SSID without a WEP key that matches the access point's key.
• EAP Authentication - This option enables 802.1x authentication (such as LEAP, PEAP, EAP-TLS, EAP-GTC, EAP-SIM, and others) and requires you to enter the IP address and shared secret for an authentication server on your network (server authentication port 1645). Because 802.1x authentication provides dynamic encryption keys, you do not need to enter a WEP key. This security features enables mandatory 802.1x authentication. Client devices that associate using this SSID must be WPA-capable.
• WPA - Wi-Fi Protected Access (WPA) permits wireless access to users authenticated against a database through the services of an authentication server, then encrypts their IP traffic with stronger algorithms than those used in WEP. As with EAP authentication, you must enter the IP address and shared secret for an authentication server on your network (server authentication port 1645). This security feature enables mandatory WPA authentication. Client devices that associate using this SSID must be WPA-capable.

SSID Table

This table displays the SSID and the VLAN, encryption, authentication, and key management options associated with it.

See Also: Using Express Security