Cisco Wireless LAN Controller Configuration Guide, Release 7.5
Configuring Layer2 Security
Downloads: This chapterpdf (PDF - 1.5MB) The complete bookPDF (PDF - 19.52MB) | The complete bookePub (ePub - 4.58MB) | Feedback

Configuring Layer2 Security

Prerequisites for Layer 2 Security

WLANs with the same SSID must have unique Layer 2 security policies so that clients can make a WLAN selection based on information advertised in beacon and probe responses. The available Layer 2 security policies are as follows:

  • None (open WLAN)
  • Static WEP or 802.1X

    Note


    Because static WEP and 802.1X are both advertised by the same bit in beacon and probe responses, they cannot be differentiated by clients. Therefore, they cannot both be used by multiple WLANs with the same SSID.


  • CKIP
  • WPA/WPA2

    Note


    Although WPA and WPA2 cannot be used by multiple WLANs with the same SSID, you can configure two WLANs with the same SSID with WPA/TKIP with PSK and Wi-Fi Protected Access (WPA )/Temporal Key Integrity Protocol (TKIP) with 802.1X, or with WPA/TKIP with 802.1X or WPA/AES with 802.1X.


Configuring Static WEP Keys (CLI)

Controllers can control static WEP keys across access points. Use these commands to configure static WEP for WLANs:

  • Disable the 802.1X encryption by entering this command: config wlan security 802.1X disable wlan_id
  • Configure 40/64-bit or 104/128-bit WEP keys by entering this command: config wlan security static-wep-key encryption wlan_id { 40 | 104} { hex | ascii} key key_index
    • Use the 40 or 104 option to specify 40/64-bit or 104/128-bit encryption. The default setting is 104/128.
    • Use the hex or ascii option to specify the character format for the WEP key.
    • Enter 10 hexadecimal digits (any combination of 0-9, a-f, or A-F) or five printable ASCII characters for 40-bit/64-bit WEP keys or enter 26 hexadecimal or 13 ASCII characters for 104-bit/128-bit keys.
    • Enter a key index (sometimes called a key slot). The default value is 0, which corresponds to a key index of 1; the valid values are 0 to 3 (key index of 1 to 4).

Configuring Dynamic 802.1X Keys and Authorization (CLI)

Controllers can control 802.1X dynamic WEP keys using Extensible Authentication Protocol (EAP) across access points and support 802.1X dynamic key settings for WLANs.


Note


To use LEAP with lightweight access points and wireless clients, make sure to choose Cisco-Aironet as the RADIUS server type when configuring the CiscoSecure Access Control Server (ACS).


  • Check the security settings of each WLAN by entering this command: show wlan wlan_id The default security setting for new WLANs is 802.1X with dynamic keys enabled. To maintain robust Layer 2 security, leave 802.1X configured on your WLANs.
  • Disable or enable the 802.1X authentication by entering this command: config wlan security 802.1X {enable | disable} wlan_id After you enable 802.1X authentication, the controller sends EAP authentication packets between the wireless client and the authentication server. This command allows all EAP-type packets to be sent to and from the controller.

    Note


    The controller performs both web authentication and 802.1X authentication in the same WLAN. The clients are initially authenticated with 802.1X. After a successful authentication, the client must provide the web authentication credentials. After a successful web authentication, the client is moved to the run state.


  • Change the 802.1X encryption level for a WLAN by entering this command: config wlan security 802.1X encryption wlan_id [ 0 | 40 | 104]
    • Use the 0 option to specify no 802.1X encryption.
    • Use the 40 option to specify 40/64-bit encryption.
    • Use the 104 option to specify 104/128-bit encryption. (This is the default encryption setting.)

Configuring 802.11r BSS Fast Transition

Restrictions for 802.11r Fast Transition

  • This feature is not supported on Mesh access points.
  • For the access points in FlexConnect mode:
    • 802.11r Fast Transition is supported only in central and locally switched WLANs.
    • This feature is not supported for the WLANs enabled for local authentication.
  • This feature is not supported on Linux-based APs such as Cisco 600 Series OfficeExtend Access Points.
  • 802.11r client association is not supported on access points in standalone mode.
  • 802.11r fast roaming is not supported on access points in standalone mode.
  • 802.11r fast roaming between local authentication and central authentication WLAN is not supported.
  • 802.11r fast roaming is not supported if the client uses Over-the-DS preauthentication in standalone mode.
  • EAP LEAP method is not supported. WAN link latency prevents association time to a maximum of 2 seconds.
  • The service from standalone AP to client is only supported until the session timer expires.
  • TSpec is not supported for 802.11r fast roaming. Therefore, RIC IE handling is not supported.
  • If WAN link latency exists, fast roaming is also delayed. Voice or data maximum latency should be verified. The controller handles 802.11r Fast Transition authentication request during roaming for both Over-the-Air and Over-the-DS methods.
  • This feature is supported only on open and WPA2 configured WLANs.
  • Legacy clients cannot associate with a WLAN that has 802.11r enabled if the driver of the supplicant that is responsible for parsing the Robust Security Network Information Exchange (RSN IE) is old and not aware of the additional AKM suites in the IE. Due to this limitation, clients cannot send association requests to WLANs. These clients, however, can still associate with non-802.11r WLANs. Clients that are 802.11r capable can associate as 802.11i clients on WLANs that have both 802.11i and 802.11r Authentication Key Management Suites enabled. The workaround is to enable or upgrade the driver of the legacy clients to work with the new 802.11r AKMs, after which the legacy clients can successfully associate with 802.11r enabled WLANs. Another workaround is to have two SSIDs with the same name but with different security settings (FT and non-FT).
  • Fast Transition resource request protocol is not supported because clients do not support this protocol. Also, the resource request protocol is an optional protocol.
  • To avoid any Denial of Service (DoS) attack, each controller allows a maximum of three Fast Transition handshakes with different APs.

Information About 802.11r Fast Transition

802.11r, which is the IEEE standard for fast roaming, introduces a new concept of roaming where the initial handshake with the new AP is done even before the client roams to the target AP, which is called Fast Transition (FT). The initial handshake allows the client and APs to do the Pairwise Transient Key (PTK) calculation in advance. These PTK keys are applied to the client and AP after the client does the reassociation request or response exchange with new target AP.

802.11r provides two methods of roaming:
  • Over-the-Air
  • Over-the-DS (Distribution System)

The FT key hierarchy is designed to allow clients to make fast BSS transitions between APs without requiring reauthentication at every AP. WLAN configuration contains a new Authenticated Key Management (AKM) type called FT (Fast Transition).

How a Client Roams

For a client to move from its current AP to a target AP using the FT protocols, the message exchanges are performed using one of the following two methods:
  • Over-the-Air—The client communicates directly with the target AP using IEEE 802.11 authentication with the FT authentication algorithm.
  • Over-the-DS—The client communicates with the target AP through the current AP. The communication between the client and the target AP is carried in FT action frames between the client and the current AP and is then sent through the controller.
Figure 1. Message Exchanges when Over the Air client roaming is configured. This figure shows the sequence of message exchanges that occur when Over the Air client roaming is configured.

Figure 2. Message Exchanges when Over the DS client roaming is configured. This figure shows the sequence of message exchanges that occur when Over the DS client roaming is configured.

Configuring 802.11r Fast Transition (GUI)


    Step 1   Choose WLANs to open the WLANs page.
    Step 2   Click the WLAN ID to open the WLANs > Edit page.
    Step 3   Choose the Security > Layer 2 tab.
    Step 4   From the Layer 2 Security drop-down list, choose WPA+WPA2.

    The Authentication Key Management parameters for Fast Transition appear.

    Step 5   Select or unselect the Fast Transition check box to enable or disable Fast Transition on the WLAN.
    Step 6   Select or unselect the Over the DS check box to enable or disable Fast Transition over a distributed system.

    This option is available only if you enable Fast Transition.

    Step 7   In the Reassociation Timeout box, enter the number of seconds after which the reassociation attempt of a client to an AP should time out.

    The valid range is 1 to 100 seconds.

    This option is available only if you enable Fast Transition.

    Step 8   Under Authentication Key Management, choose between FT 802.1X or FT PSK. Select or unselect the corresponding check boxes to enable or disable the keys. If you select the FT PSK check box, then, from the PSK Format drop-down list, choose ASCII or Hex and enter the key value.
    Step 9   From the WPA gtk-randomize State drop-down list, choose Enable or Disable to configure the WPA group temporal key (GTK) randomize state.
    Step 10   Click Apply to save your settings.

    Configuring 802.11r Fast Transition (CLI)


      Step 1   To enable or disable 802.11r fast transition parameters, use the config wlan security ft {enable | disable} wlan-id command.

      By default, the fast transition is disabled.

      Step 2   To enable or disable 802.11r fast transition parameters over a distributed system, use the config wlan security ft over-the-ds {enable | disable} wlan-id command.

      By default, the fast transition over a distributed system is disabled.

      Step 3   To enable or disable the authentication key management for fast transition using preshared keys (PSK), use the config wlan security wpa akm ft-psk {enable | disable} wlan-id command.

      By default, the authentication key management using PSK is disabled.

      Step 4   To enable or disable the authentication key management for fast transition using 802.1X, use the config wlan security wpa akm ft-802.1X {enable | disable} wlan-id command.

      By default, the authentication key management using 802.1X is disabled.

      Step 5   To enable or disable 802.11r fast transition reassociation timeout, use the config wlan security ft reassociation-timeouttimeout-in-seconds wlan-id command.

      The valid range is 1 to 100 seconds. The default value of reassociation timeout is 20 seconds.

      Step 6   To enable or disable the authentication key management for fast transition over a distributed system, use the config wlan security wpa akm ft over-the-ds {enable | disable} wlan-id command.

      By default, the authentication key management for fast transition over a distributed system is enabled.

      Step 7   To view the fast transition configuration on a client, use the show client detailed client-mac command.
      Step 8   To view the fast transition configuration on a WLAN, use the show wlan wlan-id command.
      Step 9   To enable or disable debugging of fast transition events, use the debug ft events {enable | disable} command.
      Step 10   To enable or disable debugging of key generation for fast transition, use the debug ft keys {enable | disable} command.

      Troubleshooting 802.11r BSS Fast Transition

      Symptom Resolution
      Non-802.11r legacy clients are no longer connecting. Check if the WLAN has FT enabled. If so, non-FT WLAN will need to be created.
      When configuring WLAN, the FT setup options are not shown. Check if WPA2 is being used (802.1x / PSK). FT is supported only on WPA2 and OPEN SSIDs.
      802.11r clients appear to reauthenticate when they do a Layer 2 roam to a new controller. Check if the reassociation timeout has been lowered from the default of 20 by navigating to WLANs > WLAN Name > Security > Layer 2 on the controller GUI.

      Configuring MAC Authentication Failover to 802.1X Authentication

      You can configure the controller to start 802.1X authentication when MAC authentication with static WEP for the client fails. If the RADIUS server rejects an access request from a client instead of deauthenticating the client, the controller can force the client to undergo an 802.1X authentication. If the client fails the 802.1X authentication too, then the client is deauthenticated.

      If MAC authentication is successful and the client requests for an 802.1X authentication, the client has to pass the 802.1X authentication to be allowed to send data traffic. If the client does not choose an 802.1X authentication, the client is declared to be authenticated if the client passes the MAC authentication.

      Configuring MAC Authentication Failover to 802.1x Authentication (GUI)


        Step 1   Choose WLANs > WLAN ID to open the WLANs > Edit page.
        Step 2   In the Security tab, click the Layer 2 tab.
        Step 3   Select the MAC Filtering check box.
        Step 4   Select the Mac Auth or Dot1x check box.

        Configuring MAC Authentication Failover to 802.1X Authentication (CLI)

        To configure MAC authentication failover to 802.1X authentication, enter this command:

        config wlan security 802.1X on-macfilter-failure {enable | disable} wlan-id


        Configuring 802.11w

        Restrictions for 802.11w

        • Cisco's legacy Management Frame Protection is not related to the 802.11w standard that is implemented in the 7.4 release.
        • The 802.11w standard is supported on all 802.11n capable APs except those that are configured for FlexConnect operation.
        • The 802.11w standard is supported on the following Cisco Wireless LAN Controller model series: 2500, 5500, 8500, and WiSM2. The 802.11w standard is not supported on the following Cisco Wireless LAN Controller models: Flex 7500 and Virtual Wireless LAN Controller.
        • When 802.11w is set to optional and the keys are set, the AKM suite still shows 802.11w as disabled; this is a Wi-Fi limitation.
        • 802.11w cannot be applied on an open WLAN, WEP-encrypted WLAN, or a TKIP-encrypted WLAN.
        • The WLAN on which 802.11w is configured must have either WPA2-PSK or WPA2-802.1x security configured.

        Information About 802.11w

        Wi-Fi is a broadcast medium that enables any device to eavesdrop and participate either as a legitimate or rogue device. Control and management frames such as authentication/deauthentication, association/disassociation, beacons, and probes are used by wireless clients to select an AP and to initiate a session for network services.

        Unlike data traffic which can be encrypted to provide a level of confidentiality, these frames must be heard and understood by all clients and therefore must be transmitted as open or unencrypted. While these frames cannot be encrypted, they must be protected from forgery to protect the wireless medium from attacks. For example, an attacker could spoof management frames from an AP to tear down a session between a client and AP.

        The 802.11w standard for Management Frame Protection is implemented in the 7.4 release.

        The 802.11w protocol applies only to a set of robust management frames that are protected by the Management Frame Protection (PMF) service. These include Disassociation, Deauthentication, and Robust Action frames.

        Management frames that are considered as robust action and therefore protected are the following:
        • Spectrum Management
        • QoS
        • DLS
        • Block Ack
        • Radio Measurement
        • Fast BSS Transition
        • SA Query
        • Protected Dual of Public Action
        • Vendor-specific Protected
        When 802.11w is implemented in the wireless medium, the following occur:
        • Client protection is added by the AP adding cryptographic protection (by including the MIC information element) to deauthentication and disassociation frames preventing them from being spoofed in a DOS attack.
        • Infrastructure protection is added by adding a Security Association (SA) teardown protection mechanism consisting of an Association Comeback Time and an SA-Query procedure preventing spoofed association request from disconnecting an already connected client.

        Configuring 802.11w (GUI)


          Step 1   Choose WLANs > WLAN ID to open the WLANs > Edit page.
          Step 2   In the Security tab, choose the Layer 2 security tab.
          Step 3   From the Layer 2 Security drop-down list, choose WPA+WPA2.

          The 802.11w IGTK Key is derived using the 4-way handshake, which means that it can only be used on WLANs that are configured for WPA2 security at Layer 2.

          Note   

          WPA2 is mandatory and encryption type must be AES. TKIP is not valid.

          Step 4   Choose the PMF state from the drop-down list
          The following options are available:
          • Disabled—Disables 802.11w MFP protection on a WLAN
          • Optional—To be used if the client supports 802.11w.
          • Required—Ensures that the clients that do not support 802.11w cannot associate with the WLAN.
          Step 5   If you choose the PMF state as either Optional or Required, do the following:
          1. In the Comeback Timer box, enter the association comeback interval in milliseconds. It is the time within which the access point reassociates with the client after a valid security association.
          2. In the SA Query Timeout box, enter the maximum time before an Security Association (SA) query times out.
          Step 6   In the Authentication Key Management section, follow these steps:
          1. Select or unselect the PMF 802.1X check box to configure the 802.1X authentication for the protection of management frames.
          2. Select or unselect the PMF PSK check box to configure the preshared keys for PMF. Choose the PSK format as either ASCII or Hexadecimal and enter the PSK.
          Step 7   Click Apply.
          Step 8   Click Save Configuration.

          Configuring 802.11w (CLI)

          • Configure the 802.1X authentication for PMF by entering this command:

            config wlan security wpa akm pmf 802.1x {enable | disable} wlan-id

          • Configure the preshared key support for PMF by entering this command:

            config wlan security wpa akm pmf psk {enable | disable} wlan-id

          • If not done, configure a preshared key for a WLAN by entering this command:

            config wlan security wpa akm psk set-key {ascii | hex} psk wlan-id

          • Configure protected management frames by entering this command:

            config wlan security pmf {disable | optional | required} wlan-id

          • Configure the association comeback time settings by entering this command:

            config wlan security pmf association-comeback timeout-in-seconds wlan-id

          • Configure the SA query retry timeout settings by entering this command:

            config wlan security pmf saquery-retrytimeout timeout-in-milliseconds wlan-id

          • See the 802.11w configuration status for a WLAN by entering this command:

            show wlan wlan-id

          • Configure the debugging of PMF by entering this command:

            debug pmf events {enable | disable}