Personal Pre-Shared Key Feature in CBW Access Point

Objective

This article will explain the personal pre-shared key (PSK) feature in Cisco Business Wireless (CBW) Access Point (AP) firmware version 10.6.1.0.

Applicable Devices | Software Version

• Cisco Business Wireless 140AC Access Point | 10.6.1.0 (Download latest)
• Cisco Business Wireless 145AC Access Point | 10.6.1.0 (Download latest)
• Cisco Business Wireless 240AC Access Point | 10.6.1.0 (Download latest)

Introduction

If you have CBW gear in your network, you can now use the personal PSK feature in firmware version 10.6.1.0!

Personal PSK, also referred to as Individual PSK (iPSK), is a feature that allows an administrator to issue unique pre-shared keys to individual devices for the same Wi-Fi Protected Access II (WPA2) personal Wireless Local Area Network (WLAN). The unique PSK is tied to the MAC address of the device. This is not supported in WLANs where WPA3 policy is enabled.

This feature authenticates the client using a RADIUS Server. It is generally intended for use by IoT devices and company issued laptops and mobile devices.

Table of Contents

• Prerequisites
• Configure CBW RADIUS Settings
• Configure WLAN Settings
• Next Steps

Prerequisites

• Make sure you have upgraded the CBW AP firmware to 10.6.1.0. Click if you would like step-by-step instructions on doing a firmware update.
• You will require a RADIUS server where the personal PSK and the MAC address of the device need to be configured.
• This CBW feature is supported with three different RADIUS servers - FreeRADIUS, Microsoft’s NPS, and Cisco’s ISE. The configuration will vary depending on the RADIUS server used.

Configure CBW RADIUS Settings

To configure the RADIUS settings on the CBW AP, follow the steps.

Step 1

Login to the web user interface (UI) of the CBW AP.

Step 2

Click the bi-directional arrow symbol to switch to expert view.

Step 3

Navigate to Management > Admin Accounts.

Step 4

Select the RADIUS tab.

Step 5

Click on Add RADIUS Authentication Server.

Step 6

Configure the following:

• Server Index - Select 1 through 6
• Network User - Enable the state. By default, this is Enabled
• Management - Enable the state. By default, this is Enabled
• State - Enable the state. By default, this is Enabled
• CoA – Make sure charge of authority (CoA) is enabled.
• Server IP Address - Enter the IPv4 address of the RADIUS server
• Shared Secret - Enter the shared secret key
• Port Number - Enter the port number being used for communicating with the RADIUS server.
• Server Timeout - Enter the server timeout

Click Apply.

Configure WLAN Settings

Create a WLAN as a standard WPA2 Personal Secured WLAN.

Step 1

Navigate to Wireless Settings > WLANs.

Step 2

Click on Add new WLAN/RLAN.

Step 3

Under General tab, enter a Profile Name for the WLAN.

Step 4

Navigate to WLAN Security tab and enable MAC Filtering by sliding the toggle.

Step 5

Click on Add RADIUS Authentication Server to add the RADIUS server that was configured in the previous section to provide authentication for this WLAN.

Step 6

A pop-up window will appear. Enter the Server IP Address, State, and Port Number. Click Apply.

Step 7

(Optional)

Enable Authentication Caching. When you enable this option, the following fields are displayed.

• User Cache Timeout - Specifies the time period at which the authenticated credential in the cache expires.
• User Cache Reuse - Use the credentials cache information before cache timeout. By default, this
  is disabled.

Step 8

Navigate to the Advanced tab. Enable Allow AAA Override by sliding the toggle.

Next Steps

Once you have configured the settings on your CBW AP and set up your RADIUS server, you should be able to connect your device. Enter the custom PSK configured for that MAC address, and it will join the network.

If you have configured authentication caching, you will be able to see the devices that have joined the WLAN by going to the Auth Cached Users tab under Admin Accounts. If needed, this can be deleted.

Conclusion

There you go! You can now enjoy the benefits of personal PSK feature on your CBW AP.