Provides instructions for configuring, disabling, and monitoring 802.11w, including step-by-step procedures for GUI-based and other configurations to ensure effective implementation and management of 802.11w features.

Configure 802.11w (GUI)

To protect management traffic against spoofing and replay attacks, configure 802.11w settings after enabling WPA and AKM.

Enable protected management frames (PMF) on a WLAN to strengthen security for management communications.

Before you begin

Ensure WPA and AKM are configured on the target WLAN.

Procedure

Choose Configuration > Tags & Profiles > WLANs.
Click Add to create WLANs.

The Add WLAN page is displayed.
In the Security > Layer2 tab, navigate to the Protected Management Frame section.
Choose PMF as Disabled, Optional, or Required. By default, the PMF is disabled.
If you choose PMF as Optional or Required, you can view these fields:
- Association Comeback Timer—Enter a value between 1 and 10 seconds to configure 802.11w association comeback time.
- SA Query Time—Enter a value between 100 to 500 milliseconds. This is required for clients to negotiate 802.11w PMF protection on a WLAN.
Click Save & Apply to Device.

802.11w PMF is enabled with the parameters you selected. This strengthens the security of management frames on the WLAN.

Configure 802.11w (CLI)

Configuring 802.11w improves security for management frames on wireless LANs.

Enable 802.11w Protected Management Frames (PMF) on a WLAN using CLI commands.

Before you begin

Configure WPA.
Configure AKM (Authentication and Key Management) on the WLAN.

Procedure

Enter global configuration mode.
Example:
```
Device# configure terminal
```
Configure a WLAN and enters configuration mode.
Example:
```
Device(config)# wlan profile-name wlan-id ssid
```
Configure 802.1x support using the security wpa akm dot1x-sha256 command.
Example:
```
Device(config-wlan)#security wpa akm dot1x-sha256
```

Configure the 802.11w association comeback time.

Example:

Device(config-wlan)# security pmf association-comeback comeback-interval

Example:

Device(config-wlan)# security pmf association-comeback 10

Require clients to negotiate 802.11w PMF protection on a WLAN.
Example:
```
Device(config-wlan)# security pmf mandatory  
```
Configure time interval identified in milliseconds before which the SA query response is expected.
Example:
```
Device(config-wlan)# security pmf saquery-retry-time timeout  
```
Example:
```
Device(config-wlan)# security pmf saquery-retry-time 100  
```
If the device does not get a response, another SQ query is tried.

802.11w Protected Management Frames are enabled and mandatory on the specified WLAN, providing improved protection of management frames.

Disable 802.11w

Disabling 802.11w may be necessary for compatibility with legacy or non-compliant devices.

Prevent wireless clients from using 802.11w Protected Management Frames on a specified WLAN.

Procedure

Enter global configuration mode.
Example:
```
Device# configure terminal
```
Configure a WLAN and enters configuration mode.
Example:
```
Device(config)# wlan profile-name wlan-id ssid
```
Disable 802.1x support using the no security wpa akm dot1x-sha256 command.
Example:
```
Device(config-wlan)# no security wpa akm dot1x-sha256
```

Configure the 802.11w association comeback time.

Example:

Device(config-wlan)# security pmf association-comeback comeback-interval

Device(config-wlan)# security pmf association-comeback 10

Disable client negotiation of 802.11w PMF protection on a WLAN.
Example:
```
Device(config-wlan)# no security pmf mandatory  
```

Disable SQ query retry.

Example:

Device(config-wlan)# no security pmf saquery-retry-time 100

802.11w PMF protection is disabled for the specified WLAN.

Monitor 802.11w

Use these commands to monitor 802.11w.

Procedure

Display the WLAN parameters on the WLAN.

The PMF parameters are displayed.

Device# show wlan name wlan-name
                        . . . . 
                        . . . .        
                        Auth Key Management
                        802.1x                             : Disabled
                        PSK                                : Disabled
                        CCKM                               : Disabled
                        FT dot1x                           : Disabled
                        FT PSK                             : Disabled
                        FT SAE                             : Disabled
                        Dot1x-SHA256                       : Enabled
                        PSK-SHA256                         : Disabled
                        SAE                                : Disabled
                        OWE                                : Disabled
                        SUITEB-1X                          : Disabled
                        SUITEB192-1X                       : Disabled
                        CCKM TSF Tolerance                         : 1000
                        FT Support                                 : Adaptive
                        FT Reassociation Timeout               : 20
                        FT Over-The-DS mode                    : Enabled
                        PMF Support                                : Required
                        PMF Association Comeback Timeout       : 1
                        PMF SA Query Time                      : 500
                        . . . . 
                        . . . .

Display the summary of the 802.11w authentication key management configuration on a client.

Device# show wireless client mac-address mac-address detail
                        . . . . 
                        . . . .        
                        Policy Manager State: Run
                        NPU Fast Fast Notified : No
                        Last Policy Manager State : IP Learn Complete
                        Client Entry Create Time : 497 seconds
                        Policy Type : WPA2
                        Encryption Cipher : CCMP (AES)
                        Authentication Key Management : 802.1x-SHA256
                        Encrypted Traffic Analytics : No
                        Management Frame Protection : No
                        Protected Management Frame - 802.11w : Yes
                        EAP Type : LEAP
                        VLAN : 39
                        Multicast VLAN : 0
                        Access VLAN : 39
                        Anchor VLAN : 0
                        WFD capable : No
                        Manged WFD capable : No
                        . . . . 
                        . . . .

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.