How to configure WLAN security | WLAN Security | Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.x

Configures security settings for a wireless LAN (WLAN) to protect access and data on your network.

Configure static WEP Layer 2 security parameters (GUI)

Configure static WEP layer 2 security parameters to secure wireless network communication using WEP encryption keys.

Use this procedure when you need to configure WEP layer 2 security for a WLAN. Static WEP provides basic encryption for wireless communications using either 40-bit or 104-bit encryption keys.

Procedure

Choose Configuration > Tags & Profiles > WLANs.
On the WLANs page, click the name of the WLAN.
In the Edit WLAN window, click the Security tab.
From the Layer 2 Security Mode drop-down list, select the Static WEP option.
(Optional) Check the Shared Key Authentication check box to set the authentication type as shared. By leaving the check box unchecked, the authentication type is set to open.
Set the Key Size as either 40 bits or 104 bits.
- 40 bits: The keys with 40-bit encryption must contain 5 ASCII text characters or 10 hexadecimal characters.
- 104 bits: The keys with 104-bit encryption must contain 13 ASCII text characters or 26 hexadecimal characters.
Set the appropriate Key Index; you can choose between 1 to 4.
Set the Key Format as either ASCII or Hex.
Enter a valid Encryption Key.
- 40 bits: The keys with 40-bit encryption must contain 5 ASCII text characters or 10 hexadecimal characters.
- 104 bits: The keys with 104-bit encryption must contain 13 ASCII text characters or 26 hexadecimal characters.
Click Update & Apply to Device.

The WLAN is configured with static WEP layer 2 security parameters. The settings are applied to the device and WEP encryption is enabled for the wireless network.

Configure static WEP layer 2 security parameters (CLI)

Set up static WEP encryption and authentication for WLAN security.

Static WEP provides basic wireless security through shared encryption keys. This configuration is used when legacy devices require WEP compatibility, though WPA/WPA2 is recommended for better security.

Before you begin

You must have administrator privileges.

Procedure

Enter global configuration mode.
Example:
```
Device# configure terminal
```
Enter WLAN configuration submode.
Example:
```
Device# wlan profile-name wlan-id SSID-Name
```
Example:
```
Device# wlan test4 1 test4
```
profile-name is the profile name of the configured WLAN.

wlan-id is the wireless LAN identifier. The range is 1 to 512.

SSID_Name is the SSID which can contain 32 alphanumeric characters.

Note

If you have already configured this command, enter wlan profile-name command.
Disable fast transition over the data source on the WLAN.
Example:
```
Device(config-wlan)# no security ft over-the-ds
```
Disable 802.11r Fast Transition on the WLAN.
Example:
```
Device(config-wlan)# no security ft
```

Disable the WPA/WPA2 support for a WLAN.

Example:

Device(config-wlan)# no security wpa wpa1 ciphers tkip

Configure Static WEP Key authentication with authentication type.
Example:
```
Device(config-wlan)# security static-wep-key authentication open
```
The keywords are as follows:
- static-wep-key : Configures Static WEP Key authentication.
- authentication : Specifies the authentication type you can set. The values are open and shared.
Configure Static WEP Key encryption parameters.
Example:
```
Device(config-wlan)# security static-wep-key encryption 104 ascii 0 encryption-key key-index
```
Example:
```
Device(config-wlan)# security static-wep-key encryption 104 ascii 0 1234567890123 1
```
The keywords are as follows:
- static-wep-key : Configures Static WEP Key authentication.
- encryption : Specifies the encryption type that you can set. The valid values are 104 and 40. 40-bit keys must contain 5 ASCII text characters or 10 hexadecimal characters. 104-bit keys must contain 13 ASCII text characters or 26 hexadecimal characters.
- ascii : Specifies the key format as ASCII.
- hex : Specifies the key format as HEX.
Exit configuration mode and return to privileged EXEC mode.
Example:
```
Device(config-wlan)# end
```

Static WEP layer 2 security is now configured on the WLAN with the specified authentication and encryption parameters.

Configure WPA + WPA2 Layer 2 security parameters (GUI)

This task configures WPA + WPA2 layer 2 security parameters to secure wireless network communications using the graphical user interface.

Use this procedure when you need to set up wireless network security using both WPA and WPA2 protocols through the GUI interface. This configuration provides enhanced security for your wireless network by supporting both protocols simultaneously.

Procedure

Click Configuration > Tags and Profiles > WLANs.
Click Add to add a new WLAN Profile or click the one you want to edit.
In the Edit WLAN window, click Security > Layer2.
From Layer 2 Security Mode drop-down menu, select WPA + WPA2.
Configure the security parameters and then click Save and Apply to Device.

The WPA + WPA2 layer 2 security parameters are configured and applied to the device. The WLAN profile now uses both WPA and WPA2 security protocols to protect wireless network communications.

Configure WPA + WPA2 layer 2 security parameters (CLI)

This task configures WPA and WPA2 layer 2 security settings to secure wireless networks using command-line interface commands.

Note

The default values for security policy WPA2 are:

Encryption is AES.

Authentication Key Management (AKM) is dot1x.

Before you begin

You must have administrator privileges.

Follow these steps to configure WPA + WPA2 layer 2 security parameters using commands:

Procedure

Enter global configuration mode.
Example:
```
Device# configure terminal
```
Enter the WLAN configuration submode.wlan
Example:
```
Device(config)# wlan profile-name wlan-id SSID_name
```
Example:
```
Device(config)# wlan test4 1 test4
```
- profile-name is the profile name of the configured WLAN.
- wlan-id is the wireless LAN identifier. The range is from 1 to 512.
- SSID_name is the SSID that contains 32 alphanumeric characters.
Note

If you have already configured this command, enter wlan profile-name command.

Enables WPA or WPA2 support for WLAN.

Example:

Device(config-wlan)# security wpa {akm | wpa1 | wpa2}

Device(config-wlan)# security wpa

Enables WPA.
Example:
```
Device(config-wlan)# security wpa wpa1
```
Specify the WPA1 cipher.
Example:
```
Device(config-wlan)# security wpa wpa1 ciphers [aes | tkip]
```
```
Device(config-wlan)# security wpa wpa1 ciphers aes
```
Choose one of the following encryption types:
- aes : Specifies WPA/AES support.
- tkip : Specifies WPA/TKIP support.
The default values are TKIP for WPA1 and AES for WPA2.

Note

You can enable or disable TKIP encryption only using the CLI. Configuring TKIP encryption is not supported in GUI.

When you have VLAN configuration on WGB, you need to configure the encryption cipher mode and keys for a particular VLAN, for example, encryption VLAN 80 mode ciphers TKIP. Then, you need to configure the encryption cipher mode globally on the multicast interface by entering the following command: encryption mode ciphers TKIP.
Enable or disable Cisco Centralized Key Management, 802.1x, 802.1x with SHA256 key derivation type, Fast Transition, PSK or PSK with SHA256 key derivation type.security WPA AKM {CCKM| dot1x | dot1x-sha256 | ft | PSK |PSK-sha256}
Example:
```
Device(config-wlan)# security wpa akm {cckm | dot1x | dot1x-sha256 | ft | psk | psk-sha256}
```
```
Device(config-wlan)# security wpa akm psk-sha256
```
Note
- You cannot enable 802.1x and PSK with SHA256 key derivation type simultaneously.
- When you configure Cisco Centralized Key Management SSID, you must enable the ccx aironet-iesupport for Cisco Centralized Key Management to work.
- WPA3 Enterprise dot1x-sha256 is supported only in local mode.
Enter this command to specify a preshared key, if you have enabled PSK.
Example:
```
Device(config-wlan)# security wpa psk set-key {ascii | hex} {0 | 8} password
```
```
Device(config-wlan)# security wpa psk set-key ascii 0 test
```
WPA preshared keys must contain 8 to 63 ASCII text characters or 64 hexadecimal characters.
Enable or disable authentication key management suite for fast transition.
Example:
```
Device(config-wlan)# security wpa akm ft {dot1x | psk | sae}
```
```
Device(config-wlan)# security wpa akm ft psk
```
Note

You can now choose between PSK and fast transition PSK as the AKM suite.
Enable WPA2.
Example:
```
Device(config-wlan)# security wpa wpa2
```
Configure WPA2 cipher. security wpa wpa2 ciphers aes
Example:
```
Device(config-wlan)# security wpa wpa2
```
Example:
- aes : Specifies WPA/AES support.
show wireless pmk-cache
Displays the remaining time before the PMK cache lifetime timer expires.

If you have enabled WPA2 with 802.1X authenticated key management or WPA1 or WPA2 with Cisco Centralized Key Management authenticated key management, the PMK cache lifetime timer is used to trigger reauthentication with the client when necessary. The timer is based on the timeout value received from the AAA server or the WLAN session timeout setting.

If you configure 802.1x with session timeout between 0 and 299, Pairwise Master Key (PMK) cache is created with a timer of 1 day 84600 seconds.
Note
- The command will show VLAN ID with VLAN pooling feature in VLAN-Override field.
- Sticky key caching (SKC) is not supported.

WPA and WPA2 layer 2 security parameters are configured for the WLAN. The wireless network is secured with the specified authentication and encryption settings.