Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Private preshared keys

Updated: April 10, 2026

Want to summarize with AI?

Log in

Introduces Private PSK authentication, detailing system limitations, identity PSK operation, and step-by-step procedures for configuring and applying PSKs on WLANs and policy profiles via GUI and CLI, including verification methods for secure wireless access.

A private preshared key (PSK) is a security protocol for network authentication that

  • enables devices to securely connect to wireless local area networks (WLANs),

  • assigns unique keys to individual devices or user groups, reducing the risk of unauthorized access, and

  • ensures compatibility with systems where advanced authentication methods like 802.1X are unsupported.

Understanding identity PSKs

Identity PSKs are unique PSKs created for individuals or groups of users on the same SSID. They provide the same simplicity of PSK while enabling features such as:

  • Stronger security for IoT by supporting devices that do not use 802.1X.

  • Easy revocation of access for a specific device or individual without affecting others.

  • Scalable management of thousands of keys distributed through the AAA server.

These features make Identiy PSKs ideal for IoT, BYOD, and guest deployments.

Limitations

SSID Preshared Key Special Characters

  • Special characters, such as '<' and ‘>’ are supported in SSID Preshared key.

SSID Preshared Key Whitespace Support

PSK supports whitespace in passwords (before or after or in-between) within double quotes only; single quotes for whitespaces are not supported.

How identity PSK authentication works

Summary

The key components involved in the process are:

  • Client device: Sends an association request to connect to the access point.

  • AP: Broadcasts the SSID and forwards association requests to the controller.

  • Embedded Wireless Controller: Constructs RADIUS requests and relays them to the authentication server; manages computation of PSKs and applies received configuration parameters.

  • RADIUS (AAA) server: Authenticates client MAC addresses, authorizes access, and returns passphrases or additional parameters as needed.

Workflow

Here are the stages you will follow for Identity PSK authentication:

  1. The client device attempts to connect to the wireless network by sending an association request to the SSID broadcast by the access point.
  2. The access point forwards the association request to the Embedded Wireless Controller.
  3. The controller creates a RADIUS authentication request packet containing the client’s MAC address and relays it to the RADIUS (AAA) server.
  4. The RADIUS server performs authentication and determines whether the client is authorized.
    • If authorized, the server sends an ACCESS-ACCEPT response; otherwise, it sends an ACCESS-REJECT.
  5. If the client is authorized, the RADIUS server includes the AV-pair passphrase (the identity PSK) in the response, as well as optional parameters such as username, VLAN, and Quality of Service (QoS).
  6. Upon receiving the response, the controller uses the passphrase to compute the Pairwise Master Key (PMK) and apply any additional attributes for the client’s session.
  7. If you have multiple devices, the same passphrase can apply to all of them.
  8. If a configured PSK is shorter than 15 characters (when Federal Information Processing Standard, FIPS, is enabled), the controller allows the WLAN configuration but displays the following console warning:
    Note

    AP is allowed to join but corresponding WLAN will not be pushed to the access point.

Result

Your device will either be granted access to the network with its assigned unique PSK and relevant settings, or access will be denied based on the authentication outcome. This information could be better presented in a separate paragraph or subsection to distinctively address the outcome of the process.

Configure a PSK in a WLAN

Set up security for a pre-shared key (PSK) in a WLAN environment using command-line instructions.

Before you begin

  • Configure security for a pre-shared key (PSK) in a WLAN.

  • If there is no override from the AAA server, the system uses the WLAN value for authentication.

  • In Federal Information Processing Standard (FIPS) and common criteria mode, ensure that the PSK WLAN uses at least 15 ASCII characters.

Procedure

1.

Configure terminal

Example:

Device# configure terminal

Enters global configuration mode.
2.

Configure the WLAN and the SSID

Example:

Device(config)# wlan test-profile 4 abc

Configures the WLAN and SSID.
3.

Disable security AKM for 802.11

Example:

Device(config-wlan)# no security wpa akm dot1x

Disables security AKM for 802.11x.
4.

Configure the security type PSK

Example:

Device(config-wlan)# security wpa akm psk

Configures the security type PSK.
5.

Configure PSK authenticated key management (AKM) shared key

Example:

Device(config-wlan)# security wpa akm psk set-key asci 0

Configures the PSK authenticated key management (AKM) shared key.

Note

You must set the psk set-key before configuring AKM PSK.
6.

Configure PSK support

Example:

Device(config-wlan)# security wpa akm psk

Configures PSK support.
7.

Configure multi-preshared key (MPSK) support

Example:

Device(config-wlan)# security wpa wpa2 mpsk

Configures multi-preshared key (MPSK) support.

Note

Enable AKM PSK to use MPSK.
8.

Specify MAC filtering in WLAN

Example:

Device(config-wlan)# mac-filtering test1

Specifies MAC filtering in a WLAN.

The WLAN is configured to use a pre-shared key for client authentication.

Configure a PSK in a WLAN using GUI

Configure a pre-shared key (PSK) for a WLAN.

Procedure

1.

Choose Configuration > Tags & Profiles > WLANs.
2.

On the Wireless Networks page, click Security tab.
3.

In the Layer 2 window that is displayed, go to the WPA Parameters section.
4.

From the Auth Key Mgmt drop-down, select the PSK format and type.

5.

Enter the Pre-Shared Key in hexadecimal characters.

  • If you selected the PSK format as HEX, the key length must be exactly 64 characters.

  • If you selected the PSK format as ASCII, ensure the key length ranges from 8 to 63 characters.

After configuring the key, these details are not visible due to security reasons. Even if you click on the eye icon next to the Pre-Shared Key box, the details remain hidden.
6.

Click Save & Apply to Device.

The PSK is configured and applied to the selected WLAN.

What to do next

Check the WLAN connectivity to ensure successful configuration.

Apply a policy profile to a WLAN (GUI)

This task helps you configure WLAN by applying policy profiles for better network management.

Procedure

1.

Choose Configuration > Tags & Profiles > Tags.
2.

On the Manage Tags page, click Policy tab.
3.

Click Add to view the Add Policy Tag window.
4.

Enter the policy tag name and its description.
5.

Click Add to map WLAN and policy.
6.

Choose the WLAN profile to map with the appropriate policy profile, then click the tick icon.
7.

Click Save & Apply to Device.

Once the task is completed, you successfully map the WLAN to the chosen policy profile

What to do next

Verify the changes by checking the applied profiles under Wireless Local Area Network (WLAN) settings.

Monitor network performance to confirm the policy effectiveness.

Apply a policy profile to a WLAN using CLI

The goal of this task is to effectively apply a policy profile to a WLAN using CLI commands, which helps manage network configurations efficiently.

Procedure

1.

Enter global configuration mode

Example:

Device# configure terminal

Enters global configuration mode.
2.

Configure the default policy profile

Example:

Device(config)# wireless profile policy policy-iot

Configures the default policy profile.
3.

Configure AAA override to apply policies coming from the AAA server

Example:

Device(config-wireless-policy)# aaa-override

Configures AAA override to apply policies coming from the AAA server or ISE, the Cisco Identity Services Engine server.

Once you apply the policy profile, configure the WLAN with the specified policy settings to enable the expected network management and security features.

What to do next

You should verify the applied configuration by checking the WLAN settings to ensure all policies are correctly enforced.

  • Confirm connectivity and performance with the new settings.

Verify a private PSK

To verify the configuration of a WLAN and a client, use the following show commands

Verify wireless client configuration

Device# show wlan id 2


WLAN Profile Name     : test_ppsk
================================================
Identifier                                     : 2
Network Name (SSID)                            : test_ppsk
Status                                         : Enabled  
Broadcast SSID                                 : Enabled  
Universal AP Admin                             : Disabled 
Max Associated Clients per WLAN                : 0        
Max Associated Clients per AP per WLAN         : 0        
Max Associated Clients per AP Radio per WLAN   : 0        
Number of Active Clients                       : 0        
Exclusionlist Timeout                          : 60       
CHD per WLAN                                   : Enabled  
Interface                                      : default  
Multicast Interface                            : Unconfigured
WMM                                            : Allowed     
WifiDirect                                     : Invalid     
Channel Scan Defer Priority:                                 
  Priority (default)                           : 4           
  Priority (default)                           : 5           
  Priority (default)                           : 6           
Scan Defer Time (msecs)                        : 100         
Media Stream Multicast-direct                  : Disabled    
CCX - AironetIe Support                        : Enabled     
CCX - Diagnostics Channel Capability           : Disabled    
Peer-to-Peer Blocking Action                   : Disabled    
Radio Policy                                   : All         
DTIM period for 802.11a radio                  : 1           
DTIM period for 802.11b radio                  : 1           
Local EAP Authentication                       : Disabled    
Mac Filter Authorization list name             : test1     
Accounting list name                           : Disabled    
802.1x authentication list name                : Disabled    
Security                                                     
    802.11 Authentication                      : Open System 
    Static WEP Keys                            : Disabled    
    802.1X                                     : Disabled    
    Wi-Fi Protected Access (WPA/WPA2)          : Enabled     
        WPA (SSN IE)                           : Disabled    
        WPA2 (RSN IE)                          : Enabled     
            TKIP Cipher                        : Disabled    
            AES Cipher                         : Enabled     
        Auth Key Management                                  
            802.1x                             : Disabled    
            PSK                                : Enabled     
            CCKM                               : Disabled    
            FT dot1x                           : Disabled    
            FT PSK                             : Disabled    
            PMF dot1x                          : Disabled    
            PMF PSK                            : Disabled    
    CCKM TSF Tolerance                         : 1000        
    FT Support                                 : Disabled    
        FT Reassociation Timeout               : 20          
        FT Over-The-DS mode                    : Enabled     
    PMF Support                                : Disabled    
        PMF Association Comeback Timeout       : 1           
        PMF SA Query Time                      : 200         
    Web Based Authentication                   : Disabled    
    Conditional Web Redirect                   : Disabled    
    Splash-Page Web Redirect                   : Disabled    
    Webauth On-mac-filter Failure              : Disabled    
    Webauth Authentication List Name           : Disabled    
    Webauth Parameter Map                      : Disabled    
    Tkip MIC Countermeasure Hold-down Timer    : 60          
Call Snooping                                  : Disabled
Passive Client                                 : Disabled
Non Cisco WGB                                  : Disabled
Band Select                                    : Disabled
Load Balancing                                 : Disabled
Multicast Buffer                               : Disabled
Multicast Buffer Size                          : 0
IP Source Guard                                : Disabled
Assisted-Roaming
    Neighbor List                              : Disabled
    Prediction List                            : Disabled
    Dual Band Support                          : Disabled
IEEE 802.11v parameters
    Directed Multicast Service                 : Disabled
    BSS Max Idle                               : Disabled
        Protected Mode                         : Disabled
    Traffic Filtering Service                  : Disabled
    BSS Transition                             : Enabled
        Disassociation Imminent                : Disabled
            Optimised Roaming Timer            : 40
            Timer                              : 200
    WNM Sleep Mode                             : Disabled
802.11ac MU-MIMO                               : Disabled

Commands for PSK verification

Device# show wireless client mac-address a886.adb2.05f9 detail


Client MAC Address : a886.adb2.05f9
Client IPv4 Address : 9.9.58.246
Client Username : A8-86-AD-B2-05-F9
AP MAC Address : c025.5c55.e400
AP Name: saurabh-3600
AP slot : 1  
Client State : Associated
Policy Profile : default-policy-profile
Flex Profile : default-flex-profile
Wireless LAN Id : 6
Wireless LAN Name: SSS_PPSK
BSSID : c025.5c55.e40f
Connected For : 280 seconds
Protocol : 802.11n - 5 GHz
Channel : 60 
Client IIF-ID : 0xa0000001
Association Id : 1
Authentication Algorithm : Open System
Client CCX version : No CCX support
Session Timeout : 320 sec (Remaining time: 40 sec)
Input Policy Name  :
Input Policy State : None
Input Policy Source : None
Output Policy Name  :
Output Policy State : None
Output Policy Source : None
WMM Support : Enabled
U-APSD Support : Enabled
  U-APSD value : 0
  APSD ACs    : BK, BE, VI, VO
Fastlane Support : Disabled
Power Save : OFF
Current Rate : m22
Supported Rates : 9.0,18.0,36.0,48.0,54.0
Mobility:
  Move Count                  : 0
  Mobility Role               : Local
  Mobility Roam Type          : None
  Mobility Complete Timestamp : 09/27/2017 16:32:25 IST
Policy Manager State: Run
NPU Fast Fast Notified : No
Last Policy Manager State : IP Learn Complete
Client Entry Create Time : 280 seconds
Policy Type : WPA2
Encryption Cipher : CCMP (AES)
Authentication Key Management : PSK
AAA override passphrase: Yes
Management Frame Protection : No
Protected Management Frame - 802.11w : No
EAP Type : Not Applicable
VLAN : 58
Access VLAN : 58
Anchor VLAN : 0
WFD capable : No
Manged WFD capable : No
Cross Connection capable : No
Support Concurrent Operation : No
Session Manager:
  Interface        : capwap_90000005
  IIF ID           : 0x90000005
  Device Type      : Apple-Device
  Protocol Map     : 0x000001
  Authorized       : TRUE
  Session timeout  : 320
  Common Session ID: 1F3809090000005DC30088EA
  Acct Session ID  : 0x00000000
  Auth Method Status List
        Method : MAB
                SM State        : TERMINATE
                Authen Status   : Success
  Local Policies:
        Service Template : wlan_svc_default-policy-profile (priority 254)
                Absolute-Timer   : 320
                VLAN             : 58
  Server Policies:
  Resultant Policies:
                VLAN             : 58
                Absolute-Timer   : 320
Client Capabilities
  CF Pollable : Not implemented
  CF Poll Request : Not implemented
  Short Preamble : Not implemented
  PBCC : Not implemented
  Channel Agility : Not implemented
  Listen Interval : 0
Fast BSS Transition Details :
  Reassociation Timeout : 0
11v BSS Transition : Not implemented
FlexConnect Data Switching : Local
FlexConnect Dhcp Status : Local
FlexConnect Authentication : Central
FlexConnect Central Association : No
Client Statistics:
  Number of Bytes Received : 59795
  Number of Bytes Sent : 21404
  Number of Packets Received : 518
  Number of Packets Sent : 274
  Number of EAP Id Request Msg Timeouts :
  Number of EAP Request Msg Timeouts :
  Number of EAP Key Msg Timeouts :
  Number of Policy Errors : 0
  Radio Signal Strength Indicator : -32 dBm
  Signal to Noise Ratio : 58 dB
Fabric status : Disabled