WLAN Security

AAA override

AAA override is a WLAN option that enables you to configure the WLAN for identity networking by applying VLAN tagging, Quality of Service (QoS), and Access Control Lists (ACLs) to individual clients based on the returned RADIUS attributes from the AAA server.

Prerequisites for Layer 2 Security

WLANs with the same SSID must have unique Layer 2 security policies so that clients can make a WLAN selection based on the information advertised in beacon and probe responses.

The available Layer 2 security policies are as follows:

  • None (open WLAN)

  • WPA+WPA2


    Note

    • Although WPA and WPA2 cannot be used by multiple WLANs with the same SSID, you can configure two WLANs with the same SSID with WPA/TKIP with PSK and Wi-Fi Protected Access (WPA)/Temporal Key Integrity Protocol (TKIP) with 802.1X, or with WPA/TKIP with 802.1X or WPA/AES with 802.1X.

    • A WLAN configured with TKIP support will not be enabled on an RM3000AC module.

  • Static WEP (not supported on Wave 2 APs)

How to Configure WLAN Security

Configure static WEP layer 2 security parameters (CLI)

Set up static WEP encryption and authentication for WLAN security.
Static WEP provides basic wireless security through shared encryption keys. This configuration is used when legacy devices require WEP compatibility, though WPA/WPA2 is recommended for better security.

Before you begin

You must have administrator privileges.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Exit configuration mode and return to privileged EXEC mode.

Example:

Device(config-wlan)# end
Static WEP layer 2 security is now configured on the WLAN with the specified authentication and encryption parameters.

Configure WPA + WPA2 layer 2 security parameters (CLI)

This task configures WPA and WPA2 layer 2 security settings to secure wireless networks using command-line interface commands.

Before you begin

You must have administrator privileges.

Follow these steps to configure WPA + WPA2 layer 2 security parameters using commands:

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Example:

Device(config-wlan)# security wpa {akm | wpa1 | wpa2}
Device(config-wlan)# security wpa

Step 3

Enables .

Example:

Device(config-wlan)# security wpa wpa1

Step 4

Specify the WPA1 cipher.

Example:

Device(config-wlan)# security wpa wpa1 ciphers [aes | tkip]
Device(config-wlan)# security wpa wpa1 ciphers aes

Choose one of the following encryption types:

  • aes : Specifies WPA/AES support.

  • tkip : Specifies WPA/TKIP support.

Step 5

Enable WPA2.

Example:

Device(config-wlan)# security wpa wpa2

Step 6

Configure WPA2 cipher. security wpa wpa2 ciphers aes

Example:

Device(config-wlan)# security wpa wpa2

Example:

WPA and WPA2 layer 2 security parameters are configured for the WLAN. The wireless network is secured with the specified authentication and encryption settings.