Initial setup and core configuration | Workgroup Bridges | Cisco Catalyst IW9167E Heavy Duty Access Point Configuration Guide, Release 26.1.x

Learn how to enable a Workgroup Bridge (WGB) to join a wireless network by configuring the WLAN and its associated settings.

Configure the WLAN profile

The purpose of this procedure is to enable a Workgroup Bridge (WGB) to join a wireless network by configuring the WLAN and its associated configuration. Completing this configuration ensures that the WGB can establish secure and reliable communication with the access point (AP), thereby maintaining proper network connectivity.

Procedure

	1.	Use the wlan profile-name command to enter the WLAN configuration submode. Example: `Device# wlan test-wlan` Here, profile-name refers to the name of the configured WLAN.
	2.	Use the ccx aironet-iesupport command to configure the Cisco Client Extensions (CCX) option and enable support for Aironet Information Element (IE) on the WLAN. Example: `Device# ccx aironet-iesupport` Note This configuration is mandatory for the WGB to associate with the AP.

Configure wireless policy profile

Perform this task to configure wireless policy profile and enable VLAN client support for a WGB on the AP. This ensures seamless client connectivity and proper VLAN assignment for WGBs in the network.

Before you begin

Ensure that you have administrative access to the device before configuring.
Verify that the VLAN ID you assign exists and is configured on the network infrastructure.

Procedure

	1.	Use the wireless profile policy profile-policy command to access the wireless policy configuration mode for the desired profile. `Device# wireless profile policy Corp-Policy`
	2.	Use the vlan vlan-id command to map the WLAN policy profile to the corresponding VLAN ID. `Device# vlan 20`
	3.	Use the wgb vlan command to enable VLAN client support for the WGB. `Device# wgb vlan`

Configure IP address

Configure an IPv4 address

Perform this task to configure an IPv4 address on a device using either the DHCP or a static configuration. This task ensures proper network connectivity and device management.

Procedure

Configure an IPv4 address on a device using one of the options.

Option	Description
Dynamically obtain IPv4 address	Use the configure ap address ipv4 dhcp command. `Device# configure ap address ipv4 dhcp`
Manually assign a static IPv4 address	Use the configure ap address ipv4 static ipv4_addr netmask gateway command. `Device# configure ap address ipv4 static 192.168.10.25 255.255.255.0 192.168.10.1`

(Optional) Use the show ip interface brief command to to view the current IP address configuration.

Device# show ip interface brief

Configure an IPv6 address

Perform this task to configure IPv6 address for the device.

Procedure

Configure or obtain an IPv6 address on a device using one of the options.

Option Description

Dynamically obtain IPv6 address

Use the configure ap address ipv6 dhcp command.

Device# configure ap address ipv6 dhcp

Automatically obtain an IPv6 address

Use the configure ap address ipv6 auto-config enable command.

Device# configure ap address ipv6 auto-config enable

Note

Enabling IPv6 auto-configuration also activates Stateless Address Auto-Configuration (SLAAC),but SLAAC does not apply to CoS of WGB. This command configures IPv6 address using DHCPv6 instead of SLAAC.

Use the configure ap address ipv6 auto-config disable command to disable the IPv6 auto configuration on the AP.

Manually assign a static IPv6 address

Use the configure ap address ipv6 static ipv6_addr prefix-length gateway command.

Device# configure ap address ipv6 static 2001:db8:abcd:100::25 64 2001:db8:abcd:100::1

Configuring a static IPv6 address allows you to manage the AP through a wired interface, even if there is no uplink connection.

(Optional) Use the show ipv6 interface brief command to verify current IP address configuration.

Device# show ipv6 interface brief

Configuring WGB on the Radio Interface

A Workgroup Bridge (WGB) provides a way for non-wireless, wired devices to gain access to a wireless network. By acting as a bridge, the WGB connects wired endpoints to the WLAN, extending wireless connectivity to equipment that does not have native Wi-Fi capability. To enable this functionality, you must first create an SSID profile that defines the wireless parameters. The WGB is then configured on the radio interface, after which the SSID profile is associated with the interface to establish the connection.

Summary

WGB allows non-wireless devices to connect to a wireless network. This configuration involves creating an SSID profile, configuring the WGB on the radio interface, and associating the SSID profile with the interface.

Workflow

Create an SSID Profile Choose the authentication method based on your network requirements.
Configure the Radio Interface Access the radio interface settings. Apply the required configuration to enable WGB functionality.
Associate the SSID Profile with the RadioLink the previously created SSID profile to the radio interface. This establishes the connection.
Enable the Radio Interface Activate the radio interface to complete the WGB configuration. This will begin operation.

Create an SSID profile

Before you begin

Perform this task to configure an SSID profile that meets your network's authentication requirements and ensures secure access for users.

Procedure

Select an authentication protocol for the SSID profile based on your network requirements.

Options are:

Open authentication: Allows access without requiring user credentials.
PSK authentication: Provides encryption for secure access.
Dot1x authentication: Utilizes a centralized authentication server for user verification.

Note

For PSK configurations, ensure that the pre-shared key is strong and follows recommended security practices.

MSCHAPv2 authentication using RADIUS is incompatible with FIPS mode on Cisco IW9165E APs.

Configure an SSID profile using open authentication

Open authentication allows devices to connect to the network without requiring credentials, making it suitable for specific scenarios like guest networks or public access points.

Procedure

Use the configure ssid-profile ssid-profile-name ssid radio-serv-name authentication open command to configure an SSID profile using open authentication.

Device# configure ssid-profile Guest-WiFi ssid Guest authentication open

Configure an SSID profile using PSK authentication

PSK authentication secures wireless networks by providing users with a shared key. This task provides instructions for configuring SSID profiles with PSK authentication, tailored to different key management protocols.

Procedure

Configure an SSID with PSK authentication, using one of these options: WPA2, 802.11r, or 802.11w.

Option	Description
Enhanced wireless security	Use the configure ssid-profile ssid-profile-name ssid SSID_name authentication psk preshared-key key-management wpa2 command. `Device# configure ssid-profile Corp-WiFi ssid CorpNet authentication psk StrongP@ss123 key-management wpa2`
Fast roaming for mobile devices	Use the configure ssid-profile ssid-profile-name ssid SSID_name authentication psk preshared-key key-management dot11r command. `Device# configure ssid-profile Corp-WiFi ssid CorpNet authentication psk StrongP@ss123 key-management dot11r`
Management frame protection	Use the configure ssid-profile ssid-profile-name ssid SSID_name authentication psk preshared-key key-management dot11w command. `Device# configure ssid-profile Corp-WiFi ssid CorpNet authentication psk StrongP@ss123 key-management dot11w`

Configure an SSID profile using Dot1x authentication

Dot1x authentication is a network access control method that enhances security by requiring user credentials before granting access. This task guides you in configuring the SSID profile with appropriate key management options.

Perform this task to set up an SSID profile with Dot1x authentication, ensuring secure network access using Extensible Authentication Protocol (EAP).

Procedure

Use the configure ssid-profile ssid-profile-name ssid radio-serv-name authentication eap profile eap-profile-name key-management { dot11r | wpa2 | dot11w { optional | required}} command to configure an SSID profile using Dot1x authentication.

Device# configure ssid-profile Corp-WiFi ssid CorpNet authentication eap profile EAP-Profile1 key-management wpa2


If..	Then..
If you want to enable fast roaming	Use the dot11r key-management option.
If WPA2 security is required	Use the wpa2 key-management option.
If management frame protection is needed	Use the dot11w key-management option with optional or required.

Configure an SSID profile using Dot1x EAP-PEAP authentication

Before you begin

Perform this task to set up a secure SSID profile using Dot1x EAP-PEAP authentication, which provides enhanced security for wireless networks.

This task is applicable when configuring wireless profiles on devices that support Dot1x EAP-PEAP authentication. This ensures the device can authenticate securely using a specified username and password.

Procedure

	1.	Use the configure dot1x credential credential_name username username password password command to create Dot1x credentials. `Device# configure dot1x credential Corp-Cred username corpuser password C!sc0Str0ng`
	2.	Use the configure eap-profile profile_name dot1x-credential credential_name command to configure the EAP profile and associate it with the configured Dot1x credentials. `Device# configure eap-profile Corp-EAP dot1x-credential Corp-Cred`
	3.	Use the configure eap-profile profile_name method peap command to define the EAP method for the profile as PEAP. `Device# configure eap-profile Corp-EAP method peap`
	4.	Use the configure ssid-profile ssid-profile-name ssid ssid name authentication eap profile eap-profile-name key-management wpa2 command to create an SSID profile and set up authentication using the EAP profile. `Device# configure ssid-profile iot-peap ssid iot-peap authentication eap profile p1 key-management wpa2`

Configure radio interface for WGB

Before you begin

The IW9165E device does not support a 2.4 GHz radio. Therefore, only the dot11radio 1 interface can be configured as the uplink to operate in WGB mode.

Configure the radio interface to enable the WGB mode and establish a connection to the appropriate SSID profile.

Procedure

	1.	Use the configure dot11radio slot_id mode wgb ssid-profile ssid-profile-name command to configure a radio interface to a WGB SSID profile. `Device# configure dot11radio 1 mode wgb ssid-profile Corp-WiFi` Note Ensure that the SSID profile being used is already configured and accessible by the device.
	2.	Use the configure dot11radio slot_id enable command to enable a radio interface. `Device# configure dot11radio 1 enable`
	3.	(Optional) Use the configure dot11radio slot_id disable command to disable a radio interface. `Device# configure dot11radio 1 disable`

Configure security parameters

Use this process to configure security parameters on the WGB to ensures secure authentication and encryption for wireless communication.

Procedure

	1.	Set up the device parameters. Configure the device username and password. Configure the NTP server to ensure accurate time synchronization. Define the hostname and assign a valid IP address.
	2.	Create and import trustpoints. Establish trustpoints and import the required certificates using your preferred method.
	3.	(Optional) Configure the dot1x credentials. Provide the necessary dot1x username and password credentials if required by your setup.
	4.	Create the EAP profile. Map the EAP method, trustpoint name, and (optionally) the dot1x credentials to the EAP profile.
	5.	Bind the EAP profile to the SSID profile. Associate the EAP profile with the desired SSID profile to enable secure wireless connections.
	6.	Bind the SSID profile to the radio. Link the SSID profile to the preferred radio interface to activate the configuration. Note Ensure that the NTP server is reachable and the certificates are valid to avoid authentication failures. Use a secure method to import certificates to maintain system integrity. If the certificate import fails, verify the certificate format and re-import using a valid method.

What to do next

Note
If you make any modifications to the dot1x credential profile, trustpoint profile, or EAP profile, the changes do not take effect immediately. You must manually re-attach the EAP profile to the SSID profile for the changes to apply.
Use configure ssid-profile ssid_prof_name ssid ssidauthentication eap profile eap_prof_name key-management key_type command to re-attach the EAP profile to the SSID profile.
Device# configure ssid-profile Corp-SSID ssid CorpNet authentication eap profile Corp-EAP key-management wpa2

Configure an EAP profile

This task guides you through the steps required to configure an Extensible Authentication Protocol (EAP) profile, ensuring secure and efficient authentication for your network.

Before you begin

An EAP profile is critical in ensuring secure authentication for wireless clients. Configuring the profile correctly ensures seamless integration with Dot1x credentials, SSID profiles, and radio configurations.

Before you begin configuring an EAP profile, ensure the following:

A valid Dot1x credential profile is already created.
The SSID profile has been configured.
The radio to which the SSID will be attached is properly set up.
Administrative access to the device's CLI.

Procedure

Use the configure eap-profile profile-name method { fast | leap | peap | tls} command to configure the EAP profile with the desired method.

Device# configure eap-profile Corp-EAP method peap


If..	Then..
If the TLS method is selected for the EAP profile	Attach a CA trustpoint using Step 2.
If a profile is no longer needed	Use Step 4 to delete the EAP profile.

Use the configure eap-profile profile-name trustpoint { default | name trustpoint-name} command to attach the CA trustpoint for TLS. By default, the WGB uses the internal MIC certificate for authentication.

Device# configure eap-profile Corp-EAP trustpoint default

Note
To ensure any newly created trustpoint to take effect, update the trustpoint name that is mapped to the eap-profile.
Example:
Device# configure eap-profile Corp-EAP trustpoint Corp-CA

Use the configure eap-profile profile-name dot1x-credential profile-name command to attach the dot1x-credential profile.

Device# configure eap-profile Corp-EAP dot1x-credential Corp-Cred

(Optional) Use the configure eap-profile profile-name delete command to delete an EAP profile.

Device# configure eap-profile Corp-EAP delete

Configure Dot1X credential

This task configures a Dot1X credential to ensure the device is correctly set up for 802.1X authentication, enabling secure access control and network protection.

Procedure

	1.	Use the configure dot1x credential credential-profile-name username username password password command to configure the Dot1X credential. `Device# configure dot1x credential Corp-Cred username corpuser password C!sc0Str0ng`
	2.	(Optional) Use the show wgb eap dot1x credential profile command to view the status of the WGB EAP Dot1x profile. `Device# show wgb eap dot1x credential profile`

Configure trustpoint manual enrollment for terminal

This procedure explains how to manually configure a trustpoint for terminal-based enrollment. It ensures secure communication between the device and the Certificate Authority (CA) server by enabling the use of a trusted certificate.

Procedure

	1.	Use the configure crypto pki trustpoint ca-server-name enrollment terminal command to create a trustpoint for the WGB. `Device# configure crypto pki trustpoint Corp-CA enrollment terminal`
	2.	Use the configure crypto pki trustpoint ca-server-name authenticate command to authenticate the trustpoint manually. Enter the base64-encoded CA certificate. If you use an intermediate certificate, you must import the entire certificate chain into the trustpoint. Type `quit` to finish. `Device# configure crypto pki trustpoint demotp authenticate Enter the base 64 encoded CA certificate. ....And end with the word "quit" on a line by itself.... -----BEGIN CERTIFICATE----- [base64 encoded root CA certificate] -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- [base64 encoded intermediate CA certificate] -----END CERTIFICATE----- quit`
	3.	Use the configure crypto pki trustpoint ca-server-name key-size key-length command to configure a private key size. `Device# configure crypto pki trustpoint Corp-CA key-size 2048`
	4.	Use the configure crypto pki trustpoint ca-server-name subject-name name [2ltr-country-code state-name locality org-name org-unit email ] command to configure the subject-name for the trustpoint. `Device# configure crypto pki trustpoint Corp-CA subject-name AP1.cisco.com US California SanJose CorpNet IT admin@cisco.com`
	5.	Use the configure crypto pki trustpoint ca-server-name enroll command to generate a private key and CSR. `Device# configure crypto pki trustpoint Corp-CA enroll` Note Generate a digitally signed certificate on the CA server using the CSR output.
	6.	Use the configure crypto pki trustpoint ca-server-name import certificate command to import the signed certificate. `Device# configure crypto pki trustpoint Corp-CA import certificate` Enter the base64-encoded CA certificate and type `quit` to finish importing the certificate.
	7.	(Optional) Use the configure crypto pki trustpoint trustpoint_name import private-key command to import a private key from an external device into the WGB. Perform this step only if you create the private key and CSR externally, rather than generating them within the WGB. Enter the base64-encoded private key and type `quit` to finish importing the key. Example: `Device# configure crypto pki trustpoint Corp-CA import private-key Enter the base 64 encoded CA certificate or private key. ....And end with the word "quit" on a line by itself.... -----BEGIN PRIVATE KEY----- [base64 encoded private key] -----END PRIVATE KEY----- quit` The device stores the private key file only if the key size is within 360-4096 bits. If the key size is outside this range or invalid, the device deletes the private key file and displays this message: `Key size of imported private key (0) is not within allowed range (360-4096).`
	8.	(Optional) Use the configure crypto pki trustpoint trustpoint-name delete command to delete a trustpoint. Example: `Device# configure crypto pki trustpoint Corp-CA delete`

Configure trustpoint auto-enrollment

Perform this task to automate the certificate enrollment process to improve the efficiency and security within the environment. This process uses the Simple Certificate Enrollment Protocol (SCEP) to ensure integrity and secure certificate issuance.

Note

The SCEP certificate auto-enrollment feature has been validated only with Windows Server 2016 NDES (Network Device Enrollment Service) (version 10.0.14393.0).

In release 26.1.1, SCEP auto-enrollment is not supported with WPA3 Enterprise.

The system supports only client certificate renewal. CA certificate rollover is not supported. To update a CA certificate, manually re-install the certificate. You must delete the original trustpoint, or create a new trustpoint and associate the certificate with it.

Before you begin

Ensure the Workgroup Bridge (WGB) has an active connection established to the infrastructure network.
Ensure that the system time on all network devices is synchronized to the same Network Time Protocol (NTP) server.
Configure the CA certificate chain on the SCEP server by including these parameters on separate certificates:
- CA:True
- Key Usage:Key Encipherment
- Key Usage:Digital Signature

Procedure

Use the configure crypto pki trustpoint ca-server-name enrollment url ca-server-url command to enroll a trustpoint in the WGB using the server URL.

Example:

Device# configure crypto pki trustpoint Corp-CA enrollment url http://192.168.71.2/certsrv/mscep/mscep.dll

Note

Only HTTP URLs are accepted and HTTPS URLs are not supported.

Use the configure crypto pki trustpoint ca-server-name authenticate command to authenticate a trustpoint.

Example:

Device# configure crypto pki trustpoint Corp-CA authenticate

Note

This command automatically fetches the Certificate Authority (CA) certificate from the CA server.

If CA authentication or enrollment operations fail, the system discards the certificates. You must re-initiate the certificate requests.

Use the configure crypto pki trustpoint ca-server-name key-size key-length command to configure a private key size.

Example:

Device# configure crypto pki trustpoint Corp-CA key-size 2048

Use the configure crypto pki trustpoint ca-server-name subject-name name [2ltr-country-code state-name locality org-name org-unit email ] command to configure the subject-name.

Example:

Device# configure crypto pki trustpoint Corp-CA subject-name AP1.cisco.com US California SanJose CorpNet IT admin@cisco.com

Use the configure crypto pki trustpoint ca-server-name enroll command to request a digitally signed certificate from the CA server and enroll the trustpoint in a secure environment.

Example:

Device# configure crypto pki trustpoint Corp-CA enroll

(Optional) Use the configure crypto pki trustpoint ca-server-name enroll [password password ] command if the SCEP server requires authentication, such as a challenge password.

Example:

Device# configure crypto pki trustpoint Corp-CA enroll password *****

Note

If authentication is enabled on the SCEP server, the required shared secret (challenge password) can be found on the GUI page of the SCEP server.

The authenticate and enroll commands from step 2 and step 5 are action commands that do not appear in the show running-config command output. These commands are not applied to other WGB devices during certificate auto enrollment export or import.

Use the configure crypto pki trustpoint ca-server-name auto-enroll enable [renew-percent ] [regenerate ] [max-retries retries] [retry-interval-minutes retry-interval] command to enable auto-enroll.

Example:

Device# configure crypto pki trustpoint Corp-CA auto-enroll enable 90 regenerate 10 retries 10 retry-interval


Parameter	Description	Default Value	Configuration Range	Additional Information
max-retries	Specifies the maximum number of times the WGB attempts to renew the certificate.	5	max-retries: 5 to 100	You can increase this value to allow more renewal attempts if failures are expected. This parameter is optional. If not configured, the system uses the default values.
retry-interval	Defines the time (in minutes) between each renewal attempt.	1	retry-interval-minutes: 1 to 480 minutes	You can adjust this value based on how frequently you want renewal attempts to occur after a failure. This parameter is optional. If not configured, the system uses the default values.
regenerate	Indicates the percentage of the certificate lifetime that has expired, after which a renewal attempt should be triggered.	95	renew-percent: 0 to 95 Note If the regenerate value is configured as 0, the system will automatically set it to the default value 95.	A value of 95 triggers a certificate renewal attempt after 95% of the client certificate’s lifetime has passed. Set the regenerate value according to your organization’s certificate lifecycle policy to ensure timely renewal.

Note

Use the configure crypto pki trustpoint ca-server-name auto-enroll disable command to disable the auto-enroll.

(Optional) Use the show crypto pki timers command to show the time left for certificate renewal.

Example:

Device# show crypto pki timers

Sample output:

Trustpoint         Rollover Timer        Shadow Timer         Renewal Timer
  tls                Disabled              Disabled          0000D:00H:03M:08S

Note

The timer for the client certificate is triggered only after auto-enroll is enabled in step 6.

(Optional) Use the configure crypto pki trustpoint trustpoint-name delete command to delete a trustpoint.

Example:

Device# configure crypto pki trustpoint Corp-CA delete

Verify PKI trustpoint

Use the commands given in this section to verify if PKI trustpoint is properly configured during manual or auto-enrollment procedures.

Procedure

Use the show crypto pki trustpoint command to display a summary of all trustpoints.

Example:

Device# show crypto pki trustpoint

Sample output:

Device# show crypto pki trustpoint
Crypto PKI trustpoints are:-
================================================================
     Trustpoint name : tls
   Enrollment method : Auto Enrollment
            URL path : http://192.XXX.XX.X/certsrv/mscep/mscep.dll
        Auto Renewal : Enabled
        CA-Cert file : /storage/wbridge_pki_cert/tls/tls_ca.pem
    Client-Cert file : /storage/wbridge_pki_cert/tls/tls_client.pem
             Subject : C=US,ST=California,L=SanJose,O=CISCO,OU=IOT,CN=user1,emailAddress=user1@cisco.com
            Key size : 2048

Use the show crypto pki trustpoint trustpoint-name certificate command to view the content of the certificates that are created for a trustpoint.

Example:

Device# show crypto pki trustpoint trustpoint-name certificate

Sample output:

Device# show crypto pki trustpoint tls certificate 
CA Certificate:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            12:d5:b2:3d:69:70:8d:98:46:90:f5:e9:47:56:65:1e
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: DC=local, DC=iottest, CN=WIN2016-AD-CA
        Validity
            Not Before: Feb 28 08:43:08 2020 GMT
            Not After : May 23 03:33:13 2034 GMT
        Subject: DC=local, DC=iottest, CN=WIN2016-AD-CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    [Modulus value]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                0A:0C:44:AD:88:EF:2B:E5:9C:A9:53:3F:C7:95:35:41:1C:B2:C8:B3
            1.3.6.1.4.1.311.21.1: 
                ...
            1.3.6.1.4.1.311.21.2: 
                ..h{..,.6I3\.....W}...
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        [Modulus value]

Client Certificate:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            16:00:00:2c:f8:0a:24:92:ca:d1:61:0e:9d:00:01:00:00:2c:f8
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: DC=local, DC=iottest, CN=WIN2016-AD-CA
        Validity
            Not Before: Nov 13 06:21:13 2025 GMT
            Not After : Nov 13 07:21:13 2025 GMT
        Subject: C=US, ST=California, L=Sanjose, O=CISCO, OU=IOT, CN=user, emailAddress=user@cisco.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    [Modulus value]
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                76:B2:CC:17:F9:3A:A3:1C:47:18:9F:3D:64:A3:5F:89:90:E0:97:BE
            X509v3 Authority Key Identifier: 
                0A:0C:44:AD:88:EF:2B:E5:9C:A9:53:3F:C7:95:35:41:1C:B2:C8:B3
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:ldap:///CN=WIN2016-AD-CA,CN=win2016-ad,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,
                  DC=iottest,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint
            Authority Information Access: 
                CA Issuers - URI:ldap:///CN=WIN2016-AD-CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,
                DC=iottest,DC=local?cACertificate?base?objectClass=certificationAuthority
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            Microsoft certificate template: 
...1...SW...:...t..d..&...7....)...a...
            X509v3 Extended Key Usage: 
                1.3.6.1.5.5.8.2.2, TLS Web Client Authentication
            Microsoft Application Policies Extension: 
                0.0
..+.......0
..+.......
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        [Signature value]
APFC58.9A17.AF98#

Configure manual certificate enrollment using a TFTP/HTTP/HTTPS server

Perform this task to manually enroll certificates using a TFTP/HTTP/HTTPS server. This ensures secure communication by retrieving, authenticating, and managing certificates for a trustpoint.

Procedure

	1.	Use the configure crypto pki trustpoint ca-server-name enrollment server <proto>://<server_IP_address>/file-name command to retrieve the CA and client certificate for a trustpoint. Example: `Device# configure crypto pki trustpoint Corp-CA enrollment server http://192.168.1.100/certs/corp-ca-cert` Note The enrollment server supports HTTP, TFTP, or HTTPS protocols. Specify the required protocol in the server URL for your deployment. It is not necessary to include the file extension in the URL's file name.
	2.	Use the configure crypto pki trustpoint ca-server-name authenticate command to retrieve and authenticate the CA certificate from the specified server. `Device# configure crypto pki trustpoint Corp-CA authenticate` Note This command retrieves and authenticates the CA certificate from the specified server. The server should contain the CA certificate file with .ca extension in the specified path.
	3.	Use the configure crypto pki trustpoint ca-server-name key-size key-length command to set the private key size. `Device# configure crypto pki trustpoint Corp-CA key-size 2048`
	4.	Use the configure crypto pki trustpoint ca-server-name subject-name name [2ltr-country-code state-name locality org-name org-unit email ] command to configure the subject-name. `Device# configure crypto pki trustpoint Corp-CA subject-name AP1.cisco.com US California SanJose CorpNet IT admin@cisco.com`
	5.	Use the configure crypto pki trustpoint ca-server-name enroll command to generate a private key and a CSR. Then copy the CSR to the server. Example: `Device#configure crypto pki trustpoint Corp-CA enroll` Note This generates certificate request and sends the request to the server. The CSR file is written to the server with the .req extension.
	6.	Use the configure crypto pki trustpoint ca-server-name import certificate command to import the signed certificate into the WGB. `Device#configure crypto pki trustpoint Corp-CA import certificate` Ensure that the digitally signed certificate created from the CSR is saved with a .crt extension in the server before executing this command.
	7.	(Optional) Use the show crypto pki trustpoint command to display a summary of all trustpoints. `Device# show crypto pki trustpoint`
	8.	(Optional) Use the show crypto pki trustpoint trustpoint-name certificate command to view the content of the certificates that are created for a trustpoint. `Device# show crypto pki trustpoint Corp-CA certificate`

Configure a PKCS12 or PFX or P12 certificate enrollment using a TFTP/HTTP/HTTPS server

This task enables you to import a PKCS12 full certificate bundle for EAP-TLS authentication and private key configuration. This ensures secure communication and device authentication in WGB mode.

Procedure

Use configure crypto pki trustpoint trustpoint_name import pkcs12 server <proto>://<server_IP_address>/path_to_certificate password certificate_password command to import PKCS12 full certificate bundle for EAP-TLS authentication and private key.

Example:

Device# configure crypto pki trustpoint Corp-CA import server tftp://1.2.3.4/corp-ca.p12 password *****

Note

You can use TFTP, HTTP, or HTTPS as the server protocol, depending on your environment and server configuration.

(Optional) Use the show crypto pki trustpoint command to verify the downloaded PKCS12 certificate.

Device# show crypto pki trustpoint

Crypto PKI trustpoints are:-
================================================================
     Trustpoint name : example
   Enrollment method : TFTP
           TFTP path : tftp://192.168.0.1/users/example/ca
        CA-Cert file : /storage/wbridge_pki_cert/example/example_ca.pem
             Subject : C=US,ST=Unknown,L=Unknown,O=Cisco,OU=Wnbu,CN=ap.cisco.com
,emailAddress=wgb@cisco.com
            Key size : 2048

Trustpoint enrollment error codes and logs

Debug Commands

You can enable any debug level listed in the Trustpoint debug levels table for troubleshooting.

Device# debug trustpoint {all | critical | debug | error | info}

Table 1. Trustpoint debug levels
Debug level	Description
all	Enable all levels of trustpoint debugging
critical	Enable trustpoint critical level debugging
debug	Enable trustpoint debugging
error	Enable trustpoint error debugging
info	Enable trustpoint info debugging

When a WGB certificate renewal or fetch operation is disrupted, specific error codes are displayed on the console. These error codes are only applicable for the Configure trustpoint auto-enrollment commands (for SCEP based certificate operations).

The error codes are listed in the Error codes for certificate fetch and renewal operations table.

Table 2. Error codes for certificate fetch and renewal operations
Error Code	Description
1	General catch-all error code used when an unspecified error occurs that does not fit other categories.
70	Bad Algorithm - Unrecognized or unsupported algorithm identifier
71	Bad Message Check - Integrity check failed due to message corruption, tampering, or invalid digital signature
72	Bad Request - Transaction not permitted or supported (Commonly hit when SCEP server expects password but WGB does not provide it)
73	Bad Time - Message timestamp validation failed
74	Bad Certificate ID - No matching certificate found
89	Network communication timeout
91	Self-signed certificate generation error
93	File system operation error
95	Network message sending error, which occurs when the WGB is unable to reach the SCEP server
97	PKCS#7 cryptographic operation error

Error messages and logs

This section lists possible issues that may occur during the trustpoint enrollment process.

Table 3. Error logs and messages
Issue	Description and Cause	Error Message / Log
Client and CA certificate fetch failure	A network connection disruption prevents the WGB from reaching the SCEP server. Error code 95 indicates a network message sending error.	`WCP_TP: Failed to get CA certificate: 95`
SCEP certificate enrollment failure	Network disruption occured while the WGB attempts to reach the SCEP server for a client certificate. The WGB attempts to renew the certificate every 60 seconds. After five retries (the default maximum), the process fails.	`WCP_TP: Failed to Renew the certificate. Retry renewing the certificate after [60] sec for the trustpoint [tls]: 95` `WCP_TP: Failed to Renew the client certificate for trustpoint [tls]. Maximum retry reached. Please check the clock and network configuration parameters.`
Incorrect SCEP server URL	The SCEP server URL provided in the configuration is incorrect, preventing a connection.	`cannot connect: No route to host` `sscep: error while sending message`
Password mismatch	A password is configured on the SCEP server, but no corresponding password is configured on the WGB.	`sscep: pkistatus: FAILURE` `sscep: reason: Transaction not permitted or supported` `WCP_TP: Failed to get device certificate: 72`

Feature History

Table 4.
Feature	Release	Feature Information
SCEP for certificate renewal on IW916x WGB	26.1.1	This feature enables automatic certificate enrollment and renewal for IW916x Workgroup Bridges (WGBs). WGBs securely obtain and update digital certificates from a Certificate Authority (CA) server using SCEP. This process enhances security, simplifies management, and supports large-scale deployments in environments requiring EAP-TLS authentication.

Verify the PKI timer information

Procedure

Use the show crypto pki timers command to view the public key infrastructure (PKI) timer information.

Device#show crypto pki timers

Configure WGB or uWGB timer

Configure timers for the WGB or uWGB modes to ensure proper timeout settings for association, authentication, EAP, and bridge client responses. The CLI commands for timer configuration are identical for both the WGB and uWGB modes.

Configure the association response timeout

Procedure

Use the configure wgb association response timeout response-millisecs command to configure the WGB association response timeout.

Device#configure wgb association response timeout 400

Default Value: 100 milliseconds
Valid Range: 100–5000 milliseconds

Configure the authentication response timeout

Procedure

Use the configure wgb authentication response timeout response-millisecs command to configure the WGB authentication response timeout.

Device#configure wgb authentication response timeout 400

Default Value: 100 milliseconds
Valid Range: 100 –5000 milliseconds

Configure the EAP timeout

Procedure

Use the configure wgb eap timeout timeout-secs command to configure the WGB EAP timeout.

Device#configure wgb eap timeout 15

Default value: 3 seconds
Valid range: 2–60 seconds

Configure the bridge client response timeout

Procedure

Use the configure wgb bridge client timeout timeout-secs command to configure the WGB bridge client response timeout.

Device#configure wgb bridge client timeout 400

Default Value: 300 seconds
Valid Range: 10–1,000,000 seconds

Deauthenticate WGB wired client

Use the clear wgb client {all | single mac-addr} command to deauthenticate WGB wired client.

Device#clear wgb client all

Configure uWGB on the radio interface

The uWGB mode can associate with third-party APs using uplink radio MAC address, thus the uWGB role supports only one wired client.

Procedure

Use configure dot11 slot_id mode uwgb uwgb_wired_client_mac_address ssid-profile ssid-profile command to configure the wired client's MAC address.

Device# configure dot11 1 mode uwgb 00:11:22:33:44:55 ssid-profile IoT-SSID

Note

Most WGB configurations also apply to uWGB mode. The only difference is that you configure wired client’s MAC address using this command:

What to do next

These configurations outlines the detailed information about uWGB setup. The settings are common for both WGB and uWGB:

Conversion between WGB and uWGB modes

Conversion from WGB to uWGB mode

Perform this task to convert the device from WGB to uWGB mode. This conversion enables enhanced functionality and integration of wired clients with the desired SSID profile.

Procedure

Use the configure dot11radio radio_slot_id mode uwgb wired_client_mac ssid-profile ssid_profile_name command to convert from WGB to uWGB mode.

Device#configure dot11radio 1 mode uwgb 00:11:22:33:44:55 ssid-profile IoT_Profile

Conversion from uWGB to WGB mode

Perform this task to convert an AP from uWGB mode to WGB mode, enabling it to function in WGB mode.

Procedure

	1.	Use the configure dot11radio radio_slot_id mode wgb ssid-profile ssid_profile_name command to convert from uWGB to WGB mode. This conversion involves rebooting of the AP. `Device# configure dot11radio 1 mode wgb ssid-profile IoT_Profile This command will reboot with downloaded configs. Are you sure you want continue? [confirm]`
	2.	After entering the command, the system prompts you to confirm the action. This step is necessary as the AP reboots to apply the new configuration. When prompted, type confirm to proceed with the conversion.

Import and export WGB configuration

Import a WGB configuration

Perform this task to download a sample configuration file to all WGBs in the deployment. This ensures the devices are configured with the necessary settings for proper operation.

Procedure

Use the copy configuration download {tftp:| sftp:scp:| | http:}ip-address [directory] [file-name] command to download a sample configuration to all WGBs in the deployment.

copy configuration download tftp: 192.168.1.100 configs startup-config.cfg

Note

When you execute the copy configuration download command, the AP starts to reboot. The new configuration takes effect only after the reboot.

Ensure that the configuration file is accessible from the specified sftp: or tftp: server and that the file path is correctly specified.

Export WGB configuration

Export the configuration of an existing WGB to make it reusable for newly deployed WGBs. This ensures consistency and simplifies deployment.

You can upload the current configuration of a WGB to a server using the appropriate protocol. This configuration file can later be downloaded to configure additional WGBs, streamlining the setup process.

Procedure

Upload the WGB configuration to a server

Use the copy configuration upload {tftp:| sftp:| scp:| http:}ip-address [directory] [file-name] command to upload the working configuration of an existing WGB to a server.

Device# copy configuration upload tftp: 192.168.1.100 configs running-config.cfg