Wireless
Wireless Security
Covers authentication and encryption options for WLANs, from open networks to enterprise-grade 802.1X, and how these are configured on a WLC.
What you need to know
- WPA2 uses AES-CCMP encryption; WPA3 mandates AES and adds SAE (Simultaneous Authentication of Equals) to replace the PSK 4-way handshake, resisting offline dictionary attacks.
- Personal (PSK) mode uses a shared passphrase for all clients; Enterprise mode uses 802.1X with a RADIUS server for per-user authentication.
- 802.1X involves three roles: supplicant (client), authenticator (AP/WLC/switch), and authentication server (RADIUS).
- WPA3-Personal replaces the WPA2 PSK handshake with SAE; WPA3-Enterprise can require 192-bit security suite mode for high-security environments.
- Open authentication with no encryption should never be used for production SSIDs; it is only appropriate for guest/captive-portal networks.
- Layer 2 security settings (WPA2/WPA3, PSK/802.1X) are configured under the WLAN's Security tab on the WLC, separate from Layer 3 (web auth) settings.
- RADIUS servers are defined globally on the WLC (Security > RADIUS > Authentication) and then referenced by an AAA server group applied to the WLAN.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| WLANs > WLAN ID > Security > Layer 2 | gui | Select WPA2/WPA3 and PSK or 802.1X authentication key management. |
| WLANs > WLAN ID > Security > AAA Servers | gui | Assign a RADIUS server group to the WLAN for 802.1X authentication. |
| Security > AAA > RADIUS > Authentication > New | gui | Add a RADIUS server IP address, port, and shared secret to the WLC. |
| WLANs > WLAN ID > Security > Layer 2 > PSK Format | gui | Enter and format the pre-shared key (ASCII or hex) for WPA2/WPA3-Personal. |
| radius server <name> | config | Define a RADIUS server on an IOS device (e.g. switch acting as 802.1X authenticator). |
| address ipv4 <ip> auth-port 1812 acct-port 1813 | config | Set the RADIUS server address and standard authentication/accounting ports. |
| key <shared-secret> | config | Configure the shared secret used between the device and the RADIUS server. |
| aaa authentication dot1x default group radius | config | Use the RADIUS group for 802.1X authentication decisions. |
| dot1x system-auth-control | config | Globally enable 802.1X port-based authentication on the switch. |
Verify it
- show wlan summary
- show client summary
- show radius server-group all
- show aaa servers
- show dot1x all
Common mistakes
- Mismatched PSK between client and WLAN configuration, preventing association.
- Selecting WPA2 encryption but leaving key management set incorrectly (e.g. 802.1X selected without a working RADIUS server).
- Forgetting to configure the RADIUS shared secret identically on both the WLC and the RADIUS server.
- Using open authentication for a WLAN that should require WPA2/WPA3, exposing the lab to unintended access.
- Not enabling dot1x system-auth-control globally before applying 802.1X on an interface.
Practise Wireless Security in a real CLI
Generated labs, graded against the simulated network state.