doc title Help Center
You are here: Home > Bridge Mode Deployment > Configuring Security for a WLAN SSID Profile in Bridge Mode > Configuring Personal Security for a WLAN SSID Profile

Configuring Personal Security for a WLAN SSID Profile

To configure a personal security profile, complete the following procedure:

  1. To access the WLANWireless Local Area Network. WLAN is a 802.11 standards-based LAN that the users access through a wireless connection. SSIDService Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network. configuration wizard for a new SSID profile or an existing SSID profile, see Configuring a WLAN SSID Profile in Bridge Mode or Creating a WLAN Profile in Tunnel and Mixed Mode.
  2. In the WLAN SSID configuration wizard, click the Security tab.
  3. In Security Level, select Personal.
  4. Configure the following parameters:

    Table 1: Personal Security Profile Configuration Parameters

    Data pane item

    Description

    Key Management

    Select any of the following options from Key Management drop-down list:

    Passphrase Format

    (Applies to WPA)

    Select a passphrase format. The options available are 8-63 alphanumeric characters and 64 hexadecimal characters.

    Passphrase

    (Applies to WPA)

    Enter the passphrase of length between 8 and 63 characters.

    Retype

    (Applies to WPA)

    Retype the password.

    WEP Key Size

    (Applies to Static WEP)

    Specify a value from the drop-down.

    WEP Key

    (Applies to Static WEP)

    Specify a length of 26 hexadecimal characters.

    Retype WEP Key

    (Applies to Static WEP)

    Retype the WEP key.

    Primary Server

    (Applies to MPSK-AES)

     

    Specify a primary authentication server for client authentication.

    To create a new server, see Configuring External Authentication Servers for a WLAN SSID Profile.

    Secondary Server

    (Applies to MPSK AES)

    Specify a secondary authentication server for client authentication.

    To create a new server, see Configuring External Authentication Servers for a WLAN SSID Profile.

    Load Balancing

    (Applies to MPSK AES)

    Enable this option to load balance between the two authentication servers.

    MPSK Local

    (Applies to MPSK Local)

    Specify an MPSK Local profile for client authentication. To create a new MPSK Local profile, see Creating an MPSK Local Profile .

  5. Click Advanced Settings and configure the following parameters.

    Table 2: Advanced WLAN Security Settings—Personal Security Profile

    Data pane item

    Description

    MAC Authentication

    To enable MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address based authentication of clients, turn on the MAC Authentication toggle switch. When MAC authentication is enabled, you can configure Reauth Interval.

    NOTE: This option is not available when MPSK-AES is selected from the Key Management drop-down list.

    Reauth Interval

    When set to a value greater than zero, APs periodically re-authenticate all associated and authenticated clients. On an SSID performing L2 authentication (MAC or 802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. authentication), if re-authentication fails, the clients are disconnected. If the SSID is performing only MAC authentication and has a pre-authentiation role assigned to the client, the client will get a post-authentication role only after a successful re-authentication. If re-authentication fails, the client retains the pre-authentication role.

    Denylisting

    To enable denylisting of the clients with a specific number of authentication failures, select Denylisting and specify a value between 1 and 10 for Max Authentication Failures. The users who fail to authenticate the number of times specified in Max Authentication Failures field are dynamically denylisted. By default, the Denylisting option is disabled.

    Enforce DHCP

    To enforce DHCPDynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network.  and to block traffic for AP clients that do not obtain IP address from DHCP, enable Enforce DHCP. When DHCP is enforced:

    1. A layer-2 user entry is created when a client associates with an AP.
    2. The client DHCP state and IP address are tracked.
    3. When the client obtains an IP address from DHCP, the DHCP state changes to complete.
    4. If the DHCP state is complete, a layer-3 user entry is created.
    5. When a client roams between the APs, the DHCP state and the client IP address is synchronized with the new AP.

    Use IP for Calling Station ID

    Enable this option to configure client IP address as calling station ID.

    Called Station ID Type

    The Called Station ID Type detail can be configured even if the Use IP for Calling Station ID is set to disabled. Select any of the following options for configuring a called station ID:

    Access Point Group

    Called Station ID Include SSID

    Appends the SSID name to the called station ID.

    Called Station ID Delimiter

    Sets delimiter at the end of the called station ID.

    Primary Server

    Add a primary server.

    To create a new server, see Configuring External Authentication Servers for a WLAN SSID Profile.

    Secondary Server

    Add a secondary server.

    To create a new server, see Configuring External Authentication Servers for a WLAN SSID Profile.

    Load Balancing

    Enable load-balancing of the servers.

    Delimiter Character

    Specify a character (for example, colon or dash) as a delimiter for the MAC address string. When configured, the AP uses the delimiter in the MAC authentication request. For example, if you specify the colon as a delimiter, MAC addresses in the xx:xx:xx:xx:xx:xx format are used. If the delimiter is not specified, the MAC address in the xxxxxxxxxxxx format is used. This option is available only when MAC authentication is enabled.

    Uppercase Support

    Select this option to allow the AP to use uppercase letters in MAC address string for MAC authentication. This option is available only if MAC authentication is enabled.

    Accounting

    Accounting

    On enabling this option, the APs post accounting information to the RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  server at the specified Accounting Interval. Select one of the following options from the drop-down list:

    • Disabled—To disable the accounting option.
    • Use authentication server—To select authentication servers and the accounting time interval in minutes.
    • Use separate servers— To select specific accounting and mention the accounting time interval in minutes.

    Accounting Server1

    (Applies to Use separate servers)

    Specify the primary RADIUS accounting server from the drop-down list.

    To create a new server, see Configuring External Authentication Servers for a WLAN SSID Profile.

    Accounting Server2

    (Applies to Use separate servers)

    Specify the secondary RADIUS accounting server from the drop-down list.

    To create a new server, see Configuring External Authentication Servers for a WLAN SSID Profile.

    Accounting Interval

    Specify a number between 0 and 60 minutes.

    Fast Roaming

    802.11r

    Turn on the 802.11r802.11r is an IEEE standard for enabling seamless BSS transitions in a WLAN. 802.11r standard is also referred to as Fast BSS transition. toggle switch to enable 802.11r roaming. Selecting this option enables fast BSSBasic Service Set. A BSS is a set of interconnected stations that can communicate with each other. BSS can be an independent BSS or infrastructure BSS. An independent BSS is an ad hoc network that does not include APs, whereas the infrastructure BSS consists of an AP and all its associated clients. transition. The fast BSS transition mechanism minimizes the delay when a client transitions from one BSS to another within the same cluster.

    MDID

    A mobility domain identifier (MDID). Enter a value between 1 and 65535.

    NOTE: This option is available only when 802.11R field is enabled.

    802.11k802.11k is an IEEE standard that enables APs and client devices to discover the best available radio resources for seamless BSS transition in a WLAN.

    Turn on the 802.11k toggle switch to enable 802.11k roaming. The 802.11k protocol enables APs and clients to dynamically discover the available radio resources. When 802.11k is enabled, APs and clients send neighbor reports, beacon reports, and link measurement reports to each other.

    802.11v

    Turn on the 802.11v toggle switch to enable 802.11v802.11v is an IEEE standard that allows client devices to exchange information about the network topology and RF environment. This information is used for assigning best available radio resources for the client devices to provide seamless connectivity. based BSS transition. The 802.11v standard defines mechanisms for wireless network and BSS transition management. It allows the client devices to exchange information about the network topology and RFRadio Frequency. RF refers to the electromagnetic wave frequencies within a range of 3 kHz to 300 GHz, including the frequencies used for communications or Radar signals. environment. The BSS transition management mechanism enables an AP to request a voice client to transition to a specific AP, or suggest a set of preferred APs to a voice client, due to network load balancing or BSS termination. It also helps the voice client identify the best AP to transition to as they roam.

  6. Click Next.
/*]]>*/