Configuring Enterprise Security for a WLAN SSID Profile

Select any of the following options from the Key Management drop-down list:

• WPA2-Enterprise—Select this option to use WPA2 Wi-Fi Protected Access 2. WPA2 is a certification program maintained by IEEE that oversees standards for security over wireless networks. WPA2 supports IEEE 802.1X/EAP authentication or PSK technology, but includes advanced encryption mechanism using CCMP that is referred to as AES. security. The WPA2 Enterprise requires user authentication and requires the use of a RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  server for authentication.
• WPA-Enterprise—Select this option to use both WPA Wi-Fi Protected Access. WPA is an interoperable wireless security specification subset of the IEEE 802.11 standard. This standard provides authentication capabilities and uses TKIP for data encryption. Enterprise.
• Both (WPA2 & WPA)—Select this option to use both WPA2 and WPA security.
• Dynamic WEP with 802.1X—If you do not want to use a session key from the RADIUS Server to derive pairwise unicast keys, set Session Key for LEAP to Enabled. This is required for old printers that use dynamic WEP Wired Equivalent Privacy. WEP is a security protocol that is specified in 802.11b and is designed to provide a WLAN with a level of security and privacy comparable to what is usually expected of a wired LAN. through LEAP Lightweight Extensible Authentication Protocol. LEAP is a Cisco proprietary version of EAP used in wireless networks and Point-to-Point connections. authentication. The Session Key for LEAP feature is Disabled by default.
• WPA3-Enterprise(CNSA)—Select this option to use WPA3 security employing CNSA encryption operation mode.
• WPA3-Enterprise(CCM 128)—Select this option to use WPA3 security employing CCM encryption operation mode limited to encrypting 128 bits of plain text.
• WPA3-Enterprise(GCM 256)—Select this option to use WPA3 security employing GCM encryption operation mode limited to encrypting 256 bits of plain text.

NOTE: When either WPA2-Enterprise or Both (WPA2-WPA) encryption type is selected and if 802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. authentication method is configured, ensure that you turn on the Opportunistic key caching (OKC) toggle switch under Advanced Settings to enable OKC Opportunistic Key Caching. OKC is a technique available for authentication between multiple APs in a network where those APs are under common administrative control. Using OKC, a station roaming to any AP in the network will not have to complete a full authentication exchange, but will instead just perform the 4-way handshake to establish transient encryption keys. . When OKC is enabled, a cached Pairwise Master Key (PMK Pairwise Master Key. PMK is a shared secret key that is generated after PSK or 802.1X authentication. ) is used when the client roams to a new AP. This allows faster roaming of clients without the need for a complete 802.1X authentication. OKC roaming can be configured only for the Enterprise security level.

Select a server group. For more information on server groups, see Configuring Server Groups.

The first server in the list is always used by default. If it is unavailable, the next server in the list is used.

The default is Primary and back up only, if Server Group is not selected.

NOTE: When this option is selected, the primary and secondary authentication servers are not available for selection.

Specify a primary authentication server for client authentication.

To create a new server, see Configuring External Authentication Servers for a WLAN SSID Profile.

Specify a secondary authentication server for client authentication.

To create a new server, see Configuring External Authentication Servers for a WLAN SSID Profile.

Enable this option to load balance between the two authentication servers.

Select this option to use the session key for Lightweight Extensible Authentication Protocol (LEAP)

Allows you to use 802.1X authentication after the client completes the MAC authentication successfully. You can configure the following parameters:

Delimiter Character—Specify a character as a delimiter for the MAC address string. When configured, the AP uses the delimiter in the MAC authentication request. For example, if you specify the colon as a delimiter, MAC addresses in the xx:xx:xx:xx:xx:xx format are used. If the delimiter is not specified, the MAC address in the xxxxxxxxxxxx format is used. The supported characters are : (colon), / (slash), , (comma), - (dash), and % (percent).

Uppercase Support—Set to Enabled to allow the AP to use uppercase letters in the MAC address string for MAC authentication. This option is available only if MAC authentication is enabled.

On selecting this, the 802.1X authentication is attempted when the MAC authentication of an AP client fails.

Define a value for Reauth Interval. When set to a value greater than zero, APs periodically reauthenticate all associated and authenticated clients.

The following events occur when the reauthentication interval is configured on WLANS SSIDs:

On an SSID performing L2 authentication (MAC or 802.1X authentication)—When reauthentication fails, the clients are disconnected. If the SSID is performing only MAC authentication and has a preauthentication role assigned to the client, the client will get a post-authentication role only after a successful reauthentication. If reauthentication fails, the client retains the preauthentication role.

On an SSID performing L2 authentication (MAC with captive portal A captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. authentication)—When reauthentication succeeds, the client retains the role that is already assigned. If reauthentication fails, a preauthentication role is assigned to the client.

To enable denylisting of the clients with a specific number of authentication failures, select Denylisting and specify a value for Max Authentication Failures. The users who fail to authenticate the number of times specified in the Max Authentication Failures field are dynamically denylisted. By default, the Denylisting option is disabled.

Sets a value for the maximum allowed authentication failures. Enter a number between 1-10.

To enforce DHCP Dynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network.  and to block traffic for AP clients that do not obtain IP address from DHCP, enable Enforce DHCP. When DHCP is enforced:

• A layer-2 user entry is created when a client associates with an AP.
• The client DHCP state and IP address are tracked.
• When the client obtains an IP address from DHCP, the DHCP state changes to complete.
• If the DHCP state is complete, a layer-3 user entry is created.
• When a client roams between the APs, the DHCP state and the client IP address are synchronized with the new AP.

Enable this option to configure the client IP address as calling station ID.

The Called Station ID Type detail can be configured even if the Use IP for Calling Station ID is set to disabled. Select any of the following options for configuring a called station ID:

• Access Point Group—Uses the AP's IP address as the called station ID.
• Access Point Name—Uses the host name of the AP as the called station ID.
• VLAN ID—Uses the VLAN Virtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID of as the called station ID.
• IP Address—Uses the IP address of the AP as the called station ID.

Appends the SSID name to the called station ID.

Sets a delimiter at the end of the called station ID.

Specify a character (for example, colon or dash) as a delimiter for the MAC address string. When configured, the AP uses the delimiter in the MAC authentication request. For example, if you specify the colon as a delimiter, MAC addresses in the xx:xx:xx:xx:xx:xx format are used. If the delimiter is not specified, the MAC address in the xxxxxxxxxxxx format is used. The supported characters are: (colon), / (slash), , (comma), - (dash), and % (percent).

NOTE: This parameter is available only when you enable MAC authentication.

Set to Enabled to allow the AP to use uppercase letters in the MAC address string for MAC authentication. This option is available only if MAC authentication is enabled.

Enable this option to allow WPA2 and WPA3 clients to be on the same SSID. The WPA3 Transition is available only when the WPA3-Enterprise(CCM 128) option is selected from the Key Management drop-down list for Enterprise security level.

Select a Passpoint Passpoint is a Wi-Fi certified solution that enables the mobile devices to automatically authenticate on enterprise Wi-Fi networks using their cellular credentials. service profile from the drop-down list. To add a new Passpoint service profile, click Manage Passpoint Services.

For more information, see Configuring a Passpoint Service Profile in a WLAN Network.

NOTE: The Passpoint Service Profile parameter is not available if you select CloudAuth Cloud Authentication and Policy allows you to configure user and client access policies that provide a secured, cloud-based network access control (NAC). from the Primary Server drop-down list.

Accounting

Enable or disable RADIUS accounting. Select one of the following options from the drop-down list:

Disabled—To disable the accounting option.

Use a separate servers—To select specific accounting and define the accounting interval time in minutes.

Specify a number to set the minutes used for interim accounting. You can specify a value within the range of 1-60 minutes.

NOTE: Setting the value to 0 disables interim accounting.

Fast Roaming

Turn on the Opportunistic key caching (OKC) toggle switch to reduce the time needed for authentication. When OKC is enabled, multiple APs can share Pairwise Master Keys (PMKs) and use these keys when clients roam to a neighboring AP.

Select 802.11r to enable 802.11r roaming. Selecting this option enables fast BSS Basic Service Set. A BSS is a set of interconnected stations that can communicate with each other. BSS can be an independent BSS or infrastructure BSS. An independent BSS is an ad hoc network that does not include APs, whereas the infrastructure BSS consists of an AP and all its associated clients. transition. The fast BSS transition mechanism minimizes the delay when a client transitions from [one BSS to another within the same cluster.

A mobility domain identifier (MDID). Enter a value between 1-65535.

This option is available only when Opportunistic Key Caching (OKC) field is enabled.

Select 802.11k to enable 802.11k roaming. The 802.11k protocol enables APs and clients to dynamically discover the available radio resources. When 802.11k is enabled, APs and clients send neighbor reports, beacon reports, and link measurement reports to each other.