5.10 - Configuring WLAN Security with WPA2 PSK

Greetings, Tech Talkers!

This is Tor, your trusted network engineering uplink! Today, we're diving into the practical aspects of securing your wireless networks by Configuring WLAN Security with WPA2 Pre-Shared Key (PSK). WPA2-PSK is widely used to secure wireless networks in small to medium-sized environments due to its balance of strong security and ease of deployment.

In this article, we'll discuss the importance of using WPA2-PSK, the steps to configure it on Cisco wireless devices, and best practices to ensure your wireless network remains secure. By the end, you'll be equipped to implement WPA2-PSK on your WLAN effectively.

Let's get started!

Why Use WPA2-PSK?

WPA2-PSK (Wi-Fi Protected Access II - Pre-Shared Key) offers:

• Strong Encryption: Uses AES (Advanced Encryption Standard) with CCMP (Counter Mode CBC-MAC Protocol) for robust security.

• Simplicity: Easy to configure without the need for a RADIUS server.

• Compatibility: Supported by most wireless devices.

  
  

Ideal For:

• Small to medium-sized networks.

• Environments where enterprise authentication (802.1X) is not feasible.

  
  

Understanding WPA2-PSK Components

1. SSID (Service Set Identifier):

   • The network name broadcasted by the access point.

2. Pre-Shared Key (PSK):

   • A passphrase used by clients to authenticate with the access point.

   • Must be kept secret and complex to prevent unauthorized access.

3. Encryption:

   • AES (Advanced Encryption Standard): Provides strong encryption for data confidentiality.

     
     

Configuring WPA2-PSK on Cisco Wireless LAN Controller (WLC)

Example Scenario:

• Objective: Configure a WLAN named "SecureWiFi" with WPA2-PSK security.

  
  

Configuration Steps:

Access the WLC:

• Use the web-based GUI or CLI via SSH or console.

  
  

Create a New WLAN:

1. GUI Method:

   • Navigate to WLANs > Create New > Go.

   • Enter the following:

     • Profile Name: SecureWiFi

     • SSID: SecureWiFi

   • Click Apply.

     
     

2. CLI Method:

(Cisco Controller) > config wlan create 1 SecureWiFi SecureWiFi

Configure WLAN Security Settings:

1. UI Method:

   1. Select the newly created WLAN.

   2. Go to the Security tab.

   3. Under Layer 2 Security, select WPA+WPA2.

   4. Check WPA2 Policy.

   5. Under WPA2 Encryption, select AES.

   6. Under Authentication Key Management, check PSK.

   7. Choose ASCII and enter a strong passphrase (minimum 8 characters, recommended 12+).

   8. Click Apply.

      
      

2. CLI Method:

(Cisco Controller) > config wlan security wpa enable 1 
(Cisco Controller) > config wlan security wpa wpa2 enable 1 
(Cisco Controller) > config wlan security wpa akm psk enable 1 
(Cisco Controller) > config wlan security wpa psk set-key ascii 1 MyStrongPassphrase

Enable the WLAN:

1. GUI Method:

   1. Go back to the WLANs page.

   2. Check the Enabled box next to your WLAN.

   3. Click Apply.

      
      

2. CLI Method:

(Cisco Controller) > config wlan enable 1

Save Configuration:

(Cisco Controller) > save config

Verify Configuration:

1. GUI Method:

   1. Ensure the WLAN status is Enabled.

   2. Review settings under the Security tab.

      
      

2. CLI Method:

(Cisco Controller) > show wlan summary
(Cisco Controller) > show wlan 1

Configuring WPA2-PSK on Cisco Autonomous Access Point

Example Scenario:

• Objective: Configure an autonomous AP with SSID "SecureWiFi" using WPA2-PSK.

  
  

Configuration Steps:

Access the AP CLI:

• Connect via console or SSH.

  
  

Enter Global Configuration Mode:

AP# configure terminal

Define the SSID:

AP(config)# dot11 ssid SecureWiFi
AP(config-ssid)# authentication open
AP(config-ssid)# authentication key-management wpa
AP(config-ssid)# wpa-psk ascii MyStrongPassphrase
AP(config-ssid)# exit

Configure the Radio Interface:

For 2.4 GHz Radio:

AP(config)# interface dot11Radio 0
AP(config-if)# ssid SecureWiFi
AP(config-if)# encryption mode ciphers aes-ccm
AP(config-if)# exit

For 5 GHz Radio:

AP(config)# interface dot11Radio 1
AP(config-if)# ssid SecureWiFi
AP(config-if)# encryption mode ciphers aes-ccm
AP(config-if)# exit

Configure the Gigabit Ethernet Interface:

AP(config)# interface GigabitEthernet 0
AP(config-if)# no shutdown AP(config-if)# exit
Save Configuration:
AP# write memory
Verify Configuration:
AP# show running-config AP# show dot11 associations

Best Practices for WPA2-PSK

1. Use a Strong Passphrase:

   • At least 12 characters.

   • Mix of uppercase, lowercase, numbers, and special characters.

   • Avoid common words or easily guessable information.

     
     

2. Change the Passphrase Regularly:

   • Periodically update the PSK to reduce the risk of compromise.

     
     

3. Disable SSID Broadcast (Optional):

   • Hiding the SSID can provide minimal security through obscurity.

   • Note: Determined attackers can still detect hidden SSIDs.

     
     

4. Enable Management Frame Protection:

   • Use Protected Management Frames (PMF) if supported.

   • Enhances protection against deauthentication and disassociation attacks.

     
     

5. Update Firmware:

   • Keep APs and controllers updated to patch vulnerabilities.

     
     

6. Monitor the Wireless Network:

   • Use wireless intrusion detection/prevention systems (WIDS/WIPS).

   • Regularly review logs for suspicious activities.

     
     

7. Secure Physical Access:

   • Prevent unauthorized physical access to APs.

     
     

8. Segment Wireless Traffic:

   • Use VLANs to separate wireless traffic from critical network segments.

Testing Connectivity

1. Connect a Wireless Client:

   • Select the SSID "SecureWiFi".

   • Enter the PSK when prompted.

     
     

2. Verify Network Access:

   • Ensure the client obtains an IP address.

   • Test connectivity to network resources and the internet.

     
     

3. Check AP or WLC Logs:

   • Confirm the client association and authentication events.

     
     

Troubleshooting Tips

• Client Unable to Connect:

  • Verify the SSID and PSK are entered correctly.

  • Check for mismatched security settings (e.g., WPA2 vs. WPA).

    
    

• No IP Address Assigned:

  • Ensure DHCP server is reachable.

  • Verify VLAN configurations.

    
    

• Intermittent Connectivity:

  • Check for interference from other wireless networks or devices.

  • Adjust channel settings if necessary.

    
    

Wrapping It Up

Configuring WLAN security with WPA2-PSK is a vital step in protecting your wireless network from unauthorized access. By following best practices and ensuring proper configuration, you can provide a secure wireless environment for your users.

Until next time, Tech Talkers, keep your wireless networks secure and your data safe!

Thanks,

Tor – Your trusted network engineering uplink