Wireless security and WPA2 PSK
WPA, WPA2 and WPA3 compared, and the structured WLAN settings a WPA2-PSK network requires in the controller GUI.
WPA generations
| Generation | Cipher / handshake | Status |
|---|---|---|
| WPA (2003) | TKIP — interim fix after WEP broke | Obsolete; do not use |
| WPA2 (2004) | AES-CCMP, 4-way handshake (PSK or 802.1X) | Baseline requirement; still widely deployed |
| WPA3 (2018) | SAE handshake (Personal), PMF required, stronger crypto — 192-bit only in Enterprise CNSA mode | Current standard — use where clients support it |
Two authentication modes per generation: Personal (PSK/SAE) — everyone shares one passphrase; fine for home/small networks but the key is shared so anyone who knows it can join (and in WPA2-PSK, observe handshakes to attempt offline cracking). Enterprise (802.1X/EAP) — per-user authentication against a RADIUS server; the enterprise answer.
WPA2-PSK WLAN configuration task — the settings that matter
| Setting | Value for this task |
|---|---|
| Security (Layer 2) | WPA2 with AES only — do not enable WPA/TKIP fallback for the lab |
| Auth key management | PSK (not 802.1X) |
| Pre-shared key | A real passphrase — placeholder here; never a reused production key |
| Protected management frames | Optional/Disabled for broadest WPA2 client compatibility; required under WPA3 |
| SSID broadcast | Enabled |
| Status | Enabled |
| Interface/VLAN | Map to the correct client VLAN |
| QoS profile | Per traffic need (Silver default) |
WPA3-Personal changes the handshake to SAE (Simultaneous Authentication of Equals): offline dictionary attacks on captured handshakes stop working, forward secrecy is added, and Protected Management Frames (deauth protection) become mandatory. WPA3-Enterprise still uses 802.1X — its stronger 192-bit CNSA option is mode-dependent, not automatic. Transition modes allow mixed WPA2/WPA3 operation during migration.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Wi-Fi Alliance — Security — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.