Wireless security and WPA2 PSK
WPA, WPA2 and WPA3 compared, and the structured WLAN settings a WPA2-PSK network requires in the controller GUI.
WPA, WPA2, WPA3
WPA generations
| Generation | Cipher / handshake | Status |
|---|---|---|
| WPA (2003) | TKIP — interim fix after WEP broke | Obsolete; do not use |
| WPA2 (2004) | AES-CCMP, 4-way handshake (PSK or 802.1X) | Baseline requirement; still widely deployed |
| WPA3 (2018) | SAE handshake (Personal), PMF required, stronger crypto — 192-bit only in Enterprise CNSA mode | Current standard — use where clients support it |
WPA3-Personal changes the handshake to SAE (Simultaneous Authentication of Equals): offline dictionary attacks on captured handshakes stop working, forward secrecy is added, and Protected Management Frames (deauth protection) become mandatory. WPA3-Enterprise still uses 802.1X — its stronger 192-bit CNSA option is mode-dependent, not automatic. Transition modes allow mixed WPA2/WPA3 operation during migration.
Personal versus Enterprise
Two authentication modes per generation: Personal (PSK/SAE) — everyone shares one passphrase; fine for home/small networks but the key is shared so anyone who knows it can join (and in WPA2-PSK, observe handshakes to attempt offline cracking). Enterprise (802.1X/EAP) — per-user authentication against a RADIUS server; the enterprise answer.
- WLAN shows
- WPA2, AES, PSK, PMF: disabled
- WPA2 + AES → CCMP encryption, current baseline.
- PSK → all clients share one passphrase — the join credential.
- PMF disabled → broadest compatibility but clients can be deauthed by forged frames; prefer enabling PMF where clients support it rather than disabling protection outright.
- A WPA3-requiring client cannot join; a WPA2-capable one can.
Read the profile as: cipher + handshake + auth method + management-frame policy.
WPA2-PSK WLAN configuration
WPA2-PSK WLAN configuration task — the settings that matter
| Setting | Value for this task |
|---|---|
| Security (Layer 2) | WPA2 with AES only — do not enable WPA/TKIP fallback for the lab |
| Auth key management | PSK (not 802.1X) |
| Pre-shared key | A real passphrase — placeholder here; never a reused production key |
| Protected management frames | Optional/Disabled for broadest WPA2 client compatibility; required under WPA3 |
| SSID broadcast | Enabled |
| Status | Enabled |
| Interface/VLAN | Map to the correct client VLAN |
| QoS profile | Per traffic need (Silver default) |
Verifying the configured WLAN
- Client association + authentication success is the first checkpoint — auth failures show in client status.
- Confirm the cipher in use on a test client (AES/CCMP vs legacy).
- Verify the VLAN delivered matches the WLAN's interface mapping — security and IP delivery are separate checkpoints.
Verification and troubleshooting
Common mistakes
- Using TKIP 'for compatibility' — it weakens the whole network; use AES only.
- Confusing WPA-Personal (PSK) with WPA-Enterprise (802.1X) — different auth backends.
- Assuming WPA3 works for all clients — legacy clients need transition mode or fail.
- Enabling PMF-required on WPA2 with old clients — incapable clients are rejected.
- Reusing a production passphrase in examples/tests — always placeholder secrets.
Observation: SSID visible; the client reports 'unable to join' after entering the key.
- Wrong PSK or a stale saved profile
- Client requires WPA3 while WLAN is WPA2-only
- PMF setting incompatible with the client
| Check | Indicates |
|---|---|
| Delete the saved profile, re-enter the key | Cached credential errors look exactly like auth failure. |
| Client security capability vs WLAN setting | A WPA3-only client can't join a WPA2-only SSID. |
| PMF required/disabled in the WLAN security tab | Required PMF rejects clients that can't do it. |
Correction: Align the security profile with supported clients (transition modes) or fix the credential.
The client associates, authenticates, and lands on the right VLAN with an IP.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Wi-Fi Alliance — Security — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.