Wpa And Wpa2 - Cisco Aironet CB21AG Installation And Configuration Manual

Chapter 5 Configuring the Client Adapter
4.
5.
Refer to the following pages for instructions on enabling these EAP types:
•
•
•
Refer to the IEEE 802.11 Standard for more information on 802.1X authentication and to the following
Note
URL for additional information on RADIUS servers:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter0918
6a00800ca7ab.html

WPA and WPA2

Wi-Fi Protected Access (WPA) and WPA2 are standards-based security solutions from the Wi-Fi
Alliance that provide data protection and access control for wireless LAN systems. WPA is compatible
with the IEEE 802.11i standard but was implemented prior to the standard's ratification; WPA2 is the
Wi-Fi Alliance's implementation of the ratified IEEE 802.11i standard.
WPA uses Temporal Key Integrity Protocol (TKIP) and message integrity check (MIC) for data
protection while WPA2 uses the stronger Advanced Encryption Standard encryption algorithm using
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). Both
WPA and WPA2 use 802.1X for authenticated key management.
Both WPA and WPA2 support two mutually exclusive key management types: WPA/WPA2 and
WPA/WPA2 passphrase (also known as WPA pre-shared key or WPA-PSK). Using WPA or WPA2, clients
and the authentication server authenticate to each other using an EAP authentication method, and the
client and server generate a pairwise master key (PMK). The server generates the PMK dynamically and
passes it to the access point. Using WPA or WPA2 passphrase, however, you configure a passphrase (or
pre-shared key) on both the client and the access point, and that passphrase is used as the PMK.
Refer to the following pages for instructions on enabling these WPA variations:
•
•
•
•
•
•
WPA must also be enabled on the access point. To use WPA, access points must use Cisco IOS Release
Note
12.2(11)JA or later. To use WPA2, access points must use Cisco IOS Release 12.3(2)JA or later. Refer
to the documentation for your access point for instructions on enabling this feature.
Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration Guide
OL-4211-05
The RADIUS server transmits the key to the access point using a secure channel on the wired LAN.
For the length of a session, or time period, the access point and the client use this key to encrypt or
decrypt all unicast packets (and broadcast packets if the access point is set up to do so) that travel
between them.
LEAP, page 5-29
EAP-FAST, page 5-34
EAP-TLS, PEAP (EAP-GTC), or PEAP (EAP-MSCHAP V2),
WPA/WPA2 passphrase, page 5-28
LEAP with WPA/WPA2, page 5-29
EAP-FAST with WPA/WPA2,
EAP-TLS with WPA/WPA2,
PEAP (EAP-GTC) with WPA/WPA2,
PEAP (EAP-MSCHAP V2) with WPA/WPA2,
page 5-34
page 5-45
page 5-48
page 5-52
Setting Security Parameters
page 5-44
5-19