Cisco C3201FESMIC-TP= - 3201 Fast EN Switch Mobile Interface Card Expansion Module Software Configuration Manual page 162

Configuring Cipher Suites
Command
Step 3
encryption mode ciphers
{[aes-ccm | ckip | cmic | ckip-cmic |
tkip]} {[wep128 | wep40]}
Step 4
end
Step 5
copy running-config startup-config (Optional) Saves your entries in the configuration file.
The following example sets up a cipher suite for SSID sample_ssid that enables CKIP, CMIC, and
128-bit WEP as the encryption mode:
bridge# configure terminal
bridge(config)# dot11 ssid sample_ssid
bridge(config-ssid)# encryption mode ciphers ckip-cmic wep128
bridge(config-ssid)# end
The following example sets up a cipher suite for ssid sample_ssid that enables AES as the encryption
mode:
bridge# configure terminal
bridge(config)# dot11 ssid sample_ssid
bridge(config-ssid)# encryption mode ciphers aes-ccm
bridge(config-ssid)# end
Cisco 3200 Series Wireless MIC Software Configuration Guide
6
Purpose
Enables a cipher suite containing the WEP protection you need.
(Table 3 lists guidelines for selecting a cipher suite to match the
type of authenticated key management you configure.)
Set the cipher options.
•
You can combine TKIP with 128-bit or 40-bit WEP.
Note
You can combine AES with TKIP. In this case, AES is
Note
the unicast cipher and TKIP becomes the group cipher.
If you enable a cipher suite with two elements (such as
Note
TKIP and 128-bit WEP), the second cipher becomes the
group cipher.
You can also use the encryption mode wep command
Note
to set up static WEP. However, you should use
encryption mode wep only if none of the non-root
bridges that associate to the root device are capable of
key management. See the Cisco IOS Command
Reference for Cisco Access Points and Bridges for a
detailed description of the encryption mode wep
command.
When you configure TKIP-only, AES-only, or the
Note
combination of AES and TKIP (no WEP included) on
any radio interface or VLAN, the SSID on that radio or
VLAN must be set to use WPA or CCKM key
management. If you do not configure key management
on the SSID, non-root bridge authentication fails on the
SSID.
Cisco Key Integrity Protocol (CKIP) and
Note
CKIP-Cisco Message Integrity Protocol (CMIP) are
supported only on the 2.4-GHz (802.11b/g) WMIC.
Returns to privileged EXEC mode.
Cipher Suites and WEP