Lesson 3 — Wireless Security and WLAN Configuration

Week 8Lesson 3Required29 min estimated0% progress

Wireless Security and WLAN Configuration

Compare WPA, WPA2, and WPA3 and the PSK-versus-802.1X fork, then create and secure a WLAN in the WLC GUI with WPA2-PSK, bound to the correct dynamic interface.

What you'll learn (5 objectives)~29 min: video → lesson → check → apply → lab prep

Learning objectives

Compare WPA, WPA2, and WPA3 by encryption and integrity and say which is the current baseline
Distinguish WPA2-Personal (PSK) from WPA2-Enterprise (802.1X/RADIUS) and name the three 802.1X roles
Configure a WPA2-PSK WLAN in the WLC GUI bound to a dynamic interface and VLAN
Interpret a WLAN GUI screen for status, SSID, interface binding, Layer 2 security, and QoS profile
Explain why hidden SSID and MAC filtering are not substitutes for WPA2/WPA3 encryption

Terms you will see

WPA / WPA2 / WPA3TKIPCCMP (AES)GCMPPSKSAE802.1XSupplicant / authenticator / authentication serverRADIUSEAPDynamic interface

Time breakdown

Read the notes14 min
Walk the WLC GUI configuration9 min
Work the two failure cases6 min

Opens on YouTube

Wireless Security (Day 57)

By Jeremy's IT Lab · Opens externally on YouTube

Assigned watch: ~8 min

Where to stop

The GUI configuration itself is covered in the written sections below, not in this video.

The source marks this segment timestampStatus="unresolved" with no start or end, so no bounds are shown here.

Watch on YouTube

The link opens in a new browser tab. Return here when you finish watching.

Watch for these concepts

The WPA2 versus WPA3 comparison
The PSK versus 802.1X/RADIUS distinction

Go beyond the video

The assigned video introduces the idea. CCNA Practice Labs completes the learning path: clarify core concepts, explore how each device behaves, visualize the communication path, check your understanding, and prepare for hands-on lab work.

Watch the concept → understand it → visualize it → practice it → apply it.

Three things wireless security must provide, and two ways to authenticate

Because the medium is open air and the signal does not stop at the wall, a WLAN needs authentication so only trusted clients join, encryption so over-the-air traffic is unreadable, and integrity so frames cannot be altered in transit. WEP failed at all three and must never be used. Open authentication provides none of them, and is only acceptable behind a captive portal or an 802.1X overlay.

How a client proves it belongs is the fork that defines Personal versus Enterprise. With a pre-shared key, every client uses the same passphrase — simple, and right for home, lab, and small office. The passphrase itself is never sent over the air; both sides use it to derive session keys through a four-way handshake. With 802.1X, each user authenticates individually against an authentication server, so there is no shared secret and credentials can be revoked one user at a time.

The three 802.1X roles

Role	Device
Supplicant	The client requesting access
Authenticator	The AP or WLC that gates the port
Authentication server	RADIUS — decides yes or no

RADIUS here, TACACS+ there

802.1X carries EAP methods — PEAP, EAP-TLS, EAP-FAST — and at CCNA depth it is enough to know that EAP-TLS uses mutual certificates, making it the strongest and the hardest to scale. The pairing worth fixing in memory is that RADIUS, not TACACS+, is the authentication server for wireless clients. TACACS+ is for device-administrator AAA, which is the Week 7 material. Both appear as options in the same question, and the deciding factor is whether you are authenticating a *user onto the network* or an *admin onto a device*.

Match the standard to its crypto

The WPA family

Standard	Encryption	Integrity	Authentication options
WPA	TKIP (RC4-based, a WEP-hardware workaround)	MIC	PSK or 802.1X
WPA2	CCMP (AES) — current baseline	AES CBC-MAC	PSK or 802.1X
WPA3	GCMP (AES)	GMAC	PSK with SAE, or 802.1X

Read the table two ways. Down the encryption column: TKIP goes with WPA, CCMP/AES with WPA2, GCMP with WPA3. Across the authentication column: every version offers both Personal and Enterprise, so the version does not decide PSK-versus-802.1X and PSK-versus-802.1X does not decide the version. They are independent axes, and questions routinely test exactly that independence.

If WPA2 with AES is solid, why does WPA3 exist?

WPA2-Personal's four-way handshake can be captured and attacked offline — an attacker who records it can guess the passphrase at leisure, with no further contact with the network. WPA3-Personal replaces that handshake with SAE (Simultaneous Authentication of Equals), which resists offline guessing, and adds forward secrecy so a passphrase leaked later does not retroactively expose old captures. WPA3 also mandates protected management frames. WPA2 with AES remains an acceptable baseline at CCNA level; WPA3 is the stronger successor rather than a correction of a broken cipher.

Create a WPA2-PSK WLAN in the WLC GUI

This is a GUI workflow rather than CLI. Configure the tabs in order and apply after each.

WLC GUI (AireOS-style) — WPA2-Personal on the dynamic interface

General tab
  Profile Name : INTERNAL-WLAN
  SSID         : CorpWiFi
  Status       : Enabled
  Interface    : INTERNAL  (the dynamic interface / VLAN from the previous lesson)

Security tab (Layer 2)
  Layer 2 Security          : WPA + WPA2
  WPA2 Policy / Encryption  : AES (CCMP)
  Auth Key Management (AKM) : PSK        (enable)
  PSK Format                : ASCII
  Pre-Shared Key            : <passphrase, 8+ characters>

QoS tab
  QoS Profile : Silver (best effort)   ! Platinum=voice, Gold=video

Verify
  Monitor > WLANs   : WLAN enabled, security shows WPA2 PSK
  Monitor > Clients : client associated, has IP, correct WLAN name

The Interface binding on the General tab is what maps this WLAN's clients into their VLAN — it must point at the dynamic interface built in the previous lesson.
On the Security tab, WPA+WPA2 with AES and PSK enabled is the exact recipe for WPA2-Personal.
For Enterprise instead, choose 802.1X as the AKM and point the WLAN at a RADIUS server under Security then AAA.
Verification is two screens: Monitor > WLANs shows the WLAN enabled with WPA2 PSK, and Monitor > Clients shows a client associated with an IP address and the right WLAN name.

Troubleshooting — two failures that look similar and are not

Symptom A: the WLAN is enabled with WPA2/AES/PSK, but clients report authentication failed. That is almost always a PSK mismatch — the passphrase on the client does not match the WLAN's pre-shared key, or PSK was never actually enabled as the AKM. Authentication fails before any data path forms, so there is nothing further downstream to check. Symptom B: clients associate successfully and show the WPA2 policy, but never receive an IP address. That is the Interface binding on the General tab — a wrong dynamic interface, or one on a VLAN the network does not carry or that has no DHCP, leaves the client properly associated but landed in the wrong subnet. The distinction to hold: failed authentication is a Security-tab problem, associated-but-no-address is a General-tab problem.

Hidden SSID and MAC filtering are not encryption

Both live in the WLAN's advanced options and both are trivially bypassed — an SSID is still present in association frames whether or not it is beaconed, and a MAC address is a field the attacker writes. They may reduce casual noise, but they are not a substitute for WPA2 or WPA3. Always set real Layer 2 security.

What you should retain

Encryption by standard: WPA uses TKIP, WPA2 uses CCMP/AES and is the baseline, WPA3 uses GCMP and adds SAE for Personal.
Personal means PSK — one shared passphrase. Enterprise means 802.1X with RADIUS — per-user credentials.
The three 802.1X roles are supplicant, authenticator, and authentication server.
RADIUS authenticates wireless clients; TACACS+ is for device-administrator AAA.
WPA2-PSK in the GUI is WPA+WPA2, AES, PSK enabled, ASCII passphrase of 8 or more characters — and bind the WLAN to its dynamic interface.
Hidden SSID and MAC filtering are not encryption and never substitute for it.
Authentication failure points at the Security tab; associated-but-no-IP points at the interface binding.

Pause and predictNot scored — nothing is recorded

Before you read on

(1) A café wants Wi-Fi where anyone with the printed password can join, but people sniffing from the parking lot cannot read the traffic. Which mode, and what do you set on the WLC Security tab? (2) A WLAN is Enabled with WPA2/AES/PSK, but clients get "authentication failed" — most likely single cause? (3) Clients associate and show the WPA2 policy but never get an IP address — which GUI setting do you check first?

Interactive tool

See it happen

Required~9 min

Wireless Security Builder

Build a WPA2-PSK policy and then a WPA2-Enterprise one, and compare exactly what each demands — the Enterprise path asking for a RADIUS server is the difference the exam tests.

Open the tool

Study deeper

Topic guides extend this lesson — they do not replace the first-party walkthrough above.