Auto (AKM)
Selects the 802.11 Authentication mechanism automatically from the configuration information exhibited
by the AP. Supports WPA/WPA2-PSK or LEAP with 802.1x+WEP or WPA/WPA2.
This section describes the following concepts:
•
Authenticated Key Management, on page 41
•
Encryption Methods, on page 41
Authenticated Key Management
The following authentication schemes use the RADIUS server to manage authentication keys:
Wi-Fi Protected Access (WPA)
Uses information on a RADIUS server to generate unique keys for authentication. Because these keys
are generated at the centralized RADIUS server and are not saved on the phone or AP, WPA provides
more security than WPA Pre-Shared Key (WPA PSK). WPA2 provides more security than WPA.
Cisco Centralized Key Management (CCKM)
Uses information on a RADIUS server and a wireless domain server (WDS) to manage and authenticate
keys. The WDS creates a cache of security credentials for CCKM-enabled client devices for fast and
secure reauthentication.
With WPA and CCKM, encryption keys are not entered on the phone, but are automatically derived between
the AP and phone. The EAP username and password that are used for authentication must be entered on each
phone.
Authenticated key management supports WPA/WPA2-PSK and WPA/WPA2/802.1x+WEP utilizing LEAP
for the EAP type. CCKM can optionally be used with WPA/WPA2/802.1x+WEP mode.
Encryption Methods
To ensure that voice traffic is secure, the Cisco Unified Wireless IP Phone supports WEP, TKIP, and Advanced
Encryption Standards (AES) for encryption. When using these mechanisms for encryption, both the signaling
Skinny Client Control Protocol (SCCP) packets and voice Real-Time Transport Protocol (RTP) packets are
encrypted between the AP and the wireless IP phone.
WEP
When using WEP in the wireless network, authentication happens at the AP by using open or shared-key
authentication. The WEP key that is set up on the phone must match the WEP key that is configured
at the AP for successful connections. The Cisco Unified Wireless IP Phone supports WEP keys that
use 40-bit encryption or a 128-bit encryption and remain static on the phone and AP.
EAP and CCKM authentication can use WEP keys for encryption. The RADIUS server manages the
WEP key and passes a unique key to the AP after authentication for encrypting all voice packets;
consequently, these WEP keys can change with each authentication.
Cisco Unified Wireless IP Phone 7925G, 7925G-EX, and 7926G Administration Guide
41
VoIP Wireless Network
Authenticated Key Management
