◦
WPA-TKIP
—
This network has client stations that only support the original WPA and TKIP
security protocol. Note that selecting the WPA-TKIP only is not allowed as per the latest Wi-Fi
Alliance requirements.
◦
WPA2-AES
—
All client stations on the network support WPA2 and AES-CCMP cipher/security
protocol. This provides the best security per IEEE 802.11i standard. As per the latest Wi-Fi Alliance
requirement, the AP has to support this mode all the time.
If the network has a mix of clients, some of which support WPA2 and others which support only
the original WPA, select both. This lets both WPA and WPA2 client stations associate and
authenticate, but uses the more robust WPA2 for clients who support it. This WPA configuration
allows more interoperability in place of some security.
WPA clients must have one of these keys to be able to associate with the WAP device:
◦
A valid TKIP key
◦
A valid AES-CCMP key
•
PMF (Protection Management Frame)
—
Provides security for the unencrypted 802.11 management
frames. When Security Mode is disabled, the PMF is set to No PMF and is not editable (Hidden or
Grey).When the security Mode is set to WPA2-xxx, the PMF is Capable by default and is editable. The
following three check box values can be configured for it.
◦
Not Required
◦
Capable
◦
Required
The WiFi Alliance requires the PMF to be enabled and set to Capable (Default). You
may disable it when the non-compliant wireless clients experience instability or
connectivity issues.
Note
•
Key
—
The shared secret key for WPA Personal security. Enter a string of at least 8 characters to a
maximum of 63 characters. Acceptable characters include uppercase and lowercase alphabetic letters,
the numeric digits, and special symbols such as @ and #.
•
Show Key as Clear Text
—
When enabled, the text you type is visible. When disabled, the text is not
masked as you enter it.
•
Key Strength Meter
—
The WAP device checks the key against complexity criteria such as how many
different types of characters (uppercase and lowercase alphabetic letters, numbers, and special characters)
are used and how long is the string. If the WPA-PSK complexity check feature is enabled, the key is
not accepted unless it meets the minimum criteria. See
Configure WAP-PSK Complexity, on page 36
for information on configuring the complexity check.
•
Broadcast Key Refresh Rate
—
The interval at which the broadcast (group) key is refreshed for clients
associated with this VAP. The default is 86400 seconds and the valid range is from 0 to 86400 seconds.
A value of 0 indicates that the broadcast key is not refreshed.
Cisco WAP125 Wireless-AC/N Dual Band Desktop Access Point with PoE
47
Wireless
Configuring Security Settings
