This security mode is backwards-compatible with the wireless clients that support the original WPA.
The dynamic VLAN mode is enabled by default, which allows RADIUS authentication server to decide which
VLAN is used for the stations.
These parameters configure WPA Enterprise:
•
WPA Versions
— Choose the types of client stations to be supported. The options are:
•
WPA-TKIP
— The network has some client stations that only support original WPA and TKIP
security protocol. Note that selecting only WPA-TKIP for the access point is not allowed as per the
latest Wi-Fi Alliance requirement.
•
WPA2-AES
— All client stations on the network support WPA2 version and AES-CCMP cipher/
security protocol. This provides the best security per the IEEE 802.11i standard. As per the latest
Wi-Fi Alliance requirement, the AP has to support this mode all the time.
•
Enable Pre-authentication
— If you choose only WPA2 or both WPA and WPA2 as the WPA version,
you can enable pre-authentication for the WPA2 clients.
Check this option if you want the WPA2 wireless clients to send the pre-authentication packets. The
pre-authentication information is relayed from the WAP device that the client is currently using to the
target WAP device. Enabling this feature can help speed up the authentication for roaming clients who
connect to multiple APs.
This option does not apply if you selected WPA for WPA versions because the original WPA does not
support this feature.
Client stations configured to use WPA with RADIUS must have one of these addresses and keys:
• A valid TKIP RADIUS IP address and RADIUS key
• A valid CCMP (AES) IP address and RADIUS key
•
PMF (Protection Management Frame)
— Provides security for the unencrypted 802.11 management
frames. When Security Mode is disabled or WEP, the PMF is set to
No PMF
and is not editable (Hidden
or Grey).When the security Mode is set to
WPA2-xxx
, the PMF is
Capable
by default and is editable.
The following three check box values can be configured for it.
•
Not Required
•
Capable
•
Required
WiFi Alliance requires PMF to be enabled with default setting of
Capable
. You
may disable it when non-compliant wireless clients experience instability or
connectivity issues.
Note
•
Use Global RADIUS Server Settings
— By default, each VAP uses the global RADIUS settings that
you define for the WAP device. However, you can configure each VAP to use a different set of RADIUS
servers.
Check this option to use the global RADIUS server settings, or uncheck this option to use a separate
RADIUS server for the VAP and enter the RADIUS server IP address and key in the appropriate fields.
Cisco WAP581 Wireless-AC/N Dual Radio Access Point with 2.5GbE LAN Administration Guide
55
Wireless
Configuring Security Settings
Summary of Contents for Wap581
Page 4: ......
