11-7
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
OL-30644-01
Chapter11 Configuring Authentication Types
Understanding Authentication Types
Figure 11-5 shows the reassociation process using CCKM.
Figure11-5 Client Reassociation Using CCKM
Using WPA Key Management
WPAv1 is a Wi-Fi Alliance certification based on an early draft of the 802.11i amendment. WPAv1
leverages TKIP (Temporal Key Integrity Protocol) for data protection. WPAv2 is a Wi-Fi Alliance
certification based on the final 802.11i amendment published in the year 2004. WPAv2 leverages AES
(Advanced Encryption Standard) with the Counter-Mode Cipher Block Chaining (CBC) Message
Authentication Code (MAC) Protocol. Both WPAv1 and WPAv2 allow authentication using pre-shared
key (PSK) for home-type of deployment, and 802.1X for authenticated key management for
enterprise-type of deployments.
Note WPA recommends the use of TKIP, and allows the use of AES. WPA2 recommends the use of
AES-CCMP, and allows the use of TKIP for backward compatibility. Cisco and the Wi-Fi Alliance
recommend that you do not use WPAv1 with AES, or WPAv2 with TKIP. The strongest level of security
is achieved with WPAv2 and AES-CCMP. WPAv1 and TKIP can be used in networks where clients do
not support WPAv2 with AES-CCMP.
Using WPA (WPAv1 or WPAv2) key management, clients and the authentication server authenticate to
each other using an EAP authentication method, and the client and server generate a pairwise master key
(PMK). Using WPA, the server generates the PMK dynamically and passes it to the access point. Using
WPA-PSK, however, you configure a pre-shared key on both the client and the access point, and that
pre-shared key is used as the PMK.
WPA key management supports two mutually exclusive management types: WPA and WPA-pre-shared
key (WPA-PSK). Using WPA key management, clients and the authentication server authenticate to each
other using an EAP authentication method, and the client and server generate a pairwise master key
(PMK). Using WPA, the server generates the PMK dynamically and passes it to the access point. Using
WPA-PSK, however, you configure a pre-shared key on both the client and the access point, and that
pre-shared key is used as the PMK.
88964
Reassociation request
Reassociation response
Pre-registration request
Pre-registration reply
Roaming client
device
Access point WDS Device - Router/
Switch/AP Authentication server
Wired LAN