Cisco Systems OL-6415-04 manual Configuring WPA Migration Mode, End Return to privileged Exec mode

Chapter 6 Configuring Authentication Types

Configure Authentication Types

	Command	Purpose
Step 7
	end	Return to privileged EXEC mode.
Step 8
	copy running-config startup-config	(Optional) Save your entries in the configuration file.

Use the no form of the SSID commands to disable the SSID or to disable SSID features.

This example sets the authentication type for the SSID batman to Network-EAP authenticated key management. Client devices using the batman SSID authenticate using the adam server list.

router# configure terminal router(config)# interface dot11radio 0 router(config-if)#ssid batman router(config-ssid)#authentication network-eap adam router(config-ssid)#authentication key-management optional router(config-ssid)#end

Configuring WPA Migration Mode

WPA migration mode allows these client device types to associate to the access point using the same SSID:

•WPA clients capable of AES-CCM, TKIP and authenticated key management

•802.1X-2001 clients (such as legacy LEAP clients and clients using TLS) capable of authenticated key management but not TKIP

•Static-WEP clients not capable of TKIP or authenticated key management

If all three client types associate using the same SSID, the multicast cipher suite for the SSID must be WEP. If only the first two types of clients use the same SSID the multicast key can be dynamic, but if the static-WEP clients use the SSID, the key must be static. The access point can switch automatically between a static and a dynamic group key to accommodate associated client devices. To support all three types of clients on the same SSID, you must configure the static key in key slots 2 or 3.

To set up an SSID for WPA migration mode, configure these settings:

•WPA optional

•A cipher suite containing TKIP and 40-bit or 128-bit WEP

•A static WEP key in key slot 2 or 3

This example sets the SSID migrate for WPA migration mode:

router# configure terminal router(config)# interface dot11radio 0 router(config-if)# encryption mode cipher tkip wep128

router(config-if)#encryption key 3 size 128 12345678901234567890123456 transmit-key router(config-if)#ssid migrate

router(config-ssid)# authentication open router(config-ssid)# authentication network-eap adam router(config-ssid)# authentication key-management wpa optional router(config-ssid)# wpa-psk ascii batmobile65 router(config-ssid)# exit

Cisco Wireless ISR and HWIC Access Point Configuration Guide

6-12 OL-6415-04