Nortel Networks 2300 Changing the Tkip Countermeasures Timer Value, Enabling PSK Authentication

204Configuring User Encryption

To enable or disable cipher suites, use the following commands:

set service-profile name		cipher-ccmp {enable disable}
set service-profile name		cipher-tkip {enable	disable}
set service-profile	name	cipher-wep104 {enable disable}
set service-profile	name	cipher-wep40 {enable	disable}

To enable the 40-bit WEP cipher suite in service profile wpa, type the following command:

23x0# set service-profile wpa cipher-wep40 enable

success: change accepted.

After you type this command, the service profile supports TKIP and 40-bit WEP.

Caution! AES (CCMP) encryption is not supported on models AP-101 and AP-122. Do not attempt to enable CCMP in a service profile that is mapped to a radio profile that contains AP model AP-101 or AP-122. Otherwise, the WSS switch’s configuration file can be lost the next time the software is restarted. If your network contains model AP-101 or AP-122 APs, create a separate service profile for the other AP models that will run CCMP and enable CCMP only in that profile.

Note. Microsoft Windows XP does not support WEP with WPA. To configure a service profile to provide WEP for XP clients, leave WPA disabled and see “Configuring WEP” on page 209.

Changing the TKIP Countermeasures Timer Value

By default, WSS Software enforces TKIP countermeasures for 60,000 ms (60 seconds) after a second MIC failure within a one-minute interval. To change the countermeasures timer value, use the following command:

set service-profile name tkip-mc-time wait-time

To change the countermeasures wait time in service profile wpa to 30 seconds, type the following command:

23x0# set service-profile wpa tkip-mc-time 30000

success: change accepted.

Enabling PSK Authentication

By default, WPA uses 802.1X dynamic keying. If you plan to use static keys, you must enable PSK authentication and configure a passphrase or the raw key. You can configure the passphrase or key globally. You also can configure keys on an individual MAC client basis.

By default, 802.1X authentication remains enabled when you enable PSK authentication.

320657-A