Configuring a WPA2 PSK WLAN in the GUI

What it is

This topic is a worked example that creates a WPA2 PSK wireless network on a Cisco wireless LAN controller (WLC).

It takes the ideas about WLANs and wireless security from earlier pages and applies them to one concrete job.

WPA2-PSK means every user connects with the same passphrase, and traffic is encrypted with AES. It is the simplest secure setup for a small group or a guest network.

The steps follow the AireOS style of GUI. On the Catalyst 9800, the same settings sit under Configuration, Tags and Profiles, WLANs, so expect the labels to differ.

How it works

You create the WLAN, enable it, map it to a VLAN, then set WPA2, AES and PSK under Layer 2 security.

The steps

Step 1 and 2: create the WLAN. In the WLANs list, choose to create a new WLAN. Enter a profile name, an SSID and an ID number. The SSID is what users will see.

Step 3: general settings. Set the status to Enabled. Choose the interface or VLAN the wireless clients will join.

This decides their IP subnet, so there must be a DHCP source and a route for that VLAN. Leaving the WLAN disabled is a classic reason for an SSID that never appears.

Step 4 to 6: security. Open the security section and its Layer 2 tab, then set the following.

• Select WPA+WPA2 as the Layer 2 security.
• Under the WPA2 policy, tick WPA2 policy and the AES encryption box, and leave TKIP unticked.
• In authentication key management, tick PSK, not 802.1X.

The 802.1X option would send each user to a RADIUS server, which is a different design.

Step 7: the passphrase. Set the PSK format to ASCII and type the passphrase. A WPA2 ASCII passphrase must be 8 to 63 characters long.

The alternative is a 64 digit hexadecimal key. Choose a long, random passphrase, since the strength of the whole network rests on it.

Step 8: apply. Apply the changes and save the configuration. Check that the WLAN appears in the list as enabled, and that its security column shows WPA2 with PSK.

Testing from a client

Connect a client to the new SSID and enter the passphrase. Then check:

1. The client joins and shows a connected state.
2. It receives an IP address from the right VLAN.
3. It can reach the default gateway and then beyond it.

On the controller, the Monitor section lists the connected clients, with their address, the WLAN, the AP and the status. This shows whether the client really joined and which interface it uses.

Checking from the command line

If you have CLI access to an AireOS controller, these commands are useful:

show wlan summary
show wlan 1
show client summary

They show the list of WLANs and whether they are enabled, the details of one WLAN, including its security settings, and the associated clients. On a Catalyst 9800, the client command is show wireless client summary.

Troubleshooting a client that cannot connect

Work through the likely causes in order.

• WLAN disabled: the SSID does not appear.
• Wrong passphrase: the client keeps asking for the password, or fails after an attempt. The passphrase is case sensitive.
• Security mismatch: an old device that only supports older security cannot join a WPA2 only WLAN.
• Wrong interface or VLAN: the client joins but gets an address from the wrong subnet, or no address.
• No DHCP or no route: the client has no usable address, or cannot leave the subnet.
• Radio problems: weak signal or interference, which is a coverage issue and not a configuration one.