Wireless Security · Topic 3 of 4

Wireless Encryption and EAP

Learn how wireless encryption works in RouterOS with WEP, TKIP and AES, how WPA2 PSK differs from WPA2 EAP, and how to pick the right EAP method.

5 min

In a nutshell

WEP is broken, TKIP is weak, and AES with CCM is the standard cipher.
unicast-ciphers protect client traffic, and group-ciphers protect broadcast traffic.
WPA2 PSK uses one shared key, and WPA2 EAP uses per user credentials with a RADIUS server.

What it is

Encryption scrambles wireless traffic so that people who can hear the radio cannot read it, and EAP is a framework for proving who a user is.

Radio waves go through walls and can be received by anyone nearby. Without encryption, anyone can read the traffic. Encryption turns the traffic into data that only the two ends can read.

EAP goes one step further than a shared password. It lets each user or device prove its identity separately.

How it works

The cipher protects the data, and the authentication method decides who may get a key.

Encryption methods

Method	Status
WEP	Old and broken. Do not use
WPA with TKIP	Older and weaker. Avoid when possible
WPA2 with AES (`aes-ccm`)	The standard choice today

WEP uses static keys that can be recovered quickly. TKIP was a stopgap that allowed old hardware to be more secure than WEP. AES with CCM is the strong cipher, and it is what aes-ccm means in RouterOS.

Security profile settings

The cipher choice is in the security profile:

/interface wireless security-profiles add name=secure mode=dynamic-keys authentication-types=wpa2-psk unicast-ciphers=aes-ccm group-ciphers=aes-ccm wpa2-pre-shared-key=LongPassphrase

unicast-ciphers protect traffic between one client and the access point.
group-ciphers protect broadcast and multicast traffic.

The mode static-keys-required and static-keys-optional belong to the old WEP style. For modern networks, use dynamic-keys.

PSK versus EAP

Point	WPA2 PSK	WPA2 EAP
Credential	One shared passphrase	A user name and password, or a certificate
Key per user	No, the same secret for all	Yes, keys are specific to the session
Central server	Not needed	RADIUS server needed
Best for	Home and small networks	Companies and larger networks

With EAP, removing one user does not affect the others. With PSK, removing a person means changing the key for everyone.

The three roles

EAP, in the 802.1X form, has three roles:

The supplicant is the client that wants access.
The authenticator is the access point, which controls the port.
The authentication server is the RADIUS server, which decides.

The access point passes EAP messages between the client and the server, and it blocks other traffic until the server accepts the client.

EAP methods in RouterOS

The method is chosen in the security profile with eap-methods:

/interface wireless security-profiles set secure authentication-types=wpa2-eap eap-methods=passthrough

Method	Meaning
`passthrough`	The access point forwards EAP to a RADIUS server
`eap-tls`	The client and server use certificates
`eap-ttls-mschapv2`	A tunnel is built, and a user name and password are checked inside it
`peap`	A tunnel is built, and a password method is run inside it

On an access point that sends EAP to RADIUS, passthrough is the usual choice, and the RADIUS server needs to be set as shown in the authentication page. A station uses a method it supports, together with the credentials for it.

Certificates and TLS mode

Methods that use TLS need certificates. The tls-mode and tls-certificate properties control the checks:

Property	Purpose
`tls-mode`	Whether the certificate is checked, and how
`tls-certificate`	The certificate that this device uses
`mschapv2-username` and `mschapv2-password`	The user credentials for a station that uses a password method

Checking the server certificate protects the user from connecting to a fake access point. If the check is off, a fake network can ask for the password.

Watch out

Do not turn off certificate checking just to make EAP connect. A station that does not check the server can be fooled by a copy of your network.

Choosing a design

Home or small office: WPA2 PSK with aes-ccm and a long passphrase.
Business: WPA2 EAP with a RADIUS server.
Never use WEP, and avoid TKIP.

Verifying

/interface wireless security-profiles print detail
/interface wireless registration-table print detail

The registration table shows the encryption each client uses, so you can confirm that clients are not on a weak cipher.

What to remember for the exam

Six facts cover this topic.

WEP is broken, TKIP is weak, and AES with CCM is the standard cipher.
unicast-ciphers protect client traffic, and group-ciphers protect broadcast traffic.
WPA2 PSK uses one shared key, and WPA2 EAP uses per user credentials with a RADIUS server.
EAP has a supplicant, an authenticator and an authentication server.
eap-methods includes passthrough, eap-tls, eap-ttls-mschapv2 and peap.
Server certificate checking protects against fake networks.

Common mistakes

Four errors are typical.

Leaving WEP or TKIP enabled. One weak cipher in the list weakens the network.

Using PSK for a large company. Staff changes force a key change for everyone.

Switching off certificate checks. A fake access point can then collect passwords.

Mixing up the roles. The access point is the authenticator and not the server.

Check yourself

Work through these three questions.

Which cipher is the standard choice today, and what is it called in RouterOS?
AES with CCM, written aes-ccm. WEP and TKIP are weaker.
What are the three roles in EAP?
The supplicant is the client, the authenticator is the access point, and the authentication server is the RADIUS server. The access point passes messages between the other two.
Why is EAP better than a shared PSK for a company?
Each user has their own credentials and session keys. Removing one user does not require changing the secret for everyone.

Topic 3 of 4 in Wireless Security

Test yourself on Wireless Security

The full MikroTik MTCWE question bank has 447 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.