WPA2 is a Wi-Fi security certification program for wireless LAN devices and communications. It authenticates clients, protects confidentiality, and preserves message integrity across an exposed wireless medium. WPA2 adopted the IEEE 802.11i solution developed after WEP vulnerabilities were identified. section 20.0 section 20.2
WPA2 defines two principal authentication choices and a preferred security suite:
- WPA2-Personal uses a pre-shared key (PSK). The access point and clients share the same key; authentication includes a four-way handshake that verifies the PSK and generates encryption keys. section 20.5
- WPA2-Enterprise uses 802.1X and EAP to authenticate individual user or device credentials instead of one shared PSK. section 20.2
- The strongest WPA2 suite uses AES with CCMP for encryption and CBC-MAC for integrity. WPA2 can optionally retain TKIP for older clients, but original WPA and TKIP are no longer considered secure. section 20.4 section 21.3.1
Configuring WPA2-PSK on a WLC
For CCNA-scope WLAN configuration, select WPA + WPA2, enable WPA2 Policy and AES Encryption, disable 802.1X, and select PSK. Enter either a 64-character hexadecimal PSK or an 8- to 63-character ASCII passphrase; the WLC converts the passphrase into a 256-bit PSK. PMF may be enabled in WPA2 but is optional. section 21.3.1
Table 20.1 WPA security protocols (view table figure)
| WEP |
WPA |
WPA2 |
WPA3 |
|
|---|---|---|---|---|
| Release Year |
1997 |
2003 |
2004 |
2018 |
| Authentication (WPA-Personal) |
Open System, Shared key |
PSK |
PSK |
SAE |
| Authentication (WPA-Enterprise) |
N/A |
802.1X/EAP |
802.1X/EAP |
802.1X/EAP |
| Encryption |
RC4 |
RC4 (TKIP) |
AES (CCMP) |
AES (GCMP) |
| Integrity |
ICV |
MIC (TKIP) |
CBC-MAC (CCMP) |
GMAC (GCMP) |
Compare WPA2 with WEP, WPA, and WPA3 by release year, authentication, encryption, and integrity protocol. section 20.4
