Configure WPA3-Enterprise on Cisco WLC

WPA3-Enterprise, introduced as part of the Wi-Fi Alliance's WPA3 standard, enhances the security posture of enterprise wireless networks by mandating more…

WPA3-Enterprise, introduced as part of the Wi-Fi Alliance's WPA3 standard, enhances the security posture of enterprise wireless networks by mandating more robust cryptographic algorithms and protecting against certain attack vectors prevalent in WPA2. This article details the configuration of WPA3-Enterprise on Cisco Wireless LAN Controllers (WLCs), specifically focusing on AireOS and Catalyst 9800 series controllers. We'll cover the necessary steps to enable WPA3-Enterprise, including transitioning from WPA2, and highlight key considerations for a successful deployment.

The primary security enhancements in WPA3-Enterprise include the mandatory use of 192-bit cryptographic strength (Suite B Cryptography) and a more resilient EAP-TLS exchange, making it significantly harder for attackers to compromise network credentials through offline dictionary attacks.

Cisco AireOS WLC Configuration (v8.5+)

Cisco AireOS WLCs from version 8.5 onwards support WPA3-Enterprise. For versions prior to 8.8, 192-bit mode is not available, only WPA3-Enterprise with SHA256 is supported. Version 8.8 introduced 192-bit security mode (Suite B). We'll focus on the more common SHA256 implementation first.

1. RADIUS Server Configuration

Before configuring the WLC, ensure your RADIUS server (e.g., Cisco ISE, Microsoft NPS) supports SHA256 for EAP authentication. Most modern RADIUS deployments support this by default. For Cisco ISE, ensure your authentication policies use EAP-TLS or PEAP with appropriate certificate/credential stores. For NPS, ensure your Network Policy Server templates for Wi-Fi authentication are configured for secure EAP methods.

2. Create or Modify WLAN

Navigate to WLANs > Create New or select an existing WLAN to modify.

• Profile Name: A descriptive name (e.g., "WPA3-Enterprise").
• SSID: The broadcast name for your wireless network.
• ID: A unique WLAN ID.
• Status: Enabled.

3. Configure Security Settings

Go to the Security tab for your chosen WLAN.

Layer 2 Security

Under Layer 2 Security, select WPA+WPA2+WPA3. This option is critical for WPA3 Transition Mode, allowing both WPA2 and WPA3 clients to connect simultaneously. If you want pure WPA3-Enterprise (no WPA2 clients allowed), select WPA3.

For WPA3 Policy, select AES (CCMP128) for the encryption type. This is the standard for WPA3-Enterprise SHA256. For 192-bit mode (AireOS 8.8+), you would select AES (GCMP-256).

Check the box for 802.1X. This will enable Enterprise authentication.

AAA Servers

Under the AAA Servers tab, assign your primary and optionally secondary RADIUS authentication servers. Ensure these servers are correctly configured under Security > AAA > RADIUS > Authentication on the WLC with shared secrets and proper IP addresses.

(Cisco Controller) >config wlan security wpa akm policy add <wlan-id> wpa3 dot1x
(Cisco Controller) >config wlan security wpa akm policy add <wlan-id> wpa2 dot1x
(Cisco Controller) >config wlan security wpa ciphers <wlan-id> aes
(Cisco Controller) >config wlan security wpa version <wlan-id> wpa2+wpa3
(Cisco Controller) >config wlan security auth open <wlan-id> disable
(Cisco Controller) >config wlan security dot1x enable <wlan-id>
(Cisco Controller) >config wlan security radius auth <wlan-id> <server-index> <server-ip>

The wpa2+wpa3 option enables WPA3 Transition Mode. If you only want WPA3, use wpa3.

Cisco Catalyst 9800 Series WLC Configuration (IOS XE 16.10+)

Catalyst 9800 WLCs running IOS XE 16.10 or later support WPA3-Enterprise. This platform offers a more streamlined configuration via the GUI or CLI, aligning with standard IOS XE practices.

1. RADIUS Server Configuration

Similar to AireOS, ensure your RADIUS server is prepared. On the 9800, you'll define your RADIUS server as an AAA server group.

! Define RADIUS Server
radius server <RADIUS_SERVER_NAME>
 address ipv4 <RADIUS_SERVER_IP> auth-port 1812 acct-port 1813
 key <SHARED_SECRET_KEY>
! Create AAA Server Group
aaa group server radius <RADIUS_SERVER_GROUP_NAME>
 server name <RADIUS_SERVER_NAME>
 ip radius source-interface <VLAN_INTERFACE_FOR_RADIUS_TRAFFIC>
! Apply AAA Server Group to WLAN
aaa authentication dot1x default group <RADIUS_SERVER_GROUP_NAME>
aaa authorization network default group <RADIUS_SERVER_GROUP_NAME>

2. Configure WLAN Profile

Navigate to Configuration > Tags & Profiles > WLANs and either create a new WLAN Profile or edit an existing one.

• General Settings:
  • Name: Descriptive name.
  • SSID: Broadcast SSID.
  • Radio Policy: All radios or specific bands.
  • Status: Enabled.

3. Configure Security Settings

Within the WLAN Profile, go to the Security tab.

Layer 2

Select WPA+WPA2+WPA3 for Transition Mode, or WPA3 for pure WPA3-Enterprise. For AKM Policy, ensure 802.1X is selected. For Cipher Suite, select AES (CCMP128) for standard WPA3-Enterprise. If deploying 192-bit mode (available from IOS XE 16.12.1+), select GCMP-256.

AAA Server List

Under AAA Server List, select the AAA server group you defined previously.

! WLAN Profile Configuration
wireless profile wlan <WLAN_PROFILE_NAME>
 ssid <SSID_NAME>
 security wpa wpa3-transition
 security wpa akm dot1x
 security wpa cipher aes
 security wpa3 akm dot1x
 security wpa3 cipher aes
 security authentication list <AAA_AUTHENTICATION_LIST_NAME>
 security authorization list <AAA_AUTHORIZATION_LIST_NAME>

! Policy Profile Configuration (link WLAN to VLAN/AAA)
wireless profile policy <POLICY_PROFILE_NAME>
 description "Policy for WPA3 Enterprise"
 vlan <VLAN_ID_FOR_SSID>
 aaa authentication policy <AAA_AUTHENTICATION_LIST_NAME>
 aaa authorization policy <AAA_AUTHORIZATION_LIST_NAME>
 no shutdown

! Policy Tag (link Policy Profile to APs)
wireless tag policy <POLICY_TAG_NAME>
 wlan <WLAN_PROFILE_NAME> policy <POLICY_PROFILE_NAME>
! Assign Policy Tag to APs or AP Groups

Replace <AAA_AUTHENTICATION_LIST_NAME> and <AAA_AUTHORIZATION_LIST_NAME> with the names of your AAA authentication and authorization lists that reference your RADIUS server group.

Transition Mode vs. Pure WPA3-Enterprise

Transition Mode (WPA2+WPA3): This is the recommended starting point for most organizations. It allows both WPA2-Enterprise and WPA3-Enterprise clients to connect to the same SSID. WPA3-capable clients will negotiate WPA3, while WPA2-only clients will use WPA2. This prevents service disruption during the rollout. The WLC will advertise both OWE and WPA3 AKMs.

Pure WPA3-Enterprise: Only WPA3-Enterprise clients can connect. This provides the highest security but requires all clients to support WPA3-Enterprise. Deploy this only after verifying all necessary client devices are WPA3 compliant.

Client Compatibility Considerations

Client device support for WPA3-Enterprise is crucial. While newer devices (iOS 13+, Android 10+, Windows 10 v1903+) generally support WPA3, older devices or specific drivers might not.

• Operating Systems:
  • Windows 10 v1903 (May 2019 Update) and later.
  • macOS Catalina (10.15) and later.
  • iOS 13 and later.
  • Android 10 and later.
  • Modern Linux distributions with updated wpa_supplicant (version 2.9+).
• Wi-Fi Adapters/Drivers: Ensure client Wi-Fi adapters have updated drivers that support WPA3. Some older hardware may never receive WPA3 driver updates.
• EAP Method: WPA3-Enterprise primarily relies on 802.1X/EAP. Ensure your clients are configured for the correct EAP method (e.g., PEAP-MSCHAPv2, EAP-TLS) and trust your RADIUS server's certificate.

192-bit Security Mode (Suite B Cryptography)

For environments with stringent security requirements, WPA3-Enterprise offers a 192-bit security mode. This mode mandates the use of GCMP-256 for encryption and EAP-TLS with 192-bit curve cryptography for authentication.

• AireOS: Supported from version 8.8 with the AES (GCMP-256) cipher.
• Catalyst 9800: Supported from IOS XE 16.12.1+ with the GCMP-256 cipher.

This mode requires clients to also support 192-bit crypto suites, which is less common than the SHA256 (128-bit AES) mode. Verify client support thoroughly before enabling 192-bit mode.

A comparison of WPA2-Enterprise and WPA3-Enterprise features:

Verification Steps

After configuring WPA3-Enterprise, verify the configuration and client connectivity:

• WLC CLI:
  • AireOS: show wlan <wlan-id> - Look for "WPA3 Policy State" and "WPA3 Cipher Suites".
  • Catalyst 9800: show wireless profile wlan <WLAN_PROFILE_NAME> - Verify "Security" and "AKM" settings.
• Client Connection: Test with a WPA3-capable client (e.g., a modern smartphone or laptop).
  • On Windows: Check "Wi-Fi properties" for the connection to see "Security type" (WPA3-Enterprise).
  • On macOS/iOS: Check connection details, it should indicate WPA3.
• RADIUS Logs: Monitor your RADIUS server (ISE/NPS) for successful authentication records. Ensure the authentication method and negotiation details align with WPA3.

! Example AireOS verification
(Cisco Controller) >show wlan 1
...
WPA3 Policy State.......................... Enabled
WPA3 Policy Cipher Suites.................. AES (CCMP128)
WPA3 Policy AKM List....................... 802.1X
...

! Example Catalyst 9800 verification
#show wireless profile wlan WPA3_Enterprise_WLAN
WLAN Profile Name             : WPA3_Enterprise_WLAN
SSID                          : WPA3-Corp-WiFi
...
Security
 WPA Type                     : WPA3 Transition
 AKM Policy                   : 802.1x, WPA3 802.1x
 Cipher                       : AES (CCMP)
...

Common Pitfalls

• RADIUS Server Misconfiguration: Incorrect shared secrets, server IP addresses, or misconfigured authentication policies on the RADIUS server are common issues.
• Client Compatibility: The most frequent cause of connection failures. Not all "WPA3-ready" devices truly support WPA3-Enterprise out of the box, or they might require driver updates.
• Certificate Issues: For EAP-TLS or PEAP, ensure clients trust the RADIUS server's certificate authority. Incorrect certificate chain or expired certificates will prevent authentication.
• Missing PMF (Protected Management Frames): WPA3 mandates PMF. While the WLC typically enables this automatically when WPA3 is configured, ensure it's not disabled globally or on the WLAN. AireOS refers to this as "Management Frame Protection" or MFP.
• Firewall Rules: Ensure network firewalls permit RADIUS traffic (UDP 1812/1813) between the WLC and the RADIUS server.
• Mixed Mode (Transition) Challenges: Some older client drivers might struggle in transition mode, even if they theoretically support WPA2. Always test thoroughly.