Configuring Wpa Migration Mode - Cisco M10-RM Software Manual

Chapter 11 Configuring Authentication Types
Command
Step 7
end
Step 8
copy running-config startup-config (Optional) Save your entries in the configuration file.
Use the no form of the SSID commands to disable the SSID or to disable SSID features.
This example sets the authentication type for the SSID batman to Network-EAP with CCKM
authenticated key management. Client devices using the batman SSID authenticate using the adam
server list. After they are authenticated, CCKM-enabled clients can perform fast reassociations using
CCKM.
ap1200# configure terminal
ap1200(config-if)# ssid batman
ap1200(config-ssid)# authentication network-eap adam
ap1200(config-ssid)# authentication key-management cckm optional
ap1200(config)# interface dot11radio 0
ap1200(config-if)# ssid batman
ap1200(config-ssid)# end

Configuring WPA Migration Mode

WPA migration mode allows these client device types to associate to the access point using the same
SSID:
•
•
•
If all three client types associate using the same SSID, the multicast cipher suite for the SSID must be
WEP. If only the first two types of clients use the same SSID the multicast key can be dynamic, but if
the static-WEP clients use the SSID, the key must be static. The access point can switch automatically
between a static and a dynamic group key to accommodate associated client devices. To support all three
types of clients on the same SSID, you must configure the static key in key slots 2 or 3.
To set up an SSID for WPA migration mode, configure these settings:
•
•
•
This example sets the SSID migrate for WPA migration mode:
ap1200# configure terminal
ap1200(config-if)# ssid migrate
ap1200(config-if)# encryption mode cipher tkip wep128
ap1200(config-if)# encryption key 3 size 128 12345678901234567890123456 transmit-key
ap1200(config-ssid)# authentication open
ap1200(config-ssid)# authentication network-eap adam
ap1200(config-ssid)# authentication key-management wpa optional
ap1200(config-ssid)# wpa-psk ascii batmobile65
ap1200(config)# interface dot11radio 0
ap1200(config-if)# ssid migrate
ap1200(config-ssid)# end
OL-14209-01
WPA clients capable of TKIP and authenticated key management
802.1X-2001 clients (such as legacy LEAP clients and clients using TLS) capable of authenticated
key management but not TKIP
Static-WEP clients not capable of TKIP or authenticated key management
WPA optional
A cipher suite containing TKIP and 40-bit or 128-bit WEP
A static WEP key in key slot 2 or 3
Purpose
Return to privileged EXEC mode.
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
Configuring Authentication Types
11-13