Enabling Cipher Suite With 12.3(8)Jk Or Earlier Releases - Cisco C3201FESMIC-TP= - 3201 Fast EN Switch Mobile Interface Card Expansion Module Software Configuration Manual

Cipher Suites and WEP

Enabling Cipher Suite with 12.3(8)JK or Earlier Releases

To enable a cipher suite, follow these steps, beginning in privileged EXEC mode:
Command
Step 1 configure terminal
Step 2 interface dot11radio 0
Step 3 encryption
[vlan vlan-id]
mode ciphers
{[aes-ccm | ckip | cmic | ckip-cmic |
tkip]} {[wep128 | wep40]}
Step 4 end
Step 5 copy running-config startup-config (Optional) Saves your entries in the configuration file.
Use the no form of the encryption command to disable a cipher suite.
This example sets up a cipher suite for VLAN 1 that enables CKIP, CMIC, and 128-bit WEP:
bridge# configure terminal
bridge(config)# interface dot11radio 0
Purpose
Enters global configuration mode.
Enters interface configuration mode for the radio interface.
Enables a cipher suite containing the WEP protection you need.
(Table 3 lists guidelines for selecting a cipher suite to match the
type of authenticated key management you configure.)
(Optional) Select the VLAN for which you want to enable
•
WEP and WEP features.
Set the cipher options.
•
You can combine TKIP with 128-bit or 40-bit WEP.
Note
Note You can combine AES with TKIP. In this case, AES is
the unicast cipher and TKIP becomes the group cipher.
If you enable a cipher suite with two elements (such as
Note
TKIP and 128-bit WEP), the second cipher becomes the
group cipher.
Note You can also use the encryption mode wep command
to set up static WEP. However, you should use
encryption mode wep only if none of the non-root
bridges that associate to the root device are capable of
key management. See the Cisco IOS Command
Reference for Cisco Access Points and Bridges for a
detailed description of the encryption mode wep
command.
When you configure TKIP-only, AES-only, or the
Note
combination of AES and TKIP (no WEP included) on
any radio interface or VLAN, the SSID on that radio or
VLAN must be set to use WPA or CCKM key
management. If you do not configure key management
on the SSID, non-root bridge authentication fails on the
SSID.
Cisco Key Integrity Protocol (CKIP) and
Note
CKIP-Cisco Message Integrity Protocol (CMIP) are
supported only on the 2.4-GHz (802.11b/g) WMIC.
Returns to privileged EXEC mode.
Cisco 3200 Series Wireless MIC Software Configuration Guide
Configuring Cipher Suites
7