User's Manual

Wireless Security Commands
BreezeMAX Wi² and BreezeACCESS Wi² System Manual 231
Default Setting
open-system
Command Mode
Interface Configuration (Wireless-VAP)
Command Usage
• The auth command automatically configures settings for each authentication type, including
encryption, 802.1X, and cipher suite. The command auth open-system disables encryption and
802.1X.
• To use WEP shared-key authentication, set the authentication type to “shared-key” and define at
least one static WEP key with the key command. Encryption is automatically enabled by the
command.
• To use WEP encryption only (no authentication), set the authentication type to “open-system.”
Then enable WEP with the encryption command, and define at least one static WEP key with
the key command.
• When any WPA or WPA2 option is selected, clients are authenticated using 802.1X via a RADIUS
server. Each client must be WPA-enabled or support 802.1X client software. The 802.1X settings
(see
“802.1X Authentication” on page 191) and RADIUS server details (see “RADIUS
Client” on page 185
) must be configured on the AP. A RADIUS server must also be
configured and be available in the wired network.
• If a WPA/WPA2 mode that operates over 802.1X is selected (WPA, WPA2, WPA-WPA2-mixed,
or WPA-WPA2-PSK-mixed), the 802.1X settings (see
“802.1X Authentication” on
page 191
) and RADIUS server details (see “RADIUS Client” on page 185) must be
configured. Be sure you have also configured a RADIUS server on the network before enabling
authentication. Also, note that each client has to be WPA-enabled or support 802.1X client
software. A RADIUS server must also be configured and be available in the wired network.
• If a WPA/WPA2 Pre-shared Key mode is selected (WPA-PSK, WPA2-PSK or
WPA-WPA2-PSK-mixed), the key must first be generated and distributed to all wireless clients
before they can successfully associate with the AP. Use the wpa-preshared-key command to
configure the key (see
“key” on page 232 and “transmit-key” on page 233).
• WPA2 defines a transitional mode of operation for networks moving from WPA security to WPA2.
WPA2 Mixed Mode allows both WPA and WPA2 clients to associate to a common VAP interface.
When the encryption cipher suite is set to TKIP, the unicast encryption cipher (TKIP or
AES-CCMP) is negotiated for each client. The AP advertises it’s supported encryption ciphers in
beacon frames and probe responses. WPA and WPA2 clients select the cipher they support and
return the choice in the association request to the . For mixed-mode operation, the cipher used
for broadcast frames is always TKIP. WEP encryption is not allowed.
• The “required” option places the VAP into TKIP only mode. The “supported” option places the
VAP into TKIP+AES+WEP mode. The “required” mode is used in WPA-only environments.
• The “supported” mode can be used for mixed environments with legacy WPA products,
specifically WEP. (For example, WPA+WEP. The WPA2+WEP environment is not available
because WPA2 does not support WEP). To place the VAP into AES only mode, use “required”
and then select the “cipher-ccmp” option for the cipher-suite command.