PlantUML DiagramWPA2-Enterprise 802.1X Flow
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
In 2024, roughly 24% of enterprise wireless breaches started with weak wireless credentials. The vast majority traced to two root causes: shared PSK passwords that leaked (sticky notes, screenshots, employee turnover), and legacy WPA/TKIP configurations still running on equipment that should have been upgraded. Neither is a sophisticated attack — both are known problems with known fixes.
Wireless security has a small number of moving parts: how clients authenticate to the network, and how traffic is encrypted over the air. Getting the combination right is mostly about matching the security mechanism to the deployment scenario.
| Standard | Encryption | Authentication | Use |
|---|---|---|---|
| Open | None | None | Public hotspots only |
| WEP | RC4 (broken) | Shared key | Never use |
| WPA | TKIP | PSK / 802.1X | Legacy — replace |
| WPA2-Personal | AES-CCMP | PSK | Home / small office |
| WPA2-Enterprise | AES-CCMP | 802.1X (EAP) | Enterprise |
| WPA3-Personal | AES-CCMP / GCMP | SAE | Modern home |
| WPA3-Enterprise | AES-CCMP / GCMP / 192-bit | 802.1X + optional 192-bit mode | Modern enterprise |
WPA3's key improvement is SAE (Simultaneous Authentication of Equals) for Personal mode. In WPA2-Personal, an attacker captures the handshake and offline brute-forces the PSK at billions of guesses per second. In WPA3, each guess requires an online interaction with the AP — making dictionary attacks orders of magnitude slower.
WPA2-Enterprise and WPA3-Enterprise use 802.1X, which delegates authentication to a RADIUS server via EAP (Extensible Authentication Protocol). There are many EAP variants, each with different security properties. The two you'll see in production are PEAP and EAP-TLS.
PEAP dominates enterprise wireless because it combines good security with low client management overhead — no per-device certificates. Users log in with their AD credentials, which are tunneled inside TLS. The RADIUS server (often Cisco ISE) validates them against Active Directory.
The AP is a conduit, not a decision-maker. It relays EAP messages between client and RADIUS server until authentication completes. Once the RADIUS server returns Access-Accept, the AP and client do the standard four-way handshake to derive session keys. The client never directly talks to the RADIUS server.
In a lab with a WLC and RADIUS server (FreeRADIUS works), configure WPA2-Enterprise with PEAP. Test with a client. You'll see the EAPOL exchange in a Wireshark capture — and understand why the credentials never appear on the wire.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.