PlantUML DiagramWPA2-Enterprise Authentication on WLC
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Below is a sample WLC configuration snippet showing the key elements for WPA2-Enterprise on a Cisco Catalyst 9800. Note the four settings that matter: security type, RADIUS server group, PMF mode, and the policy profile binding. Everything else is metadata.
! Cisco Catalyst 9800 config — WPA2-Enterprise WLANwireless security dot1x WPA2_DOT1Xsecurity dot1xauthentication-list ISE_AUTHauthorization-list ISE_AUTHZaccounting-list ISE_ACCT!wlan CORP-WPA2-ENT 10 CORP-WPA2-ENTsecurity wpawpa2 dot1xpmf optional!wireless profile policy CORP-POLICYvlan 10no shutdown!wireless tag policy CORP-TAGwlan CORP-WPA2-ENT policy CORP-POLICY!aaa authentication dot1x default group ISE_GROUPaaa authorization network default group ISE_GROUP!radius server ISE-PRIMARYaddress ipv4 10.10.99.10 auth-port 1812 acct-port 1813key MyRadiusKey!
The `security dot1x` block references the AAA server groups. The `wlan` block defines the SSID and its authentication type (WPA2-Enterprise). The `pmf optional` line sets Protected Management Frames — a WPA2/WPA3 feature that prevents deauthentication attacks. Everything else maps the WLAN to a VLAN and policy profile.
Protected Management Frames (802.11w) signs management frames — including deauthentication and disassociation — so attackers can't forge them. Before PMF, an attacker could send spoofed deauth frames and disconnect clients from the AP. PMF eliminates this.
| PMF mode | Behavior |
|---|---|
| Disabled | No PMF — vulnerable to deauth attacks |
| Optional | Accepts both PMF-capable and non-PMF clients |
| Required | Only PMF-capable clients can associate |
WPA3 requires PMF. In WPA3-Enterprise mode, PMF is mandatory — a client that doesn't support it can't associate. For WPA2-Enterprise, PMF is optional but recommended. In mixed environments with older clients, use `optional` — capable clients get protection, older clients still connect.
WPA3-Enterprise offers an optional 192-bit mode (also called CNSA Suite) with stronger cryptography: 384-bit hashes, 256-bit AES-GCM, and stronger key derivation. This is required for government, defense, and financial environments with strict compliance requirements. It requires both client and infrastructure support — check compatibility before deploying.
The WLC is the RADIUS client. From the RADIUS server's perspective, the WLC — not the AP — is the authentication requester. The AP just tunnels EAPOL traffic back to the WLC over CAPWAP. This is why CAPWAP tunnels must reach the WLC for authentication to work.
A hospital is deploying new wireless infrastructure. Client devices range from 5-year-old medical devices (which only support WPA2) to new laptops (which support WPA3). What WLAN configuration is best?
Select the safest next action.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.