Security
The following scenarios show how to configure WLAN interfaces to
use different security modes. All examples will be done using the
wifi0 radio module and channel numer 36
to avoid waiting for the cac timer to exhaust. Note that an external
radius server will be required in enterprise scenarios and the user
testing with password password must be present in its database.
Open Security
Description
In this example, the wlan1 interface will be configured to
use no security.
Scenario
Warning
Note that the traffic will be visible to any attacker. Use OWE or OWE-Transition instead.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm none
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm none
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.35 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.35 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.354/4.354/6.354/2.000 ms
OWE Mode
Description
In this example, the wlan1 interface will be configured to
use OWE security (Opportunistic Wireless Encryption). The main advantage of
this mode compared with open security is that the traffic is encrypted
making passive sniffing useless.
Scenario
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm owe set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security psk-passphrase secret-password set interfaces wlan wlan1 type access-point security pmf required
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm owe set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password set interfaces wlan wlan0 type station network 1 security pmf required
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.62 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.45 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.451/4.536/6.621/2.085 ms
OWE-Transition Mode
Description
In this example, the wlan1 interface will be configured to
use OWE security (Opportunistic Wireless Encryption) and an additional one,
wlan2, will be also configured with open security. The former network is
just a transition mechanism to tell WPA3 capable devices to use the OWE network
in case they connect to this one.
Scenario
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm owe transition wlan-ifc wlan2 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point disable-broadcast-ssid set interfaces wlan wlan2 bridge-group bridge br0 set interfaces wlan wlan2 phy wifi0 set interfaces wlan wlan2 type access-point security akm none transition wlan-ifc wlan1 set interfaces wlan wlan2 type access-point ssid robotest_5ghz_owe
Note
See open security and owe security examples for client side configurations
WPA-Personal Mode
Description
In this example, the wlan1 interface will be configured in WPA personal
mode where the security is ensured by mean of the pre-shared key secret-password.
The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
WPA-Personal is considered no longer secure. Use WPA/WPA2-Personal instead in case legacy devices are present in your deployment.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security psk-passphrase secret-password
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm psk set interfaces wlan wlan0 type station network 1 security framework wpav1 set interfaces wlan wlan0 type station network 1 security passphrase secret-password
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=5.18 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.39 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.387/3.783/5.179/1.396 ms
WPA2-Personal Mode
Description
In this example, the wlan1 interface will be configured in WPAv2 personal
mode where the security is ensured by mean of the pre-shared key secret-password.
The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
The tkip unicast cipher is considered unsecure. Use aes-ccmp instead.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security psk-passphrase secret-password
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm psk set interfaces wlan wlan0 type station network 1 security pairwise-ciphers tkip set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.80 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.46 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.462/4.631/6.801/2.170 ms
WPA/WPA2-Personal Mode
Description
In this example, the wlan1 interface will be configured in WPA/WPAv2 personal
mode, also known as WPAv2 Mixed mode, where the security is ensured by mean of the pre-shared
key secret-password. The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
This mode was originally intended to provide WPA2 security while maintaining support to legacy WPA stations. As stations can connect using WPA security, which is considered unsecure, only use this mode if legacy devices are present in your deployment.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security psk-passphrase secret-password
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm psk set interfaces wlan wlan0 type station network 1 security framework wpav1 set interfaces wlan wlan0 type station network 1 security pairwise-ciphers tkip set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=7.34 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.99 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.989/5.165/7.342/2.177 ms
WPA3-Personal Only Mode
Description
In this example, the wlan1 interface will be configured in WPAv3 personal
mode, also known as SAE (Simultaneous Authentication of Equals), the state-of-the-art in
PSK mode, where the security is ensured by mean of the pre-shared key secret-password.
The aes-ccmp cipher will be used for unicast traffic. Protected Management Frames or pmf
must be set to required in this mode.
Scenario
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security psk-passphrase secret-password set interfaces wlan wlan1 type access-point security pmf required
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm sae set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password set interfaces wlan wlan0 type station network 1 security pmf required
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.56 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.86 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.860/4.708/6.557/1.849 ms
WPA2/WPA3-Personal Transition Mode
Description
In this example, the wlan1 interface will be configured in WPAv2/WPAv3 personal
mode, also known as WPAv3 transition mode, where the security is ensured by mean of the pre-shared
key secret-password. The aes-ccmp cipher will be used for unicast traffic. Protected
Management Frames or pmf must be set to optional in this mode.
Scenario
Note
This is a transition mode intended to provide connectivity to WPAv2 capable stations. WPAv3 capable stations will use this security mode when connecting to the device.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security akm psk-256 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security psk-passphrase secret-password set interfaces wlan wlan1 type access-point security pmf required
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm psk set interfaces wlan wlan0 type station network 1 security akm psk-256 set interfaces wlan wlan0 type station network 1 security akm sae set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password set interfaces wlan wlan0 type station network 1 security pmf required
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=7.35 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.49 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.486/4.917/7.348/2.431 ms
WPA-Enterprise Mode
Description
In this example, the wlan1 interface will be configured in WPA enterprise
mode where the security is ensured by mean of the radius server 10.215.168.1.
The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
WPA-Enterprise is considered no longer secure. Use WPA/WPAv2-Enterprise instead in case legacy devices are present in your deployment.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces bridge br0 address 10.215.168.64/24 set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server key enq88RORo0P5x3Wtyxfwerkj45sdLKJdnvdSASDi set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set interfaces wlan wlan1 type access-point security aaa authentication radius_list
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x set interfaces wlan wlan0 type station network 1 security framework wpav1 set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=5.16 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.50 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.500/3.831/5.162/1.331 ms
WPA2-Enterprise Mode
Description
In this example, the wlan1 interface will be configured in WPAv2 enterprise
mode where the security is ensured by mean of the radius server 10.215.168.1.
The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
The tkip unicast cipher is considered unsecure. Use aes-ccmp instead.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces bridge br0 address 10.215.168.64/24 set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server key enq88RORo0P5x3Wtyxfwerkj45sdLKJdnvdSASDi set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set interfaces wlan wlan1 type access-point security aaa authentication radius_list
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x set interfaces wlan wlan0 type station network 1 security pairwise-ciphers tkip set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.22 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.47 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.470/4.345/6.221/1.876 ms
WPA/WPA2-Enterprise Mode
Description
In this example, the wlan1 interface will be configured in WPA/WPAv2 enterprise
mode, also known as WPAv2 mixed mode, where the security is ensured by mean of the radius
server 10.215.168.1. The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
This mode was originally intended to provide WPAv2 security while maintaining support to legacy WPA stations. As stations can connect using WPA security, which is considered unsecure, only use this mode if legacy devices are present in your deployment.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces bridge br0 address 10.215.168.64/24 set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server key enq88RORo0P5x3Wtyxfwerkj45sdLKJdnvdSASDi set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set interfaces wlan wlan1 type access-point security aaa authentication radius_list
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x set interfaces wlan wlan0 type station network 1 security framework wpav1 set interfaces wlan wlan0 type station network 1 security pairwise-ciphers tkip set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.26 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.36 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.359/4.307/6.256/1.949 ms
WPA3-Enterprise Only Mode
Description
In this example, the wlan1 interface will be configured in WPAv3 enterprise
mode where the security is ensured by mean of the radius server 10.215.168.1.
The aes-ccmp cipher will be used for unicast traffic. Protected Management Frames or
pmf must be set to required in this mode.
Scenario
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces bridge br0 address 10.215.168.64/24 set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server key enq88RORo0P5x3Wtyxfwerkj45sdLKJdnvdSASDi set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security pmf required
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x-256 set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password set interfaces wlan wlan0 type station network 1 security pmf required
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.46 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.41 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.409/4.435/6.462/2.027 ms
WPA2/WPA3-Enterprise Transition Mode
Description
In this example, the wlan1 interface will be configured in WPAv2/WPAv3 enterprise
mode, also known as WPAv3 transition mode, where the security is ensured by mean of the radius
server 10.215.168.1. The aes-ccmp cipher will be used for unicast traffic. Protected
Management Frames or pmf must be set to optional in this mode.
Scenario
Note
This is a transition mode intended to provide connectivity to WPAv2 capable stations. WPAv3 capable stations will use this security mode when connecting to the device.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 mode 802.11n set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point ssid network_5GHz set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces bridge br0 address 10.215.168.64/24 set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server key enq88RORo0P5x3Wtyxfwerkj45sdLKJdnvdSASDi set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security pmf optional
Step 2: Set the following configuration in DUT0:
set interfaces bridge br0 address 192.168.100.1/24
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 52:5a:65:42:e3:e0 set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x set interfaces wlan wlan0 type station network 1 security akm dot1x-256 set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password set interfaces wlan wlan0 type station network 1 security pmf optional
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.52 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.35 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.350/4.435/6.521/2.086 ms