Security
The following scenarios show how to configure WLAN interfaces to
use different security modes. All examples will be done using the
wifi0 radio module and channel numer 36
to avoid waiting for the cac timer to expire. Note that an external
radius server will be required in enterprise scenarios and the
testing user with password password must be present in its database.
Open Security
Description
In this example, the wlan1 interface will be configured to
use no security.
Scenario
Warning
Note that the traffic will be visible to any attacker. Use OWE or OWE-Transition instead.
Step 1: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm none set interfaces wlan wlan1 type access-point ssid network_5GHz set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm none set interfaces wlan wlan1 type access-point ssid network_5GHz set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm none
Step 4: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.34 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.41 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.414/4.379/6.344/1.965 ms
Step 5: Run command configure at DUT0 and expect this output:
Step 6: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 7: Run command set interfaces bridge br0 at DUT0 and expect this output:
Step 8: Run command commit at DUT0 and expect this output:
OWE Mode
Description
In this example, the wlan1 interface will be configured to
use OWE (Opportunistic Wireless Encryption) security. The main advantage of
this mode, compared with open security, is that the traffic is encrypted
(making passive sniffing useless).
Scenario
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm owe set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX18NkrO90DTisXG82mTs58UyMJMXmsYp8co= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm owe set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX18NkrO90DTisXG82mTs58UyMJMXmsYp8co= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm owe set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password set interfaces wlan wlan0 type station network 1 security pmf required
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=9.11 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.56 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.559/5.835/9.112/3.277 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm owe set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1+OXqtZ3X8lgeSs+0/nsZsrIV+XSFzoM2g= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp-256 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm owe set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1/3pPktdJtnj8T9H+CHOAmENhg6RAtFuMA= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-128 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 14: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 15: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm owe set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1+TaCBBJGHJ7lgMVMI8ybVkuUERMx7JFhA= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-256 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA2-Personal Mode
Description
In this example, the wlan1 interface will be configured in WPAv2 personal
mode, where security is ensured by means of pre-shared key secret-password.
The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
The tkip unicast cipher is considered not safe. Use aes-ccmp instead.
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX18LpL5ad43MAjHvPIRIDaC0oQb1w0MQ7qo= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX18LpL5ad43MAjHvPIRIDaC0oQb1w0MQ7qo= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm psk set interfaces wlan wlan0 type station network 1 security pairwise-ciphers tkip set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.53 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.52 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.521/4.526/6.532/2.006 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1+dOebmApPot4B3QKxMR+INUipAb6C1R2M= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1/hJskPvOV2cR3Jp/le/pd3mvZawLuSapQ= set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA/WPA2-Personal Mode
Description
In this example, the wlan1 interface will be configured in WPA/WPAv2 personal
mode, also known as WPAv2 Mixed mode. Here, security is ensured by means of pre-shared
key secret-password. The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
This mode originally intended to provide WPA2 security while supporting legacy WPA stations. Since stations can connect using WPA security, which is not considered safe, only use this mode if legacy devices are present in your deployment.
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1/47mQFHvI1zEfmtk9+xl5M0nIqSKCL/Qs= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1/47mQFHvI1zEfmtk9+xl5M0nIqSKCL/Qs= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm psk set interfaces wlan wlan0 type station network 1 security framework wpav1 set interfaces wlan wlan0 type station network 1 security pairwise-ciphers tkip set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.34 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.43 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 2.425/4.382/6.340/1.958 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1/aTrvQxBm5aWAIPapnucwnPhEdvCoLKj8= set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX19CbcSxZMEZs9+WPfhHrBbgpea1RGyDLjY= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA3-Personal Only Mode
Description
In this example, the wlan1 interface will be configured in WPAv3 personal
mode, also known as SAE (Simultaneous Authentication of Equals), the state-of-the-art in
PSK mode, where the security is ensured by means of pre-shared key secret-password.
The aes-ccmp cipher will be used for unicast traffic. Protected Management Frames or pmf
must be set to required in this mode.
Scenario
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1/nUSzaEUhCJweXcAcHKWrx8UKHhl/8Pk0= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1/nUSzaEUhCJweXcAcHKWrx8UKHhl/8Pk0= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm sae set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password set interfaces wlan wlan0 type station network 1 security pmf required
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=10.8 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.46 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.459/6.635/10.812/4.177 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX18vxv/obQ4f4b4C0/X5T03LTm+bgjSxmKA= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp-256 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1+yCSAhv0sb3WloKnHMaA+2b63zypXyTX0= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-128 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 14: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 15: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1+Kln9UT2FZToB72nnPOmIT/8czbp/kXX4= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-256 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA2/WPA3-Personal Transition Mode
Description
In this example, the wlan1 interface will be configured in WPAv2/WPAv3 personal
mode, also known as WPAv3 transition mode, where the security is ensured by means of pre-shared
key secret-password. The aes-ccmp cipher will be used for unicast traffic. Protected
Management Frames or pmf must be set to optional in this mode.
Scenario
Note
This is a transition mode intended to provide connectivity to WPAv2-capable stations. WPAv3-capable stations will use this security mode when connecting to the device.
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security akm psk-256 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX18mtLx1/PZCTmuJF6RZ8GKdxHdkV/YO68E= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security akm psk-256 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX18mtLx1/PZCTmuJF6RZ8GKdxHdkV/YO68E= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm psk set interfaces wlan wlan0 type station network 1 security akm psk-256 set interfaces wlan wlan0 type station network 1 security akm sae set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security passphrase secret-password set interfaces wlan wlan0 type station network 1 security pmf required
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.90 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.44 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.443/4.673/6.903/2.230 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security akm psk-256 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1+56MWh0CjJdSFI9dWiEQLyk+met7VzcHQ= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp-256 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security akm psk-256 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX1812JmRzvuJZCEYloQAAgxHT5HMxo9jpJU= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-128 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 14: Set the following configuration in DUT0:
set interfaces bridge br0 set interfaces ethernet eth2 bridge-group bridge br0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 15: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security akm psk set interfaces wlan wlan1 type access-point security akm psk-256 set interfaces wlan wlan1 type access-point security akm sae set interfaces wlan wlan1 type access-point security encrypted-passphrase U2FsdGVkX19nmcUAIl9hXFDPKiHfQhBqJfTkpdi+F44= set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-256 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA-Enterprise Mode
Description
In this example, the wlan1 interface will be configured in WPA enterprise
mode, where security is ensured by means of radius server 10.215.168.1.
The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
WPA-Enterprise is considered no longer secure. Use WPA/WPAv2-Enterprise instead if legacy devices are present in your deployment.
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/wIbDSWL6SXoTwayzGR/iTfTjF+KSSM4Q50pcPzOql1yS3JP6oeYVMs+uSm4aK7hh/PEx06wm+0Q==
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/wIbDSWL6SXoTwayzGR/iTfTjF+KSSM4Q50pcPzOql1yS3JP6oeYVMs+uSm4aK7hh/PEx06wm+0Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x set interfaces wlan wlan0 type station network 1 security framework wpav1 set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=5.04 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.42 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.418/3.730/5.042/1.312 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Show output
Configuration path: [interfaces bridge br0] already exists
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/wIbDSWL6SXoTwayzGR/iTfTjF+KSSM4Q50pcPzOql1yS3JP6oeYVMs+uSm4aK7hh/PEx06wm+0Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/wIbDSWL6SXoTwayzGR/iTfTjF+KSSM4Q50pcPzOql1yS3JP6oeYVMs+uSm4aK7hh/PEx06wm+0Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA2-Enterprise Mode
Description
In this example, the wlan1 interface will be configured in WPAv2 enterprise
mode, where security is ensured by means of radius server 10.215.168.1.
The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
The tkip unicast cipher is considered unsafe. Use aes-ccmp instead.
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX18EIBVD5gkRVvrKkRjKyyS/SjK58Xl9AVER3l4PB4kxhXP71Bgmt8eif/bxq7BZeXWQmZqN2iuqLQ==
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX18EIBVD5gkRVvrKkRjKyyS/SjK58Xl9AVER3l4PB4kxhXP71Bgmt8eif/bxq7BZeXWQmZqN2iuqLQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x set interfaces wlan wlan0 type station network 1 security pairwise-ciphers tkip set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.24 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.38 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.377/4.307/6.237/1.930 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Show output
Configuration path: [interfaces bridge br0] already exists
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX18EIBVD5gkRVvrKkRjKyyS/SjK58Xl9AVER3l4PB4kxhXP71Bgmt8eif/bxq7BZeXWQmZqN2iuqLQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX18EIBVD5gkRVvrKkRjKyyS/SjK58Xl9AVER3l4PB4kxhXP71Bgmt8eif/bxq7BZeXWQmZqN2iuqLQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA/WPA2-Enterprise Mode
Description
In this example, the wlan1 interface will be configured in WPA/WPAv2 enterprise
mode, also known as WPAv2 mixed mode, where security is ensured by means of radius
server 10.215.168.1. The aes-ccmp and tkip ciphers will be used for unicast traffic.
Scenario
Warning
This mode was originally intended to provide WPAv2 security while supporting legacy WPA stations. Since stations can connect using WPA security, which is considered unsafe, only use this mode if legacy devices are present in your deployment.
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/T+ev434E+TLYPPq4DuS6gpQaZWD+Ih4khZg13dA5ZIK+TwsyGhfZvILdeDWvvwU/iJeUPBeXE9w==
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/T+ev434E+TLYPPq4DuS6gpQaZWD+Ih4khZg13dA5ZIK+TwsyGhfZvILdeDWvvwU/iJeUPBeXE9w== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x set interfaces wlan wlan0 type station network 1 security framework wpav1 set interfaces wlan wlan0 type station network 1 security pairwise-ciphers tkip set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.34 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=2.43 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 2.433/4.387/6.342/1.955 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Show output
Configuration path: [interfaces bridge br0] already exists
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/T+ev434E+TLYPPq4DuS6gpQaZWD+Ih4khZg13dA5ZIK+TwsyGhfZvILdeDWvvwU/iJeUPBeXE9w== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers tkip set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers tkip set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/T+ev434E+TLYPPq4DuS6gpQaZWD+Ih4khZg13dA5ZIK+TwsyGhfZvILdeDWvvwU/iJeUPBeXE9w== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security wpav1 pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA3-Enterprise Only Mode
Description
In this example, the wlan1 interface will be configured in WPAv3 enterprise
mode, where security is ensured by means of radius server 10.215.168.1.
The aes-ccmp cipher will be used for unicast traffic. Protected Management Frames or
pmf must be set to required in this mode.
Scenario
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX19W6xYq9UYd1snePkcGsL8fTFSEvp72Ntox/I7S3rEPpLDPezhmPvg1eaiYHaBlYIFzYB+u2BRVFQ==
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX19W6xYq9UYd1snePkcGsL8fTFSEvp72Ntox/I7S3rEPpLDPezhmPvg1eaiYHaBlYIFzYB+u2BRVFQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x-256 set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password set interfaces wlan wlan0 type station network 1 security pmf required
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=8.07 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=10.5 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2ms rtt min/avg/max/mdev = 8.072/9.280/10.488/1.208 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Show output
Configuration path: [interfaces bridge br0] already exists
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX19W6xYq9UYd1snePkcGsL8fTFSEvp72Ntox/I7S3rEPpLDPezhmPvg1eaiYHaBlYIFzYB+u2BRVFQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp-256 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX19W6xYq9UYd1snePkcGsL8fTFSEvp72Ntox/I7S3rEPpLDPezhmPvg1eaiYHaBlYIFzYB+u2BRVFQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-128 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 14: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX19W6xYq9UYd1snePkcGsL8fTFSEvp72Ntox/I7S3rEPpLDPezhmPvg1eaiYHaBlYIFzYB+u2BRVFQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 15: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-256 set interfaces wlan wlan1 type access-point security pmf required set interfaces wlan wlan1 type access-point ssid network_5GHz
WPA2/WPA3-Enterprise Transition Mode
Description
In this example, the wlan1 interface will be configured in WPAv2/WPAv3 enterprise
mode, also known as WPAv3 transition mode, where security is ensured by means of radius
server 10.215.168.1. The aes-ccmp cipher will be used for unicast traffic. Protected
Management Frames or pmf must be set to optional in this mode.
Scenario
Note
This is a transition mode aimed at providing connectivity to WPAv2-capable stations. WPAv3-capable stations will use this security mode when connecting to the device.
Step 1: Set the following configuration in DUT0:
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf optional set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/Cgl4c6E/x+LVnr0+LHAlga76rU4/ibXoKk16G1hqjN6FS5DAo8mvPJEp9gczr8kYBt0LqFZJd+g==
Step 3: Set the following configuration in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces bridge br0 address 10.215.168.64/24 set interfaces bridge br0 address 192.168.100.1/24 set interfaces ethernet eth2 bridge-group bridge br0 set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp set interfaces wlan wlan1 type access-point security pmf optional set interfaces wlan wlan1 type access-point ssid network_5GHz set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/Cgl4c6E/x+LVnr0+LHAlga76rU4/ibXoKk16G1hqjN6FS5DAo8mvPJEp9gczr8kYBt0LqFZJd+g== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Configure the MON device to connect to network_5GHz using the following configuration:
set controllers wlan installation indoor set controllers wlan radios wifi1 bandwidth 20MHz set interfaces wlan wlan0 phy wifi1 set interfaces wlan wlan0 type station network 1 bssid 12:68:38:c6:f4:7b set interfaces wlan wlan0 type station network 1 ssid network_5GHz set system wlan log-level configuration debug set interfaces wlan wlan0 address 192.168.100.10/24 set interfaces wlan wlan0 type station network 1 security akm dot1x set interfaces wlan wlan0 type station network 1 security akm dot1x-256 set interfaces wlan wlan0 type station network 1 security pairwise-ciphers aes-ccmp set interfaces wlan wlan0 type station network 1 security framework rsn set interfaces wlan wlan0 type station network 1 security eap-method mschapv2 set interfaces wlan wlan0 type station network 1 security identity testing set interfaces wlan wlan0 type station network 1 security passphrase password set interfaces wlan wlan0 type station network 1 security pmf optional
Step 5: Ping IP address 192.168.100.1 from MON:
admin@MON$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=6.57 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=6.37 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 3ms rtt min/avg/max/mdev = 6.367/6.467/6.568/0.128 ms
Step 6: Run command configure at DUT0 and expect this output:
Step 7: Run command delete interfaces bridge br0 address 192.168.100.1/24 at DUT0 and expect this output:
Step 8: Run command set interfaces bridge br0 at DUT0 and expect this output:
Show output
Configuration path: [interfaces bridge br0] already exists
Step 9: Run command commit at DUT0 and expect this output:
Step 10: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/Cgl4c6E/x+LVnr0+LHAlga76rU4/ibXoKk16G1hqjN6FS5DAo8mvPJEp9gczr8kYBt0LqFZJd+g== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 11: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-ccmp-256 set interfaces wlan wlan1 type access-point security pmf optional set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 12: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/Cgl4c6E/x+LVnr0+LHAlga76rU4/ibXoKk16G1hqjN6FS5DAo8mvPJEp9gczr8kYBt0LqFZJd+g== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 13: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-128 set interfaces wlan wlan1 type access-point security pmf optional set interfaces wlan wlan1 type access-point ssid network_5GHz
Step 14: Set the following configuration in DUT0:
set interfaces bridge br0 address 10.215.168.64/24 set interfaces ethernet eth2 bridge-group bridge br0 set system aaa group radius radius_group server radius_server set system aaa list radius_list method 1 group radius radius_group set system aaa server radius radius_server address 10.215.168.1 set system aaa server radius radius_server encrypted-key U2FsdGVkX1/Cgl4c6E/x+LVnr0+LHAlga76rU4/ibXoKk16G1hqjN6FS5DAo8mvPJEp9gczr8kYBt0LqFZJd+g== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 15: Modify the following configuration lines in DUT0:
set controllers wlan installation indoor set controllers wlan radios wifi0 band 5GHz set controllers wlan radios wifi0 bandwidth 80MHz set controllers wlan radios wifi0 channel 36 set controllers wlan radios wifi0 mode 802.11ac set controllers wlan radios wifi0 mode 802.11ax set controllers wlan radios wifi0 mode 802.11n set interfaces wlan wlan1 bridge-group bridge br0 set interfaces wlan wlan1 phy wifi0 set interfaces wlan wlan1 type access-point security aaa authentication radius_list set interfaces wlan wlan1 type access-point security akm dot1x set interfaces wlan wlan1 type access-point security akm dot1x-256 set interfaces wlan wlan1 type access-point security pairwise-ciphers aes-gcmp-256 set interfaces wlan wlan1 type access-point security pmf optional set interfaces wlan wlan1 type access-point ssid network_5GHz