TechKnowSurge
Cisco CCNA 2.9 Cisco CCNA 5.8 Cisco CCNA 5.9 Cisco CCNA 5.10
TechKnowSurge Catalog Videos DEMO: Configure RADIUS and WPA2 Enterprise
VideoNetworkFree

DEMO: Configure RADIUS and WPA2 Enterprise

WPA2 Enterprise with RADIUS authentication provides stronger wireless network security than shared passphrases by requiring individual user credentials or certificates. This content covers how to configure a RADIUS server on a wireless LAN controller and apply 802.1X authentication to a wireless network.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Shared passphrases are a straightforward way to grant wireless access, but they carry an inherent weakness: anyone who receives the key can connect to the network, with no way to distinguish or control individual users. For enterprise environments, this is an unacceptable tradeoff. WPA2 Enterprise solves the problem by replacing the passkey with 802.1X authentication, which routes credential verification through a RADIUS server and can integrate with directory services such as Active Directory to authenticate users individually by username, password, or certificate. Configuring this on a wireless LAN controller begins in the Security tab under the AAA section, where RADIUS authentication servers are defined. Each server entry requires an IP address and a shared secret key that must match the corresponding value configured on the RADIUS server itself, allowing the two systems to communicate securely. Multiple RADIUS servers can be added to provide redundancy, and the controller processes them in a configurable order of priority. Once the RADIUS server is registered, the authentication method on the target wireless LAN is changed from the PSK passkey option to 802.1X, which instructs the controller to use the defined server list for all client authentication. The AAA override tab provides additional flexibility, allowing specific server assignments per wireless LAN rather than relying on the global default order. This configuration, commonly labeled WPA2 Enterprise in consumer and commercial interfaces, represents a significantly more robust security posture than WPA2 Personal and is the standard approach for protecting wireless networks in professional and enterprise deployments.

What you'll learn

What's covered

RADIUS on Wireless LAN Controllers

Aligned to

Cisco CCNA
2.9 Interpret the wireless LAN GUI configuration for client connectivity
5.8 Compare authentication, authorization, and accounting concepts
5.9 Describe wireless security protocols
5.10 Configure and verify WLAN within the GUI using WPA2 PSK

Key terms

Remote Authentication Dial In User Service
RADIUS
A network protocol that provides centralized authentication, authorization, and accounting (AAA) for users and devices connecting to a network, commonly used with 802.1X and VPN deployments. RADIUS uses UDP and encrypts only the password field in its messages.
Authentication
The process of verifying the identity of a user, device, or system.
802.1X
An IEEE standard for port-based network access control that requires devices to authenticate before gaining access to a wired or wireless network, using a supplicant, authenticator, and authentication server (typically RADIUS). It is the foundation of enterprise Wi-Fi security and wired port security using EAP methods.
WPA2 Enterprise
A wireless security mode that uses a RADIUS authentication server instead of a shared password, providing stronger, identity-based access control for organizational networks.
WPA2 Personal
A wireless security mode that uses a pre-shared key (password) and AES encryption to authenticate and protect individual users on a network.
Authentication, Authorization, and Accounting
AAA
Authentication, Authorization, and Accounting is a security framework that controls network access by verifying user identity, determining permitted actions, and logging activity for auditing and billing purposes.
Active Directory
AD
Microsoft's directory service used to manage users, computers, and resources in a network.
Wireless LAN Controller
WLC
A network device that provides centralized management of multiple lightweight wireless access points, handling functions such as client authentication, roaming, radio frequency management, and security policy enforcement. WLCs communicate with APs using CAPWAP and allow network-wide wireless configuration from a single management point.

Topics

Wireless Security Radius 802 1x Wpa2 Enterprise Wireless Lan Controller Network Authentication Networking

Transcript

Up until now we've been using pass keys on our wireless LANs. That is, we're using WPA and we're using it with the pass key. What that allows us to do is a simple way for our clients to connect to our wireless networks: all we have to do is give them a pass key, and then they can connect in.

Now, the problem is that this key can be passed around to whoever, and they can get onto the network. It's not necessarily the most ideal scenario when it comes to enterprise networks. Instead, we'd rather them authenticate with a username and password, or authenticate with some sort of certificate using some sort of outside services — specifically RADIUS.

The AAA section

To set this up, we are going to go to our security tab, and within our security tab we see quite a few different options. There is a lot of security options here, but specifically we're looking at this AAA section, which is authentication, authorization and accounting. We see that there are several different options and different ways that we can set up.

As an example, we can set up MAC filtering and filter based off of MAC addresses, which is not necessarily a great way to do the filtering, but it is a step, it is an element of security on our network. The reason why it's not a great way to do this is because MAC addresses can be easily copied and replicated, so that presents some problems there.

But one thing we can do is RADIUS. RADIUS is a well used standard that's out there to connect different devices for authentication, and so we could set this up to, for instance, connect into an Active Directory server that has RADIUS services running on it.

Adding a RADIUS server

So what we're going to do is actually go through the process of setting up a RADIUS server on here. I don't have a RADIUS server, so we're just going to go through the motions of this. You don't need to know this in depth and in detail when it comes to the CCNA test, but this just gives you a good idea of what it looks like to set it up.

I'm going to click on this authentication under RADIUS, and here we have our servers, and we can add a new one here. So what I'm going to do is I'm going to come up with an IP address. We'll say it's 10.1.20.46 here, another server that would reside within our server network. I'm going to select that, and then what I would do is I would create a key that could be placed on both here and the other, the server that it was shared, so they understand the same key so they can communicate. What I've done is I've created this key already and I put it in my key pass here, and I'm just going to paste them into here. So I've pasted this into here, and I do the same thing on the RADIUS server, so these could communicate back and forth.

Then I'm going to leave all the other settings just about where they're at, so we're not going to mess with anything more here, and I'll hit apply. I would set up possibly multiple RADIUS servers if I wanted some sort of backup, and there is this order that these will be processed in.

Applying it to the wireless LAN

So there I have it. I now can go into this wireless LAN here, and I'm going to go into this management network, or this tks10 network right here. Within here I see the security tab. I'm going to click on security, and originally this 802.1X was actually check boxed, and now it's the pass key that's check boxed. So I'm going to uncheck the pass key, and we're going to instead select 802.1X, and now it will apply the 802.1X. It'll use that list of servers for the authentication method.

So that's how I can set this up, RADIUS set up on this management wireless LAN. Now, if for some reason I wanted to go with a different set of servers, I also have this AAA servers here. I can click this tab right here and select which server I want to go first, which second, which third, if I don't want the default, the way it's set up in the other tab. So what I can do is I can select this and then enable this override, which I don't want to do, so I'm just going to select none.

In fact, since I don't really have this RADIUS server up and running, I am not going to use 802.1X. I'm going to keep it as pass key for now — it's just more simplistic that way — so we're going to keep that.

WPA2 Enterprise

So this is also known as WPA2 Enterprise. WPA2, because that is the policy that we're using to secure this, and then the enterprise side of it is using the 802.1X instead of pass key. So in a lot of systems you'll actually see that as your option: do you want to use WPA2 Enterprise, or do you want to use WPA PSK, pass key? So those are your options there.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →