Creating a WPA2 PSK WLAN on a Cisco WLC

Building a pre-shared key WLAN on a Cisco wireless LAN controller (WLC) takes four decisions across three tabs. On the General tab you name the WLAN, map it to an interface carrying the right VLAN, and change Status from its disabled default to enabled. On the Security tab’s Layer 2 page you select WPA+WPA2, check the WPA2 policy with the AES cipher, and under Authentication Key Management replace the default 802.1X selection with PSK. Then you type the key in the format the selector says you are using: 8 to 63 ASCII characters, or exactly 64 hexadecimal digits.

Creating the WLAN

Creating a WLAN asks for a type, an ID number, and two separate name fields that catch people out. Profile Name is the controller’s internal label. It never leaves the controller and is never transmitted over the air, so teams use it to encode purpose, site, or the change ticket that created it.

SSID is the network name carried in beacons and probe responses, the one that appears in the list of available networks on a phone, so it stays short and meaningful. The two fields may hold different values, and letting them differ is the intent behind having two of them. Nothing forces them to match, and the visible name always comes from the SSID.

General tab

Status is the setting most often missed. A new WLAN is created disabled on purpose, so an engineer can finish the security and interface work before any client can join. Until Status is checked, nothing is pushed to the access points, which is the usual reason a WLAN correct in every other respect never appears. Only access points in a mode that serves clients advertise it at all, since monitor and sniffer radios carry no WLANs.

Interface or Interface Group maps the WLAN to a dynamic interface, and that interface determines the VLAN and subnet the client’s traffic lands in. Getting it wrong produces clients that authenticate perfectly and then have no usable network. Controller interfaces and the VLANs behind them are covered in the article on WLC ports and interfaces.

Radio Policy defaults to all supported bands rather than to one; which channel and power those radios then use is decided by Radio Resource Management, not by the WLAN. Broadcast SSID is enabled by default; turning it off stops the name appearing in beacons, but a client configured manually with the name still associates, so it is cosmetic rather than a security control.

Layer 2 security

The Layer 2 page starts with a single drop-down whose choices include None, WPA+WPA2, 802.1X, and Static WEP. WPA+WPA2 is the container selection that exposes the modern controls: until it is chosen, the page has no WPA2 policy check box, no cipher check boxes, and no Authentication Key Management section. The other entries mean different things. The 802.1X entry refers to legacy dynamic WEP keying driven by 802.1X rather than to WPA2, Static WEP presents a key index and key length instead of a cipher choice, and None disables Layer 2 security for an open guest SSID.

With WPA+WPA2 selected, check WPA2 Policy and, under it, the AES cipher, meaning AES-CCMP. The WPA policy check box with TKIP beside it exists for legacy clients and weakens the WLAN to the level of its oldest device.

Authentication key management

This section decides how the pairwise key protecting the client’s traffic is established, and 802.1X is selected here by default on a fresh WLAN. For a pre-shared key deployment that default is wrong: clear 802.1X and check PSK. Leaving 802.1X selected makes the controller wait for an EAP (Extensible Authentication Protocol) exchange that a device holding only a passphrase will never begin, and selecting both advertises an authentication path with no server behind it, which produces failed associations rather than a graceful fallback.

Checking PSK reveals a key format selector and a key field. The format tells the controller how to read what you type:

• ASCII: 8 to 63 characters. Shorter than 8 is rejected, and 63 is the ceiling.
• HEX: exactly 64 hexadecimal digits, the 256-bit key itself rather than a passphrase to derive one from.

The key must match on every client, and so must the format: a 64-character string typed while the selector says ASCII is a different key from the same string read as hex.

Personal and enterprise compared

	WPA2 Personal (PSK)	WPA2 Enterprise (802.1X)
Key management	PSK	802.1X
Credential	One passphrase or 64 hex digits	Per-user identity
Authentication server	None	RADIUS, on the AAA Servers tab
Extra configuration	Key format and key	RADIUS address and shared secret
Revoking one user	Rekey the WLAN	Disable that identity

The RADIUS shared secret authenticates the controller to the RADIUS server. It is not a client passphrase, and typing one there accomplishes nothing.

Advanced tab settings

Client Exclusion is enabled by default and is the controller’s automatic response to misbehavior. When a client matches an exclusion policy, such as repeated authentication failures, the controller adds it to an exclusion list and refuses its association attempts until the timer expires. The default timeout is 60 seconds, long enough to break an automated guessing loop and short enough that a mistyped passphrase costs no help desk call. Setting the value to 0 does not disable exclusion and does not mean one second: the exclusion never releases on its own. Exclusion is switched off by clearing its check box.

Maximum Allowed Clients caps how many healthy clients may associate, Session Timeout sets how long a session runs before reauthentication, and Client Idle Timeout disconnects quiet clients. None of the three decides whether a correctly configured client can join.

Verification and common failures

The monitoring pages hold a detail view for each associated client, reporting what was actually negotiated rather than what the WLAN offers: the cipher in use, the key management method in use, and the policy manager state. A client in the RUN state has completed Layer 2 security. The controller never displays a client’s key in plaintext, does not know the driver version, and shows no authentication server for a PSK WLAN because none was contacted. The symptom therefore identifies the stage that broke:

• Nothing is advertised. Status was left disabled.
• Clients cannot associate. Something in the Layer 2 configuration blocks the key exchange: 802.1X still checked, the wrong key format, a mistyped key, or a cipher the client cannot do.
• Clients reach RUN and then get a 169.254.x.x address. Layer 2 succeeded, so the fault is past authentication: the WLAN is mapped to an interface whose VLAN has no DHCP server, and the self-assigned address is the client giving up.

For a large population on one SSID, an interface group lets a single WLAN sit in front of several dynamic interfaces. The controller assigns each associating client to one member interface, spreading clients across smaller broadcast domains with the same name, the same security policy, and no change for users.

How the 200-301 exam tests this

• Which selection unlocks which field. A stem describes an unavailable WPA2 or AES control and asks what must be chosen first. WPA+WPA2 is the container. A related pattern asks what appears after PSK is checked: the key format selector and key field.
• The default that must be changed. Status disabled and 802.1X selected under key management both block a working PSK WLAN, and items build a scenario around one of them.
• Symptom placed relative to the RUN state. Failures before RUN are Layer 2 security; anything after RUN, especially an address in 169.254.0.0/16, is interface or VLAN mapping.
• Name fields and exclusion semantics. Which name clients see, whether the two may differ, and what client exclusion does, including a timeout of 0 meaning indefinite.

Nothing here is typed at an IOS prompt, and a WLAN built through the graphical interface is exactly the controller GUI work the blueprint expects under network access. The screen sequencing sticks best when tested — practice questions on the wireless material will tell you whether the order is really memorized.

Quick reference

• Profile Name is internal; SSID is broadcast. They may differ.
• A new WLAN is disabled; enable Status before clients can join.
• The interface or interface group sets the client VLAN and subnet.
• Layer 2 Security must be WPA+WPA2 before the WPA2 policy and AES appear.
• Under Authentication Key Management, clear 802.1X and check PSK.
• Keys are 8 to 63 ASCII characters or exactly 64 hex digits.
• Client exclusion defaults to enabled at 60 seconds; 0 means until manually cleared.
• RUN state plus a 169.254 address points at interface mapping, not at security.
• Interface groups spread one SSID across several VLANs.