Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


Wireless authentication query's

Posted on 2012-03-21
Medium Priority
Last Modified: 2012-04-17
hello all,

i'm just looking for a few straight answers regarding wireless authentication on WPA2 networks, since i can never seem to find a straight answer on any Cisco docs.

would appreciate answers on any of the following;

1. when deploying WAP's in standalone mode, that is, they are configured independantly, no WLC is used, but they ARE using the same SSID, so i guess they are classed as an ESS. How do clients authenticate when roaming between AP's? do the clients need to go through the whole re-authentication process when roaming to the new AP?, and need new encryption key material for the new AP etc?

2. in WPA2 mode, for authentication, i see that in infrastructure mode, when using PEAP, the authentication process is encrypted between the client and the AP / RADIUS server. My question is this... in WPA2 personal PSK mode, how is the password passed securely between the client and the AP? Is there some secure connection which is set up prior to the key being passed to the AP?

3. How is the AES session encryption key securely exchanged between the client and AP in either PSK or enterprise mode?

i understand how this type of exchange works when connecting to an SSL web server (server passes public rsa key to client, client uses this to encrypt the session keys and passes back to the server which uses it's private key to decrypt and find the session keys. i just never seem to find a good explanation of how this sort of stuff works in wireless.

please can somebody help explain, or point me in the right direction of a good link?

thanks in advance.
Question by:L-Plate
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 49

Assisted Solution

by:Jackie Man
Jackie Man earned 500 total points
ID: 37746556
The answer for your Question 2:-

Authentication in the WPA2 Personal mode, which does not require an authentication server, is performed between the client and the AP generating a 256-bit PSK from a plain-text pass phrase (from 8 to 63characters). The PSK in conjunction with the Service Set Identifier and SSID length form the mathematical basis for the PMK (Pair-wise Master Key) to be used later in key generation.


Assisted Solution

Lance_P earned 500 total points
ID: 37746806
As far as I have tested, If you have multiple AP's, you need to have the ALL on the SAME SSID. But make sure that the nearby AP's are on DIFFERENT channels to avoid interference.

This should work without issues. I have setup a similar network at home as well with 3 AP's. No issue's.

I do not see why there would be any issues with Radius or any security since all the matters is that the AP be setup correctly to communicate with the Authentication server and that the SSID matches.

Assisted Solution

RikeR earned 500 total points
ID: 37748098
Hi L-Plate,

1. If you configure the network to use WPA or WPA2 enterprise the client has to re-authenticate when roaming to a different AP. The reason being that the pairwise master key is being derived from the Radius server. A mechanism to prevent this is called PMK-caching which is only possible if there is some sort of intelligence glue-ing the accesspoint together. In most casses this is the Wireless controller.

2. When using pre-shared key authentication the PMK is allready known by both parties (client and accesspoint) calculated as jackieman states. Have a look at this video as it desribes the process very clear:

3. How these key are being used to feed AES is beyond my knowledge.

Good luck

LVL 44

Accepted Solution

Darr247 earned 500 total points
ID: 37748377
For #3,  the key is in fact never actually exchanged. Very simplified, only negotiation vectors are exchanged, and if the client doesn't already know the proper key it can't make the proper response vectors to create a secured session. Even if the exchanged negotiation packets are captured, they can't be worked backwards because they are created by mixing in a "number used once" (NONCE) rather than the passphrase by itself. Both sides take the other's challenge packet, decrypt it using what they think the key is, then create a response packet using the result. If either side has a different passphrase, the responses don't match what they're supposed to be and the session is discarded.

If the wrong key is tried more than twice in 30 seconds, the WPA2 spec makes it stop allowing new connections for 2 minutes. That limits brute force hack attempts to a maximum of 4 per minute, so it would take about 2 days for a properly constructed hacker 'bot to go through a 10,000 entry dictionary just to discover you didn't use a common passphrase (like "password" or "qwertyuiop" et cetera)... or longer if it tried 3 times in 30 seconds and got locked out from trying for 2 minutes. Keep that in the back of your mind for when the symptom shows up of not being able to connect without waiting 2 minutes. ;-)

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

660 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question