Secure WLAN and Wired Port Security Configuration
Core concepts
For WLANs, know WPA2-Enterprise (802.1X) versus WPA2-PSK versus WPA3 (SAE, PMF mandatory). Understand that enterprise SSIDs should use 802.1X with per-user credentials and server certificate validation to resist evil twins. Know management frame protection (802.11w) and its role against deauth/disassoc spoofing. For guest access, use isolated VLANs, captive portal, and client isolation.
Wired port security
On switches, understand 802.1X port-based versus per-user authentication, MAC authentication fallback, and port-security features: limiting learned MACs, sticky MAC, and violation actions (protect, restrict, shutdown). Know DHCP snooping, dynamic ARP inspection, and IP source guard as Layer 2 hardening that blocks spoofing. Understand that an unauthorized port can be placed in a restricted VLAN or given a limited role rather than simply disabled.
Traps to watch
WPA3-SAE is not the same as 802.1X; SAE replaces PSK's offline dictionary weakness but is still a shared secret. PMF is optional in WPA2 and mandatory in WPA3. Do not assume port-security shutdown is always the right violation action - it can cause outages; restrict/protect are softer. DHCP snooping builds the binding table that DAI and IP source guard rely on.
Rule of thumb
Match the control to the attack: evil twin → server cert validation + PMF; MAC spoofing → 802.1X + DAI; rogue DHCP → DHCP snooping; unauthorized device → port security or MAB role.