Design the wireless network for security
Domain 7: Design the wireless network for security
This domain tests WLAN security policy selection, AAA integration, rogue detection, management-plane hardening, and segmentation. The exam wants designs that map a client type to an authentication method and an enforcement point.
Security policies and AAA
For corporate laptops, use WPA2-Enterprise or WPA3-Enterprise with 802.1X and EAP-TLS; EAP-TLS uses certificates and avoids password exposure. WPA3-Enterprise 192-bit mode and SAE are options where clients support them. Use WPA2-PSK only for isolated IoT or legacy devices, and give each group its own PSK or segmentation where possible. Integrate RADIUS/ISE for authentication, accounting, CoA, VLAN override, ACL override, and SGT enforcement. Validate server certificates on clients and configure RADIUS failover.
Rogue, management, and segmentation
Enable rogue detection and classification, and use Management Frame Protection (infrastructure and client MFP) where supported. Deploy WIPS if the requirement includes intrusion prevention. Apply WLAN ACLs and FlexConnect ACLs to restrict traffic, and use CPU ACLs to protect the controller. Harden management with SSH, HTTPS, SNMPv3, TACACS+, RBAC, and disabled Telnet. Protect CAPWAP data with DTLS and protect mobility tunnels where supported.
Worked example
A 5,000-employee enterprise needs corporate, guest, and IoT access. Corporate uses WPA3-Enterprise with EAP-TLS through ISE; guest uses open web auth anchored to a DMZ; IoT uses WPA2-PSK with a per-site key and an ACL that permits only the IoT server subnet. The reasoning: each client type gets the strongest method it supports, and the IoT ACL limits lateral movement if the PSK leaks.
Traps
- Using WPA2-PSK for corporate users.
- Skipping server-certificate validation.
- Forgetting CoA and VLAN/ACL override.
- Not enabling MFP or rogue detection.
- Leaving default management access enabled.
- Applying an ACL in the wrong direction.
- Treating guest and IoT as one security domain.