Wireless Security and Policy
WLAN security models
WPA2-Personal uses PSK; WPA2-Enterprise uses 802.1X with EAP (EAP-TLS with certificates, PEAP-MSCHAPv2 with credentials, EAP-FAST) terminated at RADIUS. WPA3-Personal replaces PSK with SAE to defeat offline dictionary attacks, and WPA3-Enterprise offers a 192-bit suite requiring certificate-based EAP-TLS. Open networks should use OWE (Enhanced Open) for unauthenticated encryption. Guest access typically uses web authentication, often with an anchor controller in the DMZ to isolate guest traffic.
Policy and enforcement
Policies include ACLs on the WLAN or interface, VLAN/interface mapping, QoS, CoA from the RADIUS server to re-authorize a client mid-session, local EAP as a RADIUS fallback, and management frame protection (802.11w/PMF) to protect deauth and disassoc frames. Cisco rogue management distinguishes malicious, friendly, and unclassified rogues, with MFP/AirMarshal containment as a separate, deliberate action. CleanAir and wIPS handle non-Wi-Fi and behavioral threats.
Traps: PMF is optional in WPA2 but mandatory in WPA3 and required for 6 GHz operation; WPA3-Personal SAE is not simply “WPA2 with a longer key”; enabling containment without knowing the classification can disrupt neighboring legitimate APs. Remember too that 6 GHz clients must support WPA3 and PMF, so legacy IoT cannot join that band.
Rule of thumb: the fastest way to eliminate a security answer choice is by band - anything claiming WEP, TKIP, or open authentication is supported on 6 GHz is wrong.