WLAN Configuration and Wireless Security
This domain tests SSID design, security modes, 802.1X, VLAN mapping, and roaming helpers. Questions often ask which security mode fits a client mix or why one SSID fails while another works.
WLAN building blocks
A WLAN is SSID plus security plus VLAN plus auth policy, applied through a WLAN template or at site level. Map each SSID to the right VLAN and trunk that VLAN to the AP switch port.
Security modes
Open (use OWE for encryption), WPA2-PSK (AES-CCMP), WPA2-Enterprise (802.1X with RADIUS), WPA3-SAE (forward secrecy, PMF required), WPA3-Enterprise 192-bit, and WPA2/WPA3 mixed for transition. 802.1X EAP methods include EAP-TLS (certificates on both sides), PEAP/EAP-TTLS (server certificate with inner MSCHAPv2), and EAP-SIM for carrier authentication.
Roaming and guest
802.11k provides neighbor reports, 802.11v steers clients with BSS transition, and 802.11r speeds rekeying. Guest designs use captive portal, NAC, or DPSK, and guest traffic should be isolated on its own VLAN.
Worked example: corporate SSID clients fail authentication while guest works. Guest bypasses RADIUS, so the fault is 802.1X - check RADIUS reachability, shared secret, server certificate validity, and client trust of the CA. If only older clients fail on a WPA3-only SSID, the fix is a WPA2/WPA3 mixed WLAN, not a RADIUS change.
Traps: WPA3-only breaking legacy devices; confusing DPSK with a shared PSK; forgetting to trunk the client VLAN; enabling 802.11r where clients do not support it, which can cause failures.