- [Narrator] One of the most familiar ways
to secure wireless connections
is through Wi-Fi Protected Access, better known as WPA.
WPA is the suite of wireless security protocols
that replaced the deprecated WEP,
Wireless Equivalent Privacy.
There are three versions known as WPA,
WPA two and WPA three.
This is especially common to see
in home wireless deployments.
And in fact, you likely use WPA security
on your own home wireless network.
All three of these WPA iterations
can support either 802.1x or pre-shared key mode, PSK.
These modes are also referred
to as Personal mode and Enterprise mode.
With Personal mode using pre-shared keys
and Enterprise mode using 802.1x authentication.
Pre-shared key authentication or Personal mode
is very popular in small home environments.
And even in some small enterprise deployments,
that's because it's so much easier to configure
and requires no special client software on the user device.
It's also true that some legacy devices
do not support 802.1x authentication,
since this requires special supplicant software
to be installed on the client.
In this example topology,
we have a lightweight access point
connected back to a wireless LAN controller.
On the wireless LAN controller,
a key string would first be configured
for a specific wireless network.
This key string must also be configured or shared
on every single client and access point
that will be connecting to the network.
The key string is never passed over the air,
but instead uses a four-way handshake process
to build encryption keys,
which can be openly exchanged without the danger
of being intercepted.
The original version of WPA,
uses a technology called TKIP,
Temporal Key Integrity Protocol.
TKIP uses the specified key string
along with the network SSID,
to generate unique encryption keys
for each wireless clients.
And these keys are constantly changing
and constantly being exchanged
between the clients and the wireless infrastructure.
The new word WPA two and WPA three protocols
use the Advanced Encryption Standard or AES.
This more advanced algorithm
is much more difficult to defeat
using tools that are able to overcome TKIP security.
And this is why the newer generations of WPA are preferred.
So when and why would you choose
to use pre-shared key authentication in a network?
Well, PSK was designed for home and small office networks.
Those that don't need the complexity
of 802.1x authentication.
Again, we know that 802.1x authentication
requires a radio server,
and there's just no need for that level of complexity
in the average home network,
or even if you have a very small office user base.
Also maybe you have a network that has legacy clients
that do not support 802.1x.
This may require you to configure PSK,
in order to accommodate those older clients.
A few drawbacks to mention about pre-shared key
authentication include the fact that every single user
must have knowledge of the pre-shared key.
So that means there's a much higher chance
for the key to be compromised.
Also, if an employee leaves the company,
and the pre-shared key isn't changed,
they can potentially maintain access
to the wireless network.
So this creates more of an administrative burden,
that requires that the PSK is reset
each time an employee leaves the company.
Otherwise you're leaving your wireless network susceptible.
There's also a tendency to make the keys simple
and easy to remember for end users.
But that creates a situation where the keys
might be susceptible to brute-force password attacks.
If you use PSK authentication,
you definitely want to make sure
that the keys are robust enough
to stand up against such password attacks.
In the next video,
we'll look at how we can configure
pre-shared key security on a Cisco wireless LAN controller.