- We're going to take a look now
at probably the most familiar type of authentication,
and that's using pre-shared key,
or PSK authentication.
Most likely, this is the type of authentication
that you use in your own home network,
or it's possible you also use this
in your enterprise network
you may even do that in tandem with
another authentication method that we've already looked at.
Specifically, we'll look at how to configure this
on a Cisco wireless LAN controller.
It's actually really simple to do that,
and all the options are going to be found
in one area of the configuration menus.
So if we click on the WLANs tab,
which I already have selected here,
you can see a list of all of the configured networks,
and you can actually set different pre-shared keys
for each of your networks if you'd like.
And actually, that is a best practice,
you want to have separate keys for your networks,
especially between corporate and guest networks.
I'm going to click on the corporate network here
and then I'm going to set a pre-shared key
for that wireless network.
After we choose the network that we want to set a key for
we want to click on a security tab,
and under this tab, under the Layer 2 Security
this is where we are going to find all of our options.
From the Layer 2 Security drop down menu,
you can see that we already have WPA and WPA2
selected and that's the option
where you do want to chose in this section.
Below that, we can see our WPA and WPA2 parameters.
Remember, we discussed that WPA2 and WPA3
are much more robust on the security side than normal WPA,
and that's because they use
the stronger AES encryption algorithm.
We can make sure our clients are forced to use WPA2
by making sure the WPA policy is deselected,
and you can see that by default
it's already deselected on this controller.
If for some reason you did want to enable
the older WPA2 standard,
you could just simply click that and enable it here.
But, it's recommended that we do not do that,
we want to use the stronger encryption methods.
And right underneath that,
the bottom option is WPA2 encryption.
Notice that we have two options here,
we have AES and TKIP.
AES is selected by default
and that's because it's the stronger encryption algorithm.
It's much less susceptible to password attacks
than the older TKIP protocol.
AES is not supported in the original WPA standard,
which again underscores why we don't want to use
this deprecated method for pre-shared key authentication.
So that default is going to be just fine for us.
We'll leave that in place,
and right below that
we see the authentication key management area.
Remember that all versions of WPA support
two different modes.
Those are called personal mode and enterprise mode.
Personal mode is going to use pre-shared keys
and enterprise mode uses 802.1x authentication.
Now we've already configured this wireless LAN
in a previous video to use 802.1x authentication,
and so that's why we already see that enabled here.
We do want to change that, so we want to enable
that PSK option instead for our pre-shared key.
And when we do that, if we scroll down,
we'll see some more options for the pre-shared key.
First we see the PSK format.
If we look at that format drop down,
we have the option to choose the HEX format,
but ASCII is the preferred and the default option.
So we'll leave that in place,
and right underneath that
we have a box where we actually can define
the pre-shared key string of choice.
So let me go ahead and put that in, make a key string.
The final step is just to click the apply button
on the top right hand side.
We get that warning again
letting us know there's going to be
temporary wireless disconnection,
we accept that warning and that's it.
That's all it takes to configure
pre-shared key authentication,
it's really simple.
If we go back to the main WLANs window,
we can see again our list of networks,
and right at the top is our corporate wireless LAN.
If we look on the right side under Security Policies
notice that this is now listed
as WPA2 with PSK authentication,
which is exactly what we would expect to see.
So that's a look at how to configure
pre-shared key authentication
on a Cisco wireless LAN controller.