topic Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security in Network Access Control

WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

spiz — Fri, 14 Feb 2025 06:37:05 GMT

Need some advice please, trying to create new SSID with security to include PSK(WPA2+3) as well as 802.1x.

It seems Security Type=Personal only allows for PSK, but 802.1x is for Type=Enterprise.

How can I have both PSK & 802.1x on same SSID, my WLC seems doesn't allow that ?

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

Leo Laohoo — Fri, 14 Feb 2025 07:15:31 GMT

iPSK

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

MHM Cisco World — Fri, 14 Feb 2025 07:24:15 GMT

Why you want both ?

MHM

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

spiz — Fri, 14 Feb 2025 09:08:46 GMT

also trying iPSK, but want 802.1x too

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

spiz — Fri, 14 Feb 2025 09:09:47 GMT

have devices working with PSK, but will transition some to work with 802.1x (not all)

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

Flavio Miranda — Fri, 14 Feb 2025 10:32:21 GMT

@spiz

Since you are using AirOS, you can create two profile with the same SSID and add PSK in one SSID and 802.1x in the other.

I dont believe you can do both in one SSID.

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

trondaker — Fri, 14 Feb 2025 11:11:55 GMT

I dont think Aireos allows two SSIDs with the same name - only wlc9800 does that as long as the profile name is different? You cant have two different auth-methods on one SSID either, so you need two different ones for PSK and 802.1x.

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

spiz — Fri, 14 Feb 2025 13:19:41 GMT

I can certainly have two same name SSID with different profile, but then its two broadcasted SSID's.

Any references that discuss this is/isn't possible, I haven't been able to locate any ?

I've read that it is possible, but no cisco ref

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

spiz — Fri, 14 Feb 2025 13:22:12 GMT

Thanks, but then you have 2 broadcasted, any cisco ref that discuss this ?

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

trondaker — Fri, 14 Feb 2025 14:28:55 GMT

You’re right, as long as you use id over 16, you can have the same ssid. When you configure a ssid you can see that you can’t enable both at the same time. I guess it’s related to key exchange and eap-methods in enterprise vs personal.

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

Scott Fella — Fri, 14 Feb 2025 14:54:31 GMT

I would like to clarify that it has never been possible to configure both PSK (Pre-Shared Key) and 802.1x on a single WLAN profile. You must choose one or the other, as others have already mentioned. Creating a second WLAN with the same SSID but a different profile name essentially creates a separate SSID. The SSID will simply broadcast its beacon according to the compatibility it supports (for example, PSK or 802.1x). Therefore, regardless of the profile name, the system treats each SSID independently, indicating whether it supports PSK, 802.1x, or another authentication method.

The reason you can't find documentation on seeing two SSID being broadcast, is because what you want, isn't how it works. An SSID can only be configured for one, in your example, 802.1x and another SSID for PSK. When you try to configure the WLAN, you should not see an option to do that, or you get an error message.

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

Flavio Miranda — Fri, 14 Feb 2025 15:09:06 GMT

You may find this in some Cisco docs but it does not matter. If they give you this possibiliy it because in some scenario this can be applied and yours seems to be one.

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

spiz — Sat, 15 Feb 2025 03:59:13 GMT

Thanks @Scott Fella , sounds logical.

I guess I need the user experience to be transparent, where one has a psk device and another 802.1x, as we are to transition. Some can, others can't use certs. But the organisation needs to remain on an ssid that appears to be the same for all, so when we decide and transition it is seamless, even though they may use one with different profile.

I havnt tried this, but if we have one of each with same ssid name & different profile what will the user experience be, when time comes to push out certs to transition. Assuming device gets a valid cert to prioritise on that.

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

spiz — Sat, 15 Feb 2025 04:07:48 GMT

On another point, if you have two ssid with same name and different profile for each security type, can they be enabled at same time?

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

Scott Fella — Sat, 15 Feb 2025 06:34:35 GMT

Yes it can be enabled at the same time.

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

Scott Fella — Sat, 15 Feb 2025 06:38:47 GMT

I have done a lot of migrations in my time and I will be honest. Almost all of the time you create a new SSID so that you can understand what devices are using which SSID it also cleans up SSID names which sometimes don’t make sense anymore. When you manage devices either GPO or Intune/MDM, that is really how you can migrate successfully, because you can control the settings, etc.

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

Arne Bier — Sun, 16 Feb 2025 21:26:52 GMT

PSK (Pre-shared Key) and 802.1X are two completely different wifi authentication methods that do not co-exist - it has nothing to do with the WLC - it's just how wireless works. If you want to combine 802.1X with MAC Address Security (i.e. have the WLC or RADIUS server do MAB in addition to 802.1X) then you can do that - on the AireOS controllers you would simply tick the Mac Filtering checkbox in the 802.1X enabled SSID WLAN config - that would do the 802.1X first (IIRC) and then send another Access-Request to the RADIUS server to authenticate the MAC address.

iPSK is for PSK - not for 802.1X

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

MHM Cisco World — Sun, 16 Feb 2025 21:48:36 GMT

Friend check wpa3 enterprise, this l2 security can use PSK with 802.1x.

....sorry for some delay in reply I am busy....
MHM

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

spiz — Sun, 16 Feb 2025 22:25:45 GMT

Thanks @Arne that si I n d's neat.

So one ssid with 802.1x and mac filtering. Looking for a ref for that now. Any idea where ?

Re: WLC 8540 ver.8.10.183.0 - SSID with both PSK and 802.1x security

Arne Bier — Sun, 16 Feb 2025 22:47:57 GMT

I can't find a link for Cisco AireOS controllers, but I did this many years ago, and it was simply a case of ticking the checkbox for MAC Filtering in the 802.1X SSID WLAN profiled. The part I can't recall is whether the MAC filtering stage happens before the 802.1X auth, or vice-versa. Either way, your RADIUS server will need to handle those MAC auths. If you have a lab, try this out, and then do a tcpdump (e..g if your RADIUS server is ISE) and check what the Service-Type attribute is for the MAC auth. I don't recall if it's 'Call-Check' (which is MAB) or 'Framed' (in which case this is a PAP auth). Your ISE server needs Authentication to CONTINUE if 'User Not Found' to allow the handling of unknown MAC addresses.

For the Cisco 9800 controllers, you can check this link