topic Re: Security I have a 2504 wireless LAN controller in Network Security

Security I have a 2504 wireless LAN controller

blaucournet — Mon, 13 Jun 2022 09:33:03 GMT

I have a main 2504 wireless LAN controller and a backup. I see that it is possible to configure security systems. Knowing nothing about it, I didn't touch anything. What security do you recommend to put in place?

Thanks

Re: Security I have a 2504 wireless LAN controller

Mohammed al Baqari — Mon, 13 Jun 2022 09:45:19 GMT

Hi, this is a wide question but some important recommendations:

- Use CA signed certs
- Disable weak ciphers
- Limit access to HTTPS (no HTTP)
- Limit access to SSH (no telnet)
- Limit access to specific IP trusted IPs
- NTP sync is important
- You can go to disable cdp as well.

**** please remember to rate useful posts

Re: Security I have a 2504 wireless LAN controller

Flavio Miranda — Mon, 13 Jun 2022 10:54:23 GMT

If you refer to clients security, the better solution is radius with certificates. Avoid PSK.

Re: Security I have a 2504 wireless LAN controller

Jitendra Kumar — Mon, 13 Jun 2022 11:51:22 GMT

you can follow @Mohammed al Baqari statement with recommended options basics.

Further, you can create a separate SSID for guests without giving internal network access.

you can also integrate with Radius using the certificate for more security, you can also use a mac base authentication as well.

Thanks,

Jitendra

Re: Security I have a 2504 wireless LAN controller

blaucournet — Tue, 14 Jun 2022 09:07:19 GMT

I see in Security, there is a "Radius" section. Does this mean there is a built-in Radius? If so do I need to configure this or install a Radius server?

Re: Security I have a 2504 wireless LAN controller

blaucournet — Tue, 14 Jun 2022 09:13:57 GMT

I have PCs and wifi guns connected. Of course, there is a password for each WIFI access point and each 2504 wireless LAN controller. Do you have a website or documentation to properly configure the points you describe ?

Re: Security I have a 2504 wireless LAN controller

Flavio Miranda — Tue, 14 Jun 2022 12:50:18 GMT

Yes, that´s correct. WLC supports Local EAP.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215026-local-eap-authentication-on-catalyst-980.html

https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010101101.html