topic There are two types of in Wireless

Client Association before Authentication

MUQ_1899_ — Mon, 05 Jul 2021 13:19:18 GMT

Hello,

All the tech docs state that the client authentication process take place before the association. However on the controller I see clients which are associated but not authenticated. How is this possible?

There are two types of

Rasika Nayanajith — Fri, 06 Jan 2017 20:21:36 GMT

There are two types of authentication. Open System Authentication & 802.1X based authentication.

So you will see two authentication frames (req/res) prior to association req/res frames. Refer below post for some details.

https://mrncciew.com/2014/08/19/cwsp-legacy-802-11-securiry/

Once this finished, then user authentication starts.

HTH

Rasika

*** Pls rate all useful responses ***

So independent of the

MUQ_1899_ — Sat, 07 Jan 2017 09:52:40 GMT

So independent of the configured authentication PSK/802.1X user authentication always in first place we have open authentication then client association and then the final user authentication?

Just to add to Rasika's

Scott Fella — Sat, 07 Jan 2017 15:50:39 GMT

Just to add to Rasika's comments... Open auth with webauth (layer 3 auth) for example, clients need to get an ip prior to hitting a portal page, then the auth will happen. So anything that is not open and uses a layer 2 encryption will need to get auth first then if passed will get an ip and be placed on the network.

-Scott

*** Please rate helpful posts ***

Scott, the screenshot that is

MUQ_1899_ — Mon, 09 Jan 2017 18:52:26 GMT

Scott, the screenshot that is attached in the first post is from an SSID configured with PSK. I see associated clients which are not authenticated. I bet that these are someones that have tried to connect but the not know the shared secret. How is it possible to be associated than?

You first associate, means

Scott Fella — Mon, 09 Jan 2017 19:09:58 GMT

You first associate, means the device is trying to connect to that SSID, then you move to authenticated if you pass authentication. You will see this also with Webauth where devices connect automatically but need user intervention to hit accessory or enter credentials.

-Scott

*** Please rate helpful posts ***