dot11 ssid - password encryption in config file

[Nicky Maddison]

Hi community,

I am archiving the configuration of all my Cisco devices to a TFTP server.

I am using "secret" instead of "password" to avoid anyone to read the different passwords stored in the config files, but the ssid password remain encrypted with Cisco 7 and easily findable with all the tools on the web.

Example:

dot11 ssid xxx
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 7 030C5E070A006C4F471A1A0A

Is it possible to encrypt the ssid password with something else? I don't want some ssid password to be available because we have some specific devices and traffic on these ssids.

Thanks a lot.

[Julio E. Moisa]

Hi Nicky,

Usually the command: service password-encryption is configured on the network devices to encrypt the current a new passwords, you could try it on the access point.

[Nicky Maddison]

Hello Julio,

Thanks for the answer...

I have already tried the "service password-encryption" but, as explained here, http://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html it uses the cisco weak encryption algorithm and can be decrypt on any web site with Cisco decrypt password tools.

So, this is not solving my problem. May be it is not possible...

Thanks anyway.

Nicky

[Marvin Rhoads]

The "secret" feature only provides strong encryption for the enable and user passwords.

It does not provide it for wireless pre-shared keys or other passwords that may be in the configuration.

[Nicky Maddison]

Hello and thank for the answer,

but is there a way to protect the pre-shared keys in the config file?

Thanks.

[Marvin Rhoads]

Restrict access to the configuration to authorized network administrators.

If you are backing it up externally, then save the backup in an encrypted archive.

If security is so critical that those measures don't suffice, then you should be looking to alternative wireless authentication methods like 802.1x.