Client Association before Authentication

[MUQ_1899_]

Hello,

All the tech docs state that the client authentication process take place before the association. However on the controller I see clients which are associated but not authenticated. How is this possible?

[Rasika Nayanajith]

There are two types of authentication.  Open System Authentication & 802.1X based authentication.

So you will see two authentication frames (req/res) prior to association req/res frames. Refer below post for some details.

https://mrncciew.com/2014/08/19/cwsp-legacy-802-11-securiry/

Once this finished, then user authentication starts.

HTH

Rasika

*** Pls rate all useful responses ***

[MUQ_1899_]

So independent of the configured authentication PSK/802.1X user authentication always in first place we have open authentication then client association and then the final user authentication?

[Scott Fella]

Just to add to Rasika's comments...  Open auth with webauth (layer 3 auth) for example, clients need to get an ip prior to hitting a portal page, then the auth will happen. So anything that is not open and uses a layer 2 encryption will need to get auth first then if passed will get an ip and be placed on the network. 

-Scott 

*** Please rate helpful posts *** 

[MUQ_1899_]

Scott, the screenshot that is attached in the first post is from an SSID configured with PSK. I see associated clients which are not authenticated. I bet that these are someones that have tried to connect but the not know the shared secret. How is it possible to  be associated than?

[Scott Fella]

You first associate, means the device is trying to connect to that SSID, then you move to authenticated if you pass authentication.  You will see this also with Webauth where devices connect automatically but need user intervention to hit accessory or enter credentials.

-Scott 

*** Please rate helpful posts ***