C9800 WLAN layer 2 security mode

[aflbakker]

Hi Gents,

When configuring a 802.1x SSID on a C9800 in 17.9.3 you can select the Security -> Layer 2 - Layer 2 security mode.

You can choose from : 

WPA + WPA2 - and only check the WPA2 policy checkbox.

WPA2 + WPA3 - and only check the WPA2 policy checkbox.

I only want / have WPA2. So what is the difference in both options ? Or results it the same functionality ?

WPA2 + WPA3 :

[Sandeep Choudhary]

Hi,

Info: WPA3 is the successor to WPA2, and WPA2 replaces WPA. WPA3 is the most advanced WiFi security standard among these three. WPA3 and WPA2 is not hackable theoretically, but WPA wireless security type is vulnerable. WPA3 includes more advanced encryption than WPA2 and WPA.

functionality wise it would be same if you select WPA2 in either ones. But if have very old clients which only supports only WPA then you need to use WPA+WPA2 otherwise i would recommend to use WPA2+WPA3.

Regards

Dont forget to rate helpful posts

[aflbakker]

Ok. that would make sense. Because we don't have WPA clients it is more future proof to configure WPA2 + WPA3 and only enable WPA2 then..

[Sandeep Choudhary]

Yes then use WPA2+WPA3 option.

Regards

Dont forget to rate helpful posts

[MHM Cisco World]

We make SSID accpet wpa and wpa2  or wpa2 and wpa3

When the clinet connect it not select the security want to use so we use policy to detect if client capable of wpa2 or not.

If we select one policy then the detection use this policy only and fallback to other wpaX if there is no match if we select both then both policy will use to detect client capabilities.

That what I get from using wpaX policy in ssid.

MHM

[MHM Cisco World]

great Q I have half answer but let me more check and I will update you 
MHM

[pieterh]

it just means you cannot enable WPA3 together with WPA
when selecting wpa2+wpa3 , then selecting WPA policy box will result in an error

wpa2+wpa3 is an intermediate if possible enable wpa3 only (should be backwards compatible)