C9800: WPA2 for guest WLAN after upgrade to 17.9.4a

MauryJ · ‎11-13-2023

Hello All,

We recently upgraded our C9800 from 17.6.x to 17.9.4a. Following the upgrade, three of our networks would not turn back up without some security modifications, which was straight forward for two of them. However, for our guest wireless network, this has been more puzzling.

Previously, we were able to use WPA2 with our guest WLAN -- Clients could connect without supplying credentials, and then would get redirected to a web auth screen, where they would enter supplied credentials to get on the network. Web auth is using local authentication. Now, we can't enable WPA2 on this network without selecting an option for AKM:

Do we now have to also configure a PSK or additional credentials for guests to use, before they hit the web auth?

Thanks

Haydn Andrews · ‎11-13-2023

WebAuth generally has Layer 2 authentication set to none. And then configure layer 3 authentication

*****Help out other by using the rating system and marking answered questions as "Answered"*****
*** Please rate helpful posts ***

Leo Laohoo · ‎11-13-2023

Starting from 17.9.X, WPA3 is supported. Look at the Security tab in 17.9.X and it will show WPA2 + WPA3. Because the settings are incompatible, the SSID has been disabled.

Change it to WPA + WPA2 and then enable the SSID.

MauryJ · ‎11-14-2023

Thank you for the reply -

This guest SSID is set for WPA + WPA2, but, the WPA2 Policy cannot be enabled without also selecting one of the AKM options. Here is a larger screenshot of what I have:

For now I only have the WPA Policy option enabled, as having only it selected does not require AKM.

I will also run this by TAC and will follow up with what I find out on it.

Thanks

Rich R · ‎11-19-2023

Why do you have WPA policy enabled? Do you have any clients which can't support WPA2?
And it's logical that you need a key source for WPA2. If you don't want it encrypted then use Open (None) - like @JPavonM says - that is normal for a web auth SSID.

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

JPavonM · ‎11-14-2023

For any 802.11i WPA flavour it is required to set a key manager (https://www.cwnp.com/uploads/802-11i_key_management.pdf).

The basic one for a Guest SSID is to select PSK, and then you can use WebAuth or CWA.