Cisco 9115 AP web key or radius server

[heyjunsun]

hello I am setting up the Cisco AP 9115.

https://www.youtube.com/watch?v=kW9nJ3MEZX0&t=30s 

After seeing this, I succeeded in creating SSID 

Now there are two concerns for me.

1. How do I set the web key method when I log in the SSID?

2. The following is an example of how to set up radius server authentication is the config I understood.

example 

"aaa new-model"

"radius server 111.111.111.111 "

"address ipv4 111.111.111.111 auth-port 1812 acct-port 1813"

"key 0 1231231331313132"

"aaa group server radius hello_test"

"server name 123.123.11.12"

"aaa authentication login test_methods group hello_test"

"wlan DBLIFE_18104 1 DBLIFE_18104"

[JPavonM]

I think you have a misconception with regards of the authentication method you want to use in your SSID.

For RADIUS authentication through 802.1X you need to setup the WLC as a client on a RADIUS server (ISE: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213919-configure-802-1x-authentication-on-catal.html; or NPS: https://howiwifi.com/2020/07/21/cisco-9800-802-1x-eap-user-authentication-with-windows-radius-nps/) and create the policies there to allow the connection of client by using any EAP type (PEAP, TLS).

For RADIUS authentication using a web key (aka Captive Portal) you don't need to setup your SSID using 802.1X but only a PSK (your previous method) or keeping it Open (risky in terms of performance). In this case, you have the option to setup the Captive Portal on the WLC (Local Web: https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/web-authentication/b-configuring-web-based-authentication-on-cisco-catalyst-9800-series-controllers/m-local-web-authentication-configuration.html) or an external service (Central Web: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213920-central-web-authentication-cwa-on-cata.html) by using, again, ciscco ISE or other cloud services.

[heyjunsun]

hello JPavonM 

thank you reply 

I got the word wrong 

The authentication method I wanted to say is wepkey.

My situation is that I want to connect through WEPKEY authentication to see if the connection is normal after making SSID.

After that, I would like to change to the Radius server authentication method and check it again.

example command "wap-psk ascii 7 12312312313D" 

So may I know how to set up the WEPKEY scheme?

Also, you told me to assign radius server to WLC, but my question is, do I make radius server authentication like the config I gave you as an example? Is my next action complete with radius server authentication as long as I allocate WLC?

[JPavonM · Accepted solution]

WEP is an unsecure authentication method, but if you needed it becuase you have pretty legacy devices in your network, this is how to do it on the CLI:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/newconfigmodel/b_catalyst-9800-configuration-model/m_configuring-wlan-security.html#task_63147420F58D40E0A928C020F91DB551.

In the GUI:

[heyjunsun]

thank you 

After WEP authentication, I will ask you again about radius server authentication.

[Rich R]

According to https://www.cisco.com/c/en/us/td/docs/wireless/access_point/feature-matrix/ap-feature-matrix.html WEP is deprecated on all the APs since the Wave 2 AC models, including 9115 so I don't think WEP is supported at all on these APs (and I've never tried).