09-07-2022 07:29 PM - edited 09-07-2022 07:29 PM
Hi All,
We are due to migrate WLC2504 along with APs to new 9800WLC setup.
Based on the backup file preshared key configured is in this format.
config wlan security wpa akm psk set-key hex encrypt 1 b86d3329e44d59d45b3702def381431e 379eb848c2e12fa3d02159e579d85a07bdf575df 48 1edb08b35182e272f6164f18316591c534191f527a2c6bd0013383f1dcfce63f8caa76744c6834d0635e767e37de167e00000000000000000000000000000000000000000000000000000000000000001699ea6c000000000000001600000000060600010000000015822b8000000000106773f0000000000000020600000000132f00000000000015822b8000100002 3
config wlan security wpa akm psk enable 3
config wlan security wpa enable 3
How do i port this exact key over to IOS-XE?
Will it be a seemless migration for the wireless users? Or do they need to forget their SSID on their devices & re-type in the same key
Appreciate any help
09-07-2022 07:58 PM
I assume you know the key, in that way you configure it on 9800 like normally you configure it when creating SSID. Clients do not want to forget & rekey on the client devices.
HTH
Rasika
*** Pls rate all useful responses ***
09-14-2022 05:03 AM - edited 03-05-2024 01:50 AM
I think what you're really asking is whether you can decrypt the plain-text key from that config - answer is NO. You must know the original key. If you don't know it then your best option is to retrieve it from one of the client devices - method depends on device and OS, some easier than others.
02-12-2024 01:01 PM
What if you don't know the key? Is there any way to use the key as it comes out of the config converter as shown above?
02-12-2024 10:27 PM
No. You have to know the original key.
If you don't know a PSK you can try to recover it from one of the devices using it - search for instructions for the various OS. Otherwise you'll need to set a new key and users will need to be given the new key. If it's radius or TACACS then set the new key at server end at the same time as your 9800 (and possibly the old AireOS WLC at the same time).
03-05-2024 01:15 AM
In fact it turned out that it is possible to migrate psk without knowing ASCII PSK and decrypt passwords/keys from Cisco AireOS WLC configuration. The AES key was published in 2014, but most probably it was extracted earlier.
https://github.com/kuzmin-no/Cisco-AireOS-WLC-config-decryption-tool
04-05-2024 06:43 AM
This script is a lifesaver. TY.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide