Preshared key migrate from aireos to ios-xe

[J_Vansen_S]

Hi All, 

We are due to migrate WLC2504 along with APs to new 9800WLC setup. 

Based on the backup file preshared key configured is in this format. 

config wlan security wpa akm psk set-key hex encrypt 1 b86d3329e44d59d45b3702def381431e 379eb848c2e12fa3d02159e579d85a07bdf575df 48 1edb08b35182e272f6164f18316591c534191f527a2c6bd0013383f1dcfce63f8caa76744c6834d0635e767e37de167e00000000000000000000000000000000000000000000000000000000000000001699ea6c000000000000001600000000060600010000000015822b8000000000106773f0000000000000020600000000132f00000000000015822b8000100002 3

config wlan security wpa akm psk enable 3
config wlan security wpa enable 3

How do i port this exact key over to IOS-XE? 

 Will it be a seemless migration for the wireless users? Or do they need to forget their SSID on their devices & re-type in the same key

Appreciate any help

[Rasika Nayanajith]

I assume you know the key, in that way you configure it on 9800 like normally you configure it when creating SSID. Clients do not want to forget & rekey on the client devices.

HTH
Rasika
*** Pls rate all useful responses ***

[Rich R]

I think what you're really asking is whether you can decrypt the plain-text key from that config - answer is NO.  You must know the original key.  If you don't know it then your best option is to retrieve it from one of the client devices - method depends on device and OS, some easier than others.

[b.tyler]

What if you don't know the key?  Is there any way to use the key as it comes out of the config converter as shown above?

[Rich R]

No. You have to know the original key. 

If you don't know a PSK you can try to recover it from one of the devices using it - search for instructions for the various OS.  Otherwise you'll need to set a new key and users will need to be given the new key.  If it's radius or TACACS then set the new key at server end at the same time as your 9800 (and possibly the old AireOS WLC at the same time).

[SK!]

In fact it turned out that it is possible to migrate psk without knowing ASCII PSK and decrypt passwords/keys from Cisco AireOS WLC configuration. The AES key was published in 2014, but most probably it was extracted earlier.

https://github.com/kuzmin-no/Cisco-AireOS-WLC-config-decryption-tool

[Khade Purcell]

This script is a lifesaver. TY.