WiSM configuration

[Maro.Cisco]

Guyz i have 8 WLCs and i read recently about the managment frame protection which is currently disabled globally and on the WLAN its enabled optionally for Client MFP althought i dont have any clients that support 802.11W , if i enabled MFP globally would it provide me with the encryption of managment frames between APs and controller ???? and is it going to cause any problems ?????

[George Stefanick]

Marco,

Keep in mind the mgt frames arent encrypted with MFP. You can still see the layer 2 traffic with an analyzer. The value of MFP is so that clients will ignore certain frames if they arent sent from authorized access points.

Example suppose I walk into your office and run a deauth program kicking all your clients off the wifi. With MFP, your clients would ignore my deauth frame. Here is some more reading on the subject

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008080dc8c.shtml

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

[Maro.Cisco]

it says in the link u gave me that ""With MFP, all management frames are cryptographically hashed to create a Message Integrity Check (MIC). The MIC is added to the end of the frame (before the Frame Check Sequence (FCS))."" So even if i didnt make any use of Client MFP , globally enabling MFP would take care of spoofed AP trying to communicate with my APs ?????

[Maro.Cisco]

what im trying to understand here if i enabled MFP globally on all WLCs without having any clients supporting 802.11W would it actually make a difference or just better leave it disabled ???

[George Stefanick]

Thats a great question. I am not 100% sure if there is any value from the an ap perspective. I am inclined to say no.

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

[Leo Laohoo]

Duplicate posts.