Security Profile Table - Add (requires Level 10 permission)

Use the Security Profile Table - Add page to configure a security profile. Various profiles can be created, depending on the type of security that will be required for the WLAN. 

The options that are available on this page are determined by the L2 mode that is selected in step 2. An option is active only if it can be configured for the L2 security option that is selected.

To configure Security Profile parameters:

1. In the Security Profile Name box, type the name of the security profile. The name can be up to 32 alphanumeric characters long and cannot contain spaces.
2. In the L2 Modes Allowed area, select one of the following Layer 2 security modes: 
   • Clear: The WLAN does not require authentication or encryption, and the WLAN does not secure client traffic. This is the default setting. 
   • 802.1X: Can provide 802.1X authentication and WEP64 or WEP128 encryption. 
   • Static WEP keys: Requires that stations use a WEP key (see step 6).
   • WPA: Requires 802.1X Radius server authentication with one of the EAP types; see step 4 to select a pre-configured Radius server profile. 
   • WPA PSK: Uses the TKIP encryption protocol and requires a shared key (see step 11 to enter the shared Key).
   • WPA2: Requires 802.1x  Radius server authentication with one of the EAP types (see step 4 to select a pre-configured Radius server profile).
   • WPA2 PSK: Uses the CCMP-AES encryption protocol and requires a pre-shared key (see step 12 to enter the pre-shared key).
   • MIXED: Allows both WPA and WPA2 clients using a single security profile.
   • MIXED PSK: Allows pre-shared key clients to use a single security profile.
3. In the Data Encrypt area, select one of the following (available choices are determined by the L2 Mode selected):
   • WEP64: A 64-bit WEP key is used to encrypt packets.
   • WEP128: A 128-bit WEP key is used to encrypt packets.
   • TKIP: Encryption algorithm used with WPA; uses a 128-bit key and 64-bit Initialization Vector (IV).
   • CCMP-AES: A 128-bit block key is used to encrypt packets with WPA2.
   • CCMP/TKIP Use the Counter Mode with Cipher Block Chaining (CCMP) encryption protocol that replaces TKIP, the mandatory protocol in WPA, and WEP.

   If you select WEP64 or WEP128, you need to specify a WEP key, as described in step 6. If you specify TKIP for WPA-PSK or CCMP-AES for WPA2-PSK, a pre-shared key must be set, as described in step 12.

4. From the Primary Radius Profile Name list, select one of the configured Radius Server Profiles for use as the primary server or select the No Radius option. If no Radius Server Profiles have been configured, the selectable list is unavailable and the text "No Data for Primary Radius Profile Name" displays. To configure a Radius Server Profile, click the Radius link under the Security heading on the Navigation Pane.
5. From the Secondary Radius Profile Name list, select one of the configured Radius Server Profiles for use as the secondary server or select the No Radius option. If no Radius Server Profiles have been configured, the selectable list is unavailable and the text "No Data for Primary Radius Profile Name" displays. To configure a Radius server profile, click the Radius link under the Security heading on the Navigation Pane.
6. In the WEP Key box, specify a WEP key. If you selected Static WEP Keys in step 2, you need to specify a WEP key  in hexadecimal or text string format.
   • A WEP64 key must be 5 octets long, which you can specify as 10 hexadecimal digits (the hexadecimal string must be preceded with 0x) or 5 printable alphanumeric characters (the ! character cannot be used). For example, 0x619B947A3D is a valid hexadecimal value, and wpass is a valid alphanumeric string.
   • A WEP128 key must be 13 octets long, which you can specify as 26 hexadecimal digits (the hexadecimal string must be preceded with 0x) or 13 printable alphanumeric characters (the ! character cannot be used). For example, 0xB58CE2C2C75D73B298A36CDA6A is a valid hexadecimal value, and mypass8Word71 is a valid alphanumeric string.
7. In the Static WEP Key Index box, type the index number to be used with the WEP key for encryption and decryption. A station can have up to four static WEP keys configured. The static WEP key index must be an integer between 1 through 4 (although internal mapping is performed to handle wireless clients that use 0 through 3 assignments).
8. In the Re-Key Period box, type the duration that the key is valid. Specify a value from 0 to 65,535 seconds. The default re-key value is zero (0). Specifying 0 indicates that re-keying is disabled, which means that the key is valid for the entire session, regardless of the duration. 
9. In the Captive Portal list, select one of the following:
   • Disabled: Disables Captive Portal.
   • WebAuth: Enables a WebAuth Captive Portal. This feature can be set for all L2 Mode selections.
10. If you want to use a third-party Captive Portal solution from a company such as Bradford, Avenda, or CloudPath change the value for Captive Portal Authentication Method to external.
11. If 802.1X is to be used, in the 802.1X Network Initiation list, select one of the following:
    • On: The controller initiates 802.1X authentication by sending an EAP-REQUEST packet to the client. By default, this feature is enabled.
    • Off: The client sends an EAP-START packet to the controller to initiate 802.1X authentication. If you select this option, the controller cannot initiate 802.1X authentication.
12. If the Static WEP Key mode to be used, in the Shared Key Authentication list, select one of the following:
    • On: Allows 802.1X shared key authentication. 
    • Off: Uses Open authentication. By default, this feature is off.
13. In the Pre-shared Key text box, enter the key that is to be used if the WPA-PSK or WPA2-PSK option was selected in step 2 above.  The key can be from 8 to 63 ASCII characters or 64 hex characters (hex keys must use the prefix "0x" or the key will not work).
14. In the Group Keying Interval text box, enter the time in seconds for the interval before a new group key is distributed.
15. In the Key Rotation drop-down list, select whether to enable or disable this feature.
16. The timeout value for Backend Authentication Server Timeout can be 1-65535 seconds.
17. For Re-authentication, select one of the following:
    • On: Causes the controller to honor and enforce the "Session-timeout" Radius attribute that may be present in a Radius Access-Accept packet. A customer would use this option if the Session-timeout attribute is used to require stations to re-authenticate to the network (802.1X) at a specified period. If "Session-timeout" is not used, there is no reason to enable re-authentication.
    • Off: Disables re-authentication for this security profile.
18. In the MAC Filtering list, select one of the following:
    • On: Enables MAC Filtering for this security profile.
    • Off: Disables MAC Filtering for this security profile.
19. In the Firewall Capability drop-down list, select one of the following:
    • Configured: The controller defines the policy through configuration of the Firewall filter-id.
    • Radius-configured: The Radius server provides the policy after successful 802.1X authentication of the user. This option requires the Radius server have the filter-id configured. If this is not configured, the firewall capability is not guaranteed.
    • None: Disables the Firewall Capability for this security profile.
20. In the Firewall Filter ID text box, enter the firewall filter-id that is used for this security profile. The filter-id is an alphanumeric value that defines the firewall policy to be used on the controller, when the firewall capability is set to configured. For example, 1.
21.  In the Security Logging drop-down list, select one of the following:
    • On: Enables logging of security-related messages for this security profile.
    • Off: Disables logging of security-related messages for this security profile
22. In the Passthrough Firewall Filter ID text box, enter a firewall filter ID that was created using Configuration > Qos > System Settings > QoS and Firewall Rules > Add. The filter ID is an alphanumeric value that defines the firewall policy to be used on the controller for a Captive Portal-enabled client that has no authentication.
23. Click OK.