Examkin

Question

Difficulty: HardWireless Security Protocols (WPA, WPA2, WPA3)

A network administrator is deploying a dual-compatibility wireless network on a Cisco Wireless LAN Controller (WLC) to support both modern WPA3-Personal endpoints and legacy WPA2-Personal devices under a single SSID. During initial validation, legacy WPA2 devices fail to complete the 802.11 association phase, while WPA3 devices connect successfully. Investigation reveals that the WLAN security profile is configured with Simultaneous Authentication of Equals (SAE) enabled, Protected Management Frames (PMF) set to "Required", and the encryption cipher suite restricted exclusively to GCMP-256. Which configuration modification on the WLC will enable legacy WPA2 clients to successfully associate while maintaining standard WPA3 Transition Mode operation?

  1. Configure PMF to "Optional" (Capable) and add AES-CCMP128 to the supported cipher suites alongside SAE and PSK authentication.Answer
  2. B
    Change the Access Point operating mode from Local mode to FlexConnect mode to allow local switching of legacy WPA2 frames at the AP level.
  3. C
    Enable TACACS+ authentication fallback on the WLAN to bypass 802.11i key management validation for legacy hardware.
  4. D
    Apply a pre-authentication Access Control List (ACL) to explicit permit EAPoL handshakes past the implicit deny clause.

Answer

Configure PMF to "Optional" (Capable) and add AES-CCMP128 to the supported cipher suites alongside SAE and PSK authentication.
WPA3 Transition Mode allows a single SSID to service both WPA2-Personal and WPA3-Personal clients. WPA3 mandates Protected Management Frames (PMF/802.11w) and SAE key exchange. However, legacy WPA2 devices frequently do not support PMF or GCMP-256 ciphers. Configuring PMF to 'Optional' (Capable) and adding AES-CCMP128 cipher support permits legacy WPA2 devices to associate using standard PSK/CCMP-128 while allowing modern devices to connect using WPA3 SAE and mandatory PMF.

Step-by-Step Solution

1
Analyze WPA3-Personal requirements vs WPA2-Personal legacy compatibility.
WPA3 mandates Simultaneous Authentication of Equals (SAE) and Protected Management Frames (PMF / IEEE 802.11w). WPA2-Personal uses Pre-Shared Key (PSK) and optional PMF with AES-CCMP128.
Legacy devices fail association when PMF is set to 'Required' or when supported WPA2 ciphers (AES-CCMP128) are disabled.
2
Determine WPA3 Transition Mode configuration parameters on Cisco WLC.
PMF must be configured as 'Optional' (or 'Capable') rather than 'Required'. Both SAE and PSK must be enabled for Key Management, and AES-CCMP128 must be allowed as a cipher.
Setting PMF to Optional permits legacy WPA2 clients that lack 802.11w support to connect without PMF, while WPA3-capable clients are required to negotiate PMF and SAE.

Key Concept

WPA3 Transition Mode and Protected Management Frames (PMF/802.11w) Coexistence
Rate this question

Topics

Wireless Security Protocols (WPA, WPA2, WPA3)

More questions from this topic