# Configuring Wireless LAN Controller Device Hardening Methods

> Markdown source of <https://docs.calebsargeant.com/networking/cisco/core-security/network-security-fundamentals/06.-configuring-wireless-lan-controller-device-hardening-methods/>.

## Wireless Security Overview

### Why Wireless Security Is Needed

- Malicious attacker doesn’t need physical access to cable
- Can listen if they are within distance of wireless signal
- Additional security measures are needed

### Wired Equivalent Privacy (WEP)

- Password required before device allowed on network
- 24 bit initialization vector (IV and RC4
- IV was too short and insecure

### Wifi Protected Access (WPA)

- 48-bit IV & TKIP
- Message Integrity Check
- Sequence counter

### WPA2

- IEEE 802.11i
- AES-128 & Cipher Block Chaining Message Authentication Code Protocol (CCMP)
- WPA2 Enterprise
  - Uses 802.1X
  - Authentication occurs at AAA server
- WPA2 Personal
  - Use Pre-Shared-Key as authentication

### Adding Encryption to Wireless LANS

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-1.png)
<figcaption>WLANs &gt; select profile</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-2.png)
<figcaption>Security &gt; Layer 2 &gt; WPA+WPA2</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-3.png)
<figcaption>PSK &gt; input password</figcaption>
</figure>

### Configuring WPA2 Enterprise

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-4.png)
<figcaption>Security &gt; AAA &gt; RADIUS &gt; Authentication</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-5.png)
<figcaption>Input Server IP and Shared Secret</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-6.png)
<figcaption>WLANs &gt; select profile &gt; Security &gt; Layer 2 &gt; 802.1X</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-7.png)
<figcaption>AAA Servers &gt; Server 1</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-8.png)
<figcaption>Advanced &gt; Allow AAA Override, P2P Blocking Action (Drop), DHCP Addr. Assignment (Reguired)</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-9.png)
<figcaption>Advanced &gt; NAC State &gt; ISE NAC</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-10.png)
<figcaption>Advanced &gt; Radius Client Profiling (enable all), Local Client Profiling (enable all)</figcaption>
</figure>

### Securing the Management Plane on a Wireless LAN Controller

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-11.png)
<figcaption>Security &gt; Priority Order &gt; Management User &gt; move LOCAL down</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-12.png)
<figcaption>HTTP-HTTPS</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-13.png)
<figcaption>Telnet-SSH</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-14.png)
<figcaption>Mgmt Via Wireless</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-15.png)
<figcaption>SNMP &gt; General</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-16.png)
<figcaption>SNMP &gt; Create User</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-17.png)
<figcaption>SNMP &gt; Trap Receivers</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-18.png)
<figcaption>Security &gt; Access Control Lists &gt; Access Control Lists &gt; New</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-19.png)
<figcaption>Add new rule</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-20.png)
<figcaption>More rules</figcaption>
</figure>

<figure>
![securing the wireless lan controller](_images/securing-the-wireless-lan-controller-21.png)
<figcaption>Apply ACL to CPU</figcaption>
</figure>