WLAN Authentication Method

The authentication method specifies the protocol used to verify users' identities. This can include automatic methods such as using the wireless client’s MAC address, which uniquely identifies each device on the network.

Alternatively, more advanced LAN protocols, like IEEE 802.1X, can be used to provide a higher level of security by requiring credentials such as usernames and passwords or digital certificates.

Note: Some authentication methods will affect the available Encryption Options. The following sections will explain these methods and options in detail, providing guidance on how to configure and implement them effectively.

Open

The Open authentication method does not apply any authentication mechanism to device connections. This means that any device can connect to the WLAN without needing to provide credentials. However, the wireless user may still need to enter a password if some kind of encryption is enabled.

The following Encryption Options are available for Open WLANs:

  • WPA2
  • WPA3
  • WPA2/WPA3-Mixed
  • OWE
  • OWE-Transition
  • WPA-Mixed
  • None

802.1X EAP

IEEE 802.1X is a network access control protocol that enhances security by requiring devices to authenticate before accessing the network. This method requires a back-end authentication server such as a RADIUS server. This method enhances security by ensuring only authenticated users or devices can access the network, allows for dynamic VLAN assignment based on user roles, and is scalable for large networks with many users and devices.

The following Encryption Options are available for 802.1X EAP WLANs:

  • WPA2
  • WPA3
  • WPA2/WPA3-Mixed
  • WPA-Mixed
  • None
    Note: For 802.1X EAP WLANs, when selecting WPA encryption options, a password is not required because the authentication process relies on a RADIUS server to verify device certificates or user credentials other than a pre-shared key. For this, DPSK options are not available either.

The 802.1X EAP authentication method requires you to configure the Authentication & Accounting Service section:

  • Authentication and Accounting Services - Select an existing service from the drop-down list or click the + icon to create a new service. For more information, refer to AAA.
  • Use the controller as proxy - Toggle the switch to ON to use the controller as a proxy. This means that the controller will be responsible for contacting the RADIUS server for authentication or accounting, in contrast to the non-proxy setting, in which the APs contact the RADIUS server directly.

MAC Address

The MAC Address method uses the unique MAC address of the wireless client to authenticate it before granting network access. This method involves checking the device's MAC address against a predefined list of authorized addresses stored on an authentication server. When you select MAC Address, two additional fields appear in the configuration options, as follows:

  • Use user-defined text as authentication password (default is device MAC address) - Toggle the switch to ON to enable MAC authentication and allow for defining an authentication password. This option allows you to specify a custom password for authenticating client devices instead of using their own MAC addresses. You pre-configure this custom password and store it on the authentication server. When a wireless client attempts to connect, the controller uses this pre-configured password for requesting authentication to the authentication server.
  • MAC Address Format - This field specifies the format in which MAC addresses are sent to the RADIUS server. Ensure the selected format matches the supported format in the RADIUS server.

The following Encryption Options are available for MAC Address WLANs:

  • WPA2
  • WPA3
  • WPA2/WPA3-Mixed
  • OWE
  • OWE-Transition
  • WPA-Mixed
  • None

The MAC Address authentication method requires you to configure the Authentication & Accounting Service section:

  • Authentication and Accounting Services - Select an existing service from the drop-down list or click the + icon to create a new service. For more information, refer AAA.
  • Use the controller as proxy - Toggle the switch to ON to use the controller as a proxy. This means that the controller will be responsible for contacting the RADIUS server for authentication or accounting, in contrast to the non-proxy setting, in which the APs contact the RADIUS server directly.
    Note: For comprehensive instructions and configuration examples of WLANs with 802.1X EAP as the authentication method, refer AAA.

802.1X EAP & MAC

The 802.1X EAP & MAC method indicates that the 802.1X EAP and MAC address authentication methods must both pass for a user to successfully authenticate. First, MAC address authentication is verified; if that passes, 802.1X EAP authentication is processed. After the two authentication methods succeed, the user equipment gains access to the WLAN.

For 802.1X EAP & MAC Authentication WLANs, you can use any of the following Encryption Options:

  • WPA2
  • WPA3
  • WPA2/WPA3-Mixed
  • WPA-Mixed

The 802.1X EAP & MAC authentication method will require you to define the Authentication & Accounting Service section. The following settings must be defined in Authentication & Accounting Service for 802.1X EAP & MAC WLANs:

  • Authentication and Accounting Services: Select an existing service from the drop-down list or click the + icon to create a new service. For more information, refer AAA.
  • Use the controller as proxy: Toggle the switch to ON to use the controller as proxy. This means that the controller will be responsible for contacting the RADIUS server for authentication or accounting, in contrast to the non-proxy setting, in which the APs contact the RADIUS server directly.
    Note: For comprehensive instructions and configuration examples of WLANs with 802.1X EAP as the authentication method, refer AAA.

Parent topic: WLAN Authentication Options