Cisco CCNA Preparation · lesson 16 of 36 · 25 min
Wireless Security Fundamentals
Wireless networks are inherently more vulnerable than wired networks — anyone within radio range can attempt to connect or intercept traffic. Securing wireless requires strong authentication, robust encryption, and proper network design.
The CCNA exam focuses on WPA2, WPA3, and 802.1X/EAP for enterprise wireless security.
WPA2 — Wi-Fi Protected Access 2
WPA2 (IEEE 802.11i) replaced the broken WEP and WPA standards. It uses AES-CCMP encryption (128-bit AES in Counter Mode with CBC-MAC Protocol) — significantly stronger than WEP’s RC4 or WPA’s TKIP.
WPA2 vulnerability
WPA2-Personal is vulnerable to offline dictionary attacks if a weak passphrase is used. An attacker captures the 4-way handshake and brutes it offline. Use a strong random passphrase (20+ characters). WPA2-Enterprise is not vulnerable to this attack because each user has unique credentials.
WPA3 — The Current Standard
SAE
SAE (Simultaneous Authentication of Equals) is a password-based key exchange that provides forward secrecy and resistance to offline attacks. Even if an attacker captures the handshake, they cannot crack the password offline — each attempt requires interacting with the AP.
802.1X and EAP — Enterprise Authentication
802.1X is a port-based network access control standard. It has three components: Supplicant (client device), Authenticator (AP or switch), and Authentication Server (RADIUS server, e.g. Cisco ISE).
The authenticator blocks all traffic except 802.1X until the supplicant authenticates with the RADIUS server. Only after successful authentication does the authenticator open the port.
Exam tip
EAP-TLS is the most secure EAP method (mutual certificates) but requires a PKI to issue client certificates. PEAP is the most common enterprise deployment — server certificate only, client uses AD credentials inside the TLS tunnel.
Wireless Attack Types
Knowledge Check — 10 Questions
Wireless Security
What encryption algorithm does WPA2 use?
- RC4
- TKIP
- AES-CCMP
- DES
Answer: AES-CCMP
WPA2 uses AES-CCMP (128-bit AES in Counter Mode with CBC-MAC Protocol). WEP used RC4; WPA used TKIP. AES-CCMP is significantly stronger.
What is the main advantage of WPA2-Enterprise over WPA2-Personal?
- Faster connection speed
- Individual user credentials via RADIUS — no shared passphrase
- Stronger encryption algorithm
- Easier to configure
Answer: Individual user credentials via RADIUS — no shared passphrase
WPA2-Enterprise uses 802.1X with a RADIUS server. Each user authenticates individually, so compromising one account does not expose others.
What does SAE replace in WPA3-Personal?
- AES encryption
- The PSK (Pre-Shared Key) handshake
- RADIUS authentication
- The SSID
Answer: The PSK (Pre-Shared Key) handshake
SAE (Simultaneous Authentication of Equals) replaces the PSK 4-way handshake in WPA3-Personal. It provides forward secrecy and resistance to offline dictionary attacks.
In 802.1X, what is the role of the authenticator?
- The client device requesting access
- The RADIUS server verifying credentials
- The AP or switch that controls port access based on authentication result
- The certificate authority
Answer: The AP or switch that controls port access based on authentication result
The authenticator (AP or switch) blocks all traffic except 802.1X until the RADIUS server confirms the supplicant is authenticated, then opens the port.
Which EAP method requires certificates on BOTH the client and the server?
- PEAP
- EAP-FAST
- EAP-TLS
- EAP-TTLS
Answer: EAP-TLS
EAP-TLS requires mutual certificate authentication — both the client and the RADIUS server present certificates. It is the most secure EAP method but requires a PKI.
An attacker sets up a wireless AP with the same SSID as the corporate network to capture credentials. This is called:
- Deauthentication attack
- KRACK
- Evil twin / rogue AP
- Wardriving
- Answer: Evil twin / rogue AP
An evil twin AP mimics a legitimate SSID to lure clients. 802.1X with server certificate verification defeats this — clients verify the RADIUS server cert before sending credentials.
What is OWE in WPA3?
- A new EAP method
- Opportunistic Wireless Encryption — encrypts open (no-password) networks
- A replacement for RADIUS
- An attack on WPA2
Answer: Opportunistic Wireless Encryption — encrypts open (no-password) networks
OWE encrypts traffic on open networks (coffee shops, airports) without requiring a password. Users connect without a passphrase but traffic is still encrypted.
Which standard provides protected management frames to prevent deauthentication attacks?
- 802.11n
- 802.11w
- 802.1X
- 802.11ac
Answer: 802.11w
802.11w (Management Frame Protection) encrypts and authenticates management frames including deauthentication frames, preventing spoofed deauth attacks.
In 802.1X, the three roles are: supplicant (client), authenticator (AP/switch), and authentication _____ (RADIUS).
Answer: server
The authentication server (typically a RADIUS server like Cisco ISE) verifies the supplicant credentials and tells the authenticator whether to allow or deny access.
WPA2-Personal is vulnerable to which type of attack if a weak passphrase is used?
- SQL injection
- Offline dictionary attack against the captured 4-way handshake
- Man-in-the-middle via ARP spoofing
- VLAN hopping
Answer: Offline dictionary attack against the captured 4-way handshake
An attacker captures the WPA2 4-way handshake (by waiting or sending deauth frames) then brute-forces the passphrase offline. WPA3 SAE prevents this.
Previous lesson: Cisco wireless architectures, AP modes, WLC, CAPWAP, WLAN GUI configuration
Back to Cisco CCNA Preparation
Next lesson: Routing table components: prefix, mask, next hop, AD, metric, gateway of last resort