Contents

Related Topics

Configure SSID Security Settings

When you add an SSID, you can configure security settings that control how wireless clients must connect to your AP devices. By default, the wireless security mode is set to WPA2 only to encrypt the transmissions on the wireless LAN between the computers and the AP devices, and to prevent unauthorized access to the AP device.

To protect privacy, you can use other LAN security mechanisms such as password protection, VPN tunnels, and user authentication.

WPA and WPA2 with Pre-Shared Keys

The WPA (PSK) and WPA2 (PSK) Wi-Fi Protected Access methods use pre-shared keys for authentication. When you choose one of these methods, you configure a pre-shared key that all wireless devices must use to authenticate to the AP device.

AP devices support three wireless authentication settings that use pre-shared keys:

  • WPA only (PSK) — The AP device accepts connections from wireless devices configured to use WPA with pre-shared keys.
  • WPA2 only (PSK) — The AP device accepts connections from wireless devices configured to use WPA2 with pre-shared keys. WPA2 implements the full 802.11i standard; it does not work with some older wireless network cards.
  • WPA/WPA2 (PSK) — The AP device accepts connections from wireless devices configured to use WPA or WPA2 with pre-shared keys.

You configure the settings for WPA or WPA2 security on the Security tab when you edit an SSID.

To configure WPA or WPA2 settings:

  1. From the Encryption drop-down list, select an encryption method:
    • TKIP or AES — Uses either TKIP or AES for encryption.
    • AES — Uses only AES (Advanced Encryption Standard) for encryption.

For 802.11n wireless clients, TKIP is not supported and we recommend you configure the wireless client to use AES encryption.

  1. (Optional) In the Group Key Update Interval text box, type or select the WPA group key update interval.
    We recommend you use the default setting of 3600 seconds.
  2. In the Passphrase text box, type the passphrase that wireless clients must use to connect to this SSID.

WPA and WPA2 with Enterprise Authentication

The WPA Enterprise and WPA2 Enterprise authentication methods use the IEEE 802.1X standard for network authentication. These authentication methods use the EAP (Extensible Authentication Protocol) framework to enable user authentication to an external RADIUS authentication server. The WPA Enterprise and WPA2 Enterprise authentication methods are more secure than WPA/WPA2 (PSK) because users authenticate with their own credentials instead of a shared key.

To use the Enterprise authentication methods, you must configure an external RADIUS authentication server.

WatchGuard AP devices support three WPA and WPA2 Enterprise wireless authentication methods:

  • WPA Enterprise — The AP device accepts connections from wireless devices configured to use WPA Enterprise authentication.
  • WPA2 Enterprise — The AP device accepts connections from wireless devices configured to use WPA2 Enterprise authentication. WPA2 implements the full 802.11i standard; it does not work with some older wireless network cards.
  • WPA/WPA2 Enterprise — The AP device accepts connections from wireless devices configured to use WPA Enterprise or WPA2 Enterprise authentication.

Configure RADIUS Server Authentication with Active Directory for Wireless Users

To authenticate wireless users to your network, you can use the user accounts from your Active Directory server database to authenticate users with your RADIUS server and the RADIUS protocol. You must configure the wireless security settings on your Firebox to enable RADIUS authentication, configure your RADIUS server to get user credentials from your Active Directory database, and configure your Active Directory and RADIUS servers to communicate with your Firebox.

For more information, see Configure RADIUS Server Authentication with Active Directory for Wireless Users.

About RADIUS Single Sign-On

In Fireware v11.11 and higher, you can use RADIUS Single Sign-On for wireless clients when you use WPA and WPA2 Enterprise authentication. For more information on RADIUS Single Sign-On, see About RADIUS Single Sign-On.

Configure WPA and WPA2 Enterprise Authentication

Configure the settings for WPA or WPA2 Enterprise on the Security tab when you edit an SSID.

To configure WPA or WPA2 Enterprise settings:

  1. From the Security Mode drop-down list, select WPA Enterprise, WPA2 Enterprise or WPA/WPA2 Enterprise.
  2. From the Encryption drop-down list, select an encryption method:
    • TKIP or AES — Uses either TKIP or AES for encryption.
    • AES — Uses only AES (Advanced Encryption Standard) for encryption.

For 802.11n wireless clients, TKIP is not supported and we recommend you configure the wireless client to use AES encryption.

  1. (Optional) In the Group Key Update Interval text box, set the WPA group key update interval.
    We recommend you use the default setting of 3600 seconds.
  2. In the RADIUS Server text box, type the IP address of the RADIUS server.
  3. In the RADIUS Port text box, make sure that the port number the RADIUS server uses for authentication is correct.
    The default port number is 1812. Some older RADIUS servers use port 1645.
  4. In the RADIUS Secret text box, type the shared secret between the AP device and the RADIUS server.
    The shared secret is case-sensitive, and it must be the same in the SSID configuration as it is on the RADIUS server.

If you have a RADIUS accounting server, you can enable RADIUS Accounting:

  1. Select the Enable RADIUS Accounting check box.
  2. In the RADIUS Accounting Server text box, type the IP address of the RADIUS accounting server.
  3. In the RADIUS Accounting Port text box, make sure that the port number the RADIUS accounting server uses is correct.
    The default port number is 1813.
  4. In the RADIUS Accounting Secret text box, type the shared secret between the AP device and the RADIUS accounting server.
  5. In the Interim Accounting Interval text box, set the interim accounting interval.

Fast Roaming

Fast Roaming enables a wireless client to quickly hand over wireless communications as it moves from one WatchGuard AP device to another AP device. Fast Roaming helps provide a seamless communications transition and improves performance and stability of streaming-intensive applications such as VoIP and video streaming as wireless devices roam between AP devices on your network.

Fast Roaming decreases the re-authentication time for WPA2 authentication on an SSID for a wireless client.

Fast Roaming is only supported on WatchGuard AP120, AP300, AP320, AP322, and AP420 devices, and can only be enabled for WPA2-PSK, WPA/WPA2-PSK mixed, WPA/WPA2 Enterprise mixed, or WPA2-Enterprise protected SSIDs. Wireless clients must support the 802.11k and 802.11r standards.

See Also

Configure WatchGuard AP Device SSIDs

Give Us Feedback     Get Support     All Product Documentation     Technical Search