Contents

Related Topics

Configure SSID Security Settings

When you add an SSID, you can configure security settings that control how wireless clients must connect to your APs. By default, the wireless security mode is set to WPA2 only to encrypt the transmissions on the wireless LAN between the computers and the APs, and to prevent unauthorized access to the AP. To protect privacy, you can use other LAN security mechanisms such as password protection, VPN tunnels, and user authentication.

KRACK WPA/WPA2 Vulnerabilities

WatchGuard has addressed recent KRACK WPA/WPA2 vulnerabilities for the Gateway Wireless Controller and APs in Fireware v12.0.1 and higher and these AP firmware versions:

  • AP120, AP320, AP322, AP420: 8.3.0-657
  • AP100, AP102, AP200: 1.2.9.14
  • AP300: 2.0.0.9

To mitigate KRACK WPA/WPA2 vulnerabilities in unpatched wireless clients, we recommend you enable the Mitigate WPA/WPA2 key reinstallation vulnerability in clients check box in the SSID settings. For more information, see Configure WatchGuard AP SSIDs. This option only applies to AP120, AP320, AP322, and AP420 devices with AP firmware version 8.3.0-657 and higher.

WPA and WPA2 with Pre-Shared Keys

The WPA (PSK) and WPA2 (PSK) Wi-Fi Protected Access methods use pre-shared keys for authentication. When you choose one of these methods, you configure a pre-shared key that all wireless devices must use to authenticate to the AP.

APs support three wireless authentication settings that use pre-shared keys:

  • WPA only (PSK) — The AP accepts connections from wireless devices configured to use WPA with pre-shared keys.
  • WPA2 only (PSK) — The AP accepts connections from wireless devices configured to use WPA2 with pre-shared keys. WPA2 implements the full 802.11i standard. WPA2 only mode it does not work with some older wireless network cards.
  • WPA/WPA2 (PSK) — The AP accepts connections from wireless devices configured to use WPA or WPA2 with pre-shared keys.

You configure the settings for WPA or WPA2 security on the Security tab when you edit an SSID.

To configure the SSID security settings, from Fireware Web UI:Closed
  1. Add or edit an SSID.
  2. On the SSID page, select the Security tab.
  3. From the Security Mode drop-down list, select WPA (PSK), WPA2 (PSK) or WPA/WPA2 (PSK).

Screen shot of the SSID Security tab for WPA/WPA2 (PSK) security mode

  1. Configure the WPA or WPA2 settings.
To configure the SSID security settings, from Policy Manager:Closed
  1. Add or edit an SSID.
  2. In the Edit SSID or Add SSID dialog box, select the Security tab.
  3. From the Security Mode drop-down list, select WPA (PSK), WPA2 (PSK) or WPA/WPA2 (PSK).

Screen shot of the Add SSID dialog box with the WPA/WPA2 (PSK) security mode settings

  1. Configure the WPA or WPA2 settings.

To configure WPA or WPA2 settings:

  1. From the Encryption drop-down list, select an encryption method:
    • TKIP or AES — Uses either TKIP or AES for encryption (WPA or WPA/WPA2 mixed mode only). TKIP is a deprecated, insecure protocol and is not supported in WPA2 only mode.
    • AES — Uses only AES (Advanced Encryption Standard) for encryption.
  2. (Optional) In the Group Key Update Interval text box, type or select the WPA group key update interval.
    We recommend you use the default setting of 3600 seconds.
  3. In the Passphrase text box, type the passphrase that wireless clients must use to connect to this SSID.

WPA and WPA2 with Enterprise Authentication

The WPA Enterprise and WPA2 Enterprise authentication methods use the IEEE 802.1X standard for network authentication. These authentication methods use the EAP (Extensible Authentication Protocol) framework to enable user authentication to an external RADIUS authentication server. The WPA Enterprise and WPA2 Enterprise authentication methods are more secure than WPA/WPA2 (PSK) because users authenticate with their own credentials instead of a shared key.

To use the Enterprise authentication methods, you must configure an external RADIUS authentication server.

WatchGuard APs support three WPA and WPA2 Enterprise wireless authentication methods:

  • WPA Enterprise — The AP accepts connections from wireless devices configured to use WPA Enterprise authentication.
  • WPA2 Enterprise — The AP accepts connections from wireless devices configured to use WPA2 Enterprise authentication. WPA2 implements the full 802.11i standard; it does not work with some older wireless network cards.
  • WPA/WPA2 Enterprise — The AP accepts connections from wireless devices configured to use WPA Enterprise or WPA2 Enterprise authentication.

Configure RADIUS Server Authentication with Active Directory for Wireless Users

To authenticate wireless users to your network, you can use the user accounts from your Active Directory server database to authenticate users with your RADIUS server and the RADIUS protocol. You must configure the wireless security settings on your Firebox to enable RADIUS authentication, configure your RADIUS server to get user credentials from your Active Directory database, and configure your Active Directory and RADIUS servers to communicate with your Firebox.

For more information, see Configure RADIUS Server Authentication with Active Directory for Wireless Users.

About RADIUS Single Sign-On

You can use RADIUS Single Sign-On for wireless clients when you use WPA and WPA2 Enterprise authentication. For more information on RADIUS Single Sign-On, see About RADIUS Single Sign-On.

Configure WPA and WPA2 Enterprise Authentication

Configure the settings for WPA or WPA2 Enterprise on the Security tab when you edit an SSID.

To configure the SSID security settings to use WPA or WPA2 with pre-shared keys, from Fireware Web UI:Closed
  1. Add or edit an SSID.
  2. On the SSID page, select the Security tab.
  3. From the Security Mode drop-down list, select WPA Enterprise, WPA2 Enterprise or WPA/WPA2 Enterprise.

Screen shot of the SSID Security tab for WPA/WPA2 Enterprise security mode

  1. Configure the WPA or WPA2 Enterprise settings.
To configure the SSID security settings to use WPA or WPA2 with pre-shared keys, from Policy Manager:Closed
  1. Add or edit an SSID.
  2. In the Edit SSID or Add SSID dialog box, select the Security tab.
  3. From the Security Mode drop-down list, select WPA Enterprise, WPA2 Enterprise or WPA/WPA2 Enterprise.

Screen shot of the Add SSID dialog box with WPA/WPA2 Enterprise Security Mode settings

  1. Configure the WPA or WPA2 Enterprise settings.

To configure WPA or WPA2 Enterprise settings:

  1. From the Security Mode drop-down list, select WPA Enterprise, WPA2 Enterprise or WPA/WPA2 Enterprise.
  2. From the Encryption drop-down list, select an encryption method:
    • TKIP or AES — Uses either TKIP or AES for encryption. (WPA or WPA/WPA2 mixed mode only). TKIP is a deprecated, insecure protocol and is not supported in WPA2 only mode.
    • AES — Uses only AES (Advanced Encryption Standard) for encryption.
  3. (Optional) In the Group Key Update Interval text box, set the WPA group key update interval.
    We recommend you use the default setting of 3600 seconds.
  4. In the RADIUS Server text box, type the IP address of the RADIUS server.
  5. In the RADIUS Port text box, make sure that the port number the RADIUS server uses for authentication is correct.
    The default port number is 1812. Some older RADIUS servers use port 1645.
  6. In the RADIUS Secret text box, type the shared secret between the AP and the RADIUS server.
    The shared secret is case-sensitive, and it must be the same in the SSID configuration as it is on the RADIUS server.

If you have a RADIUS accounting server, you can enable RADIUS Accounting:

  1. Select the Enable RADIUS Accounting check box.
  2. In the RADIUS Accounting Server text box, type the IP address of the RADIUS accounting server.
  3. In the RADIUS Accounting Port text box, make sure that the port number the RADIUS accounting server uses is correct.
    The default port number is 1813.
  4. In the RADIUS Accounting Secret text box, type the shared secret between the AP and the RADIUS accounting server.
  5. In the Interim Accounting Interval text box, set the interim accounting interval.

Fast Roaming

Fast Roaming enables a wireless client to quickly hand over wireless communications as it moves from one WatchGuard AP to another AP. Fast Roaming helps provide a seamless communications transition and improves performance and stability of streaming-intensive applications such as VoIP and video streaming as wireless devices roam between APs on your network.

Fast Roaming decreases the re-authentication time for WPA2 authentication on an SSID for a wireless client.

Fast Roaming is only supported on WatchGuard AP120, AP320, AP322, and AP420 devices, and can only be enabled for WPA2-PSK, WPA/WPA2-PSK mixed, WPA/WPA2 Enterprise mixed, or WPA2-Enterprise protected SSIDs. Wireless clients must support the 802.11k and 802.11r standards.

See Also

Configure WatchGuard AP SSIDs

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.