Configure and verify WLAN within the GUI using WPA2 PSK

This objective asks you to recognize the steps for creating a WLAN on a Cisco Wireless LAN Controller (WLC) through its web interface and securing it with WPA2 pre-shared key. The exam shows screenshots of the WLC GUI and asks what a setting does or what is missing. The description below follows the classic AireOS WLC GUI (the Cisco 3504, 5520, and similar controllers), which is what the Cisco courseware uses; the newer Catalyst 9800 GUI uses different menus but the same concepts.

What a WLAN is on a WLC

On a controller, a WLAN is a profile that ties together an SSID (the network name clients see), security settings, QoS, and the wired interface (a VLAN) that client traffic is placed on. One controller can host many WLANs, each with a WLAN ID (1 to 512 on AireOS; by default only IDs 1 to 16 are pushed to APs in the default AP group). Every access point joined to the controller can broadcast the WLAN.

Before creating the WLAN, the administrator normally creates a dynamic interface on the controller (Controller > Interfaces > New) with a name, VLAN ID, IP address, and DHCP server address, so that client traffic has a VLAN to land in. Then the WLAN is created and mapped to that interface.

Step 1: create the WLAN

Navigate to the WLANs tab at the top of the GUI. From the drop-down at the upper right choose Create New and click Go. On the New WLAN page, fill in:

• Type: WLAN (as opposed to Guest LAN or Remote LAN).
• Profile Name: an internal name for the configuration, for example Corp-Profile.
• SSID: the name broadcast to clients, for example CorpWiFi. Case-sensitive, up to 32 characters. The profile name and SSID can be the same, but do not have to be.
• ID: the WLAN ID number; choose the next unused one.

Click Apply.

Step 2: General tab

The WLAN edit page opens on the General tab:

• Status: check Enabled. A newly created WLAN is disabled until this box is checked; this is the classic “why is nobody seeing the SSID?” exam question.
• Radio Policy: which bands broadcast the SSID (All, 802.11a only, 802.11b/g only, and so on).
• Interface/Interface Group(G): select the dynamic interface (VLAN) created earlier, such as corp-vlan10. Client traffic on this WLAN will be bridged into that VLAN.
• Broadcast SSID: checked to include the SSID in beacons; unchecking hides it (which is not a security measure).

Step 3: Security tab, Layer 2

Click Security, then the Layer 2 sub-tab:

• Layer 2 Security drop-down: choose WPA+WPA2. (Other choices include None, 802.1X for dynamic WEP, Static WEP, and WPA2+WPA3 / WPA3 on newer releases.)
• Under WPA+WPA2 Parameters, check WPA2 Policy and, for its encryption, check AES (leave WPA Policy and TKIP unchecked for a WPA2-only network).
• Under Authentication Key Management, check PSK (as opposed to 802.1X, CCKM, or FT variants).
• PSK Format: choose ASCII and type the passphrase (8 to 63 characters), or choose HEX and enter a 64-hex-digit key.

A WLAN that uses 802.1X would instead check the 802.1X key management box and require an AAA Servers sub-tab entry pointing at a RADIUS server; that is not needed for PSK.

Step 4: Security tab, Layer 3

On the Layer 3 sub-tab, Layer 3 Security should be None for a normal WPA2-PSK WLAN. Layer 3 security is where you would configure Web Policy (a captive portal or web authentication page), typically for open guest networks. Enabling it here on top of PSK would force users to both know the passphrase and log in on a web page.

Step 5: QoS tab

The QoS tab sets the Quality of Service (QoS) level for the WLAN with four choices, from highest to lowest priority: Platinum (voice), Gold (video), Silver (best effort), and Bronze (background). The default is Silver. A WLAN for Wi-Fi phones would be set to Platinum. The tab also has WMM (Wi-Fi Multimedia) policy settings and per-user/per-SSID bandwidth contracts.

Step 6: Advanced tab

The Advanced tab contains many optional settings. Ones you may see on the exam:

• Allow AAA Override: lets a RADIUS server override the WLAN’s VLAN or QoS for individual users.
• Coverage Hole Detection: lets the controller boost AP power when clients report weak signal.
• Session Timeout: how long before a client must re-authenticate (default 1800 seconds for PSK/802.1X WLANs).
• Client Exclusion: temporarily bans clients after repeated authentication failures (default 60 seconds).
• Maximum Allowed Clients per WLAN.
• DHCP Addr. Assignment Required: forces clients to use DHCP (blocks static IPs).
• FlexConnect Local Switching: for branch APs that bridge traffic locally instead of tunneling it to the controller.
• Client Band Select and Load Balancing for steering clients across bands and APs.

Click Apply and then Save Configuration at the top right; changes on a WLC take effect when applied but are lost on reboot unless saved.

Verification in the GUI

Back on the WLANs page, the list shows each WLAN with its ID, profile name, SSID, Admin Status (Enabled/Disabled), and Security Policies (for our WLAN: [WPA2][Auth(PSK)]). To confirm clients are connecting, use Monitor > Clients, which lists each client’s MAC address, AP, WLAN, and state (RUN means fully authenticated and passing traffic). Monitor > Summary shows counts of APs and clients per controller.