First, the essential ideas
- SSID, profile and WLAN ID
- The SSID is the name clients select. An AireOS profile name identifies a controller configuration, and the WLAN ID is its numeric identifier. These three values can differ.
- Authentication and encryption
- Authentication checks the credential or identity allowed to join. Encryption protects data using keys. A successful password exchange does not establish correct addressing or application access.
- PSK and Personal
- A preshared key (PSK) is a shared credential for a Personal WLAN. Every holder can use that credential; it does not identify an individual employee.
- Enterprise, 802.1X and RADIUS
- Enterprise WLANs normally use 802.1X access control and an authentication service such as RADIUS. RADIUS carries authentication policy exchanges; this lab has no RADIUS server.
- WPA, WPA2 and WPA3
- Wi-Fi Protected Access names security generations. Legacy WPA commonly used TKIP; this lesson configures WPA2 with AES-CCMP. WPA3-Personal uses SAE, a different password-authentication exchange.
- SAE and PMF
- Simultaneous Authentication of Equals (SAE) is WPA3-Personal's password-based key establishment. Protected Management Frames (PMF) protect specified management traffic; WPA3 requires appropriate PMF support.
- VLAN and dynamic interface
- A VLAN is a Layer 2 broadcast domain. An AireOS dynamic interface maps a service to a wired VLAN; its IP address is not automatically the clients' default gateway.
- QoS and WMM
- Quality of Service (QoS) controls traffic treatment under contention. Wi-Fi Multimedia (WMM) defines wireless access categories. A priority label does not create radio capacity.
- DHCP and static addressing
- DHCP leases IP settings to clients. Static addressing is entered manually. This lab uses static client addresses and leaves DHCP Address Assignment Required disabled.
- GUI and configuration state
- A graphical user interface (GUI) presents configuration pages. Apply changes the active settings; Save Configuration preserves them for restart. Neither button is a connectivity test.
Read the WLAN as a set of independent decisions: which name is advertised, who may join, how frames are protected, where client traffic exits and how it is treated. Use the prepared rack only after every dependency is checked. Expected results below are predictions; authoring did not execute a controller.
See the idea
One SSID, four independent decisions
A matching password is only one part of a usable wireless service.
Name the service
The client selects QCS-LAB28; the controller uses profile QCS28 and ID8.
What this model leaves out: Configuration comparison, not a packet capture. The drawing does not prove client association, radio coverage, encryption strength or measured traffic performance.
Full visual explanation and references
Four records show the SSID identity, WPA2 security, VLAN20 exit and Silver QoS policy. Each must match the intended lab service.
Configuration comparison, not a packet capture. The drawing does not prove client association, radio coverage, encryption strength or measured traffic performance.
- Name the service
The client selects QCS-LAB28; the controller uses profile QCS28 and ID8.
www.cisco.com - Protect and map
Match WPA2-AES credentials, then check that lab20 carries the intended VLAN20 service.
www.cisco.comwww.cisco.com - Interpret policy
Silver controls treatment, not authentication. Verify client state and a real destination separately.
www.cisco.com
One idea at a time
Start with something familiar.
Begin with the SSID-to-VLAN worksheet before opening any settings page. The same SSID spelling can exist in different profiles or environments, so record the controller and numeric WLAN ID as well as the name.
Why learn this?
A common error is to weaken wireless security when the real fault is the wrong service VLAN. Separating authentication from forwarding makes the next test useful and avoids exposing unrelated clients.
An everyday comparison
A venue's public event name, internal booking reference and room number are separate labels. Matching the event name does not prove that a visitor has the right ticket or reached the right room.
What happens in a network
SSID resembles the public name, WLAN ID resembles the internal reference, and VLAN mapping resembles the assigned room. The credential check is separate from all three.
Where the comparison stopsA WLAN is not literally a ticket desk. Wireless key establishment and encryption have technical rules; a familiar analogy cannot show that authentication or data protection succeeded.
Follow one worked example
- Record identity before security.
Use profile QCS28, SSID QCS-LAB28 and WLAN ID 8, mapped to the prebuilt lab20 interface.
Why: Clear identity prevents editing a similarly named or unrelated wireless service.
- Make security choices while disabled.
Select WPA2-only AES with PSK, using a locally generated test passphrase and no Enterprise server.
Why: A disabled service can be checked before it is made available to the test client.
- Verify distinct checkpoints.
Record association/security details, the client address and a ping to the local router interface; then compare a wrong-key attempt.
Why: Different observations separate credential failure from a missing VLAN or wrong IP setting.
Your first small task
On paper, write QCS-LAB28, QCS28, 8 and VLAN 20 in four labeled columns. Add WPA2-Personal, AES and the statement 'credential stored privately', then identify which fields a client normally sees.
Show a hint
Do not treat the number 8 as the VLAN number. The lab intentionally uses different identifiers.
Check the expected result
The client normally selects the SSID and compatible security settings; the profile name, WLAN ID and wired VLAN remain controller-side identifiers.
Pause and explain it in your own words
Would switching from Silver to Platinum QoS repair an incorrect PSK?
Show a hint
Ask whether priority treatment checks the shared credential.
Show the explanation
No. QoS controls traffic treatment, not credential agreement. Correct the client profile to the authorized WPA2-PSK settings, then verify association and IP reachability without changing the priority policy.
Short answer
What should you understand today?
A WLAN needs a matching SSID, authentication method, encryption settings and wired VLAN mapping. Configure those fields deliberately, then test a client from association to its intended destination. A visible SSID, accepted GUI change or successful password entry does not prove the client has a usable IP path.
Before you begin
Learning targets
- Read Day 27's central-switching and AP/controller roles.
- The practical track requires the exact prepared, isolated rack below and permission to create only WLAN ID 8.
- Without that rack, complete the clearly labeled GUI worksheet; do not claim hands-on configuration.
- Use a dedicated test credential generated locally; never use an employer or personal account password.
- Map the visible SSID to WLAN ID, profile and VLAN.
- Compare WPA, WPA2 and WPA3 without enabling legacy security.
- Configure WPA2-PSK with AES in a supported controller GUI.
- Interpret QoS and advanced settings without assuming they repair authentication.
- Observe a single wrong-client-key fault and repeat the original reachability test.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
SSID, profile and WLAN ID
The SSID is the name clients select. An AireOS profile name identifies a controller configuration, and the WLAN ID is its numeric identifier. These three values can differ.
Authentication and encryption
Authentication checks the credential or identity allowed to join. Encryption protects data using keys. A successful password exchange does not establish correct addressing or application access.
PSK and Personal
A preshared key (PSK) is a shared credential for a Personal WLAN. Every holder can use that credential; it does not identify an individual employee.
Enterprise, 802.1X and RADIUS
Enterprise WLANs normally use 802.1X access control and an authentication service such as RADIUS. RADIUS carries authentication policy exchanges; this lab has no RADIUS server.
WPA, WPA2 and WPA3
Wi-Fi Protected Access names security generations. Legacy WPA commonly used TKIP; this lesson configures WPA2 with AES-CCMP. WPA3-Personal uses SAE, a different password-authentication exchange.
SAE and PMF
Simultaneous Authentication of Equals (SAE) is WPA3-Personal's password-based key establishment. Protected Management Frames (PMF) protect specified management traffic; WPA3 requires appropriate PMF support.
VLAN and dynamic interface
A VLAN is a Layer 2 broadcast domain. An AireOS dynamic interface maps a service to a wired VLAN; its IP address is not automatically the clients' default gateway.
QoS and WMM
Quality of Service (QoS) controls traffic treatment under contention. Wi-Fi Multimedia (WMM) defines wireless access categories. A priority label does not create radio capacity.
DHCP and static addressing
DHCP leases IP settings to clients. Static addressing is entered manually. This lab uses static client addresses and leaves DHCP Address Assignment Required disabled.
GUI and configuration state
A graphical user interface (GUI) presents configuration pages. Apply changes the active settings; Save Configuration preserves them for restart. Neither button is a connectivity test.
Give every GUI field a specific job
AireOS WLAN creation asks for a profile name, SSID and WLAN ID. The ID selects the configuration entry; it is not a VLAN assignment. An interface mapping associates centrally switched traffic with a wired service network. The management interface has a different purpose from a client dynamic interface. Keep a table of these relationships before enabling the WLAN, especially when several profiles have similar names.
- Do not infer the VLAN from the WLAN ID or SSID spelling.
- Check the complete profile-to-interface mapping before client testing.
Compare security generations without enabling a weak fallback
WPA, WPA2 and WPA3 describe different security capabilities. Legacy WPA/TKIP is comparison material, not the target configuration. WPA2-Personal with AES-CCMP uses a shared credential; WPA2-Enterprise uses an identity-authentication framework and normally RADIUS. WPA3-Personal uses SAE rather than the WPA2 PSK exchange and adds required management-frame protection. Device and release compatibility matters. A transition mode intentionally permits more than one security method and is not identical to WPA3-only operation.
- A shared key is not a unique user account.
- Do not enable WPA1 or TKIP as a shortcut for an unexplained join failure.
Follow creation, security and activation in order
Build the WLAN disabled so its identity, wired mapping and security can be inspected first. In AireOS, WLANs leads to the ID-specific edit page. General identifies the SSID, status and interface. Security > Layer 2 controls the policy and authentication key management. For this exercise select WPA+WPA2 as the menu family, enable only WPA2 with AES, choose PSK and enter the authorized ASCII passphrase. The family label does not mean WPA1 must also be enabled.
- Check WPA Policy is off and WPA2 Policy with AES is on.
- A hidden or set-only PSK field should not be interpreted as proof that a saved key is missing.
Read QoS and advanced settings as policy, not magic repairs
AireOS offers Platinum for voice, Gold for video, Silver for best effort and Bronze for background treatment. These are profiles, not promises of bandwidth or latency. WMM must be considered with client capabilities and the wireless design. Advanced settings such as session timeout, client exclusion, AAA override and DHCP-required behavior change specific admission or service rules. AAA override permits an authentication policy to replace certain configured choices; this PSK lab does not need it.
- A QoS selection cannot repair a mismatched credential or VLAN.
- Interpret a setting against this lab's requirements before copying it to another WLAN.
Use checkpoints to locate the failing stage
First confirm the intended SSID and negotiated security on the client, then its assigned or configured address, mask and gateway. Next test the local intended IP destination. If association fails after changing only the client password, investigate that profile before changing controller VLANs. If association works but IP communication fails, compare the service interface, wired VLAN, client IP settings and any filters. A cached address may remain visible after disconnect, so an IP display alone does not establish current association.
- Record actual timestamps and state rather than pasting predicted results.
- Test the same source and destination before the fault and after restoration.
Keep the exam mapping and platform boundary honest
The current v1.1 blueprint explicitly includes WLAN GUI interpretation, WPA-family descriptions and WPA2-PSK GUI configuration. This lesson provides those tasks on a specified prepared platform; completing the worksheet alone is conceptual practice. The announced v2.0 wireless-security principles are a partial mapping, while AP-facing wired connectivity is supporting context. AireOS is used to make one coherent GUI path; Catalyst 9800 uses profiles and tags and needs its own instructions.
- v1.1 remains current through 2 February 2027; v2.0 starts 3 February 2027.
- Controller setup, RF design and Enterprise authentication require separate practical work.
Real-world walkthrough
The correct password did not put the client in the correct VLAN
In a hypothetical training room, QCS-LAB28 is visible and a learner can associate, but the endpoint cannot reach Router1. The profile was accidentally mapped to management instead of lab20. The useful response is to compare the mapping and address plan, not enable open authentication or change every QoS setting.
- Identify WLAN ID 8 and compare its profile, SSID and interface with the worksheet before editing.
- Keep a screenshot of the relevant non-secret settings and record Client1's association and address state.
- Check whether the traffic is centrally switched and whether VLAN 20 reaches Router1 through the WLC service port.
- Restore only the lab20 interface selection while following the platform's disable/apply/enable procedure, then reconnect the test client.
- Repeat the same local reachability check and keep remaining symptoms separate from the corrected mapping.
Guided GNS3 lab
Prepared-rack WPA2-PSK GUI exercise
Create one isolated AireOS WLAN, verify a local client exchange, introduce a wrong credential only on the owned client, restore it and retest. The practical track requires the prepared dependencies; no runtime was executed during authoring.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| WLC1 | management VLAN10 | 192.0.2.2/24 | HTTPS administration and AP join |
| AP1 | management | 192.0.2.11/24 | Already joined; no external route |
| AdminPC | Ethernet0 | 192.0.2.10/24 | Local HTTPS management |
| WLC1 | lab20 VLAN20 | 198.51.100.2/24 | Prepared dynamic interface; gateway 198.51.100.1 |
| Router1 | Gi0/0 | 198.51.100.1/24 | Local test destination and client gateway |
| Client1 | Wi-Fi | 198.51.100.10/24 | Static address; gateway 198.51.100.1; no DNS needed |
Set up the lab
- Instructor must prebuild the exact ports/VLANs, management and lab20 interfaces, legal radio country/channel/power, AP join and Router1 responder before this task. No DHCP or RADIUS is provided.
- Confirm WLAN ID8, profile QCS28 and SSID QCS-LAB28 are unused, AP1 uses default-group, and this is a dedicated rack with no other clients. Stop if any prerequisite differs.
- AdminPC opens https://192.0.2.2 using the instructor-verified certificate and authorized account. Do not bypass an unexplained certificate identity warning.
- Set Client1's Wi-Fi IPv4 settings through Windows Settings to the address plan, recording previous settings privately. Instructor verifies a known-good test WLAN can reach Router1 first.
- Paper alternative: draw the named AireOS pages and fill every specified field. Label association, ping and fault results predicted; no hardware or RF claim is allowed.
Record the prepared baseline
On AdminPC's authenticated WLC GUI, inspect Controller > Interfaces for management and lab20 and Wireless > All APs for AP1. Record versions, addresses, AP group and Local mode. Stop if the instructor's baseline client cannot reach Router1.
- What you should see
- The required service interface and joined AP are present before a new WLAN is created.
- Why this step matters
- A new WLAN cannot compensate for a missing AP join, VLAN or prepared local destination.
Create an inactive service identity
In the same AdminPC browser, open WLANs, choose Create New and Go. Select WLAN, profile QCS28, SSID QCS-LAB28 and ID8, then Apply. On General keep Status disabled and select Interface lab20; keep SSID broadcast enabled.
- What you should see
- The controller has a distinct disabled WLAN mapped to VLAN20 through lab20.
- Why this step matters
- Identity and forwarding decisions are reviewed before making the service available to a client.
Configure WPA2 Personal securely
On WLAN ID8, open Security > Layer 2. Choose WPA+WPA2, Personal where shown, WPA2 Policy and AES/CCMP128. Clear WPA Policy, choose PSK authentication and ASCII format, and enter the private generated lab passphrase. Leave MAC filtering and iPSK off; Apply.
- What you should see
- The intended security is WPA2-PSK with AES, without WPA1, TKIP or Enterprise authentication.
- Why this step matters
- The menu family and enabled policy are distinct; reading both avoids accidentally enabling legacy compatibility.
Inspect traffic treatment and advanced options
Still on WLAN ID8, choose QoS, select Silver and WMM Allowed, and Apply. On Advanced leave AAA Override off, peer-to-peer blocking disabled and DHCP Address Assignment Required off. Record session timeout and exclusion defaults; do not alter global QoS profiles.
- What you should see
- The data WLAN uses best-effort policy and allows the specified static client addressing.
- Why this step matters
- This checks the advanced policy against an actual requirement rather than treating every checkbox as a performance improvement.
Enable and associate the test client
Review ID8 once more, enable Status on General and Apply. On Client1 select QCS-LAB28 in Windows Wi-Fi settings and enter the private correct passphrase. Confirm WPA2-Personal/AES and the expected AP association in the WLC client details.
- What you should see
- The expected result is successful association on the intended WLAN; record the actual state before proceeding.
- Why this step matters
- A visible SSID or Apply confirmation alone does not demonstrate that the client completed authentication.
Measure the local baseline
On Client1, open Start > Command Prompt before typing. Confirm this is the owned laptop, its only active data adapter is Wi-Fi, and the static settings match the plan. Record actual output without exposing the credential.
ipconfig /all
ping 198.51.100.1What each command means
ipconfig /all- Display Windows adapter addresses, mask, gateway and configuration details; inspect the Wi-Fi adapter rather than an unrelated virtual adapter.
ping 198.51.100.1- Send ICMP echo probes from Client1 to Router1's local VLAN20 address; replies support this exchange, not Internet or application health.
- What you should see
- Expect Wi-Fi 198.51.100.10/24, gateway 198.51.100.1 and replies if all prepared dependencies work.
- Why this step matters
- This adds forwarding evidence to the association evidence and establishes the exact test to repeat after the fault.
Introduce only a client credential fault
On Client1 forget only QCS-LAB28, then reconnect using a deliberately wrong lab passphrase. Do not modify the WLC or weaken its policy. Record the connection failure and controller client state; cached IP information is not proof of association.
- What you should see
- The expected result is failed secure connection; controller configuration and other prepared dependencies remain unchanged.
- Why this step matters
- A single client-side fault isolates credential agreement without exposing an open WLAN or disrupting another user's service.
Restore the authorized client profile
Forget the incorrect QCS-LAB28 profile and reconnect with the original correct private passphrase. Recheck the Wi-Fi static address and controller client details. If exclusion temporarily blocks retries, wait for the recorded timeout rather than changing global security settings.
- What you should see
- The client should regain the same authorized association and addressing; record any unexpected state.
- Why this step matters
- Restoring the exact profile preserves the original security design instead of hiding the symptom with a weaker policy.
Retest and close the temporary WLAN
On Client1 open Start > Command Prompt before typing and repeat the same destination. After recording the result, use AdminPC's GUI to disable and remove only WLAN ID8, then restore Client1's previous adapter settings and forget the test profile.
ipconfig /all
ping 198.51.100.1What each command means
ipconfig /all- Recheck the active Wi-Fi address and gateway after reconnecting; compare them with the baseline record.
ping 198.51.100.1- Repeat the original local ICMP test to Router1 so failure and recovery are compared on the same path.
- What you should see
- Recovery should match the baseline before cleanup. After WLAN removal, the test SSID is no longer offered by this rack.
- Why this step matters
- The retest closes the experiment; removal and credential disposal restore the isolated rack without preserving a temporary service.
Verify
- Compare ID8, QCS28, QCS-LAB28 and lab20 as separate values.
- Record WPA2-only AES and PSK selection without recording the key.
- Retain association, static addressing and Router1 ping observations separately.
- Compare baseline, wrong-key failure and restored same-target result; mark paper predictions explicitly.
- Confirm only the temporary WLAN and client profile were removed; instructor baseline remains unchanged.
Troubleshoot
- No SSID: check WLAN status, AP join, AP group and authorized radio state before changing security.
- Association succeeds but ping fails: inspect lab20 mapping, tagged VLAN20 carriage and Client1's mask/gateway; do not switch to open authentication.
- Wrong-key restoration still fails: remove only the stale test profile and inspect exclusion timing; do not disable exclusion or reset every WLAN.
- Different GUI or unsupported AP: stop the practical sequence and use the worksheet. Catalyst 9800 tags are not an AireOS interface dropdown.
GNS3 does not provide Cisco images. Use software only when the applicable license or entitlement permits that environment. Do not share or redistribute image files. Cisco Modeling Labs is the official alternative; its reference images are licensed for use within CML unless separately licensed. A paper exercise needs no image, but does not establish hands-on competence. Virtual routers do not reproduce physical radios, PoE delivery, hardware forwarding rates or failover timing.
- Remove only the temporary ID8 WLAN and QCS-LAB28 client profile after recording recovery.
- Restore Client1's prior address settings, dispose of the temporary credential, and save the instructor-approved cleaned configuration.
Practice set
Answer before you reveal
01Are WLAN ID8 and VLAN20 contradictory?
Different namespaces serve different purposes. The interface mapping connects them; there is no rule requiring their numbers to match.
02Why leave DHCP Address Assignment Required off here?
A policy requiring observed DHCP assignment conflicts with this lab's static-address design, even when authentication succeeds.
03Why does the WPA+WPA2 dropdown not require enabling WPA1?
The exercise explicitly enables WPA2 with AES and leaves WPA Policy off. The family label must not be mistaken for the final active policy.
04What makes WPA3-Personal different from WPA2-PSK?
Changing an SSID label or enabling a stronger-looking QoS profile does not change the authentication exchange or establish WPA3 compatibility.
05Why is Silver appropriate for this basic exercise?
QoS is separate from authentication and addressing. No congestion workload is measured, so the lesson cannot claim throughput or latency improvement.
06What does a retained address after failed authentication prove?
Static or cached settings can persist while association is absent. Correlate the adapter's connection state, controller record and actual destination test.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Treat SSID, WLAN ID, profile and VLAN as separate fields.
- Authenticate securely before interpreting a client IP test.
- Use WPA2-AES for this bounded lab; legacy security remains comparison material.
- Read QoS and advanced settings against the actual client requirements.
- Change only the client key for the controlled fault.
- Record hardware limitations and never equate a worksheet with radio execution.