l
AES
—The Advanced Encryption Standard (AES) encryption algorithm is a widely supported encryption type
for all wireless networks that contain any confidential data. AES in Wi-Fi leverages 802.1X or PSKs to
generate per-station keys for all devices. AES provides a high level of security like IP Security (IPsec) clients.
WEP and TKIP are limited to WLAN connection speed of 54 Mbps. The 802.11n connection supports only AES
encryption. Aruba recommends AES encryption. Ensure that all devices that do not support AES are upgraded
or replaced with the devices that support AES encryption.
WPA and WPA-2
WPA is created based on the draft of 802.11i, which allowed users to create more secure WLANs. WPA-2
encompasses the full implementation of the 802.11i standard. WPA-2 is a superset that encompasses the full
WPA feature set.
The following table summarizes the differences between the two certifications:
Certification
Authentication
Encryption
WPA
l
PSK
l
IEEE 802.1X with
Extensible
Authentication
Protocol (EAP)
TKIP with message integrity check (MIC)
WPA-2
l
PSK
l
IEEE 802.1X with
EAP
AES—Counter Mode with Cipher Block Chaining
Message Authentication Code (AESCCMP)
Table 37:
WPA and WPA-2 Features
WPA and WPA-2 can be further classified as follows:
l
Personal
—Personal is also called Pre-Shared Key (PSK). In this type, a unique key is shared with each client
in the network. Users have to use this key to securely log in to the network. The key remains the same until
it is changed by authorized personnel. You can also configure key change intervals .
l
Enterprise
—Enterprise is more secure than WPA Personal. In this type, every client automatically receives a
unique encryption key after securely logging in to the network. This key is automatically updated at regular
intervals. WPA uses TKIP and WPA-2 uses the AES algorithm.
Recommended Authentication and Encryption Combinations
The following table summarizes the recommendations for authentication and encryption combinations for the
Wi-Fi networks.
Network Type
Authentication
Encryption
Employee
802.1X
AES
Guest Network
Captive portal
None
Voice Network or
Handheld devices
802.1X or PSK as supported
by the device
AES if possible, TKIP or WEP if
necessary (combine with security
settings assigned for a user role).
Table 38:
Recommended Authentication and Encryption Combinations
Aruba Instant 6.5.0.0-4.3.0.0 | User Guide
Authentication and User Management |
165
