Hello and welcome this video titled WPA Transition Mode.
So in this video we're going to be talking about what happens when you
want to offer a wireless LAN and SSID and you might have some clients
that only support WPA2 and other newer clients that support WPA3.
What do you do in that situation?
And that's actually what we're going to talk about right here.
So we already know that WPA3 has a lot of things built into it that make
it inherently stronger, more secure than WPA2.
It's got the protected management frames.
It has the ability to turn on beacon protection if you want.
It has the stronger security suites.
Certainly in the personal mode, the simultaneous authentication of equals
is a lot stronger and deriving per client PMKs than WPA2 that has a single
P.A. PMK for every client.
And I could go on and on and on.
However, not all clients support WPA3.
Certainly things that, for example, older smartphones and tablets, Internet
of Things Devices and this open source automation project called Home
Automation or Home Assistant doesn't support WPA3.
And those are just some examples.
So how do we offer an SSID that services everybody that everybody can
connect to? And this is what WPA transition mode is all about.
So in a nutshell, when you select WPA transition mode, really what you're
doing is you're just offering in your beacons an SSID that's advertising
that it can do both, WPA2 and WPA3 personal.
So the rule state that if a Wi-Fi client is capable of connecting via
WPA3 SAE, they should.
Only clients that don't understand WPA3 should connect via the older legacy
WPA2. Now, when it comes to protected management frames, we know that
that is an option.
We're going to see that here once again, when you're configuring, you're
editing your wireless LAN, especially in like the Catalyst 9800 controller,
there's a box in there for protected management frames and you can set
it to disabled, required or optional.
Those are your three options.
So in this particular case, because you might have some WPA2 clients that
might not recognize PMF because PMF wasn't mandatory until W3, WPA3 came
out, you really need to set it to optional.
Because if you set it to required, then those clients might not be able
to connect. Now, you might be thinking, well, wait a second, if I set
it to optional, then how are my WPA3 clients going to be able to connect?
Well, WPA3 requires protective management frames.
And so if you remember my video where I introduced the concept of PMF,
I showed you a screenshot of a beacon, a sniffer trace of a beacon.
And we saw in there that there were two bits for flags.
One of those bits said, protective management frames are capable.
In other words, I, the access point, I can do it if you want to.
And then there was another flag that if it was set to one said, you have
to use protected management frames.
So in this particular case, if we set it to optional, the beacon will
say it's capable.
It won't say it's required.
It will say it's capable.
And when the WPA3 clients see that, they are required to use protected
management frames.
So here's how you create a transition mode wireless LAN.
So up there in the security section, you select WPA2 plus WPA3, or however
it looks in your web UI for your particular product.
And then you would have AES CCMP 128 selected, because for the personal
mode of WPA2, that's all it supports.
It only supports AES CCMP.
And then under your authentication key management, you will select both
pre shared key, which the WPA2 clients will need and SAE for the WPA3
clients. And then it's kind of cut off here on the bottom, but you're
still going to have to type in your passphrase for the wireless LAN.
The both types of WPA clients will use to connect.
And so you can see right here, here's part of the beacon.
And this is in the robust security network information element.
And you can see now that under authentication key management, it's saying,
I actually support two different kinds of managing keys.
You can connect to me with pre shared key, or you can connect to me with
simultaneous authentication of equals.
So this is our verification that the access point is supporting a transition
mode wireless LAN.
All right. Now you probably know that GCMP 128 is much stronger of an
encryption algorithm than AES CCMP.
So the question might be, well, can I use both?
Can I maybe have my WPA2 clients use the AES and my WPA3 clients use GCMP
128 in a transition mode wireless LAN?
The answer is no, you cannot.
Remember, WPA2 clients only understand CCMP.
WPA3 clients can use GCMP 128.
But the only way that's going to work is when the wireless LAN is set
to WPA3 only, not transition mode.
So here's actually what you will see.
So here we've got our transition mode wireless LAN.
And we've tried it.
We tried clicking both of these boxes right here.
And the moment you do, you get this error message here in red.
And notice I've got SAE and PSK selected.
So in short, the only way you could get GCMP to work is if you're using
802.1x. So basically, if you unselect SAE and PSK, so let's say you say,
I'm going to do this.
I am going to go over here and I'm going to deselect this so that only
GCMP 128 is usable.
So can I do that in a transition mode wireless LAN?
Well, you can. But the only way to get that to work is if you deselected
SAE, deselected pre-shared key, and instead used sweet B1x.
And notice the 1x in there?
That should key you off to that is 802.1x.
So this is now basically turning it into an enterprise wireless LAN, not
a personal wireless LAN.
So the short end of it is that if you want to do WPA2 personal and WPA3
personal, otherwise known as SAE, then you can't do GCMP.
You can only stick with AES CCMP 128.
That's the only one that will work.
All right. Now, you might also notice that there in some platforms like
the 9800, there is a checkbox called transition disable.
And you might be wondering, what happens if I click that?
Okay. Well, if you click that, it's going to set a flag called the transition
disable flag in the beacon.
And this is actually kind of interesting how this works.
What that means is that if a wireless LAN connects to this SSID via WPA3,
guess what? It will see that flag.
It will cache that status.
It will say, Oh, I know that this particular SSID, this this wireless
LAN, I am not allowed to fall back to WPA2.
Once I connect via WPA3, I always have to connect to WPA3.
Not only on this access point, but any access point that's advertising
this SSID. And so that's what it means.
It means once you connect via WPA3, you can never fall back to WPA2.
So if you know in advance that all of your access points support both
WPA2 and WPA3, this is a good idea.
Now, for example, you know, what if you had one or two access points out
there, they were advertising this exact same SSID.
But on those access points, maybe their autonomous access points, you
know, standalone or something, those access points, they're advertising
it as WPA2 only, you know, maybe they're older, they don't support WPA3,
but you want to give people in that remote corner of the building access
to the wireless LAN.
So on those access points, you say, okay, I'll advertise the same SSID,
but as WPA2. Well, if on your newer access points that support both, you
had the transition disable flag set, that might be problematic.
Because, you know, John who's on the first floor of the building, you
know, he might connect via WPA3.
And now he's locked into that because that transition disable flag.
Now, John roams throughout the building, and eventually roams over to
that corner where those other access points are, he'll say, well, I want
a Rome right there, but I can't because the beacons I'm seeing don't have
the transition disable flag, they're only offering WPA2.
And I've already been told via previous access points, I can't connect
via WPA2. So John would not be able to roam to those access points.
So that's why you only want to check this box if you know that all of
your APs support both WPA2 and WPA3.
And this is what that looks like.
So this is the box right here for the transition disable.
So just a few other caveats about this.
So this is a somewhat new implementation.
So this is this is implemented after 2018 and WPA3.
As far as Cisco's concerned and their 9800 wireless LAN controllers, they
added this around 17 5 17 dot six.
And as far as the access points propagate that bit called the transition
disable bit in their beacon.
So if you have an older access point like one of these right here, it
won't support it.
So this will be yet another example of where you configure something in
the wireless LAN controller, it doesn't give you an error message.
And yet it's not working correctly on the access point.
Similar to my beacon protection presentation and beacon protection, that
was the same type of thing where you could select the beacon protection
checkbox in the wireless LAN controller.
But the older access points, like the ones here in this list, if you actually
caught their beacons, you would see there was no mic in there.
They weren't being protected because they didn't support that in hardware.
Same thing is true right here.
Now there are some risks though with transition mode, you need to be aware
of this. So remember, there's a reason why we want our WPA three clients
to be operating in WPA three mode, because it's safer, it's more secure,
it's virtually impossible.
If all of your clients were operating in WPA three mode, it's going to
be next to impossible for some outside malicious actor to figure out just
from sniffing the traffic, what the pairwise master key is on any of those
clients, or even what the WPA three passphrases to get on the wireless
LAN in the first place.
Just by capturing frames, they're not going to be able to reverse engineer
that. But with WPA two, especially if your passphrase is fairly simple,
it is possible to reverse engineer that there are well known documented
attacks against WPA two clients that can do just that.
So if you're in transition mode, there is a possibility of a downgrade
attack, where a malicious actor might spoof beacons attempting to influence
WPA three clients to disassociate, deauthenticate, and then reauthenticate
and associate using WPA two mode only.
And now they might be able to guess the passphrase once they do that.
And also, because you've got some mixed devices in there, those devices
operating in WPA two modes still have the same vulnerability, still have
the same like it says transition, we're transitioning everything.
Hopefully within a few months, all of our clients will support WPA three,
and then we'll be able to uncheck WPA two and have everything do WPA three.
So that concludes this video on WPA transition mode wireless LANs.
Thank you for watching.