WPA2, WPA3, and WLAN Security Basics

Security is part of every SSID design

Creating an SSID without a security plan is how guest networks become attack pivots and staff credentials leak over the air. HCIA-Datacom expects you to compare open, WPA2, and WPA3 modes at a practical level: who holds the key material, whether a RADIUS server is required, and what SAE improves for password-based networks.

Wireless security has two user-facing jobs:

1. Authentication — prove the client (or user) is allowed on this SSID.
2. Encryption / integrity — stop casual eavesdropping and forgery on the shared RF medium.

Older WEP fails both jobs by modern standards and appears mainly as “do not use” history. WPA (original) is legacy. Production campus thinking for the exam centers on WPA2 and WPA3.

Open networks and why they still appear

An open SSID allows association without a passphrase. Traffic may be unencrypted (or only lightly protected depending on extensions), so anyone in radio range can join and often sniff. Campuses still use open SSIDs for captive-portal guests (associate open, then web login) or for special IoT cases—but exam judgment is clear: open is not appropriate for confidential staff data.

WPA2-Personal (PSK)

WPA2-PSK uses a pre-shared key (passphrase) known to the AP/AC profile and to every authorized user. After association machinery, the 4-way handshake derives session keys for unicast traffic.

Strengths:

• Simple to deploy; no RADIUS required.
• Fine for small sites, IoT SSIDs with controlled passphrases, or home-lab HCIA practice.

Weaknesses (exam talking points):

• One passphrase for many users — hard to revoke a single person without changing the key for everyone.
• Offline dictionary risk against captured handshakes if the passphrase is weak (motivation for WPA3 SAE).
• Password sharing culture defeats access control.

Configuration concept on Huawei WLAN profiles: bind the SSID’s security profile to WPA2-PSK and set the PSK string; map users to a service VLAN after success.

WPA2-Enterprise (802.1X)

WPA2-Enterprise replaces the shared passphrase with IEEE 802.1X. Each user (or device certificate) authenticates via EAP methods to a RADIUS server. The AP/AC acts as authenticator; RADIUS is the authentication server; the client is the supplicant.

Flow (simplified):

1. Client associates to the enterprise SSID.
2. 802.1X/EAP exchange occurs; AP/AC relays to RADIUS.
3. On success, RADIUS may also return authorization attributes (VLAN, ACL filters—platform dependent).
4. Key hierarchy establishes per-session encryption keys; user traffic is encrypted on air.

Why enterprises prefer it:

• Per-user accounts and central revoke (disable AD/RADIUS user).
• Stronger operational audit trail.
• Can assign dynamic VLANs by group (staff vs contractors) when designed.

Exam trap: Enterprise mode is not “just a longer PSK.” If the question mentions RADIUS or 802.1X, you are in enterprise territory, not personal PSK.

WPA3 and SAE

WPA3 is the modern successor family. For HCIA, the headline personal-mode upgrade is SAE — Simultaneous Authentication of Equals.

Exam phrasing you should recognize: WPA3 introduces SAE for password-based authentication, improving resistance to offline dictionary attacks compared with classic WPA2-PSK handshake capture attacks.

Transition note: mixed WPA2/WPA3 networks exist during migration; clients and AP capabilities must match. Exact transition modes are product features—know that capability mismatch is a real association failure cause.

Where encryption is terminated (again, on purpose)

Revisit this because security questions blend with CAPWAP questions:

• Client ↔ AP (air): WPA2/WPA3 encrypts user 802.11 data frames. An attacker on the same SSID still should not read others’ unicast payloads when robust security is correctly implemented; open SSIDs are different.
• AP ↔ AC (wire, CAPWAP control): DTLS protects management. This is not a substitute for client air encryption.
• After wireless decryption: In local forwarding, clear (or otherwise processed) frames enter the wired VLAN subject to campus security (private VLANs, ACLs, DHCP snooping). In centralized mode, frames travel in the CAPWAP data tunnel to the AC before wired handoff.

So “where is encryption terminated?” depends on which encryption:

• Ask about WPA2/WPA3 → think wireless hop / AP.
• Ask about CAPWAP control confidentiality → think DTLS AP–AC.

Additional campus security controls (awareness level)

HCIA does not turn you into a wireless pentester, but these terms appear in designs and distractors:

None of these replace strong WPA2-Enterprise or WPA3 for staff networks.

Staff vs guest security patterns

A realistic two-SSID design:

Both SSIDs can live on the same Fit APs as different VAPs. Forwarding mode might tunnel guests centrally for scrubbing while staff use local forwarding—architecture and security policies interact.

Common failure modes (security lens)

• Wrong PSK on client → association or 4-way handshake failure.
• RADIUS unreachable → enterprise SSID associates partially then fails auth; users blame “Wi-Fi” when AAA is down.
• Certificate trust issues on EAP-TLS → client rejects server cert.
• VLAN assignment mismatch after auth → client online at L2 but wrong subnet/DHCP.
• Legacy client cannot do WPA3 → needs transition mode or separate SSID.

Exam traps for this section

• Claiming WEP is still recommended.
• Saying WPA3 SAE is only for enterprise RADIUS (SAE is the personal password upgrade; enterprise uses 802.1X).
• Confusing PSK shared key with per-user 802.1X.
• Stating DTLS makes open SSIDs safe for staff data.
• Treating hidden SSID as strong authentication.

Transition

Security profiles and SSIDs are configuration objects on the AC. The final section of this chapter turns the architecture into basic WLAN configuration concepts: profiles, AP join prerequisites, VAP bindings, VLANs, and verification habits on Huawei campus WLAN solutions.