Just in case you missed it cnMaestro Version 2.2.1 (Cloud and On-Premise), brings us a great new feature called ePSK. If you’re not familiar with ePSK it’s maybe because Cambium are too modest to toot their own trumpet so I’m going to do it for them.
In short ePSK gives each user a unique PSK (pre-shared key) when using WPA2-Personal, for me to explain why this is such a useful feature let me first explain the problem with using a shared PSK across the whole WLAN.
When a wireless client connects to an AP it completes a 4-Way handshake, this generates the encryption keys used to encrypt wireless traffic. For the 4-way handshake to work it is a requirement that both the client and AP know the passphrase, however the passphrase is never transmitted over the air thereby making this exchange reasonably secure.
But what happens when a 3rd party already knows the passphrase? It means they just need to capture the 4-way handshake to generate the encryption keys and decrypt your wireless traffic.
Have you ever been to a coffee shop, restaurant or hotel where everyone shares the same PSK for a guest network? Because the PSK is publicly shared your traffic can potentially by captured and decrypted.
ePSK gives each user a unique PSK, this means that no-one else knows your passphrase making the whole process much more secure.
Below is a screenshot from Wireshark, on the left ePSK is used so I couldn’t decrypt the traffic as I did not know the PSK and on the right I have been able to decrypt the traffic as a shared PSK was used:
If you’re ever deploying guest Wi-Fi and want to secure communications, ePSK is a great way to do it. But this can also be applied to other environments as well, for example in a small business without the skillset to operate a RADIUS Server they could utilise ePSK quite easily, giving them a more secure option than standard WPA2-PSK.
Using ePSK in cnMaestro is easy to do and mostly self-explanatory. It can be found under WLANS > “WLAN name” > ePSK
One nice feature is the ability to generate bulk PSKs which can be exported and distributed out to users as needed.
Another useful feature is the ability to assign different PSKs to different VLANs. For example, if your issuing a PSK to someone in the Finance Department they might be on VLAN20 but if your issuing a PSK to someone in the Sales Department they might be on VLAN30, all from one SSID.
Admittedly Cambium aren’t the first to introduce to introduce multiple PSKs, Ruckus and Aerohive have released similar features but in my experience their solutions are at a higher cost.
So credit where credit is due, this is a great feature that’s clearly been well thought out. Well done Cambium.
