5.5VPN and wireless security

A VPN lets you use an untrusted public network like the internet as safely as a leased line, and for wireless LANs—where anyone within radio range can receive the signal—encryption is the lifeline. This section builds the ability to judge "which scheme for which requirement" by understanding the two forms of VPN (connecting a teleworker into the office versus joining whole sites together), the role of IPsec, and the generational differences among wireless encryption standards (WPA to WPA2 to WPA3).

5.5.1VPN forms and IPsec

• A remote-access VPN securely connects individual devices—teleworkers, travelers—into the corporate network over a public network. The device uses a VPN client (or browser SSL/TLS), authenticates per user, and establishes a tunnel. The use case is "a person entering the office from outside."
• A site-to-site VPN permanently connects entire networks at different sites—such as headquarters and a branch—via a tunnel between the routers/firewalls (VPN gateways) at each end. No per-device configuration is needed; the gateways handle encryption on behalf of the hosts. The use case is "joining network to network."
• IPsec is a suite of protocols providing confidentiality (encryption), integrity (tamper detection), authentication (source legitimacy), and anti-replay at the IP layer. It comprises ESP (which encrypts data), IKE (which performs key exchange), and more, and in tunnel mode encapsulates the entire original IP packet to join sites. It is the core technology of site-to-site VPNs and is also used for remote access.

5.5.2Wireless encryption standards (WPA/WPA2/WPA3)

• WPA (first generation) arrived as the successor to weak WEP, using TKIP encryption as a transitional standard. WPA2, based on IEEE 802.11i, mandates strong AES (CCMP) and has been the long-standing standard. WPA3 is the latest generation, adopting SAE (Simultaneous Authentication of Equals) for personal key exchange, making it resistant to offline dictionary attacks and providing forward secrecy.
• In WPA3, PMF (Protected Management Frames) is mandatory, preventing attacks that forge management frames such as deauthentication (deauth). SAE replaces WPA2-Personal's pre-shared key (PSK) and four-way handshake; its essential advance is that even with a weak passphrase, it makes offline brute-forcing from captured traffic difficult.
• Each generation has two modes: Personal (a pre-shared key via PSK/SAE, for homes and small deployments) and Enterprise (per-user authentication via 802.1X plus RADIUS, for organizations). Enterprise integrates with the AAA (RADIUS) of Section 2, managing authentication and revocation per user.

5.5.3WPA2 PSK GUI configuration (WLC)

• The baseline procedure is to create a WLAN (SSID) in the wireless LAN controller's (WLC) GUI, choose WPA2 (AES) for security and PSK (pre-shared key) for authentication, and enter the pre-shared key (passphrase). Being Personal (PSK), no external authentication server is needed, but the key should be long and complex, and note that a leak requires changing it on every device.
• When an organization wants to "manage authentication and revocation per user" or "avoid the leak risk of a shared key," choose Enterprise (802.1X plus RADIUS) instead of PSK. In the GUI you register the AAA server (RADIUS) and specify 802.1X in the WLAN's security. The judgment is PSK for "small scale, simplicity first" and Enterprise for "organization, per-user management."

Suppose you are a corporate network designer tackling two independent requirements. Requirement A: "Permanently and securely connect the LANs of headquarters and a new branch over the internet without laying a leased line, so that all devices at both sites can communicate with each other." Requirement B: "Refresh the headquarters wireless LAN and connect the many devices employees carry using the most secure method." For Requirement A, since what is being joined is not "individual devices" but "entire site networks" and permanent connection is needed, a site-to-site VPN—not a remote-access VPN—is appropriate. Making each site's router/firewall a VPN gateway and encrypting between sites with IPsec tunnel mode lets all devices intercommunicate without per-device configuration, while ensuring confidentiality, integrity, and source authentication. For Requirement B, the generation of wireless encryption is the key. WPA2 with mandatory AES is already strong, but the latest WPA3—resistant to offline dictionary attacks via SAE even with a weak passphrase, and blocking management-frame forgery via mandatory PMF—best matches the "most secure" requirement. If per-employee authentication and revocation are also required, choose Enterprise (802.1X plus RADIUS) rather than Personal (PSK/SAE), integrating with the AAA of Section 2. The crux of the judgment is the mapping from requirement to scheme: choose the VPN by "a person entering = remote access / joining networks = site-to-site," and choose wireless by "latest, dictionary-attack-resistant, management-frame-protected = WPA3" and "per-user management needed = Enterprise."

5.5.4Section summary

• A remote-access VPN connects individual devices into the office; a site-to-site VPN joins site networks gateway-to-gateway. IPsec provides confidentiality/integrity/authentication at the IP layer (ESP, tunnel mode)
• WPA2 mandates AES; WPA3 adds SAE for dictionary-attack resistance plus mandatory PMF. Choose the wireless generation and Personal/Enterprise by requirement
• WPA2 PSK GUI configuration is create WLAN → WPA2/AES plus PSK → enter the pre-shared key. If per-user authentication/revocation is needed, use Enterprise (802.1X plus RADIUS)