In which configuration mode is security wpa2 psk set-key ascii [psk] used?

The security wpa2 psk set-key ascii [psk] command is entered in WLAN Config mode on Cisco IOS devices.

WirelessWLAN Config

security wpa2 psk set-key ascii [psk]

Configures the pre-shared key (PSK) for WPA2 personal authentication on a WLAN, used to set the passphrase that clients must provide to associate securely.

Definition: security wpa2 psk set-key ascii [psk] is a Cisco IOS wlan config command. Configures the pre-shared key (PSK) for WPA2 personal authentication on a WLAN, used to set the passphrase that clients must provide to associate securely.

Overview

The `security wpa2 psk set-key ascii [psk]` command is used in Cisco WLAN configuration mode to set the pre-shared key (PSK) for WPA2-Personal (WPA2-PSK) authentication on a wireless LAN (WLAN). This command defines the passphrase that wireless clients must provide to associate with the WLAN securely. WPA2-PSK is a common security mode for small to medium-sized networks where a RADIUS server is not available, relying on a shared secret between the access point and clients.

The command is entered after creating a WLAN and configuring its SSID and security parameters. It is an alternative to using WPA2-Enterprise (802.1X) or WPA3, and is chosen when simplicity and ease of deployment are priorities. The PSK must be between 8 and 63 ASCII characters, and the command immediately updates the running configuration.

The key is stored in a hashed format in the configuration, but the plaintext passphrase is not displayed in show commands for security reasons. This command is typically used in conjunction with other security commands like `security wpa akm psk` and `security wpa2 enable`. It is important to note that the PSK is case-sensitive and must match exactly on all clients.

The command is available in IOS 15.x and later, and in IOS-XE. The privilege level required is 15 (privileged EXEC) to enter WLAN config mode. The command does not affect other WLANs; each WLAN has its own PSK.

When troubleshooting, ensure the PSK is correctly set and that clients are using the same passphrase. The command is part of the broader wireless configuration workflow that includes creating the WLAN, setting the SSID, enabling security, and applying the WLAN to an interface or radio policy.

Syntax·WLAN Config

security wpa2 psk set-key ascii [psk]

When to Use This Command

Setting a new WPA2 passphrase for a guest WLAN to ensure only authorized users can connect.
Updating the PSK on an existing WLAN after a security breach or periodic rotation.
Configuring a unique PSK for a management WLAN to separate administrative traffic from user traffic.
Replacing an old PSK with a stronger, longer passphrase to improve wireless security.

Parameters

Parameter	Syntax	Required	Description
psk	ASCII string (8-63 characters)	Required	The pre-shared key passphrase used for WPA2-PSK authentication. Must be between 8 and 63 ASCII characters. Common mistakes include using fewer than 8 characters, using special characters that may be interpreted by the CLI (e.g., spaces, quotes), or using a weak passphrase that is easily guessable. The passphrase is case-sensitive.

Command Examples

Setting a WPA2 PSK for a WLAN

security wpa2 psk set-key ascii MySecurePass123

WPA2 PSK configured successfully.

The command sets the PSK to 'MySecurePass123' for the current WLAN. The output confirms the key was accepted.

Verifying the PSK configuration

show wlan security wpa2 psk

WLAN ID: 1
WLAN Name: Corporate
PSK: <hidden>
Key Management: WPA2-PSK

The output shows the WLAN ID, name, that the PSK is hidden for security, and the key management type. Use this to confirm the PSK is set.

Understanding the Output

The command 'security wpa2 psk set-key ascii [psk]' does not produce verbose output; it simply confirms success or failure. To verify the PSK configuration, use 'show wlan security wpa2 psk'. In the show command output, the 'PSK' field is always hidden (shown as '<hidden>') for security reasons.

The 'Key Management' field should display 'WPA2-PSK' to confirm WPA2 personal mode is active. If the PSK is not set, the 'PSK' field may be absent or show 'not configured'. Always ensure the PSK is at least 8 characters and avoid common words to prevent brute-force attacks.

Configuration Scenarios

Configure WPA2-PSK on a new WLAN for a small office

A small office needs a secure wireless network for employees. No RADIUS server is available, so WPA2-PSK is chosen. The SSID is 'OfficeNet' and the passphrase is 'SecurePass123'.

Topology

AP (WLAN) --- Wireless Clients

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Create a WLAN with ID 1 and name 'OfficeNet': wlan 1 OfficeNet
3.Step 3: Set the SSID: ssid OfficeNet
4.Step 4: Enable WPA2 security: security wpa2 enable
5.Step 5: Set the authentication key management to PSK: security wpa akm psk
6.Step 6: Set the PSK passphrase: security wpa2 psk set-key ascii SecurePass123
7.Step 7: Exit WLAN configuration: end

Configuration

! Full IOS config block
configure terminal
wlan 1 OfficeNet
 ssid OfficeNet
 security wpa2 enable
 security wpa akm psk
 security wpa2 psk set-key ascii SecurePass123
 end

Verify: Use 'show wlan 1' to verify the security settings. Look for 'Security: WPA2' and 'AKM: PSK'. The PSK is not displayed in plaintext; instead, a hash is shown. Expected output includes 'WPA2 PSK Key: [hashed value]'.

Watch out: Ensure the passphrase is exactly 8-63 characters. A common mistake is to use a passphrase that is too short or contains spaces. Also, the command 'security wpa akm psk' must be entered before setting the PSK; otherwise, the PSK command may be rejected.

Change the PSK on an existing WLAN for security rotation

An existing WLAN 'GuestNet' needs its PSK changed periodically for security. The current PSK is 'OldPass123' and the new one is 'NewPass456'.

Topology

AP (WLAN) --- Wireless Clients

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Enter the existing WLAN configuration: wlan 2 GuestNet
3.Step 3: Change the PSK: security wpa2 psk set-key ascii NewPass456
4.Step 4: Exit WLAN configuration: end

Configuration

! Full IOS config block
configure terminal
wlan 2 GuestNet
 security wpa2 psk set-key ascii NewPass456
 end

Verify: Use 'show wlan 2' to confirm the PSK hash has changed. Also, check that clients can no longer connect with the old passphrase. Use 'debug wlan dot11' to see authentication failures.

Watch out: Changing the PSK will disconnect all currently connected clients. They must re-associate with the new passphrase. Ensure the new passphrase is communicated to users before the change.

Troubleshooting with This Command

When troubleshooting WPA2-PSK connectivity issues, the `security wpa2 psk set-key ascii` command is not directly used for diagnostics, but verifying the PSK configuration is a critical step. Healthy output from `show wlan [id]` will display 'WPA2 PSK Key: [hashed value]' and 'AKM: PSK'. If the PSK is missing or incorrect, clients will fail authentication.

Common symptoms include clients repeatedly asking for the passphrase, authentication timeouts, or association failures. To diagnose, first check the WLAN configuration with `show wlan [id]` and ensure the PSK is set. If the PSK appears as 'none' or is not shown, re-enter the command.

Next, verify that the passphrase on the client matches exactly, including case and special characters. Use `debug wlan dot11` to see authentication messages; look for 'WPA2-PSK authentication failed' or 'key mismatch'. Also, check that the WLAN is enabled and mapped to an interface.

Correlate with `show wlan summary` to see the WLAN status. If clients are still failing, consider using `show dot11 associations` to see if clients are associating but not authenticating. Another useful command is `show wlan stats [id]` to see authentication failure counters.

If the PSK is correct but clients still fail, check for interference or signal issues. Remember that the PSK is case-sensitive and must be between 8 and 63 characters. If the passphrase contains special characters like $ or !, ensure the CLI does not interpret them; use quotes if necessary.

In some IOS versions, the command may require the passphrase to be enclosed in quotes if it contains spaces. Also, note that the PSK is stored as a hash; if you copy the configuration to another device, the hash is preserved, but the plaintext passphrase is not recoverable. Therefore, always document the passphrase separately.

CCNA Exam Tips

CCNA exam tip: The PSK is always hidden in show commands; you cannot retrieve it, only set or overwrite it.

CCNA exam tip: The PSK must be between 8 and 63 ASCII characters; the exam may test this range.

CCNA exam tip: WPA2-PSK uses AES encryption; the exam may ask about encryption types.

CCNA exam tip: To remove the PSK, use 'no security wpa2 psk set-key'.

Common Mistakes

Mistake 1: Using a PSK shorter than 8 characters — the command will be rejected.

Mistake 2: Forgetting to apply the WLAN after setting the PSK — the configuration may not take effect until the WLAN is enabled or reapplied.

Mistake 3: Confusing WPA2-PSK with WPA2-Enterprise — the command only applies to personal mode; for enterprise, use RADIUS configuration.

security wpa2 psk set-key ascii [psk] vs ap dot11 24ghz [setting]

Both commands influence wireless network behavior but operate at different layers: one defines authentication credentials (WPA2 PSK) for a WLAN, while the other controls physical radio parameters (channel, power) for an AP. They are commonly confused because both appear under wireless configuration and involve setting parameters that affect client connectivity.

Aspect	security wpa2 psk set-key ascii [psk]	ap dot11 24ghz [setting]
Scope	A specific WLAN (service set)	A specific AP radio (2.4 GHz interface)
Configuration Mode	WLAN configuration sub-mode (config-wlan)	Global configuration mode (config)
Persistence	Persists in running config and startup config	Persists in running config and startup config
Typical Use	Setting the passphrase clients must use to join	Enabling/disabling the radio or setting channel/power
Precedence	Overrides any previous key for that WLAN	Overrides any previous 2.4 GHz settings for that AP

Use security wpa2 psk set-key ascii [psk] when you need to define or change the WPA2 Pre-Shared Key for a specific WLAN to allow clients to authenticate.

Use ap dot11 24ghz [setting] when you need to configure 2.4 GHz radio parameters such as enabling the radio, setting the channel, or adjusting transmit power on a specific access point.

Platform Notes

In IOS-XE (e.g., Catalyst 9800, 9300), the command syntax is identical: `security wpa2 psk set-key ascii [psk]` under WLAN config mode. However, on newer IOS-XE versions (16.x and later), the command may be replaced by `security wpa2 psk set-key ascii [psk]` or `security wpa2 psk [psk]` depending on the feature set. On NX-OS (e.g., Catalyst 3850 in switch mode), wireless configuration is not native; NX-OS does not support WLAN config mode.

For Cisco AireOS (standalone APs), the command is `config wlan security wpa akm psk set-key [psk]` in the CLI. For IOS-XR, wireless is not supported. On ASA, there is no equivalent; ASAs do not manage WLANs.

In older IOS versions (12.x), the command might be `security wpa-psk ascii [psk]` under interface dot11radio. Always check the specific platform documentation. The output of `show wlan` may vary; on IOS-XE, the PSK hash is shown as 'WPA2 PSK Key: [hex]'.

On AireOS, the command `show wlan [id]` displays 'WPA2 PSK: [hex]'. For consistency, always use the latest IOS-XE syntax for CCNA/CCNP studies.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions