📚 How it Works #
Identity PSK (iPSK) combines the simplicity of Pre-Shared Keys with the security and flexibility of identity-based authentication.
Instead of using a single shared PSK for all devices on a WLAN, each device (or group of devices) is assigned its own unique PSK, managed centrally by EntryPoint.
The iPSK authentication flow works as follows:
-
A device connects to the WLAN and submits its MAC address and entered PSK to the Wireless LAN Controller (WLC).
-
The WLC sends a RADIUS authentication request to EntryPoint, including:
-
The device’s MAC address
-
The SSID (to select the correct Context)
-
-
EntryPoint looks up the MAC address in its database:
-
If found, EntryPoint returns the associated group attributes, including the group’s assigned PSK.
-
If not found, and a Default PSK is configured, EntryPoint returns the default PSK.
-
-
The WLC performs PSK parsing:
-
It compares the key entered by the client against the PSK returned by EntryPoint.
-
-
If the keys match, the device is authenticated and allowed onto the network.
-
The WLC then proceeds with DHCP to assign the device an IP address. (if configured to do so)
🔒 Client Isolation Using Cisco iPSK Tags #
Cisco iPSK also supports dynamic client isolation based on group assignment:
-
Devices that authenticate using the same iPSK (and thus are part of the same group) can be configured to communicate with each other.
-
Devices with different iPSKs (different groups) can be isolated from one another even though they are on the same SSID.
This is controlled through iPSK Tags on the WLC, which are dynamically mapped by the WLC.
Benefits of iPSK-based client isolation:
-
Enhanced security without needing to segment users across multiple SSIDs.
-
Simplified network design, as only a single WLAN needs to be broadcast.
-
Granular control over device communication at the group level.