iPSK Authentication Flow – Step-by-Step

1. Device connects to WLAN #

The device attempts to join using a pre-configured SSID and PSK.
The WLC passively captures:
- The device’s MAC address
- The PSK entered by the device

2. WLC sends a RADIUS authentication request to EntryPoint #

Includes:
- MAC address
- SSID
Implicit question:
“Is this MAC address part of any group, and what PSK should apply?”

3. EntryPoint checks its internal database #

Is MAC address found in a group?
- ✅ Yes →
  - Return the group’s PSK
  - Return the group’s RADIUS attributes (e.g., VLAN ID, SGT, ACLs)
  - → Proceed to step 4
- ❌ No →
  - Is a Default group configured and enabled?
    - ✅ Yes → Return Default PSK
    - → Proceed to step 4

4. WLC compares PSK #

Compares:
- Client-entered PSK
- PSK received from EntryPoint
Does the PSK match?
- ✅ Yes →
  - If it came from a group:
    - Authenticate the device
    - Apply group’s RADIUS attributes → Success
  - If it came from the Default group:
    - Authenticate the device
    - Apply default access
    - Proceed to step 5
- ❌ No → Return Reject → End

5. Captive Portal is presented (only for devices in Default group) #

The user is prompted to enter their email address

6. EntryPoint checks email in user directory #

Is the email associated with a group?
- ✅ Yes →
  - Register the MAC address to the user’s group
  - Return the group’s PSK and RADIUS attributes
  - Future connections use the group PSK → End
- ❌ No → Return Reject → End