Cisco Cisco Aironet 350 Wireless LAN Client Adapter

Click Configure, and select the Advanced tab.

Click Management Frame Protection Policy in the Property column.

Choose the policy setting from the drop-down list in the Value column.

Use MFP Setting of Network—This setting configures the registry entry ccxMFPPolicy to 0. When 
this setting is chosen, the client follows the MFP policy of the network. The client looks at the MFP 
bit advertised by the network in the SFA IE of the probe response. If that bit is set, then the client 
also sets the MFP bit in the SFA IE of the association request, confirms the MFP bit in the SFA IE 
that is returned in the association response frame, and obeys the rules of MFP.

The Use MFP Setting of Network value is the default policy in build 4.4.0.69.

Always Advertise MFP Support—This setting configures the registry entry ccxMFPPolicy to 1. 
When this setting is chosen, the client always advertises MFP support while connecting to a 
CCX version 5-enabled network. The client sets the MFP bit in the SFA IE of association request. 
It obeys the rules of MFP only if the association response from the access point also has the MFP 
bit set in the SFA IE.

This policy is consistent with the CCX version 5 specification for MFP. The policy is required to 
pass MFP tests for certification.

The Always Advertise MFP Support setting is not interoperable with some controller and access 
point software versions that are currently in the field. Do not use this setting until the 
infrastructure network is upgraded to the proper version.

When a profile is configured with 802.1X EAP-FAST with PEAP-GTC as the authentication method and 
auto-provisioning enabled, authentication fails. However, if an existing PAC is chosen, the domain 
username in the PAC is entered, and the correct password is entered in the password window, 
authentication succeeds. The failure also occurs when EAP-FAST with EAP-TLS is used. This behavior 
can be the result of validating the client certificate on the RADIUS server. With PEAP-GTC, a client-side 
certificate does not exist.

After a change in channel, the transmit power of transmitted packets might be lower or higher than the 
intended transmit power.

With a 4400 controller, a wireless LAN is configured with WPA2 and with 802.1X selected as the key 
management method. A client sends a PMKID in the association request, but the PMKID does not match 
the controller PMKID cache.