WPS is casually mentioned in and around enabling MFP and MFP settings, but I found a link to a list of error messages that seem to indicate what it is/does: LINK
- wireless protection policy (WPS)
- List of "show wps" commands: LINK
Seems that you can't enable ap-authentication until MFP is disabled:
- MFP must be disabled before AP neighbor authentication is enabled.
And when you enable ap-authentication, NTP must be enabled on all switches in a multi-switch environment:
- Please enable NTP on all switches in a multi-switch environment.
and then I found a totally sweet blog about Wireless LAN Security Best Practices and other assorted wireless stuff by Herbert Haas some of it is a bit dated, but some of it is still applicable: LINK
Then I found the Infrastructure Management Frame Protection (MFP) with WLC and LAP Configuration Example document: LINK
Found this too - the Lightweight Access Point (LAP) Authorization in a Cisco Unified Wireless Network Configuration Example: LINK