When going through the commands to enable WPA on cisco Wireless Account point
ap(config)#interface Dot11Radio0
ap(config-if)# encryption mode ciphers aes-ccm
Then
ap(config-ssid)#authentication open
ap(config-ssid)#authentication key-management wpa version 2
I was shown Error: Encryption mode cipher is not configured.
Turns out this setting needs to be applied to each VLAN presented to the SSID
ap(config)#interface Dot11Radio0
ap(config-if)#encryption vlan 13 mode ciphers aes-ccm tkip
I could then run
ap(config-ssid)#authentication open
ap(config-ssid)#authentication key-management wpa version 2
ap(config-ssid)#guest-mode
ap(config-ssid)#wpa-psk ascii WirelessPassword