--- title: Wi-Fi Security Modes and Client Capability Interoperability Matrix slug: wi-fi-security-modes-and-client-capability-interoperability-matrix docTags: createdAt: 2025-12-12T06:32:14.727Z --- | | | | | | | | | ------------------------------------------------------ | --------------------------------------------- | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | | | | | | | | **Security Mode** | **Client Connect Behaviour ** | **Configuration push to WiFi-6E APs** | **Configuration push to WiFi-7 APs** | | | | | **** | **** | **** | **2.4 GHz / 5 GHz ** | **6 GHz** | **2.4 GHz / 5 GHz ** | **6 GHz** | | **Open ** | 802.11be (Wi-Fi 7 Client)  | ✅ Yes   | Open Authentication
No AKM | 🚫 No  SSID on 6GHz  | Open Authentication
No AKM | 🚫 No  SSID on 6GHz  | | 802.11ax (W-Fi 6 Client)  | ✅ Yes  | | | | | | | Legacy Client (Wi-Fi 5 or lower) | ✅ Yes  | | | | | | | **Enhanced Open (Strict) ** | 802.11be (Wi-Fi 7 Client)  | ✅ Yes with MLO (OWE)  | OWE (CCMP-128) with PMF enabled 
AKM: 00-0F-AC:18
:::BlockQuote Note: PMF is mandatory for OWE ::: | OWE + (GCMP-256 / CCMP-128) with MLO enabled, PMF enabled 
AKM: 00-0F-AC:18
:::BlockQuote Note: GCMP-256 (required for Wi-Fi 7), CCMP-128 (\<=WiFi 6E) ::: | | | | 802.11ax (W-Fi 6 Client)  | ✅ Yes (OWE)  | | | | | | | Legacy Client (Wi-Fi 5 or lower)  | 🚫 No  | | | | | | | **Enhanced Open (Transition) ** | 802.11be (Wi-Fi 7 Client)  | ✅ Yes with MLO (OWE)  | DUAL SSIDs (1. Open, 2. OWE)
1) Open Authentication - No AKM 2) OWE (CCMP-128) with PMF enabled - AKM: 00-0F-AC:18 | OWE (CCMP-128) with PMF enabled 
AKM: 00-0F-AC:18 | DUAL SSIDs (1. Open, 2. OWE)
1) Open Authentication - No AKM 2) OWE (CCMP-128 / GCMP-256) with MLO enabled, optional PMF - AKM: 00-0F-AC:18
:::BlockQuote Note: Wi-Fi Enhanced Open Transition Mode is disallowed on BSSs with EHT or MLO enabled. If the network includes EHT or MLO APs and needs to support legacy STAs (that do not support Wi-Fi Enhanced Open) then the network should be configured with Dual SSIDs ::: | OWE (CCMP-128 / GCMP-256) with MLO enabled, PMF enabled 
AKM: 00-0F-AC:18
:::BlockQuote For MLO: Every band in MLD must use the same AKM. ::: | | 802.11ax (W-Fi 6 Client)  | ✅ Yes (OWE)  | | | | | | | Legacy Client (Wi-Fi 5 or lower)  | ✅ Yes (Open)  | | | | | | | **WPA2 Personal ** | 802.11be (Wi-Fi 7 Client)  | ✅ Yes  | WPA2-PSK 

AKM: 00-0F-AC:2 (PSK), 00-0F-AC:4 (PSK+FT)
  | 🚫 No  SSID on 6GHz 
 
  | WPA2-PSK 

AKM: 00-0F-AC:2 (PSK), 00-0F-AC:4 (PSK+FT)
  | 🚫 No  SSID on 6GHz 
  | | 802.11ax (W-Fi 6 Client)  | ✅ Yes  | | | | | | | Legacy Client (Wi-Fi 5 or lower) | ✅ Yes  | | | | | | | **WPA3 Personal (Strict) ** | 802.11be (Wi-Fi 7 Client)  | ✅ Yes with MLO (WPA3-SAE)  | WPA3-SAE with PMF enabled 
Cipher: CCMP-128

AKM: 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT) | WPA3-SAE with MLO enabled, PMF enabled 
Cipher: CCMP-128 / GCMP-256

AKM: 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT), 00-0F-AC:24 (SAE H2E), 00-0F-AC:25 (FT-SAE-EXT-KEY) | | | | 802.11ax (W-Fi 6 Client)  | ✅ Yes (WPA3-SAE) - if OS/driver support WPA3  | | | | | | | Legacy Client (Wi-Fi 5 or lower) | 🚫 No  | | | | | | | **WPA3 Personal (Transition) **
WPA2/WPA3 | 802.11be (Wi-Fi 7 Client)  | ✅ Yes with MLO (WPA3-SAE)  | WPA3-SAE and WPA2-PSK with optional PMF  
Cipher: CCMP-128

AKM: 00-0F-AC:2 (PSK), 00-0F-AC:4 (PSK+FT), 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT) | WPA3-SAE with PMF enabled 
Cipher: CCMP-128

AKM: 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT) | WPA3-SAE with MLO enabled and WPA2-PSK with optional PMF
Cipher: CCMP-128 / GCMP-256

AKM: 00-0F-AC:2 (PSK), 00-0F-AC:4 (PSK+FT), 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT), 00-0F-AC:24 (SAE H2E), 00-0F-AC:25 (FT-SAE-EXT-KEY)
:::BlockQuote For MLO: Every band in MLD must use the same AKM. ::: | WPA3-SAE with MLO enabled, PMF enabled 
Cipher: CCMP-128 / GCMP-256 

AKM: 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT), 00-0F-AC:24 (SAE H2E), 00-0F-AC:25 (FT-SAE-EXT-KEY)
:::BlockQuote For MLO: Every band in MLD must use the same AKM. ::: | | 802.11ax (W-Fi 6 Client)  | ✅ Yes (WPA3-SAE) - if OS/driver support WPA3  | | | | | | | Legacy Client (Wi-Fi 5 or lower)  | ✅ Yes (WPA2-PSK)  | | | | | | | **WPA2 Enterprise ** | 802.11be (Wi-Fi 7 Client)  | ✅ Yes  | WPA2-Enterprise 

AKM: 00-0F-AC:1 (802.1X), 00-0F-AC:3 (802.1X+FT), 00-0F-AC:5 (802.1X+SHA256)  | 🚫 No  SSID on 6GHz 
 
  | WPA2-Enterprise 

AKM: 00-0F-AC:1 (802.1X), 00-0F-AC:3 (802.1X+FT), 00-0F-AC:5 (802.1X+SHA256)  | 🚫 No  SSID on 6GHz 
  | | 802.11ax (W-Fi 6 Client)  | ✅ Yes 
  | | | | | | | Legacy Client (Wi-Fi 5 or lower) | ✅ Yes  | | | | | | | **WPA3 Enterprise (192-bit) **
WPA3 only | 802.11be (Wi-Fi 7 Client)  | ✅ Yes with MLO | WPA3-Enterprise (192-bit) with PMF enabled
Cipher: GCMP-256

AKM: 00-0F-AC:12 (802.1X-SHA-384), 00-0F-AC:13 (FT+ 802.1X-SHA-384) | WPA3-Enterprise (192-bit) with MLO enabled, PMF enabled 
Cipher: GCMP-256

AKM: 00-0F-AC:12 (802.1X-SHA-384), 00-0F-AC:13 (FT+ 802.1X-SHA-384) | | | | 802.11ax (W-Fi 6 Client) | ✅ Yes - Only if OS/driver supports WPA3  | | | | | | | Legacy Client (\<=Wi-Fi 5) | 🚫 No  | | | | | | | **WPA3 Enterprise (128-bit) **
WPA3 only | 802.11be (Wi-Fi 7 Client)  | ✅ Yes with MLO | WPA3-Enterprise (128-bit) with PMF enabled
Cipher: CCMP-128

AKM: 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) | WPA3-Enterprise (128-bit) with MLO enabled, PMF enabled
Cipher: CCMP-128

AKM: 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256)
:::BlockQuote For MLO: Every band in MLD must use the same AKM. ::: | | | | 802.11ax (W-Fi 6 Client) | ✅ Yes - Only if OS/driver supports WPA3  | | | | | | | Legacy Client (\<=Wi-Fi 5) | 🚫 No  | | | | | | | **WPA3 Enterprise (Transition) **
WPA2/ WPA3 | 802.11be (Wi-Fi 7 Client)  | ✅ Yes   | WPA3/WPA2-Enterprise (128-bit) with optional PMF
Cipher: CCMP-128

AKM: 00-0F-AC:1 (802.1X), 00-0F-AC:3 (802.1X+FT), 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) | WPA3-Enterprise (128 bit) with PMF enabled 
Cipher: CCMP-128

AKM: 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) | WPA3/WPA2-Enterprise (128-bit) with optional PMF, MLO enabled 
Cipher: CCMP-128

AKM: 00-0F-AC:1 (802.1X), 00-0F-AC:3 (802.1X+FT), 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256)
:::BlockQuote For MLO: Every band in MLD must use the same AKM. ::: | WPA3-Enterprise (128-bit) with MLO enabled, PMF enabled
Cipher: CCMP-128

AKM: 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256)
:::BlockQuote For MLO: Every band in MLD must use the same AKM. ::: | |  802.11ax (W-Fi 6 Client)  | ✅ Yes   | | | | | | | Legacy Client (Wi-Fi 5 or lower)  | 🚫 No  | | | | | |