Wi-Fi Security Modes and Client Capability Interoperability Matrix
| | | | | | | ||
|---|---|---|---|---|---|---|---|---|
| | | ||||||
Security Mode | Client Connect Behaviour | Configuration push to WiFi-6E APs | Configuration push to WiFi-7 APs | |||||
| | | 2.4 GHz / 5 GHz | 6 GHz | 2.4 GHz / 5 GHz | 6 GHz | ||
Open | 802.11be (Wi-Fi 7 Client) | ✅ Yes | Open Authentication No AKM | 🚫 No SSID on 6GHz | Open Authentication No AKM | 🚫 No SSID on 6GHz | ||
802.11ax (W-Fi 6 Client) | ✅ Yes | |||||||
Legacy Client (Wi-Fi 5 or lower) | ✅ Yes | |||||||
Enhanced Open (Strict) | 802.11be (Wi-Fi 7 Client) | ✅ Yes with MLO (OWE) | OWE (CCMP-128) with PMF enabled AKM: 00-0F-AC:18 Note: PMF is mandatory for OWE | OWE + (GCMP-256 / CCMP-128) with MLO enabled, PMF enabled AKM: 00-0F-AC:18 Note: GCMP-256 (required for Wi-Fi 7), CCMP-128 (<=WiFi 6E) | ||||
802.11ax (W-Fi 6 Client) | ✅ Yes (OWE) | |||||||
Legacy Client (Wi-Fi 5 or lower) | 🚫 No | |||||||
Enhanced Open (Transition) | 802.11be (Wi-Fi 7 Client) | ✅ Yes with MLO (OWE) | DUAL SSIDs (1. Open, 2. OWE)
| OWE (CCMP-128) with PMF enabled AKM: 00-0F-AC:18 | DUAL SSIDs (1. Open, 2. OWE)
Note: Wi-Fi Enhanced Open Transition Mode is disallowed on BSSs with EHT or MLO enabled. If the network includes EHT or MLO APs and needs to support legacy STAs (that do not support Wi-Fi Enhanced Open) then the network should be configured with Dual SSIDs | OWE (CCMP-128 / GCMP-256) with MLO enabled, PMF enabled AKM: 00-0F-AC:18 For MLO: Every band in MLD must use the same AKM. | ||
802.11ax (W-Fi 6 Client) | ✅ Yes (OWE) | |||||||
Legacy Client (Wi-Fi 5 or lower) | ✅ Yes (Open) | |||||||
WPA2 Personal | 802.11be (Wi-Fi 7 Client) | ✅ Yes | WPA2-PSK AKM: 00-0F-AC:2 (PSK), 00-0F-AC:4 (PSK+FT)
| 🚫 No SSID on 6GHz
| WPA2-PSK AKM: 00-0F-AC:2 (PSK), 00-0F-AC:4 (PSK+FT)
| 🚫 No SSID on 6GHz
| ||
802.11ax (W-Fi 6 Client) | ✅ Yes | |||||||
Legacy Client (Wi-Fi 5 or lower) | ✅ Yes | |||||||
WPA3 Personal (Strict) | 802.11be (Wi-Fi 7 Client) | ✅ Yes with MLO (WPA3-SAE) | WPA3-SAE with PMF enabled Cipher: CCMP-128 AKM: 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT) | WPA3-SAE with MLO enabled, PMF enabled Cipher: CCMP-128 / GCMP-256 AKM: 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT), 00-0F-AC:24 (SAE H2E), 00-0F-AC:25 (FT-SAE-EXT-KEY) | ||||
802.11ax (W-Fi 6 Client) | ✅ Yes (WPA3-SAE) - if OS/driver support WPA3 | |||||||
Legacy Client (Wi-Fi 5 or lower) | 🚫 No | |||||||
WPA3 Personal (Transition) WPA2/WPA3 | 802.11be (Wi-Fi 7 Client) | ✅ Yes with MLO (WPA3-SAE) | WPA3-SAE and WPA2-PSK with optional PMF Cipher: CCMP-128 AKM: 00-0F-AC:2 (PSK), 00-0F-AC:4 (PSK+FT), 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT) | WPA3-SAE with PMF enabled Cipher: CCMP-128 AKM: 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT) | WPA3-SAE with MLO enabled and WPA2-PSK with optional PMF Cipher: CCMP-128 / GCMP-256 AKM: 00-0F-AC:2 (PSK), 00-0F-AC:4 (PSK+FT), 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT), 00-0F-AC:24 (SAE H2E), 00-0F-AC:25 (FT-SAE-EXT-KEY) For MLO: Every band in MLD must use the same AKM. | WPA3-SAE with MLO enabled, PMF enabled Cipher: CCMP-128 / GCMP-256 AKM: 00-0F-AC:8 (SAE), 00-0F-AC:9 (SAE+FT), 00-0F-AC:24 (SAE H2E), 00-0F-AC:25 (FT-SAE-EXT-KEY) For MLO: Every band in MLD must use the same AKM. | ||
802.11ax (W-Fi 6 Client) | ✅ Yes (WPA3-SAE) - if OS/driver support WPA3 | |||||||
Legacy Client (Wi-Fi 5 or lower) | ✅ Yes (WPA2-PSK) | |||||||
WPA2 Enterprise | 802.11be (Wi-Fi 7 Client) | ✅ Yes | WPA2-Enterprise AKM: 00-0F-AC:1 (802.1X), 00-0F-AC:3 (802.1X+FT), 00-0F-AC:5 (802.1X+SHA256) | 🚫 No SSID on 6GHz
| WPA2-Enterprise AKM: 00-0F-AC:1 (802.1X), 00-0F-AC:3 (802.1X+FT), 00-0F-AC:5 (802.1X+SHA256) | 🚫 No SSID on 6GHz
| ||
802.11ax (W-Fi 6 Client) | ✅ Yes
| |||||||
Legacy Client (Wi-Fi 5 or lower) | ✅ Yes | |||||||
WPA3 Enterprise (192-bit) WPA3 only | 802.11be (Wi-Fi 7 Client) | ✅ Yes with MLO | WPA3-Enterprise (192-bit) with PMF enabled Cipher: GCMP-256 AKM: 00-0F-AC:12 (802.1X-SHA-384), 00-0F-AC:13 (FT+ 802.1X-SHA-384) | WPA3-Enterprise (192-bit) with MLO enabled, PMF enabled Cipher: GCMP-256 AKM: 00-0F-AC:12 (802.1X-SHA-384), 00-0F-AC:13 (FT+ 802.1X-SHA-384) | ||||
802.11ax (W-Fi 6 Client) | ✅ Yes - Only if OS/driver supports WPA3 | |||||||
Legacy Client (<=Wi-Fi 5) | 🚫 No | |||||||
WPA3 Enterprise (128-bit) WPA3 only | 802.11be (Wi-Fi 7 Client) | ✅ Yes with MLO | WPA3-Enterprise (128-bit) with PMF enabled Cipher: CCMP-128 AKM: 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) | WPA3-Enterprise (128-bit) with MLO enabled, PMF enabled Cipher: CCMP-128 AKM: 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) For MLO: Every band in MLD must use the same AKM. | ||||
802.11ax (W-Fi 6 Client) | ✅ Yes - Only if OS/driver supports WPA3 | |||||||
Legacy Client (<=Wi-Fi 5) | 🚫 No | |||||||
WPA3 Enterprise (Transition) WPA2/ WPA3 | 802.11be (Wi-Fi 7 Client) | ✅ Yes | WPA3/WPA2-Enterprise (128-bit) with optional PMF Cipher: CCMP-128 AKM: 00-0F-AC:1 (802.1X), 00-0F-AC:3 (802.1X+FT), 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) | WPA3-Enterprise (128 bit) with PMF enabled Cipher: CCMP-128 AKM: 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) | WPA3/WPA2-Enterprise (128-bit) with optional PMF, MLO enabled Cipher: CCMP-128 AKM: 00-0F-AC:1 (802.1X), 00-0F-AC:3 (802.1X+FT), 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) For MLO: Every band in MLD must use the same AKM. | WPA3-Enterprise (128-bit) with MLO enabled, PMF enabled Cipher: CCMP-128 AKM: 00-0F-AC:5 (802.1X+SHA256), 00-0F-AC:11 (FT + 802.1X-SHA256) For MLO: Every band in MLD must use the same AKM. | ||
802.11ax (W-Fi 6 Client) | ✅ Yes | |||||||
Legacy Client (Wi-Fi 5 or lower) | 🚫 No | |||||||