Most of the older wireless networks (Wi-Fi 5/6) might be having Open/WPA2 enabled WLANs primarily because the APs and wireless clients associating do not support WPA3. With the Wi-Fi 7 upgrade, the goal is to make your network more secure with WPA3 enabled on your WLANs while ensuring that legacy clients can associate.
WLAN distribution
The best practice to deploy an enterprise wireless network is to configure WLANs as per the use case. This offers following benefits-
- Traffic separation
- Data security
- Ability to throttle/block traffic (Role based access)
The best practice is deploy separate WLANs for the following-
- Guest devices
- IOT/BYOD devices
- Corporate devices
If these WLANs already exist in your network, you most likely have them configured as follows-
| WLAN | Wi-Fi 6 Security Configuration |
| Guest | Open |
| IOT/BYOD | WPA2 PSK |
| Corporate | WPA2 802.1x |
Design Considerations for Migration–
- Migrate all the WLANs to WPA3/Enhanced Open– This will provide a fully secure WLAN environment and eliminate legacy client devices from the network.
- Re-designing WLANs– In order to ensure that new/legacy wireless clients co-exist on the WLANs, you may configure WLANs which support both WPA2/WPA3. This ensures smooth migration.
| WLAN | Wi-Fi 6 ->Wi-Fi 7 Migration |
| Guest | Open->OWE |
| IOT/BYOD | WPA2 (PSK)->WPA3 OR WPA2/WPA3 |
| Corporate | WPA2 (802.1x)-> WPA3 OR WPA2/WPA3 (Enterprise) |
Note: Wi-Fi 7 needs GCMP256 to be enabled for the client devices to associate as MLO clients and operate with 802.11be data rates. If the legacy devices do not support GCMP256 I suggest splitting the WLAN used for legacy vs Wi-Fi 7 client devices.
Related Blogs–
Why are network admins configuring multiple WLANs?
How to associate my Wi-Fi 7 client on 6 GHz with 320M CW?
Dual Band and Quad Radio Cisco Wi-Fi 7 APs
Wi-Fi 7 vs Wi-Fi 6/6e: Client Association Basics
blogscisco.com 