topic Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication in Unleashed

WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

Escaflowne — Sat, 12 Mar 2022 19:51:39 GMT

I have a WPA2/WPA3-Mixed network authenticating with EAP-TLS on a RADIUS server. Android 12 devices connect to this network using WPA2, whereas I would prefer they connect using WPA3. However, when I set up a WPA3-only network (not mixed), leaving all other settings identical, the devices connect using WPA3 192-bit mode.

Is the behaviour using WPA2/WPA3-Mixed expected? Has anyone successfully connected their Android 12 devices using WPA3 to a WPA2/WPA3-Mixed mode network?
Is there a way to indicate preference for WPA3 over WPA2 in a mixed-mode network?
Android 12 supports Transition Disable indication in the WPA3 standard. Is it possible to enable this in Unleashed 200.12 if it's not already enabled by default?

APs: R510, Unleashed (200.12.10.5.234)

STAs: Pixel 3a, Android 12 (SP2A.220305.012)

Thanks in advance!

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

BobaEnjoyer — Sat, 08 Apr 2023 00:05:49 GMT

Necrobump. I'm also interested in Unleashed implementing the "Transition Disable" Indication, and I'm wondering if this is being worked on.

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

sanjay_kumar — Sat, 08 Apr 2023 01:28:00 GMT

Hi @Escaflowne
I just tested this on 200.13 with WPA2\WPA3-Mixed SSID, and the client got connected to WPA3.
I'm using Oneplus 10T Android 12.

Please check and let me know.

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

BobaEnjoyer — Sat, 08 Apr 2023 02:51:57 GMT

Does the "Clients" list in Unleashed also show WPA3? On mine it just shows WPA2 still even when the phone shows WPA3.

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

sanjay_kumar — Sat, 08 Apr 2023 03:56:41 GMT

Hi @BobaEnjoyer

Yes, on the Client list on the Unleashed GUI shows as WPA3.

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

BobaEnjoyer — Sat, 08 Apr 2023 04:04:28 GMT

Oh, with Open authentication, that's WPA3-Personal (SAE). Mine shows as WPA3 in unleashed as well. I think OP was having issues with WPA2/WPA3-Enterprise mixed mode, and the clients would choose only WPA2-Enterprise.

I'm having a similar problem, but a phone connects as only WPA3-Enterprised but Unleashed shows WPA2-Enterprise for that phone...

I don't know if the Unleashed firmware is at fault or if this is user error or just very strange phones and laptops.

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

sanjay_kumar — Sat, 08 Apr 2023 04:12:51 GMT

Let me check on this with EAP-TLS as well.

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

BobaEnjoyer — Sat, 15 Apr 2023 00:24:31 GMT

Any luck with EAP-TLS WPA3 instead of EAP-TLS WPA2?

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

sanjay_kumar — Mon, 17 Apr 2023 08:03:22 GMT

Hi @BobaEnjoyer @Escaflowne
Apologies for the delay, I was working on this with internal team to understand more on the behavior. Below are some details:

When configuring "WPA2/WPA3-Mixed with 802.1X EAP Authentication" in unleashed,

WPA2 means :“WPA2-Enterprise” + PMF set to disable
WPA3 means : “WPA3-Enterprise only mode”, and is essentially “WPA2-Enterprise” + PMF set to required + “AKM WPA SHA256” (when PFM is set to required, the AMK need to be "WPA SHA256”)

Currently the GUI displaying WPA2 will be fixed to show Encryption as WPA3. I believe it will be in 200.15 as 200.14 is almost ready to release.

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

BobaEnjoyer — Thu, 20 Apr 2023 06:56:59 GMT

Thank you and the internal team for this clarification. It set me on a course to read more about WPA3-Enterprise and also the transition/mixed mode, since all the AKM stuff is new to me.

I found https://mrncciew.com/2020/08/17/wpa3-enterprise/ very helpful in the AKM suites for everything and hope that Ruckus also follows the standard perfectly.

Re: WPA2/WPA3-Mixed 192-bit & Transition Disable Indication

sanjay_kumar — Thu, 20 Apr 2023 08:40:51 GMT

Thanks @BobaEnjoyer
Feel free to let us know if you have any further queries.