Selecting to use the new WPA3 encryption option?

[itsjustme999]

I have my iPhone 13 mini and a MacBook that supports WPA3 Personal and of course, the AX86U does as well.

When selecting WPA3 PERSONAL on my AX86U router, should I enable the Protected Management Framework?

Will this slow down my internet connection if I enable it?

Does the PMF also provide more security?

 

[tgl]

PMF is mandatory with WPA3. I think you can set the field to "Capable" if you like but it won't make any difference compared to "Required". I don't know what happens if you set it to "Disable" alongside requiring WPA3, but it's unlikely to be good.

 

[itsjustme999]

Another question.

With WPA3 Personal, can I set a less shorter WiFi password as long as it is complex?

In other words, I can make it shorter but still leaving it complex.

On my AX86U router I don’t see the selection to enable Simultaneous Authentication of Equals (SAE) which allows to set passwords that would be easier to remember because SAE is much harder to crack the password.

 

[tgl]

I'm not an expert in this, but I don't see how SAE could protect at all against brute-force guessing of the password. What it seems to be claimed to do is prevent after-the-fact decrypting of your wireless traffic, even for an attacker who has guessed the password. That's certainly worth something, but if you're worried at all about attacks on your network, you shouldn't think SAE makes it okay to use a weak password.

Besides which, what's the benefit of using a weak wireless password? There's no system I know of where you'd need to key that in on a regular basis.

 

[itsjustme999]

Thanks so much for the explanation.
I’ll stick to my strong password.

Your right, I don’t have to remember the WiFi password, but if I forget my router admin password, now that would be an issue.

 

[tgl]

Your right, I don’t have to remember the WiFi password, but if I forget my router admin password, now that would be an issue.

That's when you reach for the reset button ...

 

[itsjustme999]

Finally, should I still switch to using WPA3 PERSONAL or it would not make it any more secure?

If the answer is yes, then I’ll have to set my older devices which are on the 2.4Ghz band to leave those only on the WPA2 and for the devices which supports WPA3, those will be on the 5Ghz band.

 

[tgl]

WPA3 is more secure than WPA2, but I'm not sure that there's all that much gain in being WPA3-only on one band if your setup still allows WPA2 connections on the other band --- unless you have additional security layers in place, such as the other band being a "guest net" setup with restricted access to the network. So it might not be worth troubling over until you've retired the WPA2-only devices. I'm not an expert on this stuff though, so somebody else might have a different opinion.

 

[sfx2000]

In my experience with WPA3 - if the clients do it, then yes...

WAP2/3-mixed - depends, this is where most of the trouble is there...

 

[L&LD]

My experience too @sfx2000.

I don't know/join any networks (and none that I created) that use WPA3 exclusively.

 

[SteevieWeevie]

I have my iPhone 13 mini and a MacBook that supports WPA3 Personal and of course, the AX86U does as well.

When selecting WPA3 PERSONAL on my AX86U router, should I enable the Protected Management Framework?

Will this slow down my internet connection if I enable it?

Does the PMF also provide more security?

Apologies for topic necro but I am asking a similar question.

I recently got an AX86U Pro and have a number of clients which support wifi 6 and WPA3. With the previous router which was a Fritzbox, it recently had a firmware update which enabled WPA3. When I activated this my WLAN seemed to function as before, except that in Windows and similar it would show that security type as WPA3.

This doesn’t seem the case with the Asus. Firstly, setting WPA2/WPA3 mixed mode sees the same clients which before we’re connecting with 3, connecting as WPA2. Selecting WPA3 exclusive mode stops a couple of the clients connecting altogether.

The path of least resistance here is for me to bite the bullet and just use WPA2, but the Asus router is significantly more expensive, advanced (because the Fritzbox was wifi 5) and it is annoying me that the old box seemed to manage this more effectively than the “superior” product does.

Is there something which I can do so that when using mixed mode, capable clients are forced to use WPA3? If not, isn’t that kinda crappy?

 

[bbunge]

Apologies for topic necro but I am asking a similar question.

I recently got an AX86U Pro and have a number of clients which support wifi 6 and WPA3. With the previous router which was a Fritzbox, it recently had a firmware update which enabled WPA3. When I activated this my WLAN seemed to function as before, except that in Windows and similar it would show that security type as WPA3.

This doesn’t seem the case with the Asus. Firstly, setting WPA2/WPA3 mixed mode sees the same clients which before we’re connecting with 3, connecting as WPA2. Selecting WPA3 exclusive mode stops a couple of the clients connecting altogether.

The path of least resistance here is for me to bite the bullet and just use WPA2, but the Asus router is significantly more expensive, advanced (because the Fritzbox was wifi 5) and it is annoying me that the old box seemed to manage this more effectively than the “superior” product does.

Is there something which I can do so that when using mixed mode, capable clients are forced to use WPA3? If not, isn’t that kinda crappy?

The WPA2/WPA3-Personal is usable on Asus routers. I've had to disconnect the client and reconnect to the WIFI then clients that can use WPA3 do use it.
With that said there are some older clients that do not like WPA2/WPA3 and will refuse to connect. My work around is to set up a guest WIFI with just WPA2 for those old clients Use Guest 2 or 3 if you want the clients to have access to other devices on your LAN. Use the same SSID for both bands and the clients can choose to use 2.4 or 5 GHz.

 

[SteevieWeevie]

The WPA2/WPA3-Personal is usable on Asus routers. I've had to disconnect the client and reconnect to the WIFI then clients that can use WPA3 do use it.
With that said there are some older clients that do not like WPA2/WPA3 and will refuse to connect. My work around is to set up a guest WIFI with just WPA2 for those old clients Use Guest 2 or 3 if you want the clients to have access to other devices on your LAN. Use the same SSID for both bands and the clients can choose to use 2.4 or 5 GHz.

Thank you. That’s a good idea. A bit fiddly but I can see that working and it’s a fire and forget as it’s only needed for the older clients.

I’ll try it and see how I get on. Ta.