WPA3-Enterprise 802.1X Wireless RADIUS Configuration

WPA3-Enterprise changes three things that matter operationally: the AKM suite moves to 802.1X with SHA-256, protected management frames become mandatory in WPA3-only mode, and the optional CNSA 192-bit mode adds strict certificate requirements. Everything else — RADIUS, certificates, EAP method selection — is inherited from WPA2-Enterprise, which is why migration failures are almost always caused by PMF or certificate mismatches rather than by the SSID itself. This guide covers the prerequisites, the two deployment modes, and the checks that prove clients can actually associate.

Prerequisites Before Touching the SSID

• RADIUS reachability: the wireless controllers or APs must reach the authentication server on 1812/1813 UDP (or RadSec over TLS on 2083/TCP), with a matching shared secret.
• Certificates: the server presents a certificate the clients trust; clients present a certificate (EAP-TLS) or credentials (PEAP-MSCHAPv2) depending on policy.
• Client population audit: WPA3-only mode refuses WPA2-only clients. Inventory the devices before disabling transition mode.
• PMF awareness: protected management frames are optional in transition mode on 2.4/5 GHz and mandatory in WPA3-only mode; some older clients and some supplicants fail the association when PMF is required.

Mode 1: Transition (WPA2 + WPA3 on One SSID)

! ArubaOS example: SSID profile with both AKM suites
wlan ssid-profile "ACME_1X_TRANSITION"
  essid "ACME_1X_TRANSITION"
  opmode wpa2-aes
  mfp-capable
  mfp-required

! advertised AKM selectors in this mode
!   00-0F-AC:1  = 802.1X with SHA-1  (WPA2 clients)
!   00-0F-AC:5  = 802.1X with SHA-256 (WPA3 clients)
! PMF: MFPC=1, MFPR=0 (capable, not required)

Transition mode is the right first step: WPA2 clients keep working while WPA3-capable clients negotiate the stronger suite. Watch the client table for the negotiated AKM; when the majority report WPA3, plan the cutover to WPA3-only in a maintenance window.

Mode 2: WPA3-Enterprise Only

wlan ssid-profile "ACME_1X_WPA3"
  essid "ACME_1X_WPA3"
  opmode wpa2-aes
  mfp-capable
  mfp-required
  ! transition mode explicitly disabled
  no wpa3-transition-mode-enable

In this mode PMF is mandatory (MFPR=1, MFPC=1) and only clients supporting 802.1X with SHA-256 associate. The EAP conversation is still terminated by the RADIUS server, with the AP acting as authenticator and setting the NAS-Identifier/NAS-IP used for policy decisions.

Optional: CNSA 192-bit Mode

• AKM 00-0F-AC:12 — 802.1X with SHA-384.
• Pairwise and group ciphers 00-0F-AC:9 — GCMP-256; group management cipher BIP-GMAC-256.
• TLS 1.2 or later with an RFC 6460-compliant suite (for example TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 using P-384 and RSA keys larger than 3072 bits).
• Certificate chain validation is mandatory and EAP tunnel termination is not supported — the RADIUS server must enforce policy end to end.

Verification and Troubleshooting

# controller side
show ap debug client-table ap-name <ap>
show ap debug radius-statistics
show ap debug auth-trace-buf ap-name <ap>
show station-table

# RADIUS server side: confirm the Access-Accept and the attributes returned
#   WLAN-AKM-Suite (188), WLAN-Pairwise-Cipher (186), WLAN-Group-Mgmt-Cipher (189)

• Association fails immediately: client does not support PMF but the SSID requires it. Temporarily return to transition mode for that client class.
• Authentication fails after a successful association: RADIUS shared secret mismatch, or the user is not authorised for the returned VLAN/role.
• Certificate errors in EAP-TLS: server chain not trusted by the client, expired intermediate, or SAN mismatch against the configured server name.
• Clients roam and drop: PMF and 802.11r with the wrong mobility domain configuration — verify the roaming configuration per band before blaming WPA3.

Related reading: ArubaOS-CX 802.1X port access with RADIUS and MAB roles and Cisco voice VLAN for IP phones.

原文链接：https://arubanetworking.hpe.com/techdocs/aos/wifi-design-deploy/security/modes/wpa3-enterprise/