Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

FortiWiFi and FortiAP Configuration Guide

WPA3 Security

The following WPA3 security modes are supported by FortiGate devices running FortiOS 6.2.0 and later, and FortiAP-S and FortiAP-W2 device running 6.2.0 and later:

  • WPA3-Enterprise
  • WPA3-Simultaneous Authentication of Equals (SAE)
  • WPA3-SAE Transition
  • Opportunistic Wireless Encryption (OWE)
  • OWE Transition
To configure WPA3 on an SSID - GUI
  1. Go to WiFi Controller > SSID.
  2. Create a new SSID, or edit a current one.
  3. In the WiFi Settings section, set the Security Mode to a WPA3 option.

  4. Configure the relevant security settings as needed.
  5. Click OK.
To configure WPA3 OWE - CLI
  • WPA3 OWE only:

    Clients that support WPA3 can connect with this SSID.

    config wireless-controller vap
        edit "80e_owe"
            set ssid "80e_owe"
            set security owe
            set pmf enable
            set schedule "always"
        next
    end
  • WPA3 OWE Transition:

    Clients connect with normal OPEN or OWE depending on its capability. Clients which support WPA3 connect with OWS standard. Clients which cannot support WPA3 connect with Open SSID.

    config wireless-controller vap
        edit "80e_open"
            set ssid "80e_open"
            set security open
            set owe-transition enableset owe-transition-ssid "wpa3_open"
            set schedule "always"
        next
        edit "wpa3_owe_tr"
            set ssid "wpa3_open"
            set broadcast-ssid disable
            set security owe
            set pmf enable
            set owe-transition enableset owe-transition-ssid "80e_open"
            set schedule "always"
        next
    end
To configure WPA3 SAE - CLI
  • WPA3 SAE:

    Clients that support WPA3 can connect with this SSID.

    config wireless-controller vap
        edit "80e_sae"
            set ssid "80e_sae"
            set security wpa3-sae
            set pmf enable
            set schedule "always"
            set sae-password ********
        next
    end
  • WPA3 SAE Transition:

    There are two passwords in the SSID. If passphrase is used, the client connects with WPA2 PSK. If sae-password is used, the client connects with WPA3 SAE.

    config wireless-controller vap
        edit "80e_sae-tr"
            set ssid "80e_sae-transition"
            set security wpa3-sae-transition
            set pmf optional
            set passphrase ********
            set schedule "always"
            set sae-password ********
        next
    end
To configure WPA3 Enterprise - CLI

Using this option, you can select the auth type to use either RADIUS authentication or local user authentication.

config wireless-controller vap
    edit "80e_wpa3"
        set ssid "80e_wpa3"
        set security wpa3-enterprise
        set pmf enable
        set auth radius
        set radius-server "wifi-radius"
        set schedule "always"
    next
    edit "80e_wpa3_user"
        set ssid "80e_wpa3_user"
        set security wpa3-enterprise
        set pmf enable
        set auth usergroup
        set usergroup "usergroup"
        set schedule "always"
    next
end

WPA3 Security

The following WPA3 security modes are supported by FortiGate devices running FortiOS 6.2.0 and later, and FortiAP-S and FortiAP-W2 device running 6.2.0 and later:

  • WPA3-Enterprise
  • WPA3-Simultaneous Authentication of Equals (SAE)
  • WPA3-SAE Transition
  • Opportunistic Wireless Encryption (OWE)
  • OWE Transition
To configure WPA3 on an SSID - GUI
  1. Go to WiFi Controller > SSID.
  2. Create a new SSID, or edit a current one.
  3. In the WiFi Settings section, set the Security Mode to a WPA3 option.

  4. Configure the relevant security settings as needed.
  5. Click OK.
To configure WPA3 OWE - CLI
  • WPA3 OWE only:

    Clients that support WPA3 can connect with this SSID.

    config wireless-controller vap
        edit "80e_owe"
            set ssid "80e_owe"
            set security owe
            set pmf enable
            set schedule "always"
        next
    end
  • WPA3 OWE Transition:

    Clients connect with normal OPEN or OWE depending on its capability. Clients which support WPA3 connect with OWS standard. Clients which cannot support WPA3 connect with Open SSID.

    config wireless-controller vap
        edit "80e_open"
            set ssid "80e_open"
            set security open
            set owe-transition enableset owe-transition-ssid "wpa3_open"
            set schedule "always"
        next
        edit "wpa3_owe_tr"
            set ssid "wpa3_open"
            set broadcast-ssid disable
            set security owe
            set pmf enable
            set owe-transition enableset owe-transition-ssid "80e_open"
            set schedule "always"
        next
    end
To configure WPA3 SAE - CLI
  • WPA3 SAE:

    Clients that support WPA3 can connect with this SSID.

    config wireless-controller vap
        edit "80e_sae"
            set ssid "80e_sae"
            set security wpa3-sae
            set pmf enable
            set schedule "always"
            set sae-password ********
        next
    end
  • WPA3 SAE Transition:

    There are two passwords in the SSID. If passphrase is used, the client connects with WPA2 PSK. If sae-password is used, the client connects with WPA3 SAE.

    config wireless-controller vap
        edit "80e_sae-tr"
            set ssid "80e_sae-transition"
            set security wpa3-sae-transition
            set pmf optional
            set passphrase ********
            set schedule "always"
            set sae-password ********
        next
    end
To configure WPA3 Enterprise - CLI

Using this option, you can select the auth type to use either RADIUS authentication or local user authentication.

config wireless-controller vap
    edit "80e_wpa3"
        set ssid "80e_wpa3"
        set security wpa3-enterprise
        set pmf enable
        set auth radius
        set radius-server "wifi-radius"
        set schedule "always"
    next
    edit "80e_wpa3_user"
        set ssid "80e_wpa3_user"
        set security wpa3-enterprise
        set pmf enable
        set auth usergroup
        set usergroup "usergroup"
        set schedule "always"
    next
end