Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

FortiWiFi and FortiAP Configuration Guide

WPA3 Security

The following WPA3 security modes are supported by FortiGate devices running FortiOS 6.2.0 and later, and FortiAP-S and FortiAP-W2 device running 6.2.0 and later:

  • WPA3-Enterprise
  • WPA3-Simultaneous Authentication of Equals (SAE)
  • WPA3-SAE Transition
  • Opportunistic Wireless Encryption (OWE)
  • OWE Transition
To configure WPA3 on an SSID - GUI
  1. Go to WiFi Controller > SSID.
  2. Create a new SSID, or edit a current one.
  3. In the WiFi Settings section, set the Security Mode to a WPA3 option.

  4. Configure the relevant security settings as needed.

    If you set the security mode to either WPA3-SAE or WPA3-SAE-Transition, you can enable Hash-to-Element (H2E) only or Simultaneous Authentication of Equals Public Key (SAE-PK).

    • H2E only: Use hash-to-element-only mechanism for PWE derivation.

    • SAE-PK: Enable or disable WPA3 SAE-PK.

      When SAE-PK is enabled, you are required to set an SAE-PK private key.

  5. Click OK.

Configuring WPA3 OWE - CLI

To configure WPA3 OWE only

Clients that support WPA3 can connect with this SSID.

config wireless-controller vap
    edit "80e_owe"
        set ssid "80e_owe"
        set security owe
        set pmf enable
        set schedule "always"
    next
end
To configure WPA3 OWE Transition

Clients connect with normal OPEN or OWE depending on its capability. Clients which support WPA3 connect with OWS standard. Clients which cannot support WPA3 connect with Open SSID.

config wireless-controller vap
    edit "80e_open"
        set ssid "80e_open"
        set security open
        set owe-transition enableset owe-transition-ssid "wpa3_open"
        set schedule "always"
    next
    edit "wpa3_owe_tr"
        set ssid "wpa3_open"
        set broadcast-ssid disable
        set security owe
        set pmf enable
        set owe-transition enableset owe-transition-ssid "80e_open"
        set schedule "always"
    next
end

Configuring WPA3 SAE - CLI

To configure WPA3 SAE

Clients that support WPA3 can connect with this SSID.

config wireless-controller vap
    edit "80e_sae"
        set ssid "80e_sae"
        set security wpa3-sae
        set pmf enable
        set schedule "always"
        set sae-password ********
    next
end
To configure WPA3 SAE Transition

There are two passwords in the SSID. If passphrase is used, the client connects with WPA2 PSK. If sae-password is used, the client connects with WPA3 SAE.

config wireless-controller vap
    edit "80e_sae-tr"
        set ssid "80e_sae-transition"
        set security wpa3-sae-transition
        set pmf optional
        set passphrase ********
        set schedule "always"
        set sae-password ********
    next
end
To configure WPA3 SAE and enable H2E only
config wireless-controller vap
  edit "wifi"
    set ssid "Example_SSID"
    set security wpa3-sae
    set pmf enable
    set sae-h2e-only enable
    set schedule "always"
    set sae-password ENC *
  next
end
To configure WPA3 SAE and enable SAE-PK
config wireless-controller vap
  edit "wifi"
    set ssid "Example_SSID"
    set security wpa3-sae
    set pmf enable
    set sae-pk enable
    set sae-private-key "11"
    set schedule "always"
    set sae-password ENC *
  next
end

Configuring WPA3 Enterprise - CLI

Using this option, you can select the auth type to use either RADIUS authentication or local user authentication.

config wireless-controller vap
    edit "80e_wpa3"
        set ssid "80e_wpa3"
        set security wpa3-enterprise
        set pmf enable
        set auth radius
        set radius-server "wifi-radius"
        set schedule "always"
    next
    edit "80e_wpa3_user"
        set ssid "80e_wpa3_user"
        set security wpa3-enterprise
        set pmf enable
        set auth usergroup
        set usergroup "usergroup"
        set schedule "always"
    next
end

WPA3 Security

The following WPA3 security modes are supported by FortiGate devices running FortiOS 6.2.0 and later, and FortiAP-S and FortiAP-W2 device running 6.2.0 and later:

  • WPA3-Enterprise
  • WPA3-Simultaneous Authentication of Equals (SAE)
  • WPA3-SAE Transition
  • Opportunistic Wireless Encryption (OWE)
  • OWE Transition
To configure WPA3 on an SSID - GUI
  1. Go to WiFi Controller > SSID.
  2. Create a new SSID, or edit a current one.
  3. In the WiFi Settings section, set the Security Mode to a WPA3 option.

  4. Configure the relevant security settings as needed.

    If you set the security mode to either WPA3-SAE or WPA3-SAE-Transition, you can enable Hash-to-Element (H2E) only or Simultaneous Authentication of Equals Public Key (SAE-PK).

    • H2E only: Use hash-to-element-only mechanism for PWE derivation.

    • SAE-PK: Enable or disable WPA3 SAE-PK.

      When SAE-PK is enabled, you are required to set an SAE-PK private key.

  5. Click OK.

Configuring WPA3 OWE - CLI

To configure WPA3 OWE only

Clients that support WPA3 can connect with this SSID.

config wireless-controller vap
    edit "80e_owe"
        set ssid "80e_owe"
        set security owe
        set pmf enable
        set schedule "always"
    next
end
To configure WPA3 OWE Transition

Clients connect with normal OPEN or OWE depending on its capability. Clients which support WPA3 connect with OWS standard. Clients which cannot support WPA3 connect with Open SSID.

config wireless-controller vap
    edit "80e_open"
        set ssid "80e_open"
        set security open
        set owe-transition enableset owe-transition-ssid "wpa3_open"
        set schedule "always"
    next
    edit "wpa3_owe_tr"
        set ssid "wpa3_open"
        set broadcast-ssid disable
        set security owe
        set pmf enable
        set owe-transition enableset owe-transition-ssid "80e_open"
        set schedule "always"
    next
end

Configuring WPA3 SAE - CLI

To configure WPA3 SAE

Clients that support WPA3 can connect with this SSID.

config wireless-controller vap
    edit "80e_sae"
        set ssid "80e_sae"
        set security wpa3-sae
        set pmf enable
        set schedule "always"
        set sae-password ********
    next
end
To configure WPA3 SAE Transition

There are two passwords in the SSID. If passphrase is used, the client connects with WPA2 PSK. If sae-password is used, the client connects with WPA3 SAE.

config wireless-controller vap
    edit "80e_sae-tr"
        set ssid "80e_sae-transition"
        set security wpa3-sae-transition
        set pmf optional
        set passphrase ********
        set schedule "always"
        set sae-password ********
    next
end
To configure WPA3 SAE and enable H2E only
config wireless-controller vap
  edit "wifi"
    set ssid "Example_SSID"
    set security wpa3-sae
    set pmf enable
    set sae-h2e-only enable
    set schedule "always"
    set sae-password ENC *
  next
end
To configure WPA3 SAE and enable SAE-PK
config wireless-controller vap
  edit "wifi"
    set ssid "Example_SSID"
    set security wpa3-sae
    set pmf enable
    set sae-pk enable
    set sae-private-key "11"
    set schedule "always"
    set sae-password ENC *
  next
end

Configuring WPA3 Enterprise - CLI

Using this option, you can select the auth type to use either RADIUS authentication or local user authentication.

config wireless-controller vap
    edit "80e_wpa3"
        set ssid "80e_wpa3"
        set security wpa3-enterprise
        set pmf enable
        set auth radius
        set radius-server "wifi-radius"
        set schedule "always"
    next
    edit "80e_wpa3_user"
        set ssid "80e_wpa3_user"
        set security wpa3-enterprise
        set pmf enable
        set auth usergroup
        set usergroup "usergroup"
        set schedule "always"
    next
end