Support for WPA3 security modes on FortiWiFi units operating in Client Mode

GUI support is available in FOS 7.4.2. For more information, see GUI support for WPA3 security mode on Client mode FortiWiFi units 7.4.2.

This release supports WPA3-SAE and OWE security modes on FortiWiFi units operating in wireless client mode. When the local radio of a FortiWiFi 8xF/6xF/40F model is operating in client mode, it can connect with third-party SSIDs with a WPA3-SAE or OWE security mode.

CLI changes

config wifi-networks
  edit < ID >
    set wifi-security [open | wpa-personal | wpa3-sae | owe]
  next
end

To configure WPA3 security mode SSID on a FortiWiFi running in client mode - CLI:

1. Change the wireless mode to client.

   config system global
     set wireless-mode client
   end

   Note: You must remove any AP WiFi configurations such as SSIDs, DHCP servers, policies, and software switch members before you can change the mode to Wireless Client. Once you select Wireless Client, the FortiWiFi unit will reboot.

2. Create a wireless network by connect to a third-party SSID and setting the security mode. In this example, the SSID is FOS_101F_WAP3_SAE and the security mode is WPA3 SAE.

   config system interface
     edit "wifi"
       config wifi-networks
         edit 1
           set wifi-ssid "FOS_101F_WAP3_SAE"
           set wifi-security wpa3-sae
           set wifi-passphrase *
         next
       end
     next
   end

To verify the connection status:

1. Verify the connection between the local radio and the third-party SSID with diagnose wireless-controller wlsta cfg.

   diagnose wireless-controller wlsta cfg
   STA intf        name: wlan17
                 status: up
                     ip: 3.1.1.2
                    mac: d4:76:a0:18:e0:8f
           auto connect: yes
              auto save: no
                ap band: any
       wifi network cnt: 1
                      1: FOS_101F_WPA3_SAE, 19, 1
              connected: FOS_101F_WPA3_SAE