Cisco Meraki WPA3 Encryption and Configuration Guide

Introduction

This guide provides an in-depth look at WPA3 encryption, a significant advancement in Wi-Fi security. Introduced by the Wi-Fi Alliance in 2018, WPA3 enhances authentication, strengthens cryptographic capabilities, and mandates Protected Management Frames (PMFs) for improved network security. This document aims to help users make informed decisions regarding their network security by explaining WPA3's features and implementation within Cisco Meraki networks.

WPA3 is enabled by default on wireless networks configured for MR 27.X. Legacy access points (802.11ac Wave-1 or older) may not support WPA3; in such cases, traffic will be encrypted using WPA2 if a WPA3 SSID is configured.

Encryption Modes

Cisco Meraki supports two primary WPA3 modes:

WPA3-Personal: Offers enhanced password-based authentication using Simultaneous Authentication of Equals (SAE), providing stronger protection against password guessing.
WPA3-Enterprise: Delivers advanced security for sensitive data transmission with 192-bit cryptographic strength, aligning with high-security network standards.

WPA3-Personal Explained

WPA3-Personal utilizes SAE, building upon WPA2-PSK. It allows authentication solely through a passphrase, adding a security layer by authenticating both the client device (STA) and the Meraki Access Point (AP) before association. This process is particularly beneficial for non-complex passphrases.

WPA3-Personal includes two variants:

WPA3 Only: The access point only accepts clients using WPA3 SAE.
WPA3 Transition Mode: Allows both WPA2 and WPA3 clients to connect to the same SSID, ensuring compatibility for older devices.

WPA3-Enterprise Explained

WPA3-Enterprise enhances WPA2 by providing 192-bit security through the 802.1x standard, making it suitable for enterprise environments like government, defense, and finance. For WPA3-Enterprise to function, RADIUS servers must support specific EAP ciphers, including TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_DHE_RSA_WITH_AES_256_GCM_SHA384.

The WPA3-Enterprise process involves a series of authentication steps, including probe requests and responses, 802.11 authentication, association requests, and an EAP process utilizing EAP-TLS for credential exchange with the RADIUS server.

Configuration Steps

To enable WPA3-SAE, navigate to Wireless > Access Control and set the WPA encryption mode to WPA3 only.

For WPA3 Transition Mode, navigate to Wireless > Access Control and select WPA2 and WPA3 (transition mode).

For WPA3-Enterprise, navigate to Wireless > Access Control, select Enterprise with my RADIUS server, and configure the RADIUS server accordingly.

Compatibility and Recommendations

The guide also details client behavior charts for WPA3 Personal based on dashboard configurations and discusses compatibility for different bands (2.4/5GHz and 6GHz). It is recommended to use distinct SSID names when encryption modes are mismatched (e.g., WPA2 on 2.4/5GHz vs. WPA3 on 6GHz) to avoid compatibility issues.

	Cisco Meraki MR46 Datasheet: High Performance 802.11ax Wireless Access Point Detailed datasheet for the Cisco Meraki MR46, a cloud-managed 4x4:4 802.11ax wireless access point offering high performance, enterprise-grade security, and advanced features for demanding network deployments. Includes specifications, features, and performance data.
	CW9163 Installation Guide - Cisco Meraki Access Point Comprehensive installation guide for the Cisco Meraki CW9163 series cloud-managed 802.11ax access points, covering setup, configuration, mounting, and troubleshooting.
	The Smart Branch With an Even Smarter Network: Cisco Meraki Solution for Financial Services Explore how Cisco Meraki's cloud-managed networking solutions empower financial institutions to create smart branches, enhance security, improve IT efficiency, and transform customer experiences. This guide details key benefits and features for the financial services sector.
	Cisco Meraki MR28-HW/GR12-HW Installation Guide This document provides installation instructions for the Cisco Meraki MR28-HW/GR12-HW, a dual-band enterprise-class 802.11ax cloud-managed access point. It covers package contents, hardware features, mounting procedures, network configuration, power options, and regulatory compliance information.
	Cisco Meraki MR86 Quick User Guide This guide provides a brief overview of the Cisco Meraki MR86, including its features, hardware specifications, compliance, placement, and troubleshooting.
	Vodafone Connected Business: Cisco Meraki Setup Guide A comprehensive setup guide for Vodafone's Connected Business solutions, featuring Cisco Meraki hardware including MS switches, MR/CW access points, MX security appliances, and MG cellular gateways. Learn how to install, configure, and log in to the Meraki dashboard for seamless network management.
	Cisco Meraki MR46 Installation Guide This guide provides instructions on how to install and configure Cisco Meraki MR46 dual-band enterprise class 802.11ax cloud-managed access points. It covers physical specifications, product features, security, power options, LED indicators, package contents, mounting instructions, and basic troubleshooting.
	Cisco Meraki Retail Solution Guide: Deliver Elevated Customer and Employee Experiences A guide from Cisco Meraki on leveraging cloud-managed IT solutions to transform customer and employee experiences in retail, focusing on unifying operations, enhancing security, and gaining insights.