Wi-Fi Security: WPA3, 802.1X and Guest Isolation That Actually Isolates

Wi-Fi doesn't stop at your office walls. Someone sitting in a car park or in the office downstairs can see your SSIDs and try to join. The three problems we find most when we audit:

• One Wi-Fi password in use for years, still known to staff who left long ago.
• A "Guest" SSID with a different name, on the same subnet as the servers.
• An old device that forced every AP onto WPA/TKIP so that one machine could connect.

Security modes

WPA3-Personal replaces WPA2's PSK handshake with SAE. What that means in practice: someone who captures the handshake can no longer take it away and guess the passphrase offline, and you get forward secrecy (learning the passphrase later doesn't decrypt traffic recorded earlier). WPA3 also makes Protected Management Frames (802.11w) mandatory, which stops deauthentication attacks that kick users off the network.

The 6 GHz band (Wi-Fi 6E and Wi-Fi 7) allows only WPA3 and OWE. If your SSID is still WPA2, it simply won't broadcast on 6 GHz.

Wi-Fi 7 goes further. Multi-Link Operation (MLO), where one device uses two or three bands at once, requires WPA3 on every link of the connection, and Wi-Fi 7 adds stronger options such as GCMP-256 encryption. A WPA2 or WPA2/WPA3 transition SSID therefore cannot give Wi-Fi 7 laptops and phones their full benefit. During a migration, many sites run a separate WPA3-only SSID for new devices.

802.1X (Enterprise): each person signs in with their own account or a device certificate through a RADIUS server tied to Active Directory or Entra ID. When someone leaves, you disable one account instead of changing the Wi-Fi password for everyone. Choose EAP-TLS (certificates) for managed devices. If you use PEAP (passwords), configure clients to always validate the RADIUS server certificate; without that, a rogue AP can harvest user credentials.

OWE (Enhanced Open): connects without a password like open Wi-Fi, but each client gets its own encryption, so the person at the next table can't eavesdrop. OWE doesn't prove the AP is genuine, so it doesn't stop evil twins. Some phones and laptops still don't support OWE; use the OWE transition mode most APs offer so older devices can still connect as open.

One more reason to leave PEAP-MSCHAPv2 behind: since Windows 11 version 22H2, Credential Guard is enabled by default on many business PCs, and it blocks the automatic sign-in that MSCHAPv2-based Wi-Fi relied on. Users get repeated password prompts or cannot connect at the login screen. Microsoft's recommended path is certificate-based EAP-TLS. For RADIUS, the usual options are Windows NPS, the cloud RADIUS service some Wi-Fi platforms include, or FreeRADIUS; certificates are easiest to deploy through a device-management tool such as Intune.

SSIDs and VLANs

Every SSID adds beacons that eat into everyone's airtime. Three or four SSIDs cover almost every organization:

Don't put CCTV cameras, fingerprint scanners and smart TVs on the same SSID as laptops. They are hard to update and often become an attacker's foothold.

Guest isolation that really isolates

• Dedicated guest VLAN, with the firewall blocking all internal ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), including the gateway and AP/controller admin pages
• Client isolation on, so guests can't see each other
• Per-user bandwidth limits so one heavy download can't fill the office line
• DNS filtering to block malicious domains
• Test it yourself: join guest Wi-Fi, then try to ping and open the admin pages of the router, NVR and servers. If anything answers, isolation isn't working
• Connection logs (MAC, time, assigned IP) kept for a period so you can trace problems later

Worked example: sizing the guest limit

A hotel lobby and restaurant share a 200 Mbps line. On a busy evening 80 guest devices are connected, though rarely more than a quarter of them pull data at the same moment. Set a per-device limit of about 5 Mbps down and 2 Mbps up: enough for video calls and HD streaming, while 20 active devices at full rate still use only 100 Mbps. Then reserve bandwidth for the POS, the booking system and staff with the firewall's traffic shaping, so a busy guest network never blocks a card payment. Check the real numbers in the controller after the first month and adjust. Our bandwidth calculator helps with the first estimate.

Other protections

• WIDS/WIPS in the controller: alerts when an AP broadcasts your SSID (evil twin) or when someone plugs in their own AP.
• WPS off everywhere.
• Firmware updates for APs and controller at least quarterly.
• Admin interfaces reachable only from the management VLAN.

Mistakes we keep finding

• A hidden SSID or MAC filtering treated as security. Both are visible to anyone with a free capture tool in a few seconds.
• The staff passphrase printed on the restaurant menu because "guests kept asking".
• Guest traffic bridged at the AP onto the native VLAN, so the guest SSID ends up on the office subnet after an AP is replaced.
• The same passphrase at every branch for years, so one leak opens every site.
• Captive portal pages served over plain HTTP that collect phone numbers or room numbers.

Moving to WPA3 without dropping devices

1. Inventory devices. Laptops and phones from the last several years mostly support WPA3. Printers, barcode scanners, card terminals and older IoT often don't.
2. Turn on WPA3 transition mode on the staff SSID for a while, and check in the controller which clients still connect with WPA2.
3. Move legacy devices to the Devices SSID on its own firewall-restricted VLAN.
4. Switch the staff SSID to WPA3-only once no WPA2 clients remain. Transition mode left on forever means attackers can still go after the WPA2 side.
5. Write WPA3 and 802.1X support into purchasing requirements for every new device.

Different sites, different answers

SME office (under 30 people, no directory): WPA3-Personal for staff with the passphrase changed when someone leaves, plus a guest SSID on its own VLAN with client isolation.

Mid-to-large organizations, banks, government: 802.1X tied to the directory, EAP-TLS for managed devices.

Hotels and restaurants: captive portal with per-room or per-day codes, OWE in transition mode, and the POS system on its own VLAN rather than the staff SSID.

Mines and factories: a dedicated SSID for industrial devices and site tablets, firewall-restricted. Outdoor and rooftop APs must be weatherproof outdoor models with surge protection on the PoE run, because the rainy season and lightning in Laos regularly take out APs and switch ports.

Things we see on Lao sites

The ISP's fibre router usually ships with its own Wi-Fi switched on, often still with the password printed on its label. If your APs carry the office Wi-Fi, turn the ISP router's radio off, or that label becomes a back door that bypasses everything above. In shared office buildings, check which SSIDs belong to you before you change anything; neighbours' networks with similar names are common. Mine camps and worker dormitories need client isolation and per-person vouchers even more than hotels, because hundreds of personal phones share one network for months. And when the power drops at 17:30, APs reboot unless their PoE switch is on a UPS, which looks to users like "the Wi-Fi is bad".

Test your guest Wi-Fi yourself first

Connect a phone to guest Wi-Fi and type your router's or NVR's IP into the browser. If a login page appears, send us that screenshot along with your AP and controller models. We'll tell you which settings to fix and design an SSID/VLAN layout that suits the equipment you already have.