Open Guest SSID transition to WiFi 7

[Ryan2024]

We currently have an Open SSID for guests. My understanding is that OWE will only work for clients that support WiFi 7, which unfortunately isn't feasible in our environment. The alternative is to switch it from Open to PSK, and then enabling WPA3 transition mode (which is what our secured networks are already using).

Is there anything I'm missing? We pretty much have to switch to PSK if we want to use WiFi 7? If so and you already do this, how often are you changing the password? How are you distributing it to guests/vendors? Any other suggestions or considerations?

[KarstenI · Accepted solution]

Not only Wi-Fi 7, it is also required with Wi-Fi 6E. 

I would not configure Transition mode, I always configure two SSIDs, "Guests" which is open and "Guests-Secure" with OWE. Guests-Secure is used in 6 GHz, while both are announced in 5 GHz.

Clients that are not OWE-compatible might try the OWE one and fail. But they typically directly try the legacy SSID which will work.

[Ryan2024]

In the documentation it says, "Note: All SSIDs need to be compliant for Wi-Fi 7 to be enabled with MR 31.1.x and above firmware versions"

So my understanding was that you couldn't use WiFi 7 at all in a network if any of its SSID weren't compliant with WiFi 7 requirements. Am I misinterpreting the documentation, is the documentation wrong, or are you running older firmware that has different requirements?

[KarstenI]

This is a firmware limitation (an annoying one) of the specific release that hopefully will be resolved. If you have legacy systems that can not connect with Wi-Fi 7 compliant settings, I would disable 11be in the Radio profile until Meraki fixes this problem. You can still implement all the settings to run Wi-Fi 6/6E on your shiny new APs.

[Ryan2024]

Fortunately we are still in the planning phase, so we don't have any new equipment yet. It will be a multi-year rollout. You're thinking that with future firmware revisions we will be able to have something like this running simultaneously?

Employee SSID (WPA3 Radius) - WiFi 7

Guest SSID (Open) - WiFi 6

Guest SSID (OWE) - Wifi 7

[KarstenI]

IMO, Windows 11 is not yet compatible with WPA3-Enterprise *and* Wi-Fi 7.

I expect this to be resolved for the Meraki firmware because it would be a showstopper for any company with legacy clients.

OWE would be typically used for Wi-Fi 7 and Wi-Fi 6E where 7 is not yet available.

[PhilipDAth]

My advice - don't do this.

WPA3 has terrible driver compatibility.  Transition mode is even worse.

You'll end up with many devices that can't connect or can not connect reliably.

[Ryan2024]

Is your recommendation to not use the 6GHz band at all then?

[PhilipDAth]

The only way I have gotten it to work is to create a separate SSID.  Move those devices across that can connect.  Move those devices back again that become unreliable.

[cmr]

100% agree with @PhilipDAth here.  I've found a modern HP Probook Windows 11 laptop to be very reliable and a Samsung S22 Ultra to be a right pain...  Testing each device is definitely needed.