Wi-Fi security: WPA2, WPA3 and guest networks

Why Wi-Fi needs special care

A cable stays inside the building. Radio waves do not: anyone in the car park, the next office or the street can receive your Wi-Fi frames. So Wi-Fi security must do two jobs: authentication (only allowed people and devices may join) and encryption (people who are not allowed cannot read what is sent).

From open to WPA3

What WPA3 improves

• SAE (Simultaneous Authentication of Equals) replaces the WPA2-Personal PSK handshake. With WPA2-Personal, someone who records a client joining can try passwords offline as fast as their computer allows. SAE stops this offline guessing: each guess needs a live exchange with the AP.
• Forward secrecy: even if the passphrase leaks later, traffic recorded earlier cannot be decrypted.
• PMF (Protected Management Frames, 802.11w) is mandatory, so fake "disconnect" frames cannot knock clients off.
• WPA3-Enterprise has an optional 192-bit mode with stronger algorithms, for government, defence and finance.

Many networks run WPA3 transition mode (WPA2 and WPA3 on the same SSID) while older devices are replaced. It helps compatibility, but the older devices still use WPA2.

Personal versus Enterprise

Personal mode uses one passphrase shared by everyone: PSK (pre-shared key) in WPA2, SAE in WPA3. It is simple, and fine for homes and very small shops. In a company it has big problems: when someone leaves, they still know the password, and changing it means re-entering it on every device. You also cannot tell who did what.

Enterprise mode uses 802.1X: each user or device logs in with its own credentials, checked by a RADIUS server (for example Cisco ISE or Microsoft NPS). The client is the supplicant, the AP or WLC is the authenticator, and RADIUS is the authentication server. Common EAP methods are EAP-TLS (certificates on both sides, the strongest) and PEAP (username and password inside a protected TLS tunnel). Disabling one account removes one person, without touching anyone else.

Guest networks

• Use a separate SSID mapped to a separate VLAN, with an ACL or firewall rule that allows only the internet, never internal networks.
• Turn on client isolation (also called peer-to-peer blocking), so guests cannot reach each other's devices.
• A captive portal is the web page that appears before access is given: you accept terms, or enter a mobile number and an OTP. Many Indian railway stations and airports offer free Wi-Fi this way. Remember that a captive portal by itself does not encrypt traffic over the air.
• Limit bandwidth per guest and set session timeouts.

Common mistakes and fixes

• An office passphrase shared years ago and never changed. Move staff to 802.1X, or at least rotate the passphrase when people leave.
• WPS (Wi-Fi Protected Setup) left on. Its PIN method can be guessed in hours. Turn WPS off.
• Short or guessable passphrases like the company name and year. Use at least 12 characters, better a long phrase.
• Guests on the same VLAN as staff, or able to reach printers and servers. Separate them.
• Still allowing WEP or TKIP "for one old scanner". Replace or isolate that device instead of weakening everyone.