WPA3-Enterprise Mode lead client cannot join

Null

Customer feedback they use WPA3 enterprise and one of the user is unable to connect with dot1x parameter SSID “Mobile: Redmi A2+” Although, can connect to PSK authenticated SSID. Furthermore, user ID is ok and able to login on other devices.

Check the configuration of the WLC, and the wlan service-template shows that this SSID used the WPA3 enterprise mode, but the phone use the WPA/WPA2 enterprise

The WPA3 Enterprise mode, also called WPA3-dot1x, is only used for enterprises wanting to use 802.1x to let their clients join the wireless network.

The WPA3 personal mode also called WPA3-SAE this mode is used for family environments with PSK Auth.

The WPA3 personal mode can be configured to be backward compatible with the configure of <pmf mandatory/optional>, when using the optional it can be backward compatible.

However, the WPA3 enterprise mode cannot be configured to be backward compatible. It will force the client to use the WPA3 Encryption Algorithm, If the client does not support the Negotiation will fail.

You can see when I want to make the WAP3-Enterprise mode backward compatible, the AC will forbid me to like to do this.

if you want to let some old devices join the dot1x wireless network please use WPA2-enterprise. But it is not recommended to change the security set, because it will make your wireless network more vulnerable.

Typical Configuration can be see at knowledge here:

WPA3 different mode Service template configuration Compare