User's Guide

Table 60: WLAN Service Configuration Settings (continued)
Field Description
WiNG 7.2.x or later utilize the WPA3-Personal protocol.
Older AP models that are not WPA3 compatible use WPA2
AES. See Privacy Settings for WPA3 with SAE on page 225.
• WPA3-Enterprise — WPA2-Enterprise with Protected
Management Frames (PMF). This option requires and
enforces PMF enablement. The TKIP-CCMP option is
disabled.
Note:
The AP4000 6 GHz radio supports only the following 6E WFA
Compliant network authentication methods:
• OWE (Opportunistic Wireless Encryption) for Open
Networks
• WPA3-Personal (SAE/H2E)
• WPA3-Enterprise
• WPA3-Compatability
Extreme Campus Controller requires that your 6 GHz radio
network assignment be 6E WFA compliant. It rejects network
configuration changes that result in a 6 GHz radio network
assignment that are not compliant. It might be necessary to
redefine your networks when configuring the 6 GHz radio on
the AP4000.
A green icon displays on the user interface when the Auth Type
is 6E WFA Compliant.
Enable Captive Portal Check this option to enable captive portal support on the
network service.
Captive Portal Type See Captive Portal Settings on page 243.
MAC-based Authentication The following parameter displays when MAC-based
Authentication is enabled:
• MBA Timeout Role. Select the role that will be assigned to a
wireless client during MAC-based authentication (MBA) if
the RADIUS server access request times out. If no MBA
Timeout Role is selected, then a RADIUS server timeout is
treated like an Access-Reject, which prevents the client from
accessing the network. Other options:
◦ — create a new role
◦ — edit role
◦
— delete role
• Two-stage authentication is supported oering a
combination of MAC-Based (MBA) authentication and
WPA2-Enterprise (802.1x/EAP). The wireless client is first
authenticated using MBA and then, in stage 2, the client
authenticates with WPA2-Enterprise (802.1x/EAP).
Configure WLAN Service Settings
Extreme Campus Controller User Guide for version 5.46.03 223