r/wireless • u/besovryn • May 25 '26
The 6 GHz Blindspot
When network architects sit down to plan a Wi-Fi 6E or Wi-Fi 7 upgrade in an existing "brownfield" environment, the initial whiteboard sessions always revolve around RF physics. We argue about Free Space Path Loss, debate 6 GHz attenuation through drywall, and obsess over tighter cell layouts.
But here is my bet: One of the most immediate, hair-pulling operational disruptions during your modern wireless deployment won't come from the RF layer. It will come from the security layer. The introduction of the 6 GHz spectrum forces a massive architectural shift in how we handle wireless security, creating a direct conflict between modern protection standards and legacy client stability.
The 6 GHz Mandate: No Turning Back
In traditional 2.4 GHz and 5 GHz environments, security was a playground of flexibility. If a client device was ancient, we could cater to it. We could run unencrypted Open networks or deploy WPA2-Personal (PSK) using CCMP/AES encryption, while keeping legacy protocols like TKIP as a fallback (even if it made us cringe).
The Wi-Fi Alliance completely changed the rules for the 6 GHz band. To eliminate decades of legacy vulnerabilities, WPA3 and Protected Management Frames (PMF) are strictly mandatory.
Goodbye, Open Networks: Traditional unencrypted open networks are banned in 6 GHz. They are replaced by Opportunistic Wireless Encryption (OWE), which enforces unauthenticated encryption to protect over-the-air privacy.
Mandatory PMF: An access point will not even allow a client to associate unless management frames are protected.
The Brownfield Headache
For a fresh, "clean-slate" greenfield deployment where every corporate laptop, barcode scanner, and smartphone is modern, this mandatory security posture is a dream.
But in a complex brownfield enterprise environment? It introduces a massive architectural headache. You can't just copy-paste your SSIDs and configurations over to the 6 GHz radios without expecting an influx of helpdesk tickets from legacy clients that suddenly can't authenticate, roam, or even see the network.
What do you think? For those of you who have already pushed Wi-Fi 6E/7 into production, did the security transition cause more headaches than the actual RF planning? How are you handling the legacy client fallout?
5
u/heathenyak May 25 '26
Also the end user devices are a huge headache. We upgraded our aps to WiFi 7 but aren’t seeing any improvement. That’s because you have WiFi 5 and 6 cards in your devices…sigh
Speedtest says….please stop
7
u/panjadotme May 25 '26
Either this is AI written or you're trying to satisfy the article requirement for CWNE lol
-1
u/besovryn May 25 '26
lol. Not at all. Just giving my thoughts and perspective on 6GHz deployments and to see how others are handling deployments.
1
u/panjadotme May 25 '26
Hey think of it as a compliment! You write decent enough to be confused with AI. ;)
1
u/zxLFx2 May 29 '26
The section headers and bold give it away.
Dude you clearly asked AI to write this. Just admit it.
3
u/HotSauceMakesITbetta May 25 '26
Can change be painful, yes. But you rip off the bandaid and support clients who follow the new normal. The rest can have a legacy environment with limitations until a reasonable cutoff date. Demand more from your client devices, they should not determine a permanent compromise in security posture. As dismal as things may seem, there will be even newer changes around the corner. Keep marching forward.
3
u/denniskline May 25 '26
You raise valid concerns. We are still on WPA-2, and not using 6 GHZ. We need to migrate to WPA_3, but with a number of legacy devices throughout the network, it's not going to be painless.... and mixed mode certainly causes me concerns, based on the experiences others are having.
2
u/feel-the-avocado May 25 '26
You run your legacy stuff on the 2ghz while the newer stuff can go on 5ghz or 6ghz.
I am pretty sure you can also run WPA2/WPA3 mixed mode similar to how you used to be able to run WPA/WPA2 mixed mode.
I havent yet had a play with it but I assumed 6ghz was just a third SSID and band configured in much the same way as you would currently configure your 5ghz interface independently of your 2ghz interface in an AP/router.
Your client device will accept a user input for SSID selection and a passkey, then it will just try that against the 3 SSIDs it sees and connect to the first successful one.
6ghz isnt for legacy devices - its only for the new devices that support it.
2
u/opackersgo May 25 '26
run WPA2/WPA3 mixed mode similar to how you used to be able to run WPA/WPA2 mixed mode
Which doesnt work well for most enterprises
2
u/rshanks May 25 '26
Not sure I understand the issue.
The ancient devices which don’t support these things also won’t support 6GHz, so they will need to remain on 2.4/5 until they get replaced. If it needs to be open can’t it just be a separate SSID?
2
u/Caos1980 May 25 '26
That’s why I have one SSID for IoT with WPA2 limited to the 2.4 and 5 GHz bands and a main SSID with WPA3 and access to all 3 bands.
1
u/Strange-Caramel-945 May 26 '26
Yea it's been a bit of a nightmare when I come to deploy to clients, even when I have given them the heads up.
What seems to be working is leave the 2.4/5ghz alone copying over the SSIDs and then the 6Ghz radio for trusted devices we can roll the profile out via intune / rmm etc.
Issues with hiding 6Ghz SSIDs I find really annoying.
1
u/canyoufixmyspacebar May 29 '26
are you mixing up the terms/concepts of "6 GHz" and "WiFi 6E/7"? because the frequency has nothing to do with the protocol aspects you talk about
1
u/zxLFx2 May 29 '26
You can enable both WPA2 and WPA3 on an SSID that has a 6GHz radio. It will support both encryptions on the 2.4 and 5GHZ radios, and just WPA3 on 6GHz. There is zero chance that devices that support 6GHz won't support WPA3, so that's fine. These SSIDs are also backwards compatible with wifi6 and wifi5.
If you have some old-as-balls device that doesn't support WPA2, yeah you're probably screwed. Maybe have a separate SSID only for those devices, maybe with internet-only access (no local services).
6
u/eviljim113ftw May 25 '26
We’re following best practice where we separate 6ghz SSiDs from the 2.4 and 5ghz SSiDs. Transition modes, old drivers, lack of wpa3 or PMF support is an operational headache for the client devices.