netviz

802.11 · WiFi

Captive portal on Wi-Fi 6E a guest portal that finally encrypts

Same captive-portal experience as any café — but on the 6 GHz band the 'open' guest link is already encrypted (by OWE) before you ever reach the login page. The bouncer logic is unchanged; what changed is that nobody nearby can read your session, even before you log in.

Sequence diagram poster of the WPA2 4-way handshake

Requesting scene from the content service…

6 GHz
no open networks
OWE
encrypts before login
two independent locksMAB → redirect → CoAMFP requiredno open fallback

What you'll learn

  • Why 6 GHz forbids open guest networks, forcing CWA to run over OWE.
  • How OWE's Diffie-Hellman and 4-way complete BEFORE the captive-portal flow begins.
  • Why the portal now has two independent locks: the OWE link and the portal's TLS.
  • Why the CWA mechanics (MAB, redirect ACL, CoA) are byte-for-byte identical to the Wi-Fi 5 plate.
  • A new 6 GHz failure mode: a client that can't do OWE/MFP never reaches CWA at all — there's no open fallback.

The open guest network that isn't open

Wi-Fi 6E bans open BSSes on the 6 GHz band, so a passwordless guest network must run OWE (Enhanced Open). The result is the best of both worlds: users still get the no-password, captive-portal experience they expect, but their link is encrypted with a per-client key as soon as the OWE exchange completes — before they ever reach the login page.

The Central Web Authentication flow itself — MAC Authentication Bypass, the RADIUS redirect, the ISE portal, the Change of Authorization — is identical to the Wi-Fi 5 plate. Only the layer beneath it changed: an OWE-encrypted link instead of cleartext.

Same portal, stronger floor

On the old open guest SSID, the portal's HTTPS was the only thing protecting credentials and the passive-sniffing exposure was real. Running the same portal over OWE adds defense in depth and removes that exposure structurally. The plate keeps the Wi-Fi 5 failure modes (redirect-ACL mismatch, blocked CoA on UDP 1700) and adds the 6 GHz one: a legacy client without OWE or management-frame protection simply can't associate, so it never reaches the portal — and there is no open network to fall back to.

← Previous plate

Captive portal (CWA) · Wi-Fi 5

Next plate →

OWE · Enhanced Open

Atlas index