Dynamic PSK3

Dynamic PSK3 (DPSK3) provides WPA2/WPA3 transition-based dynamic credentials, enabling secure access using WPA3-SAE while allowing onboarding and connectivity for legacy WPA2 clients.

Feature Overview

Dynamic PSK3 extends DPSK by introducing WPA3-SAE support while maintaining backward compatibility with WPA2 clients.

Dynamic PSK3 operates as a WPA3 transition WLAN and creates two WLANs:

  • Intermediate WLAN (DPSK)
    • WPA2-PSK with external DPSK.
    • Used to authenticate the client and establish MAC-to-passphrase binding.
    • Available on 2.4 GHz and 5 GHz.
  • Service WLAN (DPSK/DSAE)
    • WPA2/WPA3 mixed mode (transition mode) on 2.4 GHz and 5 GHz.
    • WPA3-only on 6 GHz.
    • Uses the previously created binding for secure access.

Both WLANs share the same SSID and Dynamic PSK, enabling seamless transition from onboarding to secure access.

Dynamic PSK3 supports two deployment models:

  • Internal Dynamic PSK3 (controller-managed)
  • External Dynamic PSK3 (server-managed)

Requirements

The following are the requirements to deploy a WLAN that uses Dynamic PSK3:

  • Controller with DPSK3 support.
  • Access Points supporting WPA2-PSK, WPA3-SAE, and IEEE 802.11v.
  • WLAN configured with DPSK3 enabled.

Considerations

The following are the considerations to deploy a WLAN that uses Dynamic PSK3:

  • 6 GHz band supports WPA3 only; WPA2 clients cannot connect on 6 GHz.
  • Service WLAN operates in transition mode on 2.4 GHz and 5 GHz, and WPA3-only on 6 GHz.
  • Internal and External DPSK3 have different scalability and management models.
  • External DPSK3 depends on external server availability and connectivity.

Best Practices

The following are the best practices to deploy a WLAN that uses Dynamic PSK3:

  • Use WPA3-capable clients wherever possible to maximize security benefits.
  • Use consistent SSID configuration across Intermediate and Service WLANs.
  • Select Internal or External DPSK3 based on deployment scale.
  • Ensure high availability for controller and external server (for external DPSK3).

Prerequisites

The following are the prerequisites to deploy a WLAN that uses Dynamic PSK3:

  • Required licenses installed and active.
  • Access Points supporting WPA2 and WPA3 (including 6 GHz, if applicable).

In this section:

  1. Configuring Internal DPSK3
    Configuring Internal DPSK3 enables SmartZone to locally generate and manage Dynamic Pre-Shared Keys (DPSKs) for client authentication without relying on an external server. It allows per-user or per-device unique keys, MAC binding, and policy enforcement, enhancing security and access control within WPA2/WPA3-enabled WLANs.
  2. Configuring External DPSK3
    Configuring a WLAN with External DPSK3 requires setting up an external DPSK3 server, creating the required WLANs, and enabling dynamic MAC address–to–passphrase binding to support secure and scalable client access.
Parent topic: Dynamic PSK