Configuring Global WLAN Passphrase Complexity and Enhanced Security

Configure the global WLAN passphrase complexity and enhanced security settings to control PSK strength and disable insecure WLAN encryption methods for all WLANs on the controller.

Complete the following steps to configure WLAN Passphrase Complexity and WLAN Enhanced Security.

Note: These settings are system‑wide and apply to all WLANs in all Domains and partner Domains. Only Super Admin users can change them in the web UI or through the public API.
  1. In the controller web UI, select Administration > Administration > Admins and Roles > Account Security.
    The Global Security and Account Security sections appear.
  2. In the Global Security section, locate WLAN Enhanced Security. Toggle ON to prevent WLANs from using insecure encryption methods, including WPA‑mixed, OWE‑transition, or None.
      Note:
    • With WLAN Enhanced Security enabled, existing WLANs using insecure methods stay in the configuration, but creating, cloning, importing, or editing WLANs to apply or configure those insecure methods in WLANs is not allowed.
    • Assigning WLANs to Mobile Virtual Network Operators (MVNO) is blocked when WLAN Enhanced Security is enabled.
  3. In the Global Security section, locate WLAN Passphrase Complexity. Toggle ON to enforce strong passphrase requirements by requiring either a mixed‑character ASCII string or a 64‑character hexadecimal string for the WLANs. By default, the WLAN Passphrase Complexity toggle is OFF, and the controller uses standard passphrase validation (8 to 63 ASCII characters or a 64‑character hexadecimal string).
    Note: The complexity check applies only to new WLANs or when existing passphrases are modified; previously saved passphrases are not validated again until modified.

    Do one of the following:

    • Select Minimum String Length to require a mixed‑character ASCII passphrase and enter the value of minimum string length from 12 to 63 characters. The passphrase must include uppercase and lowercase letters, numerals, and special characters.

    • Select Hex String with 64 Characters to require a fixed‑length hexadecimal passphrase. The passphrase must contain exactly 64 hexadecimal characters (0–9, A–F, a–f).

    Note: This feature is not supported when 802.1X EAP or 802.1X EAP & MAC authentication is selected, or when Internal DPSK or External DPSK is enabled.
  4. Click OK to apply changes. Click Refresh to load most recently saved changes or Cancel to discard unsaved edits.
Parent topic: Configuring WLANs