Wi-Fi generations

• 1: Wi-Fi 6
• 2: Wi-Fi 6E
• 2.1: Features and benefits
• 2.2: Planning and deployment
• 3: Wi-Fi 7
• 3.1: Features and benefits
• 3.2: Planning and deployment

1 - Wi-Fi 6

Wi-Fi 6 (802.11ax) marks a fundamental shift in wireless networking design, prioritizing efficiency and scalability rather than solely increasing raw speed. Where previous standards focused on maximum data rates, Wi-Fi 6 implements sophisticated mechanisms that enhance performance in dense, multi-client environments.

Building upon the 802.11ac foundation, Wi-Fi 6 delivers several key technical advancements:

• Enhanced modulation schemes with 1024-QAM, increase data rates by 25% in high SNR environments.
• OFDMA technology enables concurrent multi-user transmissions for both downlink and uplink traffic.
• Expanded MU-MIMO capabilities support up to 8 simultaneous users and adds support for UL MU-MIMO.
• Advanced power-saving mechanisms including individual Target Wake Time (i-TWT) extend battery life substantially.

The 802.11ax amendment continues to improve sophistication of 802.11 modulation techniques.

These innovations address critical challenges in modern wireless networks: high client density, diverse application requirements from IoT to video streaming, and deterministic performance needs in mission-critical deployments.

Subsequent sections detail each feature’s technical specifications, implementation considerations, and performance benefits across various use cases.

Increased modulation complexity

Quadrature amplitutde modulation (QAM) encodes data by manipulating both the amplitude and phase of carrier waves. Each point in the QAM constellation represents a distinct symbol, with each symbol encoding multiple bits of information. Higher-order QAM schemes allow more bits to be encoded per symbol, increasing spectral efficiency.

Building on digital modulation schemes in 802.11ac of up to 256-QAM, 802.11ax supports up to 1024-QAM. This means that each RF symbol represents one of 1024 possible combinations of amplitude and phase as illustrated in figure below. The move from 256-QAM to 1024-QAM increases number of bits carried per OFDM symbol from 8 to 10. This can result in up to a 25% increase in PHY data rates and can be attained in clean environments with a high signal to noise ratio (SNR).

The key determinants of PHY data rate are:

• Channel width. Available channel widths are 20 MHz, 40 MHz, 80 MHz, 80 + 80 MHz, and 160 MHz. Wider bandwidths allow use of more subcarriers, for example there are 242 subcarriers in a 20 MHz channel and 996 subcarriers in an 80 MHz channel (hence OFDMA terms RU242 and RU996).

• Modulation and coding. 802.11ax extends the modulation and coding scheme adding 1024-QAM options with coding rates of 3/4 and 5/6. All earlier options are still available, and are used if SNR is too low to sustain highest achievable rate.

• Subcarrier changes. The fast fourier transform (FFT) length was increased from 64 in 802.11ac to 256 in 802.11ax for 20 MHz. This results in a decrease in subcarrier spacing and an increase in number of data subcarriers. These factors contribute to a 10% increase in efficiency over the previous generation.

• Symbol duration. Symbol duration was increased to 13.6 ns, 14.4 ns, and 16 ns. Extended symbol durations result in increased efficiency due to availability of more data tones compared to older standards.

• Guard interval. Guard intervals are necessary to avoid multipath reflections of one symbol from arriving late and interfering with next symbol. Extended guard interval durations of 1600 ns and 3200 ns have been introduced in addition to 800 ns from 802.11ac. Longer guard intervals allow for better protection against signal delay spread in outdoor environments. These could also potentially increase effective range of wireless outdoors.

All above factors contribute to increased PHY data rate and efficiency. Following is a table with 802.11ax data rates for a single spatial stream full-bandwidth client. Note the rates double with 2 spatial streams, triple with 3, and so on until maximum number of spatial streams supported by specification. The included guard intervals (GI) for rates listed below are 1600 ns (1.6 μs) and 800 ns (0.8 μs).

OFDMA

Orthogonal Frequency Division Multiple-Access (OFDMA) is a transmission technique which enables multiple devices to share same Wi-Fi channel at same time through use of subchannels. Wi-Fi was first major consumer technology to adopt OFDM in 1999, and was subsequently used by 3GPP community when designing LTE and now 5G. In turn, Wi-Fi 6 and 6E adopted OFDMA technology from other wireless technologies like WiMAX and LTE.

With OFDMA, multiple clients can simultaneously share a Wi-Fi channel during same transmit opportunity (TxOP) instead of having to take turns. OFDMA enables transmission on a 20 MHz channel up to nine clients at once, versus four as in 802.11ac (with MU-MIMO). This scales linearly as channel width increases i.e. 18 clients for 40 MHz and 37 clients for 80 MHz channels. And when needed, a single client can also use entire channel ensuring better client density does not come at a cost of peak performance. Notably, OFDMA is bidirectional, bringing uplink multi-user capability to Wi-Fi for first time.

Take into consideration a scenario where AP must send data to 3 clients. In 802.11ac Single User (SU) operation, AP would contend for medium and then send three packets consecutively as shown in figure below. Whereas in 802.11ax with OFDMA, transmissions for these 3 client devices are assigned a fractional channel and then sent to all 3 clients simultaneously (during same TxOP).

To summarize, downlink OFDMA (DL OFDMA) allows access point to bundle several frames together with a single preamble, in different sub-channels in a single transmit opportunity (TxOP). Clients can then tune their radios to respective sub-channels to receive their transmissions.

Benefits of OFDMA:

• OFDMA helps in reducing latency between client and Access Point (AP).

• OFDMA helps in reducing contention overhead which means that there is very little deterioration in capacity as number of clients increases. This is helpful in high density environments because OFDMA improves network capacity and efficiency.

• 802.11ax also improves performance for legacy generations. As more Wi-Fi 6 devices enter market and uses OFDMA to reduce airtime consumption, there is more usable airtime leftover for earlier Wi-Fi generations.

Applications and use cases

Voice over Wi-Fi

One of top use cases for OFDMA is Voice over Wi-Fi (VoWi-Fi). In high density environments, where a lot of users are contending for medium access, can result in increased latency and jitter. These factors can cause gaps in re-creation and playback of voice leading to an undesirable user experience. OFDMA also enables strong QoS mechanism by enabling AP to control medium access for both DL and UL. This can eliminate need for individual medium contention and enables the AP to schedule grouped transmissions in one transmit opportunity (TXOP). That is how OFDMA allows AP to better control latency and jitter. With 802.11ax, AP can assign frequent, short transmission opportunities so AP can transmit and receive packets without need to buffer them. OFDMA can be helpful in low-bandwidth streams like Voice over Wi-Fi (VoWi-Fi) by reducing latency and jitter thus improving call quality.

Internet of Things

Important metrics for an Internet of Things (IoT) device include data rate, scalability, range, power consumption, security and ease of configuration. OFDMA divides transmissions across frequency domain and smallest unit of allocated bandwidth can be as small as 2 MHz. This allows more individual devices to be reliably supported on an AP and thus fulfills a critical IoT requirement, scaling. Unlike most of mainstream Wi-Fi applications, IoT devices usually use lower speed connections, often in sub-Megabit range. OFDMA addresses first three requirements of this sector - data rate, scale and range. OFDMA allows sub-channelization which reduces data rates to ~2 Mbps. This inherently helps in improving range of IoT devices.

In addition to this, Wi-Fi 6 also offers various power-save features like TWT, Receive Operating Mode Indication, Transmit Operating Mode Indication, etc. along with 20 MHz-only clients to addresses most of basic requirements for encroaching into IoT Markets.

Video and factory automation applications

OFDMA is ideal for latency sensitive applications like video and factory automation applications. OFDMA enables several to many low-bandwidth streams to be transmitted in parallel. This can aid in reducing latency and jitter.

DL MU-MIMO improvements in Wi-Fi 6 and 6E

Multi-user Multiple-Input, Multiple-Output (MU MIMO) is a multi-user capability, originally introduced in 802.11ac for downlink traffic. MU-MIMO technology improves network capacity by allowing multiple devices to transmit simultaneously, making use of multipath spatial channels.

802.11ax introduces some new enhancements to existing 802.11ac downlink (DL) MU-MIMO. The number of users in a group is expanded up to eight users for MU-MIMO operation. Due to this advancement, now even with devices in single stream mode, MU-MIMO throughput can be doubled over single user operation. The improvement of increasing size of downlink multi-user MIMO groups can result in more efficient operation.

In addition to these improvements, 802.11ax allows uplink (UL) OFDMA as part of sounding protocol, which is more efficient than using single user transmission of feedback used for sounding protocol in 802.11ac.

All these factors can lead to increased capacity and efficiency aimed to be useful for high-bandwidth applications like mission-critical voice calls and video streaming.

Power-save enhancements

Wi-Fi 6 introduces various enhancements to already existing power-save modes. These new and improved power-save mechanisms allow longer sleep intervals and scheduled wake times for client devices. These enhancements were adopted to address power consumption issue mainly for handheld and battery powered devices and are targeted towards emerging IoT markets.

Target Wake Time (TWT)

Target Wake Time (TWT) is a power saving mechanism that was introduced in 802.11ah. A schedule (service period) can be negotiated between each client (station) and corresponding AP, which allows client to sleep for long periods of time and wake up at pre-scheduled (target) times to exchange information with the associated AP. TWT also significantly reduces small and inefficient control frame traffic that clients are required to use regularly to poll AP for buffered frames (PS-Poll or U-APSD). A client can greatly improve power savings with TWT if the client has a known deterministic traffic pattern like an Internet of Things (IoT) environmental sensor that only report sensor data every so often.

There are two types of TWT agreements.

• Individual TWT (i-TWT) is negotiated between an AP and each client to agree on parameters such as wake time, interval, and duration. This enables clients to specify when and how often to wake up.

• Broadcast TWT (b-TWT) is negotiated between an AP and a group of clients where target wake time parameters such as beacon and listen intervals are advertised in beacon frames. Clients will wake during the service period (SP) and contend for medium access. b-TWT may be used over i-TWT for the purpose of simplicity and less management frame overhead.

In addition to reducing contention between clients, use of TWT may also contribute to taking full advantage of other novel mechanisms in IEEE 802.11 universe, such as multi-user transmissions and coexistence in high-density WLAN scenarios. TWT operation is ideal for IoT devices which communicate infrequently. TWT can improve client power savings and reduces airtime contention with other clients.

20 MHz-only operation

20 MHz-only operation feature was specifically introduced for IoT markets. The feature seeks to reduce complexity, leading to low-power, lower-cost chips. Such devices are capable of operating in both 2.4 GHz and 5 GHz bands and also support nearly all Wi-Fi 6 mandatory features.

Receive operating mode indication

Receive operating mode indication enables client (station) to adapt to number of active receive chains and channel width for reception of subsequent PPDUs by using a field in MAC header of a data frame. This mechanism reduces overhead compared to 802.11ac as there is no additional Operating Mode Notification management frame exchange as there is in 802.11ac.

Transmit operating mode indication

This allows client devices (stations) to dynamically adapt their transmit capabilities like channel width and maximum number of spatial streams.

Uplink/downlink (UL/DL) flag

UL/DL flag in every preamble allows to identify frames as transmitted by an AP or client device. This helps client devices to switch off their radio circuitry as soon as they see an uplink bit in preamble.

Backward compatibility

Like previous generations of Wi-Fi, 802.11ax (Wi-Fi 6) is backward compatible and fully supports legacy 802.11a/b/g/n/ac clients. An 802.11ax access point (AP) communicates with each client device using only the protocols supported by that client. Legacy clients capable of 802.11a/b/g/n/ac can associate with an 802.11ax AP but cannot utilize 802.11ax specific features.

Communication remains limited to the most recent Wi-Fi standard supported by the client device. For example, an 802.11ac client associating with a Wi-Fi 6 AP uses only features defined in the 802.11ac Wi-Fi standard. Mixed environments with both Wi-Fi 6 and legacy clients do allow Wi-Fi 6 clients to leverage advanced features such as OFDMA and 1024-QAM.

While 802.11ax includes newer higher-efficiency techniques and frame formats that can only be decoded by other 802.11ax devices, continued support of VHT, HT and older 802.11 equipment is an integral part of standard.

802.11ax radios will communicate with other 802.11ax radios using High Efficiency (HE) OFDM symbols and Physical Protocol Data Unit (PPDU) formats. As far as compatibility with clients is concerned, they can communicate with 802.11a/g, 802.11n (HT) and 802.11ac (VHT) clients using 802.11a/g/n/ac formatted PPDUs. When 802.11ax-only OFDMA conversations are occurring, RTS/CTS mechanism may be used to protect legacy receivers during period when HE transmissions are underway.

This ensures that an 802.11ax AP is a good neighbor to adjacent to older APs while fully embracing all of generations of client devices that exist in environment. 802.11ax has a number of features for co-existence, but main one is extension of an 802.11n/ac technique: The first 20 μs of 11ax preamble uses 802.11a preamble. Non-802.11ax equipment can read first 20 μs and identify that channel will be occupied for a given time, and therefore can avoid transmitting simultaneously with high efficiency frame. Non-802.11ax devices communicating with an 802.11ax AP will still require the entire channel for transmission rather than sharing channel resources through OFDMA subcarrier allocation.

Protection, dynamic bandwidth, and channelization

802.11ax inherits dynamic bandwidth operation and protection mechanisms from 802.11ac standard. There have not been any new modifications to these mechanisms in 802.11ax. 6 GHz aside which is covered in Wi-Fi 6E, channelization for 802.11ax has changed little since introduction of 802.11ac.

When an 802.11ac or 802.11ax AP using an 80 MHz channel is operating in neighborhood of an older AP, or a network that is only using a 20 MHz or 40 MHz channel, newer generation AP must avoid transmitting simultaneously with a station in neighboring network. The question is how this can be achieved without permanently reducing channel bandwidth from 80 MHz.

The solution can be found by answering following questions.

1. How can a station (AP or client) wanting to operate at 80 MHz, warn older stations to stay off air while transmitting in 802.11ac or 802.11ax mode, which 802.11n and older cannot decode?
2. How will 802.11ac or 802.11ax station know that full channel is clear of other stations’ transmissions?
3. How can bandwidth usage be optimized if, for instance, an older station is transmitting in just 20 MHz of 80 MHz channel?

Sending a warning to other stations to stay off air is achieved by request to send (RTS) frames. The 802.11ac station sends out multiple parallel RTS protection frames in each 20 MHz channel in the bonded set, at rates an 802.11a or 802.11n clients can understand. The multiple RTS frames use duplicate, quadruplicate, or octuplicate transmission. Before sending RTS, clear channel assessment (CCA) is performed to ensure no transmissions in progress are heard. On receiving RTS frame, older stations know how long to wait for 802.11ac transmission.

Next, the recipient runs a CCA in each of 20 MHz channels. The RTS frame format is extended so that the originator can indicate channel options and replies with a clear to send (CTS) response to indicate whether transmissions in progress are heard from any neighboring network. If not, originator transmits data frame using full bandwidth (80 MHz in this example).

However, if the recipient does find transmissions in progress on any secondary channel, recipient can still continue responding with CTS, while indicating which primary channels are clear (20 MHz or 40 MHz). Then, originator can transmit using only the usable part of 80 MHz channel. This may force a reduction in channel width from 80 MHz to 40 MHz or even 20 MHz, but frame will be transmitted using airtime that would otherwise be unused. This feature is called dynamic bandwidth operation.

Dynamic bandwidth optimization is constrained by 802.11ac and 802.11ax definitions of primary and secondary channels. For each channel, such as an 80 MHz channel, one 20 MHz channel (subchannel) is designated as primary. This is carried through from 802.11n, and in networks with a mix of 802.11ac or 802.11ax, and older clients, all management frames are transmitted in this channel so that all clients can receive them.

The second part of 40 MHz channel is called secondary 20 MHz channel. And 40 MHz of wide channel that does not contain primary 20 MHz channel is secondary 40 MHz channel. Data transmissions can be in primary 20 MHz channel, 40 MHz channel including primary 20 MHz channel, or full 80 MHz channel, but not in other channel combinations.

Additionally, introduction of wide band channels, especially 80 + 80 MHz channels, requires some changes to channel switch announcement (CSA) frame. CSA is used by an AP to inform associated clients when the AP is about to switch channels after radar has been detected in current channel. CSA was first introduced in 802.11h as part of dynamic frequency selection (DFS). Otherwise, operation of DFS remains unchanged with 802.11ac and 802.11ax.

Wi-Fi 6 (802.11ax) represents an advancement in Wi-Fi aimed at delivering improved efficiency and performance in dense environments with many connected devices. This page describes considerations and deployment strategies for Wi-Fi 6 networks, focusing on key features that enhance efficiency, speed, and battery life.

Unlike the previous 802.11ac standard that primarily focused on increasing data rates, Wi-Fi 6 introduces technologies borrowed from other wireless technology that fundamentally improve how wireless networks handle multiple simultaneous connections. By implementing features like Orthogonal Frequency Division Multiple Access (OFDMA), enhanced Multi-User MIMO (MU-MIMO), and Target Wake Time (TWT), network administrators can enhance both network capacity and client device performance.

Configuration

In general, the recommendation is to use default settings for 802.11ax (HE) unless directed to change per TAC.

High efficiency (HE)

All 11ax specific features fall under High Efficiency (HE) profile in AOS-8 or the SSID profile in AOS-10. Enabling the High Efficiency parameter enables all the 802.11ax features on the radio. Users can utilize Wi-Fi 6 features like TxBF, HE supported higher MCS rates (10 and 11), HE OFDMA, MU-MIMO, TWT, etc.

High Efficiency is enabled by default and is recommended to keep enabled to reap the benefits of 802.11ax.

HE OFDMA

HE OFDMA is enabled by default and is recommended to keep enabled for increased efficiency and reduced latency. OFDMA is best for applications leveraging smaller packet sizes (IoT, Voice applications, etc.) and is suitable for low bandwidth applications.

Transmit beamforming (TxBF)

802.11ax employs an explicit beamforming procedure, similar to that of 802.11ac. Under this procedure, the beamformer (AP) initiates a channel sounding procedure with a Null Data Packet. The beamformee (client) measures the channel and responds with a beamforming feedback frame, containing a compressed feedback matrix. The beamformer uses this information to compute the antenna weights in order to focus the RF energy toward each user which can result in an increased MCS rate.

TxBF is enabled by default. In most deployments, we recommend to keep TxBF enabled for performance benefits in applicable scenarios. In certain very high density deployments, you may consider disabling to minimize sounding overhead.

Downlink MU-MIMO

Downlink MU-MIMO is enabled by default and is recommended to keep enabled in configuration as DL MU-MIMO can lead to increased capacity and enable higher speeds per user in applicable scenarios. DL MU-MIMO for applications that larger packets (video, streaming, etc.) and is suitable for high bandwidth applications.

TWT

A new power saving features offered by Wi-Fi 6 is Target Wake Time (TWT). This feature allows for clients to “wake up” at negotiated times rather than waking up for every beacon.

TWT is enabled by default and is recommended to keep enabled as i-TWT allows capable clients to request specific wake up time to AP, so that clients can go to sleep for longer time than normally and save power.

2 - Wi-Fi 6E

Wi-Fi 6E introduces 6 GHz band support using Wi-Fi 6 technology based on IEEE 802.11ax. The 6 GHz band allows for up to 1200 MHz of additional spectrum for unlicensed Wi-Fi use. Wi-Fi 6E introduces new methods in legacy bands to discover 6 GHz networks and comes with new baseline security requirements of WPA3 or Enhanced Open.

2.1 - Features and benefits

In 2020, the Wi-Fi Alliance announced Wi-Fi 6E, which extends Wi-Fi 6 into the 6 GHz spectrum. Adding Wi-Fi 6 to the 6 GHz band offers several advantages over Wi-Fi in the 2.4 GHz and 5 GHz bands. The Federal Communications Commission (FCC) then made history by opening up 1200 MHz for unlicensed use by technologies like Wi-Fi.

The iterations of Wi-Fi have done a remarkable job with backwards-compatibility over the years, but come at a cost of carrying and accommodating legacy protocols and reduced bandwidth efficiency. The 6 GHz band does not accommodate Wi-Fi technologies older than Wi-Fi 6. The band allows Wi-Fi 6E to operate without the constraints of legacy protocols, enabling improved bandwidth and latency. Crucial to understand and note, Wi-Fi 6E shares unlicensed spectrum with other technologies which might be operating at the same time. In certain scenarios, Wi-Fi 6E APs must perform frequency coordination through a frequency coordinator prior to medium access for minimized interference with licensed incumbent users of the spectrum.

Regulations in the 6 GHz band

Spectrum allocation is a regulatory function, and rules can be different at varying national levels. This page covers regulations in the FCC and ETSI regulatory domains; most countries will follow one or the other of these models, potentially with minor national variations.

Channels

The FCC unlicensed grant in 6 GHz is 1200 MHz of spectrum, compared to 83.8 MHz in the 2.4 GHz band and 570 MHz in sections of 5 GHz (FCC). After a 20 MHz guard band at the low end, usable 6 GHz spectrum starts at 5.945 GHz and continues up to 7.125 MHz. This allows for 59 channels at 20 MHz width, 29 at 40 MHz, 14 at 80 MHz, or 7 at 160 MHz (the maximum channel width supported by Wi-Fi 6E).

The number of wide channels in 6 GHz is especially significant, as gaps in allocated spectrum in the 5 GHz band limit 80 MHz channels to 6 (seven if we include U-NII-4) and 160 MHz channels to 2 (3 if we include U-NII-4), and wide channels are necessary for the highest data rates.

The FCC designates four sub-bands across the 1200 MHz of 6 GHz: U-NII-5, U-NII-6, U-NII-7, and U-NII-8. These sub-bands are significant because they contain different incumbent types (covered in a section below), so while indoor APs will have uniform power limits across the entire 1200 MHz, there are differing restrictions for higher power and outdoor use across the sub-bands.

The rules from European regulators are not the same as from the FCC. They have taken a more cautious approach, allowing operation in just the lower 500 MHz of the band (480 MHz after the 20 MHz guard band), the equivalent to U-NII-5. This is primarily due to caution over spectrum sharing approaches like the FCC’s Automated Frequency Coordination (AFC) which is necessary to protect incumbents from interference from 6 GHz unlicensed transmitters.

A consequence of this caution is that European countries will restrict 6 GHz operation to indoor WLANs initially. Decisions on extending into the upper part of the 6 GHz band and allowing outdoor and higher-power operation have been deferred, for now.

Many other countries worldwide are in the process of adopting the 6 GHz band for unlicensed use; most of them are expected to follow either the FCC (1200 MHz) or ETSI (lower 500 MHz) approaches, with minor deviations possible for national regulation.

Incumbents

While the 6 GHz band is continuous and channelized across the entire 1200 MHz, existing non-Wi-Fi technologies are active in all sub-bands of 6 GHz. To allow new users into the bands without disrupting the operation of incumbents, spectrum-sharing models are required; new users can be allowed to transmit only when they will not cause interference to incumbents.

However, there is no requirement in the 6 GHz band for special in-band sensing of incumbent transmissions, similar to the Dynamic Frequency Selection (DFS) mechanism used in parts of the 5 GHz band for radar avoidance. Instead, the 6 GHz band uses two spectrum-sharing techniques. Where possible to identify incumbent users in the vicinity of an unlicensed transmitter, power and frequency options are restricted to stay clear of the incumbents. Alternatively, where specific knowledge of nearby incumbents is unavailable, power levels must be kept low enough to ensure they will never cause interference, even in the worst case.

For U-NII-5 running from 5.925 to 6.425 GHz and U-NII-7 from 6.525 to 6.875 MHz, the most important incumbents are point-to-point, licensed radio links used by service providers and private communications for utility companies and others. These links are licensed by the FCC and included in a database known as the Universal Licensing System (ULS). As they are point-to-point, they have narrow-beam antennas, often on tall masts, and can reach for tens of kilometers. The ULS database contains tens of thousands of these links, along with their location (transmitter and receiver, giving direction), frequency, and other characteristics. The FCC allows two spectrum sharing models for these sub-bands. At a low power threshold, and indoors only, unlicensed radios can transmit anywhere. Meanwhile, outdoor locations and higher-power transmitters are allowed where a calculation based on the ULS database shows they will not interfere with incumbents.

The spectrum sharing protocol for high-powered or outdoor unlicensed transmitters requires them to contact a central AFC server, which uses their location and transmit power to calculate whether any of the licensed incumbents in the ULS database might be affected and identifies safe power and frequency parameters.

In other sub-bands, U-NII-6 and U-NII-8, the incumbents are more difficult to coordinate, as they include mobile transmitters, and also temporary links used by local TV stations for outside broadcasts. These bands are less suited for spectrum sharing because the usage patterns are more dynamic, so outdoor, high-power transmitters are not allowed.

The protection of incumbents, and differing views of how to solve this problem, shapes regulators’ approach to opening the 6 GHz band to unlicensed transmitters. Some national regulators are following the FCC approach and introducing spectrum-sharing mechanisms to ensure new unlicensed services can use the spectrum without causing interference, while others are shelving the question by addressing only the lower part of the 6 GHz band, without more complex spectrum sharing arrangements like the FCC’s AFC.

Equipment classes for 6 GHz unlicensed operation

The FCC wants to allow 6 GHz networks to have the best possible performance while ensuring that licensed incumbents are not adversely affected. The FCC policy achieves their goal by defining four separate operating classes for 6 GHz equipment: Low Power Indoor (LPI), Standard Power (SP), Very Low Power (VLP) and Client Devices. VLP is not in scope for this page.

Low power indoor

The most common class for Wi-Fi 6E access points (APs) is low power indoor (LPI). These will be the familiar home or enterprise campus APs. By definition, these APs are shielded by buildings, to some extent, so the signal ’leaking’ outside will be attenuated, which allows safe operation across the band at a power level similar to today’s indoor Wi-Fi APs.

Low power indoor (LPI) AP characteristics:

• Fixed indoor only
• PSD 5 dBm/MHz
• No antenna connectors
• No weatherproofing
• Wired power

The limiting power level for LPI APs is not defined in absolute dBm, as for the lower bands, but at 5 dBm/MHz spectral density. This method of limiting allows an increase of 3 dB for every doubling of channel bandwidth, which gives approximately 18 dBm EIRP for a 20 MHz channel, and up to 27 dBm for a 160 MHz channel in Wi-Fi 6E. Note that spectrum is never perfectly flat and actual maximum EIRP may be further restricted as to not exceed regulatory limits or by hardware limits.

The FCC can apply this rule because incumbent links are generally narrow band compared to Wi-Fi channels. This is advantageous to Wi-Fi network because noise increases proportionally with channel bandwidth. SNR will remain similar for different channel widths, given maximum transmit power levels, hardware capability, and environmentals are the same.

Low power indoor (LPI) APs can operate across the whole 1200 MHz band, as their transmit power is considered safe for all incumbents after building exit loss is subtracted and attenuated. To ensure that these indoor-only units are not used outdoors, or with external high-gain antennas (which have the potential to cause interference), the FCC provides a list of physical requirements for certifying a LPI AP:

• No connectors for external antennas
• No battery-powered operation
• Not weatherized

The current rules from European regulators allow only Low Power Indoor (LPI) APs; outdoor mounting is not allowed and transmit power (EIRP) is limited to 23 dBm. Some countries deviate from this value, but only by one or two dBm.

Standard power

APs mounted outdoors, or indoors operating at higher power than LPI, are subject to ‘Standard Power’ (SP) rules. This is because they may interfere with incumbents and, because they would not otherwise be aware of the risk of interference, they must check periodically with the AFC for channel availability.

Standard power (SP) AP characteristics:

• Fixed indoor/outdoor
• EIRP 36 dBm max
• Controlled by an AFC database
• Automated geolocation
• Pointing angle restriction

The AFC query protocol is defined by the Wi-Fi Alliance and consists of an inquiry message from the AP and a response from the AFC server. The most important information in the inquiry is the AP’s geolocation. In exchange for latitude, longitude, antenna height (above ground level) and some other information in an inquiry message, the AP or controller receives a response containing the set of channels or frequency ranges and the maximum power levels that will not cause interference.

The transmit power of a standard power AP can be as high as 36 dBm EIRP. Because of the increased risk of interference to incumbents, standard power APs are only allowed in the U-NII-5 and U-NII-7.

Number of channels available for standard power (FCC):

Client devices

As with the lower sub-bands, client devices are expected to be limited in geography by APs. If there is no AP signal, devices must not transmit or attempt connection. Therefore, we assume the AP is transmitting in an authorized manner, and the client can adjust client transmit power and channel with reference to the AP. Refer to the respective regulatory in your locale for rules regarding client devices.

6 GHz operation

One attractive feature of the 6 GHz band is that there are no older Wi-Fi devices that need to be accommodated. Wi-Fi has done a remarkable job with backwards-compatibility over the years, but these efforts come at a cost of carrying legacy protocols and reduce bandwidth efficiency. The initial Wi-Fi 6E release sets a high bar with the new baseline of Wi-Fi 6 (802.11ax).

Devices using the 6 GHz band must use Wi-Fi 6 standards, must conform to WPA3 or Enhanced Open security, and cannot offer older security options like WPA2 and Open modes. For WPA3-Enterprise, the differences are slight and exclude some combinations of WPA2-Enterprise security protocols that could expose vulnerabilities, but these combinations were never configurable on most enterprise class APs. The pre-shared key options for WPA2 are significantly changed and improved with WPA3-Personal, and a new ‘Enhanced Open’ standard replaces Open mode to ensure that over-the-air transmissions are encrypted even without authentication of the client device or the network. These mandates are in line with the Wi-Fi 6 standard, without allowance for backwards-compatibility for older client devices.

The Wi-Fi Alliance has introduced a limited number of new features in Wi-Fi 6E, many previously optional features are now mandatory, with two goals:

• Improved airtime efficiency. In crowded areas, much of the available airtime is taken up with AP discovery frames such as beacons, probe requests, and probe responses. This detracts from airtime efficiency, so several features allow client devices to discover target APs and channels with fewer frames on the air.

• Faster AP discovery. Although the large number of new channels is a significant advance, client devices would take a long time to step through each channel, transmitting probe requests and awaiting replies to find a suitable AP. Therefore, new features aim to improve the speed and efficiency of AP discovery

The features are classified as ‘in-band’ and ‘out of band’, meaning the client device discovers APs on the 6 GHz channel where they transmit, or on another channel in a lower band, 2.4 GHz or 5 GHz.

In-band AP discovery features

The traditional way for a client device to discover a suitable AP for connection is to tune its radio to a 20 MHz channel, transmit a number of probe requests, wait on-channel for ~20 msec for probe responses from APs operating on that channel, then tune to the next channel and repeat. This takes time, may result in jitter or data loss as the device is away from its serving AP, and reduces battery life through extra frame transmissions. In addition, the probe requests and responses on the air reduce throughput for other user traffic.

For some time, the industry has been working towards passive scanning where devices learn about other APs and their serving channels through Neighbor Reports. This allows the device to switch to the new channel, reducing time off-channel and frames on the air, but can require up to 102 msec off-channel waiting for the next beacon transmission. This last issue is mitigated in the Neighbor Report by a beacon offset time value, allowing efficient passive scanning, but only in cases where an AP provides comprehensive Neighbor Reports in the beacon or probe response.

As a new, greenfield band, 6 GHz offers an opportunity to mandate features that reduce acquisition time, improve battery life, and avoid excess frames on the air. Several existing and new features improve 6 GHz AP discovery in all these areas.

Preferred scanning channels

Starting with channel 5, every fourth 20 MHz channel is designated for scanning, and APs should align their transmitting channels with Preferred Scanning Channels (PSCs) when using wider channel widths.

For wider channels, the ‘primary’ 20 MHz channel where the beacon is transmitted should align with a PSC where possible. This achieves two goals.

1. Client devices searching for a suitable AP must to scan at most 15 channels to find a beacon or other advertisement.
2. Ensures that non-PSC channels are not burdened by beacons, probe requests or responses, and thus can transfer the maximum possible user data.

To enforce good behavior, several rules are in place to reduce excessive probing and encourage client device designers to optimize their probing algorithms.

For example, a client device should not transmit (e.g. probe requests) in a non-PSC channel unless the client has learned that an AP is present, either by listening for 802.11 frames or through one of the mechanisms explained here. Even in PSC channels, wildcard probe requests are restricted, and the rate at which probes can be sent is limited.

Probe request rules:

Beacon changes

The beacon itself can be shortened in time and complexity because there are no existing Wi-Fi devices operating in the 6 GHz band. 6 GHz takes advantage of opportunities for house cleaning, forgoing transmissions that would only be of interest to older equipment. An example is the backwards-compatibility in the form of ‘capabilities’ and ‘operation’ information elements. Because, for example, a Wi-Fi 4 device is not programmed to understand Wi-Fi 5 parameters, beacons in the 5 GHz band must include the older Information Elements (IEs) in addition to newer ones added for subsequent generations.

The greenfield nature of 6 GHz allows these older elements to be dropped, saving time on the air and improving bandwidth efficiency. The example above shows that the HT and VHT operations and capabilities IEs are removed, and those values that are not superseded are added to the equivalent HE (Wi-Fi 6) IEs.

The ‘operations’ IEs are announcements from the AP about the transmission channel and are part of the beacon, probe response, association response, and re-association response frames. The ‘capabilities’ IEs list the options that APs and devices can use, and are transmitted in the information elements listed above and also the equivalent requests from client devices. Other modifications to the beacon include the rate at which the elements are transmitted: no pre-Wi-Fi 6 rates are allowed, forcing higher rates, shorter durations, and better bandwidth efficiency.

Multiple BSSIDs in one beacon

This feature was introduced as optional in 802.11v-2011 and was not initially implemented in clients or APs. For Wi-Fi 6E, clients are required to support multiple BSSIDs.

Where many SSID/BSSIDs are advertised on the same radio, as is commonplace in residential and enterprise WLANs, previously, each BSSID or virtual AP had to transmit its beacon separately. If an wanted to transmit four SSIDs, four separate beacons were transmitted in each 102.4 msec beacon interval, and many IEs were duplicated across beacons.

With the multiple BSSID feature, the common elements are transmitted once, and a separate information element is appended with the values unique to each virtual AP, now termed a ’non-transmitted’ BSSID.

The “new” beacon is considerably shorter, improving WLAN efficiency. However, this method may not be universally applied. For example, a limit on the beacon size may restrict the number of multiple BSSIDs to a maximum of 4, so when more than 5 SSIDs are used, multiple MBSSID beacons are still necessary to support the multiple BSSID feature. Thus, more than 4 SSIDs are split into multiple MBSSID sets.

Unsolicited probe responses

Unsolicited probe responses (UPR) function like mini beacons. While the usual beacon interval is 102.4 msec, unsolicited probe responses can be transmitted every 20 msec. The increased rate enables clients to decide whether the AP is suitable for connection through fast passive scanning rather than active probing or passive discovery of neighbor APs through reduced neighbor reports. The unsolicited probe response allows a client, rather than tuning to a channel and transmitting some probe requests and waiting ~20 msec for responses, to listen passively for just 20 msec and be sure the client has heard all BSSIDs on that channel. Unsolicited probe responses can contain the same information elements as a ’normal’ probe response, but they are transmitted to the broadcast address.

FILS announcements

Fast initial link setup (FILS) is a complete protocol for AP discovery, authentication, and handover that was introduced in 802.11ai and the Wi-Fi Alliance optimized connectivity certification. FILS was aimed particularly at public networks but was not widely adopted. FILS announcements act as mini beacons, transmitted every 20 msec. Each announcement frame contains the information necessary for a client device to decide whether the AP is suitable for connection.

FILS announcements can also incorporate reduced neighbor reports to advertise the channels of other APs of the same network. The ‘short SSID’ can optionally be substituted for the SSID in the FILS announcement. This value is a (non-reversible) hash of a full SSID.

FILS announcements and unsolicited probe responses serve similar purpose. Only one or the other would normally be required. Starting in AOS-8.11 and AOS-10.5, FILS announcements are the default advertisement for 6 GHz channels when capable HPE Aruba Networking APs are operating as single-band 6 GHz only (without 2.4 GHz or 5 GHz operation enabled). When the capable AP is operating in a multi-band state, FILS advertisement in 6 GHz is automatically disabled to conserve airtime. This is not configurable.

Out-of-band (OOB) AP discovery

The techniques mentioned above allow a client to scan the 6 GHz band to discover APs in-band. But most 6 GHz APs will operate as multi-band, where non-6 GHz radios can be coordinated, enabling a client scanning 2.4 GHz or 5 GHz can learn about a 6 GHz AP without tuning the radio to, or scanning, 6 GHz.

Reduced neighbor report

The reduced neighbor report (RNR) was initially developed for use with the FILS discovery protocol, but use is expanded for 6 GHz operation. When associated at 2.4 GHz or 5 GHz, the client can listen for BSSIDs containing RNR information elements and discover the channels where 6 GHz neighbor APs, in the same physical unit or separate units, are transmitting. This allows clients to move directly to the target 6 GHz channel.

• List networks on adjacent radios or neighboring APs
• Supports faster 6 GHz BSS discovery
• Includes a relative offset for target beacon transmission time
• Found in existing passive/active scanning through beacon or probe response frames.
• No configuration and is automatically appended to all BSSes on 2.4 GHz and 5 GHz radios on capable APs.

The reduced neighbor report IE is included in the beacon and probe response frames of the lower-band (2.4 GHz or 5 GHz) BSSID. The report includes fields for each neighbor BSS, if transmitting the same SSID in the 6 GHz band, along with channel and beacon offset.

The operating class and channel number refer to tables in IEEE 802.11 listing all possible channel widths and center frequencies. For 6 GHz, this guides the client device to the correct channel out of the possible 59 at 20 MHz, 29 at 40 MHz, etc. With this information, the client device can parse the RNR from a 2.4 GHz or 5 GHz BSSID and go directly to the channel in the 6 GHz band to find an equivalent SSID/BSSID.

The target beacon transmission time (TBTT) information in the reduced neighbor report refers to the beacon offset in time. The TBTT is measured in time units of 1.024 msec, and allows the client device to schedule an accurate time to go off-channel from the current AP and passively scan the beacon of the 6 GHz BSSID, subsequently authenticating if desired.

The full neighbor report could be used in place of the RNR, as a superset of the RNR information is contained with-in, but the standard promotes the latter because the RNR is shorter and more efficient. Reduced neighbor reports are supported on 6 GHz capable HPE Aruba Networking APs starting in AOS-8.9.

Access network query protocol

The access network query protocol (ANQP) is a pre-association exchange protocol initially added for Passpoint operation. ANQP allows a client device to query an AP about capabilities such as Passpoint, information about the venue, and identity providers that can be reached for authentication. When used for 6 GHz WLANs, ANQP conveys a full neighbor report for 6 GHz BSSIDs that may be in the same WLAN, whether using the same SSID or different SSIDs. Transmitting the neighbor report element over ANQP rather than directly in the beacon or probe responses is more efficient, as air time is not consumed unless the client device requests the neighbor report.

In a multi-band network, BSSIDs in the lower bands (2.4 GHz or 5 GHz) could advertise ANQP capability, and multi-band client devices could request neighbor reports via ANQP, allowing them to discover full SSID, BSSID, channel and beacon offset information without leaving the lower band to receive or transmit in the 6 GHz band.

Automatic frequency coordination

The 6 GHz bands contain incumbent users, and for higher power or outdoor operation with standard power APs, the FCC requires that incumbents are protected from interference from unlicensed 6 GHz users, including Wi-Fi. Some areas of the band are not allowed, even under automatic frequency coordination (AFC) control. The available channels for higher power or outdoor operation are from 5945-6425 MHz and 6525-6875 MHz, the U-NII-5 and U-NII-7 bands.

Fortunately, the majority of incumbent, such as point-to-point fixed service, users are known, as they are licensed and their details are listed in the ULS database, maintained and updated by the FCC.

The general architecture for automatic frequency coordination (AFC) centers on an AP, or group of managed APs, generating an inquiry message that includes respective location, elevation, and indications of the desired transmit power levels, channels or frequencies for transmission. The AFC uses this information as input to algorithms along with ULS data of licensed links and a terrain map. Some AFC operators may add building outlines to their terrain map to identify RF shadows. The response from the AFC to the AP inquiry will include a range of channels or frequencies that are available, and the AP, or RRM can pick from this list and transmit. The FCC will license a number of AFC service providers. APs must check with an AFC at least every 24 hours to receive fresh information.

The general concept of AFC calculations is as follows. Each licensed receiver’s location, antenna pattern, elevation above ground, and sensitivity are taken from the ULS database and used to plot contours defining zones of interference for given transmit power levels. The example above shows one contour calculated for interference to the antenna A; another plot would be generated for antenna B.

As the antennas for point-to-point links are usually very high-gain, these plots are shaped like a keyhole, with a short-distance circle around the back for sidelobe sensitivity and a long path down the antenna boresight.

The contour is significant because any Wi-Fi transmitter within the contour and above the power threshold for which the contour is calculated would cause interference at the fixed link’s receive antenna and should not be allowed at that location, frequency, and transmit level.

Many plots or contours must be calculated and plotted depending on the power of the interfering signal, and terrain is taken into account to determine line-of-sight conditions or whether high ground obscures the path. AFCs may pre-calculate the contours to reduce response delays. The diagram above shows a set of contours from an AFC, calculated for different power levels for a single fixed link receiver.

The response from an AFC to an AP inquiry message may be either a list of available channels, or available frequency ranges, along with the maximum power levels available, or both. The graphical example shows how such information might be displayed on an AFC client application. The top row is a frequency range response, giving power spectral density limits for the various ranges. The lower levels show channel availability by transmit power level (coloring is not part of the AFC response). The example clearly shows fixed links near the location, and that these effectively exclude a number of channels in the response. The AP would only be allowed channel assignment from channels allowing viable operation.

Because AFC operation is not permitted in the U-NII-6 and U-NII-8 bands, the results shown in the diagram for those frequencies are invalid.

Note that the AFC does not grant a particular frequency to the AP; the AFC just indicates those channels, frequencies, and power levels that will not cause interference to incumbents. There is no attempt to allocate specific channels or coordinate different channels for neighboring APs or WLANs from the AFC provider. Those tasks are left up to the AirMatch RRM service.

2.2 - Planning and deployment

Wi-Fi 6E is Wi-Fi 6 (IEEE 802.11ax PHY/MAC) operating in the 6 GHz band offering up to double or triple system capacity compared to previous generations. Note the 6 GHz band is not available in every regulatory domain (region). Ensure you comply with your local regulatory requirements before deploying Wi-Fi 6E.

Key design principles

1. Enable 6 GHz by creating a multi-band SSID rather than creating a 6 GHz only SSID.
2. Choose Enhanced Open for guest networks, WPA3-Personal for passphrase networks, and WPA3-Enterprise for 802.1X corporate networks.
3. Assess your client device mix before enabling compatibility modes for WPA3 or Enhanced Open. Prefer to disable transition mode to improve security.
4. Test new security modes like WPA3 and Enhanced Open in a controlled environment before widespread deployment.
5. Consider enabling 802.11r (Fast Transition) for WPA3-Enterprise security modes.
   • Fast roaming can significantly reduce delays in service when a client transitions between neighboring APs and is crucial for latency sensitive applications like telephony (Voice over Wi-Fi).
6. Plan for a capacity based design with overlapping primary and secondary coverage targets verified by end user devices.
   • In capacity based deployments, AP density may increase 0-10% in key usage areas. Survey, check, and validate for 6 GHz.
   • Coverage based deployments must be revisited and redesigned.
7. Plan channel widths per band based on RF layering strategy and regulatory domain allocations.
   • For FCC (or other 1200 MHz domains) this generally means 20 MHz in 2.4 GHz, 20 or 40 MHz in 5 GHz, and 80 MHz in 6 GHz.
     • With sufficient channel reuse (low density), 160 MHz channel width can be used in 6 GHz.
     • With limited channel reuse (high density), like in large public venues, 40 MHz channel width in 6 GHz is desired.
   • For Europe (or other 500 MHz domains), this generally means 20 MHz in 2.4 GHz, 20 or 40 MHz in 5 GHz, and 40 MHz in 6 GHz.
8. Disable lower management rates in all bands to reduce management frame overhead.
   • For example, removing 1, 2, 5.5, 6, 9, and 11 Mbps rates (across applicable bands) and possible based on coverage and client requirements.

Security requirements

Prior to Wi-Fi 6E, the first Wi-Fi generation to enforce security requirements with the introduction of a new PHY/MAC was Wi-Fi 4 (802.11n). Clients are penalized to 802.11a/b/g speeds when using wired equivalent privacy (WEP) or temporal key integrity protocol (TKIP).

Wi-Fi 6E operation in 6 GHz also introduces new required baseline security requirements. Wi-Fi Protected Access 3 (WPA3) or Enhanced Open are mandatory for Wi-Fi 6E deployments and adoption.

Legacy security protocols are not allowed in 6 GHz:

• Open authentication
• WEP, TKIP, WPA
• WPA2

This means existing SSID deployments using WPA2-Enterprise (802.1X) or WPA2-Personal security modes cannot be enabled for 6 GHz.

This forces either configuration changes to existing SSIDs or new SSID deployment and client migrations.

Security mode options for 6 GHz:

• Enhanced Open (OWE)
  • Leverages opportunistic wireless encryption (OWE) to replace Open System Authentication
  • Diffie-Hellman exchange encrypts all wireless traffic
  • Offers encryption without user authentication
  • MFP required
• WPA3-Personal (SAE)
  • Simultaneous authentication of equals (SAE) replaces the one-way key generation found in WPA2-PSK with a Diffie-Hellman like key exchange
  • Hash-to-element (H2E) required for SAE PWE derivation as an industry response to the Dragonblood vulnerability
  • MFP required
• WPA3-Enterprise
  • AKM:5 key management (SHA-256); CCMP-128 ciphers; MFP required
• WPA3-Enterprise with GCM-256
  • AKM:5 key management (SHA-256); GCMP-256 ciphers; MFP required
• WPA3-Enterprise 192-bit (CNSA)
  • AKM:12 key management (SHA-384); GCMP-256 ciphers; MFP required; strong EAP-TLS methods only (no mix and match, no PEAP)

Clients

Wi-Fi 6E support requires both driver and operating system support.

Recommendation is to always know and understand the capabilities of the clients being serviced by the APs in order to configure and plan accordingly.

Minimum versions required:

• Android 13+

• iOS 16.1+, check which Apple devices support Wi-Fi 6E

• Windows 11+ with a capable NIC such as the Intel AX210

Software updates can improve the capabilities enabled by hardware. Recommend to periodically check release notes and update client OS and drivers.

SSID planning

With Wi-Fi 6E traditional dual-band enterprise SSID layouts must be considered for how they might evolve into a tri-band deployment.

Consider this deployment approach prior to Wi-Fi 6E.

Potential strategy after migrating to Wi-Fi 6E.

Multi-band SSIDs are recommended for the following reasons.

• Traditional active/passive scanning does not scale well when adding up to 59 more 20 MHz channels in 6 GHz. HPE Networking APs automatically append Reduced Neighbor Reports (RNRs) to out-of-band (OOB) BSSes in 2.4 GHz and 5 GHz. When the client scans in 2.4 GHz or 5 GHz, the RNR acts as a seed telling the client exactly where to discover a 6 GHz network.
• APs operating with a single radio and a 6 GHz-only will force clients to do in-band discovery which is a much slower discovery process and may cause a poor connection experience.
• Multi-band SSIDs provide a fallback band when the 6 GHz band is not available due to pending frequency coordination (AFC) bring up or expiration.

In the majority of cases, multi-band SSIDs should restrict bands to 5 GHz and 6 GHz. In other words, use the infrastructure to restrict where clients can connect. This is due to the BSS selection (discovery and association) being primarily up to the client, however, after connection HPE Networking ClientMatch can be used to influence (nudge) the client to a more optimal band. For example, place 2.4 GHz only IoT clients on a 2.4 GHz only SSID. Place tri-band capable clients on a 5 GHz + 6 GHz multi-band SSID.

There are some options to consider when deciding whether to create a new SSID or modify the configuration of an existing SSID to enable 6 GHz.

Migrate all security modes

Migrate security modes of all SSIDs to WPA3-Enterprise, WPA3-Personal, or Enhanced Open (OWE) with a multi-band SSID across 5 GHz and 6 GHz.

If transition mode is disabled, this will remove all legacy client support and is applicable for certain greenfield deployments or pop-up event networks like HPE Discover where users are professionals who typically refresh their BYOD devices often.

Proceed with caution and understand the client population.

Single SSID approach

Band specific SSIDs

This option is to create a new SSID for exclusively for 6 GHz support.

Dual SSID approach

SSID-A dedicated to WPA3-only devices and 5 GHz + 6 GHz bands. Disable transition mode.

SSID-B dedicated to WPA2 and legacy devices on the 2.4 GHz and/or 5 GHz bands. This allows support for WPA2-only clients to connect and minimizes any impact of operational parameters with WPA3-transition causing client bugs due to poor implementation or outdated drivers.

This approach adds an additional SSID which does increase management frame overhead, but can be negated by trimming lower basic rates. In general, aim to keep the number of SSIDs per AP low.

Existing SSIDs

Certain SSIDs like Hotspot 2.0 passpoint SSIDs such as eduroam recommend a single multi-band SSID. This approach should be taken for other federated SSIDs like Govroam, OpenRoaming, Cityroam, etc.

Before:

After:

Transition mode may be enabled to maintain support for WPA2-Enterprise only clients. Test in a controlled environment before widespread deployment.

AP planning

Propagation loss of 6 GHz vs 5 GHz is similar, 1-2 dB, when comparing free space path loss (FSPL). Real world tests show an additional 3-6 dB difference depending on the frequency location in the 6 GHz band and measurement points.

An industry study also shows propagation loss through different common building materials will have different effect. For example, brick has a much larger impact than drywall. Plan to increase AP density for 6 GHz when interior walls are composed of thick, dense materials.

In existing high-density deployments there may be no changes required for AP placement, but depends on the effective power levels for 6 GHz compared to 5 GHz. Factors include channel width, LPI, and SP depending on the regulatory domain. As an example, in the FCC domain under LPI rules, an 80 MHz channel width achieves higher EIRP than a 20 MHz channel because the more restrictive limit is based on power spectral density (PSD) rather than total power.

In general, the recommendation is to always place APs close to users with an unobstructed view. For example, do not place APs above ceilings. Prioritize placing APs in critical areas such as conference or training rooms. APs in hallways may not sufficiently provide 6 GHz coverage and will require to be moved in room.

Always survey, test, and validate using target end user client devices before widespread deployment.

Channel planning

With up to 59 additional channels, there are two main channel width selection choices depending on regulatory domain.

graph TD;
    reg("Regulatory domain")
    fivehundo("500 MHz")
    twelvehundo("1200 MHz")
    twenties("20 MHz or 40 MHz")
    eighties("80 MHz or 160 MHz")
    reg-->fivehundo;
    reg-->twelvehundo;
    fivehundo-->twenties;
    twelvehundo-->eighties;

If the regulatory domain allows up to 1200 MHz, 80 MHz is recommended for most deployments as each channel will line up with a preferred scanning channel (PSC) which will optimize both in-band (PSC) and out-of-band (RNR) scanning.

If the regulatory domain is restricted to the lower 500 MHz of the 6 Ghz band, 40 MHz channel width is recommended.

These recommendations primarily focus on Low Power Indoor (LPI) deployments.

For Standard power (SP) deployments, use 40 MHz channel width or 20 MHz if AP density is high (such as in LPV). Note that channel availability depends on frequency coordination.

Automatic frequency coordination

In general, 6 GHz usage falls under two categories.

1. Low power indoor (LPI) - no frequency coordination.
2. Standard power (SP) - frequency coordination mandatory.

Standard power APs need to be able to self-locate and submit geolocation information to an AFC provider. HPE Aruba Networking APs use a Frequency Coordination Orchestrator (FCO) service in Central to communicate with AFC.

Geolocation information can be collected in two different methods by HPE Aruba Networking APs.

1. Positional data collected by the APs GPS/GNSS radio.
2. An AP can leverage positional data broadcasted from a neighboring AP in AOS-8.13 and AOS-10.8 or later.

Multiple gigabit throughput planning

The maximum PHY rate on a given channel is determined by the channel width, RF environment, and MCS rates used by the client(s).

In the best case scenario, with the widest channel width and highest order MCS rate, these PHY data rates are possible.

The maximum data rate a client is capable of is determined by the client capabilities such as number of radio chains, maximum MCS rate and channel width supported on both sides of the link, of course along with the ideal RF conditions (SNR and EVM) to sustain those rates. Most clients have one or two radio chains. Consider that mobile clients with two radio chains sometimes disable one of two chains to conserve battery life.

The maximum throughput a single AP is capable of is determined by similar factors across each of the radios.

In the majority of deployments, 2.4 GHz cannot be considered in AP system capacity planning due to limited channel reuse in the crowded ISM band.

Multiple gigabit needs are determined by the configured channel widths along with environmental and traffic patterns. Aggregate data throughput on a tri-band tri-radio AP can easily exceed 1 Gbps under certain conditions.

For example, in environments with a single client per band each using maximum channel widths and rates, multiple gigabit throughput can be achieved during saturation testing.

However, consider target traffic usage patterns and expectations and active client count. As the client count increments on the same channel, throughput is reduced due to the contention based mechanisms in the 802.11 protocol.

1. Each client must wait the channel to become idle before transmitting (listen before talk)
2. When a channel is busy, each client picks a random backoff timer from a contention window and waits that many slot times before transmitting. If a collision occurs, the window size increases, spreading out retry attempts to reduce further collisions.

Thus, each additional client on a given AP reduces throughput and extends transmit opportunity (TXOP) durations as clients content for the medium.

Multiple APs on different channels are a way to scale, up to the channel reuse limits in the neighboring area with the goal of minimizing co-channel interference as much as possible.

Additionally, expected traffic usage patterns are an important characteristic to consider when determining multi-gigabit to the AP is a requirement.

Power sourcing

Additional radios and capabilities come with increased power requirements. Tri-radio APs require more power than dual-radio APs — 802.3at/CL4 or better required. The AP-650 is the only series which can operate and combine two 802.3af/CL3 sources. 802.3bt/CL6 is recommended for new deployments.

Intelligent power monitoring

Intelligent power monitoring or IPM is a method for controlling power usage of HPE Aruba Networking APs. The approach actively measures power usage and dynamically adapts the power budget and restrictions.

When IPM is disabled, static power management will apply reductions in order to not exceed worst case limits and stay within the confines of the power budget.

When IPM is enabled, dynamic power management allows the AP to enable full functionality and performance in the majority of cases.

Enabling IPM will allow for, in most cases, most features when tri-radio APs are powered by a 802.3at/CL4 PSE.

Recommendation is enable IPM.

3 - Wi-Fi 7

Wi-Fi 7 builds on previous generations supporting the 2.4 GHz, 5 GHz, and 6 GHz bands based on IEEE 802.11be. Wi-Fi 7 brings Multi-Link Operation (MLO) to Wi-Fi for the first time enabling devices to communicate on multiple links to the same AP. Additionally, Wi-Fi 7 improves speed with higher order MCS rates (4096-QAM) and latency with QoS features like restricted Target Wake Time (r-TWT), Stream Classification Service (SCS), and Triggered Uplink Access (TUA). Wi-Fi 7 comes with additional baseline security requirements of GCMP-256 and Beacon Protection.

3.1 - Features and benefits

Wi-Fi 7 is a Wi-Fi Alliance certification program based on the IEEE 802.11be amendment aiming to improve latency, reliability, and performance over previous Wi-Fi generations. Work on the specification began in 2019, and the certification program launched in January 2024.

This generation targets use cases requiring high data bandwidth, low latency, and reliability, such as extended reality (VR/MR/AR), real-time applications, gaming, and cloud computing.

Wi-Fi 7 introduces a key feature called multi-link operation (MLO) for improved link reliability, 4096-QAM for higher peak PHY data rates, wider channel widths in 6 GHz, and enhanced QoS with features like stream classification service (SCS).

Like previous generations, Wi-Fi 7 uses techniques to ensure backward compatibility across all bands to provide connectivity for previous generations of clients.

Key features

Wi-Fi 7 builds and extends on the capabilities of previous generations to increase throughput, reduce latency, and enhance reliability.

• Wi-Fi 7 can also leverage the 6 GHz band introduced by Wi-Fi 6E.

• Multiple link operation (MLO) enables channel aggregation and failover, enabling clients connecting to Wi-Fi 7 access points to combine or alternate between links across multiple frequency bands (can also be two links in the same band). Traffic can be sent over the link with lower latency or traffic could be split between links for parallel transmission. If one of the links is congested or interference occurs, traffic can be shifted seamlessly to another more stable link to improve the connection robustness.

• 4096 QAM (quadrature amplitude modulation) provides potentially higher peak data rates by enabling a 12-bit symbol to more densely embed greater amounts of data than before through MCS 12 and 13.

• Channel bonding up to 320 MHz bandwidth in 6 GHz doubles the capacity of 160 MHz supported by Wi-Fi 6. The increase in bandwidth can reduce delays and improve overall transmission rates.

• Improvements to OFDMA introduced in Wi-Fi 6 through Multi Resource Units (MRU).

• Preamble puncturing helps accommodate and co-exist with interference in wide channels by allowing the 20 MHz subchannels containing interference to be disabled within wide channels. This is sometimes called a punctured transmission. Puncturing helps work around interference or other requirements while still enabling the remainder of wide channels to function for transmit and receive.

• QoS improvements with triggered uplink access (TUA) using the stream classification service (SCS) framework.

• Power saving enhancements to target wake time with restricted target wake time (r-TWT) providing a level of medium access protection in a restricted service period (SP).

Technology comparison

6 GHz support

Like Wi-Fi 6E, Wi-Fi 7 also uses the 6 GHz band to increase capacity by using up to 1200 MHz of unlicensed spectrum depending on regulatory.

20 MHz-only operation

Wi-Fi 7 allows for 20 MHz-only operation which is aimed at IoT markets similarly as the same feature in Wi-Fi 6. 20 MHz-only operation allows for reduced implementation complexity, leading to low-power, lower-cost chips. Such clients can operate in 2.4 GHz, 5 GHz, and 6 GHz bands and support most of the mandatory Wi-Fi 7 features.

Increasing modulation complexity

Payloads in Wi-Fi are encoded using a technique called quadrature amplitude modulation (QAM) which encodes data by manipulating both the amplitude and phase of carrier waves. Each point in the QAM constellation represents a distinct symbol, with each symbol encoding multiple bits of information. Higher-order schemes allow more bits to be encoded per symbol, thus increasing spectral efficiency.

Building on digital modulation schemes in 802.11ax of up to 1024-QAM, 802.11be supports up to 4096-QAM. This means that each RF symbol represents one of 4096 possible combinations of amplitude and phase. The move from 1024-QAM to 4096-QAM increases number of bits carried per OFDM symbol from 10 to 12. This can result in up to a 25% increase in PHY data rates depending on environmental and capability support on both sides of the link.

Modulation and coding

802.11be adds a 12-bit symbol for 4096-QAM with coding rates of 3/4 and 5/6. The previous PHY rates remain available and are used during rate shifting when signal quality is insufficient to sustain higher rates.

Note both 3.2 μs guard interval and BPSK-DCM are excluded from the table.

320 MHz channel width

Wi-Fi 7 adds support for 320 MHz channel width. Support is advertised in the control field of the EHT operation information element. Inside this element there is an operating class field which defines radio parameters such as channel width. The operating class for 320 MHz channel width is 137.

Note the out-of-band reduced neighbor report element in 2.4 GHz or 5 GHz may report operating class of 131 (20 MHz), 132 (40 MHz), 133 (80 MHz) or 134 (160 MHz) instead of 137. This is for interoperability with legacy clients which do not know of operating classes introduced in newer generations.

To better line up with differing countries regulatory spectrum allocations, there are two sets.

1. 320 MHz-1 with channels 31, 95, and 159.
2. 320 MHz-2 with channels 63, 127, and 191.

Technology advancements

• EHT MU PPDU format used for all non-triggered transmissions.

• EHT TB PPDU format used for all triggered transmissions.

• New universal SIG (U-SIG) field to bring forward compatibility to the EHT preamble via new version independent fields. Duplicated in every 20 MHz sub-channel. U-SIG includes version-independent and version-dependent bits.

• DL/UL OFDMA are adopted from Wi-Fi 6 as is.

• Dynamic MU Spatial Multiplexing Power Save (SMPS) to allow clients to turn off a receive chain to reduce power consumption.

• Packet extension gives additional Rx processing time for features like 4096-QAM.

• Wi-Fi 7 adds support for multiple resource units (MRU) in orthogonal frequency division multiple access (OFDMA). This enables small or large multiple RUs to be allocated to the same client. The ability for clients to use MRUs enables more efficient and flexible usage of the available channel when using OFDMA.

• Preamble puncturing with static and dynamic puncturing to disable 20 MHz subchannels for wide channel bandwidths when there is narrow interference. This feature along with MRU enables punctured transmissions around the disabled subchannels.

• Compressed BA (C-BA) 256/512 bits to provide the ability to acknowledge (ACK) multiple MPDUs in a single block ack (BA).

• Restricted target wake time (r-TWT) enables restricted service periods for clients to have better medium access for latency sensitive traffic. r-TWT provides more precise wake-up intervals and shorter durations to improve power consumption.

• Triggered uplink access (TUA) optimization provides improved channel access through a scheduled period for latency sensitive uplink (UL) traffic. APs use the stream classification service (SCS) request frames from clients to schedule according to the requested QoS parameters.

• BPSK-DCM (dual carrier modulation) provides a 1-bit low rate MCS (14 and 15) with higher range, robustness, and interference mitigation at the cost of speed. These are optional rates.

Multiple link operation

Multi-link operation (MLO) is a key mandatory feature of Wi-Fi 7 enabling, for the first time in Wi-Fi, clients to associate and transmit and/or receive over more than one link or band at a time to a single AP.

A MLO-capable device is referred to as a multi-link device (MLD). In the MLD framework, the links can be across multiple bands or with-in the same band.

The primary benefit of multi-link operation is communication between to multi-link devices on non-overlapping frequency.

• Improved reliability and robustness. A client can seamlessly alternate between links when one of the links degrades without re-associating.
• Improved support for lower latency by fast failover between links or aggregating links.
• Higher aggregate throughput. Certain, optional, MLD types can leverage and combine multiple links at the same time, potentially improving throughput.

All Wi-Fi 7 clients are required to support basic multi-link operation (MLO) over multiple links with the ability to discover, authenticate, (re)associate, (re)setup of links, and support of multi-link control (MLC) frames.

Architecture

Multi-link operation (MLO) architecture splits the multi-link device (MLD) into two MAC layers.

Upper MLD (U-MAC) functions:

• (Re)association is at this layer
• Security association (PMKSA)
  • SN/PN assignments for unicast frames
  • Unicast encryption/decryption
• Link selection based on TID mapping
• Block ACK score boarding for unicast frames

• Channel access
• Control frames such as RTS and CTS
  • Block ACK (BA) sent in sync with upper MLD score boarding
• Beacons
• Broadcast frame transmission, encryption, decryption
• Power save state

MLO management

For any disruptive AP operations (link removal, new configuration, etc.) there are 2 methods available to manage MLO operation.

1. Multi-link reconfiguration (AP removal)

   • Multi-link reconfiguration is stateless and enables the stop and restart data traffic activity on one or more links. This may lead to client reassociation to the same AP with ‘other links’ and depends on the client implementation.

2. Advertised traffic identifier (TID) to link mapping (T2LM)

   • Advertised TID-to-link mapping is stateful and can disable data traffic on a link for a short duration after which the link is reenabled and maintains client association.
   • Used when AP needs to temporarily disable a link in a multi-link setup
   • Similar idea to multi-link reconfiguration, client can use remaining link to avoid reassociation.
   • When the AP brings the link back. The client can reuse.

Load balancing

AP MLDs can help influence link usage through BSS transition management frames (query, request, response) where the AP recommends one or more links for the client to operate on. This link recommendation feature provides clients the option to more quickly switch to links with less interference and spend less time contending for the medium on a link with more interference.

Multi-link BSS updates

The AP MLD must signal BSS critical updates (operational parameters) to client MLDs through a BSS parameters change count (BPCC). This update framework enables the client to track updates on all links by monitoring management frames on one link. Thus, clients can determine if they need to look for updated parameters on the link where a critical update occurred.

Examples of critical updates include:

• Channel switch announcements (CSA)
• Broadcast target wake time (b-TWT)
• Modification of HT, VHT, HE, or EHT operation elements

MLO MAC addressing

MLO devices have two types of MAC addresses. A MLD MAC and a per-link MAC.

The client (STA) MLD MAC (p) address and AP MLD MAC (m) address are addressable over the local network meaning they are used for resolving ARPs.

The MAC addresses for each link, (w), (x), (y), (z) are ’link local’ and not used to populate address fields in frames sent beyond their respective boundaries.

Certain HPE Aruba Networking CLI show commands are enhanced to show both MLD and per-link MAC addresses.

show ap association mlo
show ap debug client-table mlo

Device types

There are different types of MLD operation device types offer varying capabilities. The MLD type a client supports can be influenced by the bands presented by the ESS. For example, if all three 2.4 GHz, 5 GHz, and 6 GHz bands are presented, the client could support one type when setting up a MLD with 2.4 GHz and 6 GHz links, but a different type when setting up a MLD with 5 GHz and 6 GHz.

Multi-link single radio

A multi-link single radio (MLSR) device is a MLD which switches links to operate on any one link at a time. A MLSR MLD is not able to do carrier censing on multiple links at once. The MLSR client MLD controls the link for downlink traffic from the AP mld using power save (PS) polling.

Enhanced multi-link single radio

An enhanced multi-link single radio (EMLSR) device is a MLD which can only transmit (Tx) to or receive (Rx) data frames from another MLD on a single link. The enhanced part of EMLSR is the ability to carrier sense on multiple links at the same time.

Carrier sense on each link is accomplished using a single spatial stream (radio chain). If the AP MLD needs to transmit a data frame to an EMLSR device on one of the links, the AP initiates a control frame exchange (RTS, MU-RTS). While the AP MLD receives the CTS frame on the target link, the EMLSR device reconfigures the radio to switch over the spatial streams from other links to be ready for data reception.

Simultaneous transmit receive multi-link multi-radio (STR MLMR)

No need to reconfigure or transition radio chains between links.

Security requirements

The following security parameters for Wi-Fi 7 are required in all bands for Wi-Fi 7 connections:

• Security modes
  • WPA3-SAE-GDH (AKM:24/FT AKM:25) when using WPA3-Personal
  • Hash-to-element (H2E) for SAE PWE derivation required when using WPA3-Personal
  • Enhanced open when using open networks
• Beacon protection to enable clients to verify the integrity of beacon frames
• GCMP-256 ciphers
• PMF (802.11w)

Beacon protection

The december 2020 update of WPA3 introduced an optional feature called beacon protection to protect against active attacks attempting to exploit clients through forged signaling information to nudge clients to rogue APs. Wi-Fi 7 requires beacon protection to enable the AP to provision clients with integrity keys during security association.

A beacon integrity group temporal key (BIGTK) is used for beacon frame protection. The beacon integrity packet number (BIPN) is the BIGTK packet number used to calculate the MIC in the MME.

The BIGTK is then distributed to the client in message 3 of the 4-way handshake and group key handshake. The client is then enabled with information to validate, and further act on, integrity checks.

The management MIC (MME) element is appended to the beacon frame as the last element preceding the FCS providing message integrity to protect group addressed management frames and protected beacon frames from forgery and replay.

GCMP-256

GCMP is based on the GCM of the AES encryption algorithm. GCM protects the integrity of the MPDU and provides data confidentiality, integrity, and replay protection. AES processing used with-in GCMP-256 uses AES with a 256-bit key, hence GCMP-256. Wi-Fi 7 clients must support GCMP-256 as a unicast cipher.

PMF

PMF was introduced in 802.11w-2009 as an optional feature to provide integrity and encryption mechanisms for certain management frames. Wi-Fi 7 connections must use PMF. Learn more about PMF.

SAE-GDH

When using WPA3-Personal and Wi-Fi 7, the client must use simultaneous authentication of equals (SAE) with group dependent hashing (SAE-GDH) in all bands. The AKM selectors for SAE-GDH are AKM:24 and Fast Transition (802.11r) AKM:25.

The Diffie-Hellman (DH) group used will determine the hash algorithm / elliptic curve. Group selection is determined by support on both sides of the link and client preference during the commit phase of SAE.

Comparatively, previously WPA3-Personal with AKM:8 used the same SHA-256 hash algorithm for all DH groups.

MLD security

After association, the client (STA) MLD and AP MLD derive keys via the 4-way handshake. The entire handshake performed on a single link.

The pairwise master key (PMK) is derived using the MLD MAC addresses on both, the client MLD and the AP MLD. The PMK is used for generating PTK which is used for encrypting unicast frames. Same PTK is used across all the links setup in an multi-link association between an AP MLD and a client (STA) MLD.

Groupwise Transient Key (GTK) is unique per-link for all the links in the AP MLD. Each link uses its own GTK to encrypt groupcast frames.

There are new elements added in Message 2 and 3 of the existing 4-way key handshake to convey MLD MAC address to generate keys and per-link GTKs. Encryption of data frames does not require knowledge of link selection.

Multiple resource units

802.11be adds support for multiple resource units (MRU) where the previous generation only supports single resource units (RU). In Wi-Fi 6, clients could only use one resource unit at a time. In Wi-Fi 7, clients can use multiple adjacent or non-adjacent resource units.

Preamble puncturing

Preamble puncturing was introduced in IEEE 802.11ax (Wi-Fi 6) as an optional method to more efficiently use wider channel widths in the presence of narrow interference.

There are two types of puncturing.

1. Static puncturing
2. Dynamic puncturing

Wi-Fi 7 introduces static puncturing as mandatory in the 6 GHz band. Puncturing requires a minimal channel width of 80 MHz enabling clients to avoid using portions of 80 MHz, 160 MHz, or 320 MHz channels. Puncturing is not supported when the AP is operating on 20 MHz or 40 MHz channel widths.

Puncturing along with multiple resource units (MRU) enables flexible use of the remaining non-punctured channel bandwidth. OFDMA MRU distribution is then allocated in the available subchannels around the punctured subchannel.

The AP includes a disabled subchannel bitmap present in the EHT operation parameters and disabled subchannel bitmap in the EHT operation element.

Puncturing removes the PHY preamble which is normally duplicated for each 20 MHz subchannel of the bonded set. The resolution of puncturing is always in 20 MHz channel width increments e.g., 20 MHz or 40 MHz.

3.2 - Planning and deployment

Wi-Fi 7 (IEEE 802.11be PHY/MAC) operates in the 2.4 GHz, 5 GHz, and 6 GHz bands introducing new features and improvements over Wi-Fi 6 and 6E.

Key design principles

1. For 6 GHz band guidance, refer to the Wi-Fi 6E planning and deployment guidelines. Wi-Fi 7 builds on Wi-Fi 6E requirements.
2. Create a dedicated SSID for Wi-Fi 7 to enable new features without disrupting legacy clients. For federated SSIDs (eduroam, Govroam, OpenRoaming), modify the existing SSID with staged testing.
3. Configure MLDs to advertise 5 GHz + 6 GHz bands only. Reserve 2.4 GHz for legacy clients on a separate SSID to avoid unpredictable link selection.
4. Choose Enhanced Open for guest networks, WPA3-Personal for passphrase networks, and WPA3-Enterprise for 802.1X corporate networks. Wi-Fi 7 requires GCMP-256 unicast ciphers and Beacon Protection across all bands.
5. Assess your client device mix before enabling WPA3-Personal mixed mode (sae-sub-mode). Prefer GCMP-256 only operation where client support allows.
6. Do not design for 100% coverage at 4096-QAM MCS rates. Hyper-dense AP placement creates excessive co-channel interference. Balance coverage targets against channel reuse.
7. Mount APs below ceilings with an unobstructed RF path to clients. Match AP and antenna type (omnidirectional vs. directional) to the environment and density requirements.
8. Plan for a capacity-based design with overlapping primary and secondary coverage zones. Brownfield deployments may require 0–10% more APs in high-usage areas.
9. Use 802.3bt/CL6 PoE for new deployments. Enable Intelligent Power Monitoring (IPM) to maximize feature availability on 802.3at/CL4 powered APs.
10. Ensure cabling plant supports Power over Ethernet (PoE) and speed requirements.
11. Always survey, test, and validate with target client devices before widespread deployment.

AP planning

Wi-Fi 7 introduces two new MCS rates for 4096-QAM. When planning new deployments, avoid designing for complete coverage at signal levels required for these highest-order modulation rates. Doing so leads to hyper-dense AP placement and excessive co-channel interference (CCI). Instead, take a balanced approach that optimizes channel reuse within your regulatory domain.

AP placement is important which means do not place APs above ceilings. They need to have an unobstructed view to the end users. Be strategic about AP models, omnidirectional vs. directional APs and antennas, and place APs strategically to take advantage where possible.

AP placement and antenna selection

Plan to mount APs below the ceiling with an unobstructed RF path to client devices. Avoid above-ceiling or above-obstruction installations, which will attenuate signal and waste radiated power.

Deliberately plan AP and antenna selection:

• Omnidirectional APs or antennas may be used for carpeted office spaces where 360 degree coverage is ideal. A trade off can be increased co-channel interference in high to hyper dense deployments.
• Directional APs or antennas help focus energy in high-density areas, reduce signal bleed into adjacent rooms and spaces, and lower co-channel interference.

Match antenna type and AP model to the environment - what works in a carpeted office won’t be suitable for a warehouse or outdoor deployments.

Design philosophy

Plan for a capacity-based design with overlapping primary and secondary coverage zones. For brownfield deployments, this may mean adding 0–10% more APs in targeted locations such as conference rooms, training rooms, or atriums where coverage or capacity was previously insufficient.

Validation

Always survey, test, and validate with deployed end user devices before widespread deployment.

Security

Similar to the security requirements that came Wi-Fi 6E, Wi-Fi 7 also requires use of WPA3 or Enhanced Open along with some additional changes.

Wi-Fi 7 requires clients to support GCMP-256 unicast ciphers and Beacon Protection. These changes affect all bands instead of just the 6 GHz band like with Wi-Fi 6E.

WPA3-Personal

Wi-Fi 7 updates to WPA3-Personal include:

• GCMP-256 unicast ciphers
• Beacon Protection
• Hash-to-element (H2E) for PWE derivation in all bands
• SAE with group dependent hashing (GDH) using AKM:24 and (FT AKM:25 supported starting in AOS-10.8)

The sae-sub-mode configuration for WPA3-Personal controls legacy, mixed-mode, or GCMP-256 only operation.

There is a transition mode and sae-sub-mode configuration which enables support for different combinations of security parameters.

Transition mode support will enable support for WPA2-Personal only devices by advertising legacy WPA2-PSK AKMs and make protected management frames optional in the 2.4 GHz and 5 GHz bands. Note that transition mode is not supported with the sae-sub-mode is set to gcm256-only-mode. Recommendation is to migrate away from transition mode to prevent downgrade attacks.

SSID planning

New SSID approach

A new SSID is recommended. Create a dedicated SSID for Wi-Fi 7 clients. This offers the following benefits:

• Enable Wi-Fi 7 features (MLO, 4096-QAM, etc.) without affecting legacy clients
• Roll out incrementally and validate behavior before broader adoption
• Isolate troubleshooting if issues arise

Existing SSID approach

An existing SSID can be modified to support Wi-Fi 7, but changing the security type on a live network may disrupt legacy clients. Particularly in BYOD environments where you don’t control the device configuration.

This approach may be necessary for federated SSIDs such as eduroam, Govroam, or OpenRoaming, where the solution provider typically mandates a single SSID. In these cases, careful planning and staged testing are essential to understand the impact on existing clients before committing to production changes.

MLO consideration

With Multi-Link Operation (MLO), the client, not the AP, determines which links to use during setup. When the AP MLD advertises all three bands, clients may select different link combinations at association:

If all three 2.4 GHz, 5 GHz, and 6 GHz bands are presented to a client, the client may choose different link combinations at different association times.

In most deployments, reserve 2.4 GHz for legacy 2.4 GHz only clients. Configure the SSID to advertise on only 5 GHz + 6 GHz bands. This can avoid unpredictable link selection and keeps 2.4 GHz from being inadvertently used by high-performance clients.

Power Sourcing

Additional radios and capabilities come with increased power requirements. Tri-radio APs require more power than dual-radio APs — 802.3at/CL4 PoE or better required. 802.3bt/CL6 PoE is recommended for new deployments.

Intelligent Power Monitoring

Intelligent power monitoring or IPM is a method for controlling power usage of HPE Aruba Networking APs. The approach actively measures power usage and dynamically adapts the power budget and restrictions.

When IPM is disabled, static power management will apply reductions in order to not exceed worst case limits and stay within the confines of the power budget.

When IPM is enabled, dynamic power management allows the AP to enable full functionality and performance in the majority of cases.

Enabling IPM will allow for, in most cases, most features when tri-radio APs are powered by a 802.3at/CL4 PSE.

Recommendation is enable IPM.