Tutorials · Wi-Fi
How to Secure Wi-Fi With WPA3-Enterprise and RADIUS
Replace shared Wi-Fi passwords with per-user authentication using 802.1X, a RADIUS server and WPA3-Enterprise (or WPA2-Enterprise for older devices).
Before you start
- Access points supporting WPA3/WPA2-Enterprise
- A RADIUS server (for example FreeRADIUS or Windows NPS)
- A certificate for the RADIUS server
Step by step
Prepare the RADIUS server
Install a server certificate and connect RADIUS to your user directory (Active Directory or LDAP).
Add the access points as RADIUS clients
Register the AP or controller IP addresses and a strong shared secret.
Create the enterprise SSID
Select WPA3-Enterprise (or WPA2/WPA3 transition mode), enter the RADIUS server IP, port 1812 and the shared secret.
Choose the EAP method
PEAP-MSCHAPv2 is the simplest. EAP-TLS with device certificates is the most secure.
Assign VLANs dynamically (optional)
RADIUS can return a VLAN per user group, putting staff and contractors in different networks on one SSID.
Test
Connect a laptop and a phone, check the RADIUS logs and confirm users land in the right VLAN.
Pro tips
- Configure clients to validate the server certificate; otherwise attackers can impersonate your network.
- Keep a separate PSK SSID only for devices that cannot do 802.1X, in an isolated VLAN.
FAQ
Frequently asked questions
What is the difference between WPA3-Personal and WPA3-Enterprise?
Personal uses one shared password. Enterprise authenticates each user or device individually through RADIUS.
Keep learning
Related guides
802.1X wired port authentication
Read more →Understanding 802.1X
Read more →How to Set Up Secure Guest Wi-Fi With Client Isolation
Give visitors Internet access without exposing your internal network: separate SSID and VLAN, client isolation, bandwidth limits and an optional captive portal.
Read more →How to Plan Wi-Fi Channels on 2.4, 5 and 6 GHz
Reduce interference and increase capacity by choosing the right channels and widths for each band.
Read more →How to Improve Wi-Fi Roaming With 802.11k and 802.11v
Help phones, laptops and scanners move smoothly between access points without dropping calls.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.