The company wants to deploy an open WLAN for guests with the following requirements:
Guests connect without entering a password (open authentication).
Guests are redirected to a welcome web page and log in (captive portal).
Encryption is provided for devices that support it.
Open WLAN with Captive Portal: An open WLAN means no pre-shared key (PSK) or 802.1X
authentication is required to connect. A captive portal can be used to redirect users to a web page
where they must log in (e.g., with guest credentials). This meets the requirement for guests to
connect without a password and then log in via a web page.
Encryption for Capable Devices: The company wants to provide encryption for devices that support
it, even on an open WLAN. Opportunistic Wireless Encryption (OWE) is a WPA3 feature designed for
open networks. OWE provides encryption without requiring a password by negotiating unique
encryption keys for each client using a Diffie-Hellman key exchange. OWE in transition mode allows
both OWE-capable devices (which use encryption) and non-OWE devices (which connect without
encryption) to join the same SSID, ensuring compatibility.
Option A, "Opportunistic Wireless Encryption (OWE) and WPA3-Personal," is incorrect. WPA3-
Personal requires a pre-shared key (password), which conflicts with the requirement for guests to
connect without entering a password.
Option B, "Captive portal and WPA3-Personal," is incorrect for the same reason. WPA3-Personal
requires a password, which does not meet the open WLAN requirement.
Option C, "WPA3-Personal and MAC-Auth," is incorrect. WPA3-Personal requires a password, and
MAC authentication (MAC-Auth) does not provide the web-based login experience (captive portal)
specified in the requirements.
Option D, "Captive portal and Opportunistic Wireless Encryption (OWE) in transition mode," is
correct. An open WLAN with OWE in transition mode allows guests to connect without a password,
provides encryption for OWE-capable devices (e.g., WPA3 devices), and supports non-OWE devices
without encryption. The captive portal ensures that guests are redirected to a welcome web page to
log in, meeting all requirements.
The HPE Aruba Networking AOS-8 8.11 User Guide states:
"Opportunistic Wireless Encryption (OWE) is a WPA3 feature that provides encryption for open
WLANs without requiring a password. In OWE transition mode, the WLAN supports both OWE-
capable devices (which use encryption) and non-OWE devices (which connect without encryption) on
the same SSID. This is ideal for guest networks where encryption is desired for capable devices, but
compatibility with all devices is required. A captive portal can be configured on an open WLAN to
redirect users to a login page, such as captive-portal guest-login, ensuring a seamless guest
experience." (Page 290, OWE and Captive Portal Section)
Additionally, the HPE Aruba Networking Wireless Security Guide notes:
"OWE in transition mode is recommended for open guest WLANs where encryption is desired for
devices that support it. Combined with a captive portal, this setup allows guests to connect without a
password, get redirected to a login page, and benefit from encryption if their device supports OWE."
(Page 35, Guest Network Security Section)
:
HPE Aruba Networking AOS-8 8.11 User Guide, OWE and Captive Portal Section, Page 290.
HPE Aruba Networking Wireless Security Guide, Guest Network Security Section, Page 35.
===========
