802.11w Management Protection

RouterOS Security
1

Beefing up my network security vs. the defconf — and since I have a couple WiFi security cameras I became interested in 802.11w to prevent deauth attacks. After poking around I figured out how to change from "disabled" to "allowed" but I'm a little hesitant to make it "required" because I don't know if all my devices support it. I have a mix of wpa3 and wpa2, so I can't just assume.

The Oracle of ChatGPT helpfully suggests making it required and seeing what breaks. Haha, yes, I never would have thought of that. But that does lead me to wonder ... how can I tell whether a given device connecting to the WiFi interface is using Management Protection or not?

(it then hallucinated a bunch of ways I should be able to tell, none of which worked and I'm not even sure they worked on with the previous wireless package or router OS versions)

So the simple question is ... how do I find out if management-protection=yes for any given connection?

2

When you set the management protection to "required" and a device does not support it, it will fail to connect.

So, make a list of devices on your network, change the setting, and see if there are devices that drop out.

3

Obviously that's the brute force way to make the determination. One would think with the power of ROS there was some better way. But maybe I'm wrong.

4

I have been complaining on the forum of the competitor about them not showing whether a device is connected using WPA2 or WPA3 on an SSID configured as WPA2/WPA3. With no result.

It would be so useful to analyze whether WPA2 can be phased out. It is a similar topic as WPA3 requires management protection, so when a device uses WPA3 you know it has it. But there are WPA2 devices that can do management protection as well, although not many.

In the end I used a shell script running on the AP (not possible on MikroTik...) to get some detail from the driver, but it is not perfect, especially because we also use EAP.

5

I once set management-protection to required to find out which clients are incompatible. Turned out, the only devices in my house not supporting protected management frames: RouterOS devices with wireless drivers. I have some in use as wireless-ethernet bridges (map lite and hap lite). :head_shaking_horizontally:

6

But in the wireless drivers, you can enable that. It is in the security profile.

7

Sure you can. But it is not what you think. See wireless docs. See also wifi-qcom-ac benefits.

RouterOS implements a proprietary management frame protection algorithm based on a shared secret