Default Wifi settings on hAP ax2

axotik · July 21, 2026, 3:39pm

I setup a new hAP ax2 router and used the quickset function to enable the wifi radios, and i just setup the wireless key. Now looking at the security settings, there is no information about what is actually enabled with the default settings. If i click on the authentication types all the checkboxes come up empty, but i see that wpa psk is one of the options... I wonder what is the actual default auth types enabled in the router if nothing in there is actually selected?

axotik · July 21, 2026, 4:02pm

Should I trust this answer:

The output reveals exactly how your hAP ax² is currently running.

Because security.authentication-types and security.encryption are not explicitly defined in your output lines, your router is using the RouterOS 7 hardware defaults for the wifi package.

What is currently in use:

Authentication Type: wpa2-psk, wpa3-psk (WPA2/WPA3 Mixed Mode)

Encryption Cipher: ccmp, gcmp (AES-CCMP for WPA2, and GCMP for WPA3)

When you do not explicitly assign an authentication type or encryption cipher to a Wi-Fi interface in RouterOS 7, the system automatically falls back to secure defaults, which enables WPA2 and WPA3 simultaneously.

How can i actually verify this? The whole point here is making sure WPA is not enabled...

lurker888 · July 21, 2026, 4:28pm

The answer you quote sounds about right.

The surest way to verify these settings is with an external scanning tool. Lots of them are available for Android and iOS, and usually phones have more capable wifi chipsets and drivers than laptops.

axotik · July 21, 2026, 4:51pm

Yes I would use a wifi scanner, the problem is I am managing this router remotely for an office, and using an external scanner is not an option. There may be a way to pull the report of what is being used in the router's terminal.
I tried:
/interface/wifi/print detail
it only shows the SSID, MAC, wifi key and a few other bits but nothing about auth types and encryption.
/interface/wifi/print proplist=name,security
lists the available wifi interfaces with no details.

jaclaz · July 21, 2026, 4:57pm

Do a verbose export of the meaningful directories in terminal.
Example:
/interface wifi export verbose

probably:
/interface wifi security export verbose
would be enough.

Nikalia · July 21, 2026, 5:13pm

the only way to know the default value is to look at the wiki WiFi - RouterOS - MikroTik Documentation

unfortunately , there is no default value for the authentication-types

axotik · July 21, 2026, 5:21pm

Thank you for trying.. but no, the first command shows the same as i posted before with /interface/wifi/print detail, and the second one just shows the model and serial number.

jaclaz · July 21, 2026, 5:38pm

Well, it is not possible.
Export means "output all settings that are NOT default".
Export verbose means "output all settings NO MATTER if default or not"

Maybe if you don't have a /interface wifi security at all, then you will get just model and serial.

So simply add some settings, i.e. (example only):

/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no ft=yes ft-over-ds=yes management-protection=required name=MAIN wps=disable passphrase=pwdforMAIN

mkx · July 22, 2026, 8:45am

On the other hand, command

/interface/wifi/print detail

will print out actual running values ... regardless how they were obtained (implicit defaults or explicit configuration). If that command doesn't output security details, then they are not used and you're running open SSID.

holvoetn · July 22, 2026, 9:25am

My take (and some might disagree)
Don't trust defaults since they can always change with newer versions (for whatever reason).
Set them yourself so you KNOW what they are.

No need then to hunt what is being used, it's in the config.

aldek · July 22, 2026, 10:04am

This is my config. Partially sanitized .

Works like a charm! Macs, iPhones, and Windows clients—no problem at all.

[xxxx@hAPax2-xx] > /interface wifi  export verbose show-sensitive

2026-07-22 10:52:46 by RouterOS 7.23.1
software id = xxx-XXXX
model = C52iG-5HaxD2HaxD
serial number = xxxxxxxxx

/interface wifi
set [ find default-name=wifi2 ] arp-timeout=auto channel.band=2ghz-ax .reselect-interval=2h..4h .width=20mhz comment=
"XX WiFi 2GHz" configuration.country=XXXXXXX .hw-protection-mode=rts-cts .mode=ap .ssid=XXXX-X disabled=no 
l2mtu=1560 mac-address=04:F4:1C:XX:XX:XX name=wifi.2GHz radio-mac=04:F4:1C:XX:XX:XX security.authentication-types=
wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes .passphrase=XXXXXXXXXXXXX .wps=disable
add arp-timeout=auto comment="XX Guest WiFi 2GHz" configuration.mode=ap .ssid=XXXX-G datapath.client-isolation=yes 
disabled=no l2mtu=1560 mac-address=06:F4:1C:XX:XX:XX master-interface=wifi.2GHz name=wifi.2GHz-guest 
security.authentication-types=wpa2-psk,wpa3-psk .passphrase=XXXXXXXXXXXXX
set [ find default-name=wifi1 ] arp-timeout=auto channel.band=5ghz-ax .reselect-interval=2h..4h .width=20/40/80mhz 
comment="XX WiFi 5GHz" configuration.country=XXXXXXXXXX .hw-protection-mode=rts-cts .mode=ap .ssid=XXXX-X 
disabled=no l2mtu=1560 mac-address=04:F4:1C:XX:XX:XX name=wifi.5GHz radio-mac=04:F4:1C:XX:XX:XX 
security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes .passphrase=XXXXXXXXXXXXX .wps=push-button
/interface wifi cap
set enabled=no
/interface wifi capsman
set enabled=no