WLAN: New MLO Setup Method and Security for 11be

With the release of Nebula 19.10 and the AP firmware 7.20, Zyxel introduces major changes to the configuration of Multi-Link Operation (MLO) and the security methods for Wi-Fi 7 (802.11be). These updates simplify administration, enhance performance, and ensure compliance with Wi-Fi Alliance requirements.

Key Changes

Previously, administrators could manually enable or disable MLO. Starting with AP firmware 7.20, the ON/OFF toggle has been removed.

• MLO is now automatically enabled for all SSIDs assigned to radios operating in 11be mode.

• Only the following security methods are supported: Enhanced Open, WPA3 Personal, and WPA3 Enterprise.

Rationale:
MLO delivers significant improvements in throughput and connection stability, making it a default standard for Wi-Fi 7 networks.

Practical Implementation

• Selecting 802.11be radio mode for any band (2.4, 5, or 6 GHz) will automatically enable MLO for the SSIDs on that radio.

• This behavior applies to Nebula Cloud, Standalone, and ZLD Controller modes.

• The maximum number of supported MLO Groups is 20. Exceeding this limit will disable the last assigned SSID.

Administrator Tips

CLI commands such as show wlan-ssid-profile and show mlo_info config can be used to verify the real MLO status. These outputs provide details about radio modes, MLD IDs, and active SSID assignments.

Security Methods for 802.11be

For radios operating in 802.11be mode, the Wi-Fi Alliance mandates strict rules:

• 2.4/5 GHz:

  • Enhanced Open (without Transition Mode)

  • WPA3 Personal (with or without Transition Mode)

  • WPA3 Enterprise (with or without Transition Mode)

• 6 GHz:

  • Enhanced Open

  • WPA3 Personal

  • WPA3 Enterprise

Restrictions and Conversion

Unsupported [Radio Mode × Security Method] combinations applied in the Web GUI will be automatically converted to the “next best method” for service continuity.
When MLO is enabled on the 6 GHz band, the other radios (2.4/5 GHz) are also forced to adopt the “next best method.”

Legacy Client Issue

Because WPA3 is mandatory for 11be operation, many legacy clients (Wi-Fi 5 and below) cannot connect. This created compatibility concerns for organizations still supporting older devices.

Solution in Firmware 7.20

• An alternative “next best method” with Transition Mode is applied for 2.4 GHz and 5 GHz bands, improving compatibility for older clients.

• WPA3 Enterprise remains inherently backward compatible and does not require Transition Mode.

• Additionally, Zyxel changed the default 2.4 GHz mode for Wi-Fi 7 APs to 802.11ax, ensuring that 2.4 GHz can serve as a “last resort band” for legacy clients.

Conclusion

The updates in Nebula 19.10 and AP firmware 7.20 reflect Zyxel’s commitment to standardizing Wi-Fi 7 operations:

• MLO is now automatically enabled with 11be mode, ensuring maximum performance.

• Security methods strictly follow Wi-Fi Alliance mandates, providing predictable behavior and stronger protection.

• Legacy device support is maintained through 2.4 GHz adjustments, helping organizations transition smoothly to Wi-Fi 7 without excluding older clients.