Most home networks use personal Wi-Fi, which means every device uses the same shared password. It's simple, but all devices get the same level of access, and if you change the password, everyone needs to update their Wi-Fi.
Firewalla Wi-Fi adds more flexibility. It lets you create multiple SSIDs for different devices, or use Personal Keys (PPSK) so each device or group can have its own password (while sharing the same SSID). However, PPSK only works with WPA2, so it cannot use WPA3 or 6 GHz.
That's why Firewalla AP7 and Firewalla Orange support WPA Enterprise Wi-Fi, which provides per-user credentials, stronger security, and all Wi-Fi bands.
- What is Enterprise Wi-Fi?
- How to use Enterprise Wi-Fi with Firewalla
- (Advanced) Using RADIUS for 3rd-Party APs
What is Enterprise Wi-Fi?
Enterprise Wi-Fi replaces the single shared password with individual usernames and passwords. As a core principle of Zero Trust Network Architecture, each device proves who it is before joining the network.
Firewalla acts as the local authentication server (RADIUS) automatically, so you can deploy WPA2-Enterprise or WPA3-Enterprise without extra hardware.
Benefits of enterprise Wi-Fi:
- Identity-based access: each device belongs to a user
- Stronger security: each user gets unique encryption keys, so compromised devices don't affect others
- WPA3 + 6 GHz: full support under one SSID
- Automatic grouping: Firewalla automatically assigns devices to the correct user when they connect
Note:
- Firewalla enterprise Wi-Fi can only use its own local RADIUS Server (Firewalla). It cannot work with other 3rd-party servers.
- Role-based (e.g., guest, admin, employee) authentication is not yet supported. Once an enterprise Wi-Fi is created, any user can join using their credentials.
- Dynamic VLANs (e.g., assigning users to VLANs during authentication) are not yet supported. It will be coming soon.
Choosing Between Multiple SSIDs, Personal Keys, and Enterprise Wi-Fi
Different devices have different capabilities and security needs. Here's a simple guide to when to use:
- Multiple SSIDs: When you need separate Wi-Fi networks with different security levels. This is especially useful for older IoT devices that only support WPA/WPA2 and can't join newer WPA3 networks.
- Single SSID with Personal Keys (PPSK): When you want one Wi-Fi name but separate passwords for different devices or groups, so that they're automatically assigned. (Note: PPSK requires WPA2, which means it is incompatible with WPA3 and 6 GHz.)
- Enterprise Wi-Fi: When you need user identity, the strongest security, and all Wi-Fi bands, while still automatically assigning devices to users under a single Wi-Fi name.
| Method | Best For | How It Works | Pros | Cons |
Single SSID |
Traditional Wi-Fi |
A single SSID + password |
Very simple to set up |
Shared password for all devices, no device identity before connecting |
| Multiple SSIDs | Old/Legacy IoT devices | Multiple SSIDs + passwords | Works with older devices, different security modes per SSID, easy basic segmentation | Each SSID still shares the same password |
| Single SSID + PPSK | Personal devices, modern IoT, guests | A single SSID + multiple unique keys | Simple to manage, easy access control, automatically send devices to a group/user | PPSK requires WPA2, so no WPA3 or 6 GHz |
| Enterprise Wi-Fi | Work devices, devices with sensitive data | A single SSID + usernames and passwords for each user | User-based authentication, WPA3 and 6 GHz support, strongest security | Incompatible with many IoT devices |
Layered Design
In a typical consumer network, if you want better security, the best way is to take a layered approach.
-
High valued devices + WPA3-Enterprise:
- Devices such as your Phone or Laptop are often used to store very sensitive data. These devices will almost always support WPA3-Enterprise. Integrating zero trust with WPA3-Enterprise will help you better identify and secure devices.
-
IoT devices:
- Many IoT devices do not support WPA3-Enterprise; the best way to secure them is either to use multiple SSIDs or use a single SSID + PPSK.
How to use Enterprise Wi-Fi with Firewalla
Enterprise Wi-Fi Requirements
- Firewalla Gold, Purple, or Orange series box in Router or Bridge mode.
- Firewalla Access Point 7 unit, or Orange Wi-Fi LAN enabled.
- App version 1.67 and Box version 1.981 or later.
Create Enterprise Wi-Fi on Firewalla
With Firewalla Wi-Fi, creating an enterprise Wi-Fi is just as easy as any other SSID:
- From your box's main screen, tap Wi-Fi > Create Wi-Fi > set an SSID + password > Create (Note: the password at this point does not matter, as we will be updating it later.)
- Tap into the SSID you just created > Edit (top right corner) > Security > choose an enterprise security
- Tap Save.
Note that changing the security to Enterprise will remove all Microsegments (Primary and Additional) for the current SSID, as it uses the local RADIUS server (Firewalla) for authentication. Other SSIDs are not affected.
To connect to enterprise Wi-Fi, you must set up a username and password for each Firewalla User.
Setting Up Usernames and Passwords for RADIUS
Once you've set up your enterprise Wi-Fi, you'll need to set up your User credentials to connect to it.
- From your box's main screen > tap Users > select a User > tap Username & Password.
- Tap Generate Password, and adjust the username and password to your liking.
- Tap Save.
Once saved, you can use the credentials to connect to the enterprise Wi-Fi. Firewalla will automatically assign the device to the configured user.
Note:
- When connecting to any new Firewalla enterprise Wi-Fi SSID, your device may prompt you to trust the Firewalla RADIUS certificate. Please confirm the prompt to complete the connection.
- Migrating box data from one box to another box will migrate over RADIUS configuration without the original certificate. Your devices will need to trust a new certificate when connecting to the new box.
- Some Android devices may require you to select the authentication method. If prompted, please select:
- EAP Method: PEAP
- Phase 2 Authentication: MSCHAPV2
- CA Certificate: Trust on First Use
- Dynamic VLANs (e.g., assigning users to VLANs during authentication) are not yet supported. It will be coming soon.
(Advanced) Using RADIUS for 3rd-Party APs
NOTE: This advanced feature is only available to Firewalla Boxes in Router Mode using Early Access or Beta Box Release.
If you don't have the AP7 or Orange Wi-Fi LAN, but you have other APs that support enterprise Wi-Fi, you can use your Firewalla as the local RADIUS Server.
- From your box's main screen, tap Services > RADIUS Server > toggle it on.
- If your box is in Early Access or Beta, you'll see Allow 3rd-party APs. Toggle it on, and the app will generate a shared secret to use.
- Use this shared secret with your 3rd-party AP to set up RADIUS. You may also reset the shared secret if needed.
Devices connecting to enterprise Wi-Fi will be prompted for a username and password. Use the usernames and passwords you set up under Firewalla Users.
- Note that the Server Address (IPv4) displays the first LAN IP address in your Network Manager. However, all LAN subnets will work as the RADIUS Server Address (excluding OpenVPN or WireGuard VPN subnets).
- If you need help setting up RADIUS with your 3rd-party AP, please consult your AP vendor for assistance.
Comments
6 comments
Dear Firewalla Team
Just wanted to note here that I really like the addition of the RADIUS server for 3rd party AP‘s. As you can guess, replacing an existing setup of AP‘s is not something that comes cheap and any integration like the RADIUS server is a welcome addition.
Ideally, one could also set a VLAN per user, maybe this is something you could consider adding eventually?!
Once setting the vlan per user is running, this would be a great option and I'll probably move over to it.
Also any chance of generating certificates on the firewalla and putting them on the device for certificate based authentication (way down the road and a lot lower priority than connecting a user to a vlan).
I’m also hoping that mapping users to a vlan is on the roadmap. That’s the missing piece for me
Concur with others here - works well with my APs(running DDWRT). Not much else I can configure at the moment though for user-based isolation (per user VLAN etc.) but setup was a breeze - thank you Firewalla devs.!
Adding my voice to the choir here asking for dynamic user-to-VLAN assignment with WPA3 Enterprise and RADIUS.
Ask for 802.1x for security concerns and we get PEAP-MSCHAPv2 and to trust first-use certificates? Highly vulnerable to Evil Twin attacks and uses obsolete DES and MD4 cryptography that's trivial to crack. MSCHAPv2 takes the 21-byte key derived from the NT hash of the password and splits it in 3 7-byte DES keys. The 3rd key is the problem - it utilizes only 2 bytes of the hash and pads the rest with null. Capture the handshake, run hashcat and the password is recovered in relatively short time. We need EAP-TLS.
Please sign in to leave a comment.