1. The Customer Friction Point

One of the more common friction points I’m seeing lately with a few of my customers is the concept, or mindset, of leaving WPA3 “Transition Mode” enabled indefinitely. At the same time, they’ve created a dedicated WPA3 Enterprise SSID with SAE, PMF, GCMP-256, and the rest of the hardened profile. The two configurations contradict each other.

The root of it is an incomplete understanding of the 802.11 mechanics underneath. So I keep having the same conversation: why the device compatibility and roaming issues tied to Transition Mode are a real operational problem, and why the answer is moving off that feature set entirely.

2. What Transition Mode Actually Does in 802.11

On an 802.1X (Enterprise) SSID, Transition Mode typically means the BSSID advertises multiple 802.11 RSN AKMs. Specifically, it advertises both the 802.1X / WPA2-Enterprise legacy AKM suite and the 802.1X with WPA3-Enterprise suite, with RSN IE parameters aligned to WPA3’s stricter crypto and PMF expectations (Wi-Fi Alliance, “Wi-Fi CERTIFIED WPA3 Technology Overview”).

In plain terms: one SSID advertising two security options. Some clients select the WPA3 AKM. Others continue to select the legacy AKM even when they support WPA3, because chipsets and drivers vary in behavior.

AKM suite selectors per (IEEE, “IEEE Std 802.11-2020”).

When Transition Mode is active, the RSN Information Element in the beacon and probe response contains entries for both legacy and modern AKM selectors. A client supplicant reads those entries and picks based on its own capability, and its driver’s interpretation of what “capability” means (IEEE, “IEEE Std 802.11-2020”).

3. The AKM Downgrade Problem

Here’s my main issue: the downgrading of AKM suites.

If a WPA2-Enterprise AKM remains available on the same SSID as WPA3, you’ve preserved the legacy attack surface. Older crypto still exists. Any STA can negotiate it. The “WPA3” SSID isn’t purely WPA3, it is WPA2-or-WPA3, depending on which AKM each client negotiates.

This is the core problem with Transition Mode as a permanent design. You ship a policy that says “WPA3 Enterprise SSID” but the RSN IE tells a different story. The beacon doesn’t lie. The AKM selector list is right there in the frame. If 00-0F-AC:1 is still in that list, WPA2 is still on the table.

# Wireshark RSN IE dissection of a Transition Mode beacon
# Note both AKM selectors present simultaneously

RSN Information
  RSN Version: 1
  Group Cipher Suite: CCMP-128 (00-0F-AC:4)
  Pairwise Cipher Suite Count: 1
    Pairwise Cipher Suite: CCMP-128 (00-0F-AC:4)
  AKM Suite Count: 2
    AKM Suite: 802.1X (00-0F-AC:1)        <-- WPA2-Enterprise still advertised
    AKM Suite: 802.1X-SHA256 (00-0F-AC:5) <-- WPA3-Enterprise
  RSN Capabilities:
    PMF Required: 0                        <-- optional, not enforced
    PMF Capable: 1

That output tells the whole story. PMF Required is 0. Two AKMs, one of them legacy. That is not a WPA3 deployment. That is a WPA2 deployment with a WPA3 option bolted on.

4. Roaming and Device Compatibility Failures

The operational pain isn’t just theoretical. Transition Mode produces real failures in production environments (Wi-Fi Alliance, “WPA3 Specification”).

Inconsistent PMF Enforcement

With PMF set to “optional,” some clients negotiate it. Some don’t. When those clients roam, particularly in fast BSS transition scenarios, the AP and client may be operating under different PMF assumptions. That mismatch produces de-authentication frames, failed re-associations, and the kind of “sticky client” behavior that fills up support tickets with no obvious root cause (IEEE, “IEEE Std 802.11w-2009”).

Supplicant Edge Cases

Not all chipsets handle a dual-AKM RSN IE the same way. The failures show up as sticky clients, unpredictable re-associations, and PMF mismatches wherever the “optional” flag is set. The worst part: every one of these looks like an RF problem in the ticket queue, and none of them are.

5. The Case for AKM Segmentation

The fix is straightforward even if the migration isn’t always painless: separate the AKMs. Give each security generation its own SSID. No fallback, no dual-lane negotiation, no ambiguity.

Once your device inventory has migrated off the legacy SSID, you shut it down. That’s the migration path. Transition Mode was supposed to be a bridge, not a destination. Leaving it enabled indefinitely means you never cross the bridge. You just live on it.

The mindset shift is this: stop thinking about Transition Mode as a “best of both worlds” configuration. It is a “worst of both worlds” configuration. You get the attack surface of WPA2 and the operational complexity of WPA3 at the same time, with none of the security guarantees of either.

6. Works Cited