Re: Inquiry: Is WPA3-FT Roaming Supported in iwd ver3.9

[James Prestwood <prestwoj@gmail.com>]

Hi Amit,

On 9/22/25 2:23 PM, amit kumar wrote:
> Dear iwd maintainers and community,
>
> I’m currently working with iwd version 3.9 and have been evaluating
> Fast Transition (FT) behavior across different security
> configurations with standard Cisco AP (It supports FT roaming).
>
> In my testing:
>
> 1> With "WPA2-FT only" security configuration, connection and roaming
> works flawlessly — the device connects and roams as expected.
> 2> WPA3-SAE also connects without an issue.
> 3> However, when the AP is configured with "WPA3-FT only" (AKM suite
> 00-0F-AC:9), iwd fails to connect, logging:
>          iwd[440]: autoconnect: No suitable BSSes found.
> 4> With the same AP's config, wpa_supplicant is able to connect and roam.
>
> Upon reviewing the source code, I noticed that the AKM suite for FT
> over SAE (IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256) is not included in the
> logic that identifies WPA3-Personal networks. After adding the
> following patch to ie.c, iwd successfully connects to the WPA3-FT AP:
>
> ----
>
> diff --git a/src/ie.c b/src/ie.c
> --- a/src/ie.c
> +++ b/src/ie.c
> @@ -1338,7 +1338,8 @@ bool ie_rsne_is_wpa3_personal(const struct
> ie_rsn_info *info)
>           * 3. an AP should enable AKM suite selector: 00-0F-AC:6
>           * 5. an AP shall set MFPC to 1, MFPR to 0
>           */
> -       if (!(info->akm_suites & IE_RSN_AKM_SUITE_SAE_SHA256))
> +       if (!(info->akm_suites & IE_RSN_AKM_SUITE_SAE_SHA256) &&
> +           !(info->akm_suites & IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256))
>                  return false;
>
>          if (!info->mfpc)
>
> ----
>
> My query:
> Does iwd officially support WPA3-FT roaming? If not, is there a
> specific reason this AKM suite is excluded — such as spec maturity,
> roaming logic limitations, or security concerns?

IWD does support WPA3-FT, but based on the spec an AP should never 
advertise only this AKM. It should include plain SAE as well:

2.2 WPA3-Personal only mode
1. An AP shall enable at least AKM suite selector 00-0F-AC:8 in the BSS

This is also in the comment above your diff. I would definitely file a 
bug report with Cisco if you're able to, or ask what the intention of 
this configuration is. It really makes no sense IMO to have _only_ FT, 
i.e. how would you associate initially?

I'm unable to find anything online about "WAP3-FT only" and I also 
checked the settings for the AP vendor we use and there is no such 
"WPA3-FT only" option.

Relaxing this requirement in IWD is of course an option but I suspect 
Cisco is going to have compatibility issues across the board due to this.

Thanks,

James

>
> Id appreciate any insights into the roadmap or design considerations
> around WPA3-FT support. Happy to share logs or test results if
> helpful.
>
> Best regards,
> [Amit Kumar]
>