Three SSIDs, One VLAN
A hospital runs three SSIDs: clinical devices on WPA2-PSK with one shared key, staff on PEAP-MSCHAPv2, and guest open with a captive portal. All three bridge to the same VLAN. Last month the RADIUS server certificate expired; some staff laptops failed to connect while others kept working. An auditor found the clinical PSK written on a whiteboard at three nursing stations. Approximately 850 infusion pumps and patient monitors support only WPA2-PSK on 2.4 GHz. About 4,000 staff devices are dual-band. The next budget cycle includes 6 GHz access points.
1. Rank the findings by risk and propose a target architecture that does not require replacing the 850 pumps.
Read the worked answer
Ranking. The flat VLAN is the top finding, because the shared clinical key plus a bridged guest SSID means anyone with the key - posted in public - has layer-2 adjacency to pumps, monitors, and staff resources. Next is the shared PSK itself: it cannot be revoked per device and offers no accountability. The expired certificate is third: an availability incident that also exposed weak supplicant configuration. The open guest SSID sharing that VLAN compounds everything.
Target architecture. Segment first: separate VLANs and firewall/ACL policy between clinical, staff, guest, and management, with the guest path offering internet only plus client isolation. Then deal with the pumps: use a dedicated clinical SSID with per-device PSK (private PSK or identity PSK) if the WLAN platform supports it, so a lost or leaked key can be revoked for one device. MAC allow-listing is inventory control, not security - it is trivially spoofed - but combined with static addressing and restrictive ACLs it raises the bar. Move staff to EAP-TLS with certificates issued by MDM where the fleet allows; otherwise PEAP with enforced server-certificate validation pushed by profile. Treat 6 GHz as an opportunity to run WPA3-Enterprise on a modern SSID, not as a fix for the pumps.
2. Why did only some staff laptops fail when the RADIUS certificate expired?
Read the worked answer
Supplicant validation settings. Laptops whose profile required server-certificate validation against a pinned CA failed to authenticate once the certificate was expired or mismatched. Laptops configured to accept any certificate - or where validation was never enabled - kept working.
The uncomfortable conclusion. The machines that 'worked' were the insecure ones. They would have accepted an attacker's RADIUS server with a self-signed certificate, so the outage surfaced a pre-existing evil-twin exposure.
Remediation. Re-issue the certificate with the correct subject and SAN entries, confirm the server sends the full chain, and push the CA plus the complete supplicant profile through MDM so every laptop validates. Then watch the RADIUS authentication-failure reason codes during the rollout: a wave of certificate-validation failures indicates a profile or chain problem, while EAP-method mismatches point at a different issue. Verify that any fallback SSID offered during the transition does not quietly bypass validation.
3. What does the 6 GHz plan imply for these device populations?
Read the worked answer
6 GHz rules the legacy fleet out. The band requires WPA3 and 802.11ax, with protected management frames mandatory - there is no WPA2 option. The 850 pumps cannot join 6 GHz at all, so the plan must include retained 2.4 GHz coverage sized for them. Assuming the new APs offload the pumps is a planning error that will show up as coverage complaints on the wards.
Staff fleet. Test before committing. A WPA3-only SSID on 6 GHz gives the strongest protection but excludes any device or driver that lacks SAE support. WPA3 transition mode on 5 GHz keeps older clients connected, but those clients still use WPA2 and remain vulnerable to downgrade and offline dictionary attacks, so transition mode is a bridge, not a destination. Enable protected management frames globally, but audit for client types that drop off when MFP is required rather than optional.
Sequencing. Segment and fix the certificate first; those are cheap and reduce immediate exposure. Then move the clinical SSID to per-device credentials, and only then introduce 6 GHz as an additional, WPA3-only capacity layer for staff devices that have passed the compatibility test.