Protected Management Frames (PMF): Why They Matter and How to Configure Them

Have you ever wondered why your Wi-Fi router suddenly starts slowing down, even though your internet provider promises stable speeds? Or why some devices can't connect to the network even though the password is entered correctly? The cause could be protocol vulnerabilities. Wi-Fi, which are actively exploited by attackers. One solution to this problem is technology protected management frames (Protected Management Frames, PMF).

This feature, despite its name, remains little known even to experienced users. However, it can prevent attacks such as deauthentication (connection broken), disassociation (forced device shutdown) or access point substitution. In this article, we'll explore what PMF is and how it works at the protocol level. 802.11w, and why its support has become a mandatory requirement for certification Wi-Fi Alliance Since 2018. You'll also learn how to check and enable this feature on your router—even if the manufacturer has hidden it deep in the settings.

What are Wi-Fi Protected Management Frames (PMF)?

Protected Management Frames (Protected Management Frames, PMF) is a security mechanism introduced by the standard IEEE 802.11w-2009Its main task is to protect control packages Wi-Fi is protected from counterfeiting and interception. Unlike regular data (which is encrypted by protocols) WPA2 or WPA3), control frames were previously transmitted in cleartext. This allowed attackers to:

• 🔄 Disconnect devices from the network by sending fake frames Deauthentication.
• 📡 Create fake access points (rogue AP), simulating your router.
• 🕵️ Intercepting handshakes for subsequent password cracking.
• 🚫 Block connection new devices sending frames Disassociation.

PMF addresses these issues by adding cryptographic protection to control frames. Now, each such packet is signed with a unique key, and if an attacker tries to forge it, devices will simply ignore the fake traffic. It's important to note that PMF works in addition to the main encryption (WPA2/WPA3), not instead of it.

How 802.11w Works: Technical Details

Standard 802.11w defines two modes of PMF operation:

1. Mandatory - all devices on the network should Support PMF. If any device is not compatible, the connection will be blocked.
2. Optional (Capable) — PMF is only used between devices that support it. Older devices will be able to connect, but without protection for management frames.

A protocol is used to protect frames. CCMP (same as WPA2), but with unique keys for each control packet type. For example:

• 🔑 Key BIP (Broadcast/Multicast Integrity Protocol) - for broadcast frames.
• 🔐 Key IGTK (Integrity Group Temporal Key) - to check integrity.

When a device connects to the network, the router and client exchange these keys during the procedure 4-way handshakeIf the keys do not match or the packet is signed incorrectly, the connection is terminated.

Why Protected Management Personnel Are Needed: Real Threats

Without PMF, your network is vulnerable to several types of attacks that can disable Wi-Fi or compromise security:

A critical feature of PMF is that it protects not only against passive eavesdropping, but also against active attacks that were previously considered unstoppable. For example, attack Deauthentication was the primary tool for capturing the WPA2 handshake (required for brute-forcing passwords). With PMF, this scenario becomes impossible, as the forged frames will be rejected.

⚠️ Attention: Some older devices (eg. Wi-Fi adapters from 2010–2015) may not support PMF. If your router is operating in PMF mode 802.11w Mandatory, such gadgets will not be able to connect. Check the manufacturer's specifications for compatibility.

How to check if your router supports PMF

Not all routers support 802.11w, especially budget models. Here's how to find out if this feature is available on your device:

1. Check out the specifications on the manufacturer's website. Look for mentions 802.11w, Protected Management Frames or PMF.
2. Log into the router's web interface (usually at the address 192.168.0.1 or 192.168.1.1).
3. Check the security section (more often Wireless → Security or Advanced → Wireless Settings).

Examples of routers that support PMF:

• 📶 ASUS RT-AX88U (setting in Wireless → Professional → Protected Management Frames).
• 📶 TP-Link Archer AX6000 (chapter Advanced → Wireless → Wireless Security).
• 📶 Ubiquiti UniFi (enabled in the UniFi controller under Wireless Networks → Advanced).
• 📶 MikroTik hAP ac³ (setting via Wireless → Security Profile).

If there is no explicit mention of PMF in the interface, try updating the firmware - many manufacturers add support 802.11w in new versions of software.

Step-by-step instructions: how to enable protected management frames

The process of enabling PMF depends on the router model, but the general scheme looks like this:

1. Log in in the router's web interface (using the login and password usually indicated on the sticker).
2. Go to the wireless network settings sectionThe path may differ:

   ASUS: Wireless → Professional
   TP-Link: Advanced → Wireless → Wireless Security
   Ubiquiti: Wireless Networks → Advanced Configuration

3. Find the option Protected Management Frames (PMF) or 802.11w.
4. Select mode:
   • Disabled — disabled (not recommended).
   • Capable — optional mode (compatibility with older devices).
   • Required — mandatory mode (maximum safety).

Example for ASUS RT-AX88U:

1. Let's go in Wireless → Professional.
2. Find the block Protected Management Frames (PMF).
3. We choose Enable and regime Required.
4. Click here Apply.

⚠️ Attention: If after enabling PMF some devices stop connecting, try changing the mode with Required on CapableThis will allow older devices to work, but will reduce the level of protection.

Problems and errors when setting up PMF

Even after properly setting up the PMF, issues may arise. Here are the most common problems and their solutions:

Problem	Possible cause	Solution
Devices do not connect to the network	Mode Required + old device without PMF support	Switch to Capable or update the device drivers
Wi-Fi speed has decreased	Additional load on the router's processor due to frame encryption	Update your router's firmware or disable PMF if there are no threats.
The router constantly reboots	Unstable firmware with a bug in the 802.11w implementation	Roll back to the previous software version or wait for a patch
PMF turns on but doesn't work	Conflict with other functions (eg. WPS or Fast Roaming)	Disable conflicting options or reset settings

If after enabling PMF you notice that some devices (for example, smart light bulbs or IP cameras) stopped connecting, check:

• 🔧 Device compatibility with 802.11w (look in the specifications).
• 🔄 PMF operating mode (try it Capable instead of Required).
• 📱 Firmware updates for the problematic gadget.

PMF vs. WPA3: Which is Better for Security?

Many users are confused PMF And WPA3, considering them interchangeable. In fact, these are two different levels of protection:

• 🔒 WPA3 — encrypts data (traffic between the device and the router). Protects against eavesdropping and password hacking.
• 🛡️ PMF (802.11w) - protects management personnelPrevents attacks at the connection control level (deauth, disassoc).

The ideal scenario is when both mechanisms work together. For example:

• 📲 WPA3 encrypts your traffic (so no one can see what websites you visit).
• 🛡️ PMF prevents forced disconnection from the network (so that an attacker cannot intercept the handshake).

If your router supports WPA3, but does not have 802.11w, it's still vulnerable to attacks on control frames. Conversely, PMF without WPA3 will protect against deauth attacks, but won't prevent data interception.

⚠️ Attention: Some manufacturers (eg TP-Link in models before 2020) include PMF only when selected WPA3 in the security settings. Check this in the documentation!

FAQ: Answers to frequently asked questions about protected management frames