Wireless Security · Topic 4 of 4

Management Frame Protection

Learn what management frame protection does on a RouterOS wireless network, how it stops spoofed deauthentication, and how to set management-protection.

4 min

In a nutshell

Management frames, such as deauthentication, are not protected by data encryption.
Forged deauthentication frames can disconnect clients.
MFP signs management frames so forged ones are ignored.

What it is

Management frame protection protects the control messages of a wireless network from being forged.

Wi-Fi uses management frames for housekeeping, such as beacons, association and deauthentication. In the original design these frames were not protected, so anyone could send a fake one.

An attacker could send a forged deauthentication frame that looks like it comes from the access point, and the client would drop off the network. Management frame protection (MFP) closes this gap.

How it works

With MFP the access point and the client protect the management frames, so a forged frame is rejected.

Why management frames matter

The three kinds of frame are:

Kind	Purpose
Data	The user traffic
Control	Frame handling, such as acknowledgements
Management	Network housekeeping, such as beacons, authentication and deauthentication

Encryption of the data does not protect the management frames. A client can have a strong WPA2 key and still be thrown off the network by a forged deauthentication frame. This is cheap to do, which is why it is a popular attack.

What MFP adds

With MFP, certain management frames carry a proof that they come from the real access point. The receiver checks the proof. If it is wrong or missing, the frame is ignored.

This stops forged deauthentication and disassociation frames. It does not stop an attacker who simply jams the radio channel, because that is a physical disturbance and not a forged message.

Settings in RouterOS

MFP is set in the security profile:

/interface wireless security-profiles set secure management-protection=allowed management-protection-key=ProtectionKey123

Value of `management-protection`	Meaning
`disabled`	The device does not use management frame protection
`allowed`	The device uses it if the other side supports it
`required`	The device joins only with partners that support it

The management-protection-key is a key that the devices use to protect the frames. The same key must be set on the devices that talk to each other. An access list entry can also hold a key for one client.

Choosing the value

Situation	Suitable value
Mixed clients, some without support	`allowed`
All devices known to support it	`required`
Troubleshooting a link that will not form	`disabled`, as a test

With required, a device that does not support the feature cannot join. That gives the best protection, but it can lock out older clients. With allowed, clients that do not support MFP can still join, but they remain open to forged frames.

Watch out

Setting required on an access point locks out every client that cannot do MFP. Test with one client first.

Where it applies

MFP is used together with encryption, such as WPA2 with aes-ccm, and it is set in the same security profile.

The partner must support it too, and support depends on the RouterOS version and on the client. Check the clients you have before you require it.

Testing

A simple lab test:

Set management-protection=allowed on the access point and a RouterOS client.
Join the client and check the registration table.
Change the access point to required and see that a client without support is refused.
Return to allowed if you need the old client back.

/interface wireless security-profiles print detail
/interface wireless registration-table print detail

The security profile shows the setting in force. The registration table shows which clients are connected.

How it fits with other protection

MFP is one layer. Encryption protects the data, and access lists and RADIUS decide who may join.

MFP keeps the connection from being cut by forged messages. A secure network uses all of them.

Exam tip

Use allowed as a first step and move to required only when you know all clients support it.

What to remember for the exam

Six facts cover this topic.

Management frames, such as deauthentication, are not protected by data encryption.
Forged deauthentication frames can disconnect clients.
MFP signs management frames so forged ones are ignored.
management-protection has the values disabled, allowed and required.
management-protection-key is the key used to protect the frames.
MFP does not protect against jamming.

Common mistakes

Four errors are typical.

Believing encryption protects everything. Management frames were left open by the original design.

Using required too early. Clients without support are locked out.

Different keys at the two ends. The protection check fails.

Expecting protection from jamming. MFP stops forged frames and not radio noise.

Check yourself

Work through these three questions.

What attack does management frame protection help stop?
It stops forged deauthentication and disassociation frames that would disconnect clients. The frames carry proof and forged ones are ignored.
What is the difference between allowed and required?
With allowed the device uses MFP when the partner supports it. With required it joins only partners that support it.
Does MFP protect against jamming the channel?
No. Jamming is a physical disturbance and not a forged message, so MFP does not stop it.

Topic 4 of 4 in Wireless Security

Test yourself on Wireless Security

The full MikroTik MTCWE question bank has 447 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.