WPA2 is still common on MikroTik deployments, but it has known weaknesses — offline dictionary attacks against a captured handshake being the main one — that WPA3's newer key exchange (SAE, Simultaneous Authentication of Equals) closes. If your access points support it, moving to WPA3 (or a WPA2/WPA3 mixed mode while older clients age out) is a straightforward hardening step.
Check whether your wireless package supports WPA3
Newer boards running the wifiwave2 driver support WPA3 natively; devices still on the legacy wireless package have more limited support. Check what your hardware offers with /interface wifi print (wifiwave2) or /interface wireless print (legacy) before assuming WPA3 is available.
Create a WPA3 security profile
On wifiwave2:
/interface wifi security add name=wpa3-profile authentication-types=wpa3-psk wpa3-passphrase=YourStrongPassphraseThe legacy wireless package uses a similar security-profiles structure with authentication-types=wpa3-psk, depending on RouterOS version.
Use a mixed WPA2/WPA3 profile if you still have older clients
Some phones and IoT devices from before ~2020 don't support WPA3 at all and will simply fail to connect if you force it. A transitional mixed mode keeps both working while you phase out the oldest hardware:
/interface wifi security set wpa3-profile authentication-types=wpa2-psk,wpa3-pskApply the profile to your SSID
Attach the new security profile to the wifi configuration or interface actually broadcasting the network, then apply the change — clients will need to reconnect and re-enter the passphrase if you also changed it.
Confirm every client reconnects
Check the client list a few minutes after applying the change. Any device that silently disappears rather than reconnecting is worth investigating individually — it's usually old hardware that doesn't support WPA3 and needs the mixed profile, or needs to be replaced.
Why do it this way
WPA3's SAE key exchange specifically closes the offline dictionary attack that makes a weak WPA2 passphrase crackable once someone captures a handshake — the passphrase itself doesn't have to leak, just get guessed against a copy of that captured exchange. Using mixed mode during migration instead of forcing WPA3 everywhere on day one avoids silently locking out client devices that have no way to reconnect, which is a worse outage than staying on WPA2 a little longer.
How MoniTik helps
MoniTik's device monitoring doesn't change what security protocol your Wi-Fi uses, but its connection history is useful during exactly this kind of migration — if a client silently drops off, MoniTik shows you when and lets you correlate it with the moment you applied the new security profile, instead of guessing later why a device went dark.
Valentina has spent the last decade deploying and troubleshooting MikroTik networks for ISPs across Latin America.