This one catches organisations at the point of enabling 6 GHz, and the diagnosis takes longer than it should because nothing in the interface explains it.
6 GHz operation mandates WPA3 and Protected Management Frames. There is no open BSS, no WPA2, and no mixed mode. A guest network built the conventional way — an open SSID with a captive portal in front of it — simply cannot exist on 6 GHz.
Move guest to OWE. Enhanced Open provides unauthenticated encryption with no user interaction: guests connect exactly as they would to an open network, but the traffic is encrypted over the air. Deploy it in OWE transition mode, which advertises both an open and an OWE BSS so that older clients still connect.
This is strictly better than an open network even before considering 6 GHz, and where a portal is not legally required it is the right default.
Keep the portal on 2.4 and 5 GHz. Perfectly workable. Accept that guests do not get 6 GHz, and be explicit about it in the design document so the next engineer does not treat it as a fault.
Portal plus OWE. Some platforms support a portal in front of an OWE BSS. Support is inconsistent — test it with your actual client mix before committing.
Captive portals have accumulated other friction worth reviewing: MAC randomisation makes returning visitors anonymous again, client operating systems use portal-detection endpoints that must not be blocked, and HSTS with certificate pinning breaks naive HTTPS interception.
The honest question to ask is what the portal is actually for. If the answer is a legal terms-of-use acceptance, keep it and scope guest service to 2.4 and 5 GHz. If the answer is marketing email capture, weigh that against what MAC randomisation has already done to the quality of that data.
If the answer is "security", the portal was never providing any, and OWE gives you more protection for less friction.
We would move guest networks to OWE transition mode as the default recommendation now, and treat the portal as a specific requirement to be justified rather than the standard pattern.
Source: WiFi Assistant. We link to primary sources wherever one exists — read it and form your own view.
Per-SSID randomised MAC addresses are now the default across iOS, Android and Windows. Anything in your network that assumes a stable MAC is degraded, and most organisations have not audited what that includes.
One email a fortnight: new case studies, spectrum-policy changes, and the gear worth your budget.