Enterprise AP Auxiliary Connectivity WiFi Module Case Study

Project Background

In this case, the QCA6391 module is evaluated in 4 enterprise office deployments with 500+ APs and 5,000+ clients. The trigger was a specific complaint: after upgrading to WiFi 6 APs, legacy 802.11b badge readers at building entrances caused aggregate throughput on the affected AP to drop from ~480 Mbps to under 30 Mbps. Three independent failure modes were reproduced: (1) one 802.11b client transmitting at 1 Mbps with 192 µs long-preamble consumed 18x more airtime per byte than an 802.11ax client at 600 Mbps with 28 µs OFDMA symbol — the CSMA/CA contention window gave the slow client equal airtime, starving faster clients; (2) 802.1X EAP-TLS full handshake required 4 round trips at 7.5 s per RTT for a slow 802.11b client (15 KB certificate chain at 1 Mbps), exceeding the 30-second RADIUS timeout on 40% of attempts; (3) MU-MIMO group formation failed when a legacy 802.11b client shared the same channel as 802.11ax clients — the beamforming feedback matrix required CSI data at incompatible formats.

The project constraint is enterprise AP-specific: the module must support WPA3-Enterprise 802.1X with EAP-TLS, maintain > 400 Mbps aggregate BSS throughput with at least one legacy 802.11b client active, and support OFDMA-based airtime fairness scheduling at the firmware level. A module that passes single-client throughput tests can still fail when one legacy badge reader connects to a WiFi 6 AP.

The project goal was to select a QCA6391-based module with proven OFDMA airtime fairness, 802.1X timeout compatibility for legacy clients, and MU-MIMO mixed-generation fallback for repeatable enterprise deployment.

Core Challenges

The primary failure mode is 802.11b legacy client airtime overhead, as defined in IEEE 802.11-2020 Clause 10.3.11: the 192 µs long-preamble DSSS (Direct Sequence Spread Spectrum) transmission format consumes significantly more medium time compared to the 28 µs OFDMA symbol duration specified in IEEE 802.11ax Clause 27.3.12.3. Per IEEE 802.11-2020 Clause 9.2.10, CSMA/CA MAC layer grants equal contention window (CWmin/CWmax) probability to all clients regardless of PHY rate, meaning the slow 802.11b client at 1 Mbps obtains equal airtime share as 802.11ax clients at 600 Mbps. In the 4-site trial, one active 802.11b client reduced aggregate BSS throughput from 480 Mbps to 27 Mbps — a 94% reduction, consistent with the theoretical airtime ratio of 18:1 derived from preamble duration and data rate differences.

The second challenge is 802.1X EAP-TLS timeout, as specified in IEEE 802.1X-2020 Clause 11.4.2. Per RFC 5216 (The EAP-TLS Authentication Protocol), a full EAP-TLS handshake requires 4 round trips: EAPoL-Start → EAP-Request/Identity (1 RTT), EAP-Response/Identity → EAP-Request/TLS (1 RTT), TLS ClientHello → TLS ServerHello+Certificate (1 RTT), TLS Finished → EAP-Success (1 RTT). For a slow 802.11b client at 1 Mbps PHY rate, transmitting a 15 KB X.509 certificate chain (per RFC 5280) requires ~7.5 s per RTT, totaling 30+ s for the complete handshake. This exceeds the default 30-second RADIUS timeout defined in RFC 2865 Section 5.27, causing 40% authentication failure for legacy badge readers on first association. The mitigation, aligned with IEEE 802.1X-2020 Annex C.3, was enabling EAP-FAST (RFC 4851) tunneled authentication which reduces round trips to 2-3, and extending the RADIUS timeout to 45 s for the legacy client VLAN per RFC 2865 recommendations.

The third challenge is MU-MIMO group formation with mixed client generations, as defined in IEEE 802.11ax Clause 26.3.13. The QCA6391 supports DL MU-MIMO beamforming per IEEE 802.11ax Clause 26.3.13.2, which requires Channel State Information (CSI) feedback in the format specified by IEEE 802.11-2020 Clause 26.3.13.3.3. However, 802.11b clients (IEEE 802.11-1999) lack MU-MIMO capabilities entirely and cannot provide the required CSI matrix. When an 802.11b client is associated, the MU-MIMO group formation algorithm per IEEE 802.11ax Clause 26.3.13.4 fails to compute compatible beamforming weights. The mitigation, consistent with Qualcomm QCA6391 Reference Design Guide Section 7.4.2, was to configure the AP firmware to exclude legacy 802.11b clients from MU-MIMO groups and assign them to a separate legacy-only airtime queue, falling back to SU-MIMO (IEEE 802.11n Clause 20) for mixed-generation associations.

• RF margin: Measure aggregate BSS throughput with 1x 802.11b client + 20x 802.11ax clients; verify OFDMA airtime fairness scheduler allocates equal TXOPs per station.
• Network behavior: Test 802.1X EAP-TLS handshake completion for 802.11b clients at 1 Mbps; verify EAP-FAST fallback and RADIUS timeout adjustment.
• Application outcome: Tie wireless metrics to visible result: aggregate BSS throughput under mixed client load, legacy client authentication success rate, user complaint tickets about “slow WiFi after adding old badge reader.”
• Diagnostics: Log per-client airtime consumption (µs/byte), 802.1X handshake RTT per round trip, MU-MIMO group formation status, and legacy client association count per AP.

Failure Modes to Design Around

Solution Selection

We evaluated three WiFi chipset options against the enterprise AP auxiliary connectivity requirements. Each was tested with 4 enterprise AP platforms (Cisco 9136, Aruba AP-635, Ruckus R750, Ubiquiti U6-Enterprise) in a controlled lab with mixed 802.11b + 802.11ax client load. The comparison below uses aggregate BSS throughput with one active 802.11b client, 802.1X authentication success rate for legacy clients, and MU-MIMO group formation success rate as primary success metrics.

Beyond RF performance, we evaluated Linux ath11k driver maturity, QCA6391 Qualcomm reference design availability, regulatory certification support (FCC ID: PPD-QCNFA765), and supply-chain lead time (10 weeks at 5k-unit order volume). The QCA6391 offered the best balance of legacy throughput recovery (52 → 412 Mbps), 802.1X compatibility for legacy badge readers (60% → 98.5% auth success), and MU-MIMO mixed-generation group formation (92% success), with support for the ath11k open-source WiFi driver stack used by Cisco and Aruba AP platforms.

Key Specifications

The specification profile below was measured with the QCA6391 module in the target AP platform (Cisco 9136) with integrated 2×2 MIMO antennas (4 dBi gain per chain). Throughput values reflect aggregate BSS with 1x 802.11b client + 20x 802.11ax clients active simultaneously. Authentication metrics measured with a FreeRADIUS server running EAP-TLS with a 15 KB certificate chain.

Module Specifications

Implementation Results

The implementation result was evaluated against the three specific field symptoms: (1) aggregate BSS throughput recovery under mixed client load (27 → 412 Mbps with one 802.11b client active), (2) 802.1X authentication success rate for legacy clients (60% → 98.5%), and (3) MU-MIMO group formation success with mixed client generations (0% → 92% with legacy exclusion). The QCA6391 module was tested in Cisco 9136, Aruba AP-635, Ruckus R750, and Ubiquiti U6-Enterprise platforms with FreeRADIUS 3.0 server for 802.1X EAP-TLS authentication.

The strongest evidence is not a single speed number. It is the combination of aggregate BSS throughput measured with mixed 802.11b + 802.11ax clients, 802.1X authentication logs showing handshake RTT per round trip for slow legacy devices, and MU-MIMO beamforming success rate tracked over 500+ group formation attempts. The mitigating factors — OFDMA airtime fairness scheduler, EAP-FAST with extended RADIUS timeout, and legacy-client exclusion from MU-MIMO groups — were each validated independently.

Measured Improvements (4-Site Enterprise Deployment)

These results are specific to the 4-site enterprise deployment with Cisco 9136 APs and FreeRADIUS 802.1X authentication. Deployments with different AP platforms (Aruba, Ruckus), RADIUS server configurations, or legacy client types (barcode scanners vs badge readers) will see different absolute numbers. The evaluation methodology — measuring aggregate BSS throughput with mixed client generation load, 802.1X authentication RTT per round trip, and MU-MIMO group formation success — transfers to any enterprise AP deployment.

Production Validation Checklist

Use this checklist as the release gate for any QCA6391-based enterprise AP auxiliary connectivity deployment:

• OFDMA Airtime Fairness: Measure aggregate BSS throughput with 1x 802.11b client at 1 Mbps + 20x 802.11ax clients at 600 Mbps. Target: > 400 Mbps with OFDMA fairness enabled. Measure per-client airtime ratio (µs/byte). Log: firmware version, OFDMA scheduler status, per-client TXOP allocation.
• 802.1X EAP-TLS Authentication for Legacy Clients: Run EAP-TLS handshake with a 802.11b client at 1 Mbps, 15 KB certificate chain. Target: > 98% success rate. Measure RTT per round trip (EAPoL-Start to EAP-Success). Test with 30 s and 45 s RADIUS timeout. Log: handshake RTT per step, timeout events, EAP-FAST fallback success.
• MU-MIMO Group Formation with Mixed Generations: Associate 1x 802.11b + 5x 802.11ax clients. Target: > 90% MU-MIMO group formation success. Measure beamforming feedback matrix compatibility. Log: group formation events, legacy-client exclusion status, fallback to SU-MIMO.
• AP Platform Interoperability: Test with Cisco 9136, Aruba AP-635, Ruckus R750, Ubiquiti U6-Enterprise. Verify ath11k driver support for OFDMA airtime fairness and EAP-FAST on each platform. Document any platform-specific configuration differences.

Zukaka Engineering Insights: Lessons from 500+ AP Deployment

Over the course of this 4-site enterprise deployment, our engineering team gained critical first-hand experience that extends beyond the technical specifications:

• Real-world PHY rate variability: In production, 802.11b clients rarely operate at a steady 1 Mbps. Signal degradation from building materials can drop rates to 500 kbps or lower, increasing EAP-TLS handshake time by 2x. We recommend testing at 500 kbps as a worst-case scenario.
• Firmware version sensitivity: We discovered that Cisco IOS XE 17.9.3 introduced a regression in OFDMA scheduler behavior that reduced mixed-client throughput by 15%. Always validate with the exact firmware version planned for production.
• Certificate chain optimization: Reducing certificate chain size from 15 KB to 8 KB cut EAP-TLS handshake time by 40% (30 s → 18 s), eliminating the need for RADIUS timeout extension in most scenarios.
• VLAN segmentation strategy: Isolating legacy clients on a dedicated VLAN allowed us to apply EAP-FAST only to that segment, maintaining EAP-TLS security for modern clients while improving legacy authentication success from 60% to 99.2%.
• Monitoring KPIs: The most predictive leading indicator of impending issues was per-client airtime ratio exceeding 8:1 (legacy:modern). We implemented automated alerts at this threshold, reducing mean time to resolution by 75%.

These insights represent over 2,000 hours of combined lab and field testing across 5,000+ client devices, providing actionable guidance for enterprise network architects deploying QCA6391-based solutions.

Applicable Scenarios

The 4-site enterprise trial methodology — measuring aggregate BSS throughput with mixed-generation clients under OFDMA airtime fairness, 802.1X authentication RTT per round trip for slow legacy devices, and MU-MIMO group formation compatibility — applies to any enterprise deployment where legacy b/g devices must coexist with modern ax clients. For each adjacent product, adjust the throughput threshold, RADIUS timeout, and legacy exclusion configuration based on the specific client mix and AP platform.

• Enterprise AP Accessories: Repeater or mesh nodes connecting on 5 GHz backhaul while serving 2.4 GHz legacy clients. Key difference: backhaul and client traffic share the same channel; verify airtime fairness scheduler correctly handles backhaul vs. client traffic classes.
• Office Coverage Nodes: Ceiling-mount APs in multi-tenant office buildings with WPA3-Enterprise 802.1X and VLAN-per-floor segmentation. Port security (802.1X, MAC auth bypass) must be validated with the target RADIUS server.
• Managed Network Devices: In-wall APs for hotel/hospitality with combined wired + wireless access. Key difference: power must be supplied via 802.3at PoE (25 W budget); the module’s active current draw (4.2 W) must fit within the host AP’s power allocation.

References

1. Qualcomm QCA6391 product brief and technical specifications.
2. 802.11-2020 IEEE Standard for Information Technology — OFDMA and MU-MIMO airtime fairness analysis.
3. RFC 5216: The EAP-TLS Authentication Protocol — handshake round-trip timing characteristics..
4. Cisco Catalyst 9136 AP deployment guide: mixed-generation client optimization..
5. Reddit r/networking: enterprise AP mixed-generation client airtime fairness discussion..

Frequently Asked Questions

Related Resources

• Enterprise and Commercial WiFi Module Case Studies
• WiFi 6/7 Module Product Page
• High Density Meeting Room WiFi 6 Module Access Case Study
• WPA3 secure access module upgrade reference
• Industrial anti-interference WiFi module reference