Asus AX89X + ZenWiFi XT8 + Ethernet backhaul => Unencrypted network!

[slrt]

In my new apartment I was finally able to set up ethernet backhaul between my nodes.
My main router is an Asus AX89X (FW 3.0.0.4.388_32407), and nodes are ZenWiFi XT8s (FW 3.0.0.4.388_23285).
Enabling Ethernet Backhaul Mode, frees up the (better) 5Ghz-2 band of the XT8s for clients' use - but at least in my case, they are set up as an unencrypted network (with the same SSID as the AX89X's 5Ghz band).
I tried disabling 5GHz-1 on the AX8s, but that did not help - the encrypted network disappeared, and the unencrypted one remained... The only option I found so far was to just disable the 5GHz-2 bands on the AX8s.

Anyone else has stumbled upon this issue?

 

[glens]

May have to bite the bullet and go AP mode on the XT8s instead.

 

[xyx]

May have to bite the bullet and go AP mode on the XT8s instead.

Yup. AiMesh is currently missing the ability to control all bands on tri-band nodes from a dual-band master.

I've got the same setup as the OP along with an additional XT8. The AX-89X is running standalone with a wired uplink to the first XT8 that is setup as a AiMesh master and the second XT8 as a node. Seems like the least bad way to set it up.

Should be possible for Asus to adress this issue, but I'm not holding my breath.

Edit: More on this here Multi-Gig wired backhaul AiMesh combos: Mixing Wi-Fi 6 and Wi-Fi 6E

 

[slrt]

Switched to AP Mode as well. This is really ugly.

 

[majika]

Im a bit late to the party on this one however, i just commented on another post outlining this exact same security concern. Im running AX89X and x2 XT8s in Aimesh only to discover 5G_2_dwb channel is wide Open!!! not even MAC based ACL allow/deny can stop devices connecting!!

 

[xyx]

Please report this to Asus, if you haven't already.

 

[glens]

Switched to AP Mode as well. This is really ugly.

IMO AP mode is best for all auxiliary broadcasters, with loss of only "one location administration" and propagating a VLAN throughout the system. Haven't yet found a need for the latter, but would still make the trades for the individual radio configurability which is sorely lacking in mesh mode.

 

[slrt]

The configuration overhead is just a pain. But the lack of VLAN propagation results in an inability to add isolated Guest Network to the nodes, and that is substantial IMO.