What's new

Asus AX89X + ZenWiFi XT8 + Ethernet backhaul => Unencrypted network!

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!


Regular Contributor
In my new apartment I was finally able to set up ethernet backhaul between my nodes.
My main router is an Asus AX89X (FW, and nodes are ZenWiFi XT8s (FW
Enabling Ethernet Backhaul Mode, frees up the (better) 5Ghz-2 band of the XT8s for clients' use - but at least in my case, they are set up as an unencrypted network (with the same SSID as the AX89X's 5Ghz band).
I tried disabling 5GHz-1 on the AX8s, but that did not help - the encrypted network disappeared, and the unencrypted one remained... The only option I found so far was to just disable the 5GHz-2 bands on the AX8s.

Anyone else has stumbled upon this issue?
May have to bite the bullet and go AP mode on the XT8s instead.
Yup. AiMesh is currently missing the ability to control all bands on tri-band nodes from a dual-band master.

I've got the same setup as the OP along with an additional XT8. The AX-89X is running standalone with a wired uplink to the first XT8 that is setup as a AiMesh master and the second XT8 as a node. Seems like the least bad way to set it up.

Should be possible for Asus to adress this issue, but I'm not holding my breath.

Edit: More on this here Multi-Gig wired backhaul AiMesh combos: Mixing Wi-Fi 6 and Wi-Fi 6E
Last edited:
Switched to AP Mode as well. This is really ugly.
Im a bit late to the party on this one however, i just commented on another post outlining this exact same security concern. Im running AX89X and x2 XT8s in Aimesh only to discover 5G_2_dwb channel is wide Open!!! not even MAC based ACL allow/deny can stop devices connecting!!
Switched to AP Mode as well. This is really ugly.
IMO AP mode is best for all auxiliary broadcasters, with loss of only "one location administration" and propagating a VLAN throughout the system. Haven't yet found a need for the latter, but would still make the trades for the individual radio configurability which is sorely lacking in mesh mode.
The configuration overhead is just a pain. But the lack of VLAN propagation results in an inability to add isolated Guest Network to the nodes, and that is substantial IMO.

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!