Problem connecting two ESP32s, one using an ESP32 NAT router and the other as a client.

[marsilba]

I'm trying to connect another classic ESP32 to the ESP32 NAT router, but I'm having authentication problems. When I don't send a password and leave "open (no password)" selected in the configuration page, I can connect the two ESP32s. However, if I send the password and leave the "open (no password)" option unchecked, I can't connect. From what I've seen, it's a WPA2 authentication issue, but how can I solve this?

[martin-ger]

When you set a password (≥8 chars) and leave "open" unchecked, the AP comes up with the default auth mode. In get_ap_authmode() (main/esp32_nat_router.c:824), the default (ap_authmode == 0) is:

default: return WIFI_AUTH_WPA2_WPA3_PSK;

So the router's AP starts in WPA2/WPA3 transition mode. The open case works because line 935 forces WIFI_AUTH_OPEN, bypassing all of this.

The problem: WPA2/WPA3 transition mode makes the SoftAP advertise WPA3/SAE elements and mark PMF (Protected Management Frames) as capable. A classic ESP32 acting as the station frequently fails to associate with a transition-mode AP — its station-side RSN/PMF handling chokes on the mixed RSN element, which surfaces exactly as a WPA2 authentication failure during the 4-way handshake. This is a well-known ESP32-as-STA interop issue, not a password mismatch.

Fix:

You don't need to change the firmware — just pin the AP to plain WPA2. On the config page there's a Security dropdown:

WPA2/WPA3 (value 0, default) ← what you're hitting
WPA2 only (value 1) ← select this
WPA3 only (value 2)

Select "WPA2 only", save, and reboot the router. That sets WIFI_AUTH_WPA2_PSK, drops the WPA3/SAE advertisement, and the classic ESP32 client should connect.