Skip to content
Menu

Infrastructure and networks · Guide

Wi-Fi 7 on India’s lower 6 GHz band, and the VPN to retire.

Since 21 January 2026, offices in India can run Wi-Fi in 5925 to 6425 MHz without a licence, on type-approved equipment1. Refresh for Wi-Fi 7 where density already hurts and the switches can feed it. Put the internet-facing VPN on the same plan: CERT-In’s April 2026 advisory says to harden or replace older VPN appliances2.

Written by
NetScale IT Services
Published
Sources checked
Read
10 minutes
On this page

The facts

What did India open up for Wi-Fi in January 2026?

Two parts of an office network face a decision in 2027: the Wi-Fi on the busiest floors and the VPN gateway on the internet. A new spectrum rule changes the Wi-Fi decision. For the VPN, it is a run of security advisories.

The Ministry of Communications notified G.S.R. 47(E) on 20 January 2026, and it took effect on publication in the Gazette on 21 January1. It frees 5925 to 6425 MHz from licensing for low power indoor and very low power outdoor wireless access1. That covers systems “including radio local area networks”, such as Wi-Fi13.

Only the lower half of the 6 GHz band is covered13. Use is on a “non-interference, non-protection and shared (non-exclusive) basis”1. The Cellular Operators Association of India had argued that the band was needed for 5G, MediaNama reported3.

Table 1. The lower 6 GHz rules, clause by clause (G.S.R. 47(E), in force from 21 January 2026)
RuleWhat it saysWhat to check
Rule 2The rules apply in the 5925 to 6425 MHz band1.The India country setting on your access points.
Rule 3(1)(f)Indoor operation: the transmitter sits inside premises “wholly enclosed by walls that are non-transparent to radio waves”, except doors, windows or passageways1. The ceiling or roof must be non-transparent to radio waves too1.Which of your spaces meet this test. Where one is unclear, such as an open-sided shed, ask counsel.
Rule 4No licence for equipment within these limits. Low power indoor: 30 dBm maximum equivalent isotropic radiated power (EIRP) and 11 dBm/MHz. Very low power outdoor: 14 dBm and 1 dBm/MHz. Maximum emission bandwidth 320 MHz for both1.Whether yard and outdoor coverage works at the lower power, or belongs on 5 GHz.
Rule 5No use on oil platforms. No indoor use on land vehicles such as cars or trains, on boats, or on aircraft except above 10,000 feet. No communication with or control of drones and unmanned aerial systems. Devices must use a contention-based protocol1.That vehicle-mounted and drone equipment stays off the band.
Rule 7A licensed user’s interference complaint can bring a request to relocate equipment, reduce power or use special antennas. If that fails, a recommendation to stop can follow, after a hearing1.Who in your team answers such a notice.
Rule 8Equipment must have an “in-built and integrated antenna” and be type approved1.Each model’s type approval, before you order.

The facts

What does Wi-Fi 7 add on a busy floor?

Wi-Fi 7 is the 802.11be generation5. The Wi-Fi Alliance introduced its Wi-Fi CERTIFIED 7 programme on 8 January 20244. Three features matter on a dense floor.

Channels of 320 MHz are “available in countries that make the 6 GHz band available to Wi-Fi”4. Multi-Link Operation (MLO) lets a device “transmit and receive data simultaneously over multiple links”4. And 4K QAM, a denser modulation, “achieves 20% higher transmission rates than 1024 QAM”4.

IDC put Wi-Fi 7 at 44.5% of enterprise dependent access point revenue worldwide in 1Q26, up from 11.8% a year earlier5. In 2Q26 it passed half, at 53.0%6.

Security is stricter in the new band. Cisco’s WPA3 guide states that “WPA2 is not permitted in 6 GHz operation” and that Protected Management Frames are mandatory there7. WPA3 is also mandatory for MLO on Wi-Fi 7 devices7.

The facts

What does a Wi-Fi 7 access point need from the switch?

Power and uplink speed decide how much of the radio you get. Cisco’s guide for its CW9178I, a Wi-Fi 7 access point, sets it out by Power over Ethernet (PoE) class8.

Table 2. One Wi-Fi 7 access point at three PoE levels (Cisco CW9178I, from Cisco’s PoE table for IOS XE 17.15.2)
Switch port powerSpatial streamsWi-Fi radiosUplink ports
802.3bt, Class 616All four radios at 4x4Both at 10 Gbps8
802.3at, quad-radio mode8 from release 17.15.3, 6 before itAll four radios at 2x2Both at 2.5 Gbps8
802.3at, tri-radio mode8 from release 17.15.3, 6 before it2.4 and 6 GHz at 2x2, one 5 GHz radio at 4x4, the other offBoth at 1 Gbps8
802.3afNoneAll Wi-Fi radios off; no MLOOne port, at 1 Gbps8

The guide recommends Cat6 or Cat6a cabling for 10 Gbps8. Other vendors publish their own figures.

The facts

How often are VPN gateways attacked?

GreyNoise sensors in more than 80 countries logged 2,969,010,478 malicious sessions between 23 July and 31 December 20259. Its release says “VPN appliances, firewalls, and routers absorb sustained, systematic exploitation attempts”9. It compares three vendors’ remote-access VPNs, which drew 1.6 million to 16.7 million sessions each9.

Verizon’s 2025 Data Breach Investigations Report found edge devices and VPNs were the target in 22% of vulnerability exploitation10. In the previous year’s report, the figure was 3%10. Only about 54% of the edge device flaws were fully remediated during the year, at a median of 32 days10.

The 2026 report, on incidents from November 2024 to October 2025, found exploitation had overtaken stolen credentials as the most common way in11. Its median time for a flaw to be fully patched rose to 43 days, from 3211.

The facts

What do CERT-In and SEBI now ask of remote access?

CERT-In’s advisory CIAD-2026-0020 of 26 April 2026 names the VPN directly2. “Review and harden, or replace, legacy remote-access systems such as older VPN appliances,” it says2. They “have repeatedly been used as entry points by attackers and are particularly attractive to automated tools”2.

It asks for multi-factor authentication (MFA) on “remote access gateways”2. Sensitive internal tools and production systems should be reachable only from managed devices with attested hardware identity, backed by phishing-resistant two-factor authentication2.

“Avoid flat networks where systems can communicate freely with one another,” the advisory adds2. No production system should face the internet unless strictly necessary, and those that do go on an up-to-date inventory2.

CERT-In’s blueprint of 25 May 2026 adds indicative timelines12. For a known exploited flaw “affecting internet-facing and crown-jewel systems”, it expects a patch, mitigation or removal of exposure “within 12 hours where feasible”12. A critical externally exposed flaw gets 1 day12.

SEBI’s circular of 5 May 2026 asks regulated entities to disable “unnecessary services and default accounts”13. It also asks them to enforce “solutions like least privilege, Zero Trust Network (ZTNA)”13.

The baseline is older: the CERT-In Directions of 28 April 202214. They require logs of all ICT systems for “a rolling period of 180 days”, kept “within the Indian jurisdiction”14. Clocks must sync to time servers of the National Informatics Centre (NIC) or National Physical Laboratory (NPL), or ones traceable to them14.

NIST SP 800-207 sets out the model behind per-application access15. Zero trust, it says, “assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location”15. In our reading, a network-level VPN grants that kind of trust once the tunnel is up.

What it means

What changes for your office network and remote access?

Only devices with a 6 GHz radio and WPA3 can use the new band7. On day one, everything else stays on 2.4 and 5 GHz.

The 500 MHz between 5925 and 6425 MHz has room for one 320 MHz channel1. A floor with many access points runs each on a narrower channel. Plan by channel width, not by the speed on the box.

WPA2 cannot follow you into 6 GHz7. Printers, handheld scanners and sensors that speak only WPA2 keep a separate network name (SSID) on 5 or 2.4 GHz, in their own segment.

The switch sets the ceiling. On 802.3at, the access point above runs half its spatial streams or fewer, with uplinks at 2.5 Gbps or less8. On old access switches, you pay for Wi-Fi 7 and get part of it.

A VPN gateway faces the internet by design. We would class it as crown-jewel, because it opens the internal network. A known exploited flaw on it then sits in the blueprint’s 12-hour row12. Each exposed gateway you remove is one fewer 12-hour patch.

We treat access points, controllers, VPN gateways and access brokers as ICT systems, so we plan their logs to the 180-day rule14. How the Directions apply to your organisation is for your counsel.

What to check this week:

  1. Export the access point inventory with model, radio bands and switch port. Flag every model without a 6 GHz radio.
  2. Pull a week of client data from the controller and count devices by band.
  3. Record the PoE class and speed of every switch port that feeds an access point. Compare each with the datasheet of the model you would buy.
  4. Ask the vendor for each model’s type approval and the 6 GHz channels it enables for India1.
  5. List every SSID with its security mode. Mark those on WPA2 only; they cannot move to 6 GHz7.
  6. Scan your own public address ranges from outside and list what answers: VPN portals, management pages, remote desktop, file transfer.
  7. Record each exposed service’s version, owner, MFA status and last patch date.
  8. Confirm that VPN, firewall and controller logs reach a store in India kept for 180 days, on NIC or NPL time14.

Our view

Should you refresh for Wi-Fi 7, and what replaces the VPN?

We would not refresh for Wi-Fi 7 alone. Refresh where density or interference already hurts, or where a floor is being cabled now: meeting rooms, training rooms, open-plan floors and new GCC floors. Do it only where the switch can power the access point fully.

Elsewhere, an access point that serves its floor well can wait for its normal refresh date. There is a fair case for buying Wi-Fi 7 everywhere and refreshing once. It holds when the switches and cabling are due in the same year.

Put remote access on the same plan, in this order:

  1. Take management interfaces off the internet, so admin pages answer only on an internal management network.
  2. Move users from a network-level VPN to per-application access (zero trust network access, or ZTNA), with phishing-resistant MFA on managed devices2.
  3. Segment so that a stolen laptop reaches the one application its user needs, not the subnet2.
  4. Design the logging now: 180 days in India, on NIC or NPL time14.
Table 3. A network-level VPN and per-application access, side by side
QuestionNetwork-level VPNPer-application access (ZTNA)
What does a signed-in user reach?A subnet or more, limited only by firewall rules.The applications named in that user’s policy.
What listens on your public address?The gateway’s login portal and its tunnel service.It depends on the design. Where an application connector dials out to a broker, the application needs no inbound port.
When are user and device checked?At connection, then trusted for the session.Before each session to a resource, as SP 800-207 describes15.

Secure access service edge (SASE) products bundle per-application access with web filtering and SD-WAN. You can buy the access piece on its own.

Two cases change the plan: a machine maker that supports its equipment through its own remote tool, and an application that needs a full tunnel. Keep a VPN for those named exceptions, with MFA, patched on the blueprint’s timelines and with a written exit date12.

You could also argue that a patched VPN with MFA is good enough. CERT-In’s wording allows it: harden, or replace2. Hardening is a fair answer for a year. For five, it leaves the portal on the internet, where GreyNoise logged 2.97 billion malicious sessions between late July and December 20259.

Limits

What does this plan leave to others?

Whether a building counts as indoor operation under rule 3(1)(f) is for your counsel. Your vendor should show type approval for each model1. How the CERT-In Directions and sector rules from SEBI, RBI or IRDAI apply to you is for your counsel and compliance team.

The power figures are for one access point model on one software release. Plant-floor OT networks, point-to-point links and SASE pricing are outside this piece.

Where we fit

Where does NetScale fit in a network refresh?

Our enterprise networking work starts with a site-by-site map of what is installed: access points, switch ports and their power, SSIDs and remote-access gateways. We design Wi-Fi, switching and segmentation together, with the firewall alongside. Network devices log to a store in India kept for 180 days, on NIC or NPL time. The assessment is free, and the written findings are yours whether we work together or not.

Questions readers ask

Is 6 GHz Wi-Fi legal in India now?

In 5925 to 6425 MHz, yes: since 21 January 2026, low power indoor and very low power outdoor Wi-Fi needs no licence1. Indoor equipment is limited to 30 dBm EIRP and outdoor to 14 dBm1. All of it must be type approved1. Use is shared and unprotected from interference1. Whether a given site meets the indoor test is for your counsel.

Will our existing laptops and scanners use the 6 GHz band?

Only if they have a 6 GHz radio and support WPA3. WPA2 is not permitted in 6 GHz, so WPA2-only devices stay on 2.4 or 5 GHz7. Count devices by band before you plan a floor around 6 GHz.

Can Wi-Fi 7 access points run on our current PoE switches?

At reduced capability, on the one model checked here. Cisco’s CW9178I runs 16 spatial streams on 802.3bt Class 6 and 8 or fewer on 802.3at; on 802.3af its Wi-Fi radios are off8. Check each model’s datasheet against your switch ports.

Do we have to replace our VPN?

CERT-In’s advisory gives a choice: “review and harden, or replace” legacy remote-access systems such as older VPN appliances2. SEBI’s circular asks its regulated entities to enforce solutions like ZTNA13. How either applies to your organisation is for your counsel or compliance team. If you keep a VPN, put MFA on it and patch it on the blueprint’s timelines212.

How long do we keep VPN and firewall logs in India?

For a rolling 180 days, within India: the CERT-In Directions of 28 April 2022 require this for logs of all ICT systems14. They also require clocks synced to NIC or NPL time servers, or ones traceable to them14. How they apply to your organisation is for your counsel.

References

  1. 1Department of Telecommunications, Ministry of Communications (Gazette of India, Extraordinary, No. 47). G.S.R. 47(E): Use of Low Power and Very Low Power Wireless Access System including Radio Local Area Network in Lower 6 GHz band (Exemption from Licensing Requirement) Rules, 2026. 21 January 2026. dot.gov.in (opens in a new tab)
  2. 2Indian Computer Emergency Response Team (CERT-In). Defending Against Frontier AI Driven Cyber Risks (CERT-In Advisory CIAD-2026-0020). 26 April 2026. cert-in.org.in (opens in a new tab)
  3. 3MediaNama. Indian Govt. Delicenses Half of 6 GHz Band for Wi-Fi Despite Opposition From Telecom Operators. 22 January 2026. medianama.com (opens in a new tab)
  4. 4Wi-Fi Alliance. Wi-Fi Alliance® introduces Wi-Fi CERTIFIED 7™. 8 January 2024. wi-fi.org (opens in a new tab)
  5. 5IDC. Wi-Fi 7 Captures 44% of Enterprise WLAN Dependent Access Point Revenue as 1Q26 Market Grows 15.9% to Nearly $2.7 Billion. 16 June 2026. idc.com (opens in a new tab)
  6. 6IDC. Enterprise WLAN Market Grows 23.2% to $3.2 Billion in 2Q26, Driven by Accelerating Wi-Fi 7 Adoption. 10 September 2026. idc.com (opens in a new tab)
  7. 7Cisco. WPA3 Deployment Guide. 6 October 2025. cisco.com (opens in a new tab)
  8. 8Cisco. Cisco Wireless CW9178I Access Point Deployment Guide. 13 December 2024. cisco.com (opens in a new tab)
  9. 9GreyNoise Intelligence. GreyNoise Releases 2026 State of the Edge Report: More Than Half of Remote Code Execution Attempts Originate From Previously Unseen IPs. 24 February 2026. greynoise.io (opens in a new tab)
  10. 10SecurityWeek, reporting the Verizon 2025 Data Breach Investigations Report. Verizon DBIR Flags Major Patch Delays on VPNs, Edge Appliances. 24 April 2025. securityweek.com (opens in a new tab)
  11. 11Help Net Security, reporting the Verizon 2026 Data Breach Investigations Report. Verizon DBIR: Vulnerability exploitation is the dominant initial access vector. 20 May 2026. helpnetsecurity.com (opens in a new tab)
  12. 12Indian Computer Emergency Response Team (CERT-In). Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (CISG-2026-02, Version 1.0). 25 May 2026. cert-in.org.in (opens in a new tab)
  13. 13Securities and Exchange Board of India. Advisory on Emerging Advanced Artificial Intelligence (AI) Tools for Vulnerability Detection (like Mythos), circular HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026. 5 May 2026. sebi.gov.in (opens in a new tab)
  14. 14CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet. 28 April 2022. cert-in.org.in (opens in a new tab)
  15. 15National Institute of Standards and Technology (NIST). SP 800-207, Zero Trust Architecture. August 2020. csrc.nist.gov (opens in a new tab)

Changes

  • First published.

Written by NetScale IT Services. How these guides are written

  1. Security operations10 minutes

    How to meet CERT-In’s 12-hour patch window.

  2. Security operations10 minutes

    Ransomware in India: who to report to, how fast and how to recover.