diff --git a/src/script/multiap b/src/script/multiap
index 99545456c6ec8e4431eb345f9c72ad2fbc63904c..72e2fc8fd2c3596810ae9b03ed7beb3c3e3d93d9 100755
--- a/src/script/multiap
+++ b/src/script/multiap
@@ -52,7 +52,7 @@ get_network_id() {
 	local ifname=$1
 
 	[ -n "$ifname" ] || return
-	network_id=$(wpa_cli -i $ifname list_n|tail -n 1 | awk '{print $1}')
+	network_id=$(wpa_cli -i $ifname list_n| sed '1d' | head -n 1 | awk '{print $1}')
 	echo ${network_id}
 }
 
@@ -64,6 +64,48 @@ get_type_by_section() {
 	echo "$(type_to_multi_ap $type)"
 }
 
+encryption_to_key_mgmt() {
+	enc=$1
+
+	case $enc in
+		sae)
+			echo "SAE"
+		;;
+		sae-mixed)
+			echo "WPA-PSK SAE"
+		;;
+		psk2|psk-mixed)
+			echo "WPA-PSK"
+		;;
+		none)
+			echo "NONE"
+		;;
+	esac
+}
+
+encryption_to_ieee80211w() {
+	enc=$1
+
+	case $enc in
+		sae)
+			echo "2"
+		;;
+		sae-mixed)
+			echo "1"
+		;;
+	esac
+}
+
+encryption_to_proto() {
+	enc=$1
+
+	case $enc in
+		*)
+			echo "RSN"
+		;;
+	esac
+}
+
 setup_conf() {
 	. /lib/multiap/map_genconfig
 
@@ -837,16 +879,28 @@ bsta_to_wireless() {
 				uci -q set wireless.${section}.bssid="$bssid"
 				uci -q set wireless.${section}.default_disabled='0'
 
-				[ "$disabled" != "1" ] && return
-
-				[ -n "$ifname" ] || return
-
 				network_id=$(get_network_id $ifname)
-				wpa_cli -i "$bsta" disconnect > /dev/null 2>&1
-				wpa_cli -i "$bsta" disable_network $network_id > /dev/null 2>&1
+				key_mgmt=$(encryption_to_key_mgmt $encryption)
+				ieee80211w=$(encryption_to_ieee80211w $encryption)
+				proto=$(encryption_to_proto $encryption)
+
+				# explicitly apply config to wpa_supplicant if valid
+				if [ "$key_mgmt" != "" -a "$proto" != "" ]; then
+					wpa_cli -i "$bsta" set_n $network_id ssid \"$ssid\"
+					wpa_cli -i "$bsta" set_n $network_id psk \"$key\"
+					wpa_cli -i "$bsta" set_n $network_id key_mgmt "$key_mgmt"
+					wpa_cli -i "$bsta" set_n $network_id proto "$proto"
+					wpa_cli -i "$bsta" set_n $network_id ieee80211w "$ieee80211w"
+					[ "$bssid" != "" ] && wpa_cli -i "$bsta" set_n $network_id bssid "$bssid"
+				fi
+
+				if [ "$disabled" != "1" ]; then
+					wpa_cli -i "$bsta" enable_n $network_id
+				else
+					wpa_cli -i "$bsta" disconnect > /dev/null 2>&1
+					wpa_cli -i "$bsta" disable_network $network_id > /dev/null 2>&1
+				fi
 				wpa_cli -i "$bsta" save_config > /dev/null 2>&1
-
-				echo 1
 			}
 
 			config_load wireless
@@ -895,23 +949,9 @@ bsta_to_wireless() {
 		fi
 	}
 
-#	best=$(mapagent_find_lowest_prio_onboarded)
-#
-#	[ -z "$best" ] && return
-#
-#	band=$1
-#	sec=""
-#	prio=""
-#
-#	config_foreach mapagent_enable_best bsta $best
-#	uci commit mapagent
 	config_load mapagent
-
-	diff=$(config_foreach mapagent_bsta_to_wireless bsta)
-
-#	[ "$diff" != "" ] && {
-		uci commit wireless
-#	}
+	config_foreach mapagent_bsta_to_wireless bsta
+	uci commit wireless
 }