--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -3007,6 +3007,8 @@ static int hostapd_config_fill(struct ho
 		wpa_printf(MSG_INFO,
 			   "Line %d: Obsolete peerkey parameter ignored", line);
 #ifdef CONFIG_IEEE80211R_AP
+	} else if (os_strcmp(buf, "ft_iface") == 0) {
+		os_strlcpy(bss->ft_iface, pos, sizeof(bss->ft_iface));
 	} else if (os_strcmp(buf, "mobility_domain") == 0) {
 		if (os_strlen(pos) != 2 * MOBILITY_DOMAIN_ID_LEN ||
 		    hexstr2bin(pos, bss->mobility_domain,
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -283,6 +283,7 @@ struct airtime_sta_weight {
 struct hostapd_bss_config {
 	char iface[IFNAMSIZ + 1];
 	char bridge[IFNAMSIZ + 1];
+	char ft_iface[IFNAMSIZ + 1];
 	char vlan_bridge[IFNAMSIZ + 1];
 	char wds_bridge[IFNAMSIZ + 1];
 	int bridge_hairpin; /* hairpin_mode on bridge members */
--- a/src/ap/wpa_auth_glue.c
+++ b/src/ap/wpa_auth_glue.c
@@ -1616,8 +1616,12 @@ int hostapd_setup_wpa(struct hostapd_dat
 	    wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
 		const char *ft_iface;
 
-		ft_iface = hapd->conf->bridge[0] ? hapd->conf->bridge :
-			   hapd->conf->iface;
+		if (hapd->conf->ft_iface[0])
+			ft_iface = hapd->conf->ft_iface;
+		else if (hapd->conf->bridge[0])
+			ft_iface = hapd->conf->bridge;
+		else
+			ft_iface = hapd->conf->iface;
 		hapd->l2 = l2_packet_init(ft_iface, NULL, ETH_P_RRB,
 					  hostapd_rrb_receive, hapd, 1);
 		if (!hapd->l2) {