--- a/etc/net/scripts/config-wireless	
+++ a/etc/net/scripts/config-wireless	
@@ -29,10 +29,12 @@ if [ -x "${IWCONFIG:=$DEFAULT_IWCONFIG}" ]; then
 fi
 
 # configure WPA
-if [ -x "${WPA_SUPPLICANT:=$DEFAULT_WPA_SUPPLICANT}" ]; then
+if [ -x "${WPA_SUPPLICANT:=$DEFAULT_WPA_SUPPLICANT}" -a \
+	-x "${WPA_CLI:=$DEFAULT_WPA_CLI}" ]; then
 	prof_conf=`profiled_filename $MYIFACEDIR/wpa_supplicant.conf`
 	if [ -s "$prof_conf" ]; then
-		$WPA_SUPPLICANT -i$NAME${WPA_DRIVER:+ -D$WPA_DRIVER} -c $prof_conf 2>&1>/dev/null &
-		echo $! >/var/run/wpa_supplicant-$NAME.pid
+		$WPA_SUPPLICANT -i$NAME${WPA_DRIVER:+ -D$WPA_DRIVER} \
+			-B -P/var/run/wpa_supplicant-$NAME.pid -c $prof_conf
+		$WPA_CLI -i$NAME -B -P/var/run/wpa_cli-$NAME.pid -a $SCRIPTDIR/wpa_cli.action
 	fi
 fi
--- a/etc/net/scripts/functions	
+++ a/etc/net/scripts/functions	
@@ -18,6 +18,7 @@ DEFAULT_IFPLUGD=/usr/sbin/ifplugd
 DEFAULT_IWPRIV=/sbin/iwpriv
 DEFAULT_IWCONFIG=/sbin/iwconfig
 DEFAULT_WPA_SUPPLICANT=/usr/sbin/wpa_supplicant
+DEFAULT_WPA_CLI=/usr/sbin/wpa_cli
 DEFAULT_PLIPCONFIG=/sbin/plipconfig
 DEFAULT_VCONFIG=/usr/bin/vconfig
 DEFAULT_IPSECADM=/usr/sbin/ipsecadm
@@ -501,7 +502,7 @@ declare -frx modprobe_with_rename
 declare -frx eval_string
 declare -rx DENOISE DEFAULT_BONDMODE IFACEDIR LOCALSCRIPTDIR VARLIBDIR
 declare -rx VLANTAB HOSTTAB IFTAB PROFILE_FILE PROC_CMDLINE DEFAULT_IFPLUGSTATUS
-declare -rx DEFAULT_IFPLUGD DEFAULT_IWCONFIG DEFAULT_WPA_SUPPLICANT DEFAULT_PLIPCONFIG
+declare -rx DEFAULT_IFPLUGD DEFAULT_IWCONFIG DEFAULT_WPA_SUPPLICANT DEFAULT_WPA_CLI DEFAULT_PLIPCONFIG
 declare -rx DEFAULT_VCONFIG DEFAULT_PENTANETT DEFAULT_PENTAVALT DEFAULT_PENTANET_CONF
 declare -rx DEFAULT_PENTAVAL_CONF DEFAULT_IPSECADM DEFAULT_IFENSLAVE DEFAULT_BRCTL
 declare -rx DEFAULT_ETHTOOL DEFAULT_PPPD DEFAULT_CHAT DEFAULT_PPPOPTIONSFILE
--- a/etc/net/scripts/ifdown-ifplugd	
+++ a/etc/net/scripts/ifdown-ifplugd	
@@ -51,15 +51,17 @@ case "$BOOTPROTO" in
 	;;
 esac
 
-case "$USE_IFPLUGD" in
-	[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]|[Oo][Nn]|[Yy]|1|[Aa][Uu][Tt][Oo])
+if [ "${0##/*}" = "ifdown-ifplugd" ]; then
+	case "$USE_IFPLUGD" in
+		[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]|[Oo][Nn]|[Yy]|1|[Aa][Uu][Tt][Oo])
 		# It's Ok, just do the job.
-	;;
-	*)
+		;;
+		*)
 		print_error "ERROR: USE_IFPLUGD is not enabled for $NAME"
 		exit 1
-	;;
-esac
+		;;
+	esac
+fi
 
 ExecIfExecutable $LOCALSCRIPTDIR/ifdown-pre-local $NAME && print_progress
 ExecIfExecutable $MYIFACEDIR/ifdown-pre $NAME && print_progress
--- a/etc/net/scripts/ifup-common	
+++ a/etc/net/scripts/ifup-common	
@@ -184,18 +184,23 @@ process_sysctl_conf()
 	return 0
 }
 
+if ! is_yes $IN_WPA_CLI; then	# non-wifi or first pass for wifi
 # setup link-level params
-xargise_file $IFACEDIR/default/iplink "$IP link set dev $NAME"
-xargise_file $IFACEDIR/default/iplink-$TYPE "$IP link set dev $NAME"
-xargise_file $MYIFACEDIR/iplink "$IP link set dev $NAME"
+    xargise_file $IFACEDIR/default/iplink "$IP link set dev $NAME"
+    xargise_file $IFACEDIR/default/iplink-$TYPE "$IP link set dev $NAME"
+    xargise_file $MYIFACEDIR/iplink "$IP link set dev $NAME"
 
 # bring iface up
-if ! is_yes $KEEP_DOWN; then
+    if ! is_yes $KEEP_DOWN; then
 	$IP link set dev $NAME up && print_progress
+    fi
 fi
 
 # handle wireless extensions
-is_yes "$CONFIG_WIRELESS" && $SCRIPTDIR/config-wireless $NAME && print_progress
+if is_yes "$CONFIG_WIRELESS" && ! is_yes $IN_WPA_CLI; then
+    $SCRIPTDIR/config-wireless $NAME && print_progress
+    exit 0
+fi
 
 # process ip neighbours
 xargise_file $MYIFACEDIR/ipneigh "$IP neigh replace dev $NAME"
--- a/etc/net/scripts/ifup-ifplugd	
+++ a/etc/net/scripts/ifup-ifplugd	
@@ -13,7 +13,7 @@ usage()
 [ -z "$1" ] && usage
 export NAME=$1
 
-# forget everything we have inherited from ifplugd
+# forget everything we have inherited from ifplugd/wpa_cli
 export SCRIPTDIR=/etc/net/scripts
 . $SCRIPTDIR/functions
 pickup_defaults
@@ -37,4 +37,14 @@ is_yes "$DISABLED" && {
 seen_iface $NAME && exit 0
 add_seen_iface $NAME
 export SEEN_IFACES
-IN_IFPLUGD=yes $SCRIPTDIR/ifup-common $NAME
+case "$0" in
+    *ifup-ifplugd)
+    IN_WPA_CLI=no IN_IFPLUGD=yes $SCRIPTDIR/ifup-common $NAME
+    ;;
+    *ifup-wireless)
+    USE_IFPLUGD=no IN_IFPLUGD=no IN_WPA_CLI=yes $SCRIPTDIR/ifup-common $NAME
+    ;;
+    *)
+    $SCRIPTDIR/ifup-common $NAME
+    ;;
+esac
--- a/etc/net/scripts/wpa_cli.action	
+++ a/etc/net/scripts/wpa_cli.action	
@@ -0,0 +1,17 @@ 
+#!/bin/sh
+
+# This file is /etc/net helper for use with wpa_cli action mode
+# and called from wpa_cli with two parameters:
+# $1 interface name
+# $2 event, CONNECTED|DISCONNECTED
+
+if [ -z "$1" -o -z "$2" ] ; then
+    logger -d "Wrong arguments to $0: '$@'"
+    exit 1
+fi
+
+unset SEEN_IFACES
+[ "$2" = "CONNECTED" ] && exec /etc/net/scripts/ifup-wireless $1
+[ "$2" = "DISCONNECTED" ] && exec /etc/net/scripts/ifdown-wireless $1
+
+exit 0