--- a/contrib/Makefile	
+++ a/contrib/Makefile	
@@ -45,11 +45,13 @@ install:
 	@install -m 755 etc/net/scripts/contrib/* $(etcnetdir)/scripts/contrib
 	@install -m 644 etc/net/scripts/functions* $(etcnetdir)/scripts
 	@install -m 755 etc/net/scripts/{config-,create-,destroy-,ifdown,ifup,setup-,shutdown-}* $(etcnetdir)/scripts
-	@install -m 755 etc/net/scripts/{ifplugd.action,network.init} $(etcnetdir)/scripts
+	@install -m 755 etc/net/scripts/{ifplugd.action,wpa_cli.action,network.init} $(etcnetdir)/scripts
 	@install -m 644 etc/net/sysctl.conf $(etcnetdir)
 	@install -d $(mandir)/man{5,8}
 	@install -m 644 docs/*.8 $(mandir)/man8
 	@install -m 644 docs/*.5 $(mandir)/man5
+	@ln -s ifup-ifplugd $(etcnetdir)/scripts/ifup-wireless
+	@ln -s ifdown-ifplugd $(etcnetdir)/scripts/ifdown-wireless
 
 # 2. Install aux files.
 	@install -D -m 644 etc/sysconfig/network $(sysconfdir)/network
--- a/etc/net/scripts/config-wireless	
+++ a/etc/net/scripts/config-wireless	
@@ -29,10 +29,13 @@ if [ -x "${IWCONFIG:=$DEFAULT_IWCONFIG}" ]; then
 fi
 
 # configure WPA
-if [ -x "${WPA_SUPPLICANT:=$DEFAULT_WPA_SUPPLICANT}" ]; then
-	prof_conf=`profiled_filename $MYIFACEDIR/wpa_supplicant.conf`
-	if [ -s "$prof_conf" ]; then
-		$WPA_SUPPLICANT -i$NAME${WPA_DRIVER:+ -D$WPA_DRIVER} -c $prof_conf 2>&1>/dev/null &
-		echo $! >/var/run/wpa_supplicant-$NAME.pid
-	fi
+prof_conf=`profiled_filename $MYIFACEDIR/wpa_supplicant.conf`
+if [ -x "${WPA_SUPPLICANT:=$DEFAULT_WPA_SUPPLICANT}" -a \
+	-x "${WPA_CLI:=$DEFAULT_WPA_CLI}" -a \
+	-s "$prof_conf" ]; then
+	$WPA_SUPPLICANT -i$NAME${WPA_DRIVER:+ -D$WPA_DRIVER} \
+		-B -P/var/run/wpa_supplicant-$NAME.pid -c $prof_conf && \
+	$WPA_CLI -i$NAME -B -P/var/run/wpa_cli-$NAME.pid -a $SCRIPTDIR/wpa_cli.action
+else
+	exit 2		# continue without wpa_cli
 fi
--- a/etc/net/scripts/functions	
+++ a/etc/net/scripts/functions	
@@ -18,6 +18,7 @@ DEFAULT_IFPLUGD=/usr/sbin/ifplugd
 DEFAULT_IWPRIV=/sbin/iwpriv
 DEFAULT_IWCONFIG=/sbin/iwconfig
 DEFAULT_WPA_SUPPLICANT=/usr/sbin/wpa_supplicant
+DEFAULT_WPA_CLI=/usr/sbin/wpa_cli
 DEFAULT_PLIPCONFIG=/sbin/plipconfig
 DEFAULT_VCONFIG=/usr/bin/vconfig
 DEFAULT_IPSECADM=/usr/sbin/ipsecadm
@@ -501,7 +502,7 @@ declare -frx modprobe_with_rename
 declare -frx eval_string
 declare -rx DENOISE DEFAULT_BONDMODE IFACEDIR LOCALSCRIPTDIR VARLIBDIR
 declare -rx VLANTAB HOSTTAB IFTAB PROFILE_FILE PROC_CMDLINE DEFAULT_IFPLUGSTATUS
-declare -rx DEFAULT_IFPLUGD DEFAULT_IWCONFIG DEFAULT_WPA_SUPPLICANT DEFAULT_PLIPCONFIG
+declare -rx DEFAULT_IFPLUGD DEFAULT_IWCONFIG DEFAULT_WPA_SUPPLICANT DEFAULT_WPA_CLI DEFAULT_PLIPCONFIG
 declare -rx DEFAULT_VCONFIG DEFAULT_PENTANETT DEFAULT_PENTAVALT DEFAULT_PENTANET_CONF
 declare -rx DEFAULT_PENTAVAL_CONF DEFAULT_IPSECADM DEFAULT_IFENSLAVE DEFAULT_BRCTL
 declare -rx DEFAULT_ETHTOOL DEFAULT_PPPD DEFAULT_CHAT DEFAULT_PPPOPTIONSFILE
--- a/etc/net/scripts/functions-eth	
+++ a/etc/net/scripts/functions-eth	
@@ -15,6 +15,17 @@ check_eth_link ()
 	return 0
 }
 
+# checks, if given iface is wireless one
+is_wireless ()
+{
+	# FIXME better way ?
+	if [ -d "/sys/class" ]; then
+		[ -d "/sys/class/net/$1/wireless" ]
+	else
+		grep -q "^[[:blank:]]*$1:" /proc/net/wireless
+	fi
+}
+
 # see ifaces/default/options-eth
 wait_for_macaddr()
 {
--- a/etc/net/scripts/ifdown-ifplugd	
+++ a/etc/net/scripts/ifdown-ifplugd	
@@ -51,15 +51,17 @@ case "$BOOTPROTO" in
 	;;
 esac
 
-case "$USE_IFPLUGD" in
-	[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]|[Oo][Nn]|[Yy]|1|[Aa][Uu][Tt][Oo])
+if [ "${0##/*}" = "ifdown-ifplugd" ]; then
+	case "$USE_IFPLUGD" in
+		[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]|[Oo][Nn]|[Yy]|1|[Aa][Uu][Tt][Oo])
 		# It's Ok, just do the job.
-	;;
-	*)
+		;;
+		*)
 		print_error "ERROR: USE_IFPLUGD is not enabled for $NAME"
 		exit 1
-	;;
-esac
+		;;
+	esac
+fi
 
 ExecIfExecutable $LOCALSCRIPTDIR/ifdown-pre-local $NAME && print_progress
 ExecIfExecutable $MYIFACEDIR/ifdown-pre $NAME && print_progress
--- a/etc/net/scripts/ifup-common	
+++ a/etc/net/scripts/ifup-common	
@@ -39,6 +39,10 @@ case "$USE_IFPLUGD" in
 		# A and D
 		if ! is_yes "$IN_IFPLUGD"; then
 			# D
+			! is_wireless $NAME || {
+				print_error "ERROR: USE_IFPLUGD=yes for $NAME, wireless card is unsupported"
+				exit 1
+			}
 			! is_yes "$HAVE_IFPLUGD" && exit 1
 			if is_yes "$PERSISTENT_IFPLUGD"; then
 				if ! ifplugd_runs; then
@@ -184,18 +188,27 @@ process_sysctl_conf()
 	return 0
 }
 
+if ! is_yes $IN_WPA_CLI; then	# non-wifi or first pass for wifi
 # setup link-level params
-xargise_file $IFACEDIR/default/iplink "$IP link set dev $NAME"
-xargise_file $IFACEDIR/default/iplink-$TYPE "$IP link set dev $NAME"
-xargise_file $MYIFACEDIR/iplink "$IP link set dev $NAME"
+    xargise_file $IFACEDIR/default/iplink "$IP link set dev $NAME"
+    xargise_file $IFACEDIR/default/iplink-$TYPE "$IP link set dev $NAME"
+    xargise_file $MYIFACEDIR/iplink "$IP link set dev $NAME"
 
 # bring iface up
-if ! is_yes $KEEP_DOWN; then
+    if ! is_yes $KEEP_DOWN; then
 	$IP link set dev $NAME up && print_progress
+    fi
 fi
 
-# handle wireless extensions
-is_yes "$CONFIG_WIRELESS" && $SCRIPTDIR/config-wireless $NAME && print_progress
+# handle wireless extensions, if any
+if is_yes "$CONFIG_WIRELESS" && is_wireless $NAME; then
+    if ! is_yes $IN_WPA_CLI; then
+	$SCRIPTDIR/config-wireless $NAME
+	rc=$?
+	[ $rc -eq 2 ] || exit $rc
+	print_progress
+    fi
+fi
 
 # process ip neighbours
 xargise_file $MYIFACEDIR/ipneigh "$IP neigh replace dev $NAME"
--- a/etc/net/scripts/ifup-ifplugd	
+++ a/etc/net/scripts/ifup-ifplugd	
@@ -13,7 +13,7 @@ usage()
 [ -z "$1" ] && usage
 export NAME=$1
 
-# forget everything we have inherited from ifplugd
+# forget everything we have inherited from ifplugd/wpa_cli
 export SCRIPTDIR=/etc/net/scripts
 . $SCRIPTDIR/functions
 pickup_defaults
@@ -37,4 +37,15 @@ is_yes "$DISABLED" && {
 seen_iface $NAME && exit 0
 add_seen_iface $NAME
 export SEEN_IFACES
-IN_IFPLUGD=yes $SCRIPTDIR/ifup-common $NAME
+
+case "${0##*/}" in
+    ifup-ifplugd)
+    IN_WPA_CLI=no IN_IFPLUGD=yes $SCRIPTDIR/ifup-common $NAME
+    ;;
+    ifup-wireless)
+    USE_IFPLUGD=no IN_IFPLUGD=no IN_WPA_CLI=yes $SCRIPTDIR/ifup-common $NAME
+    ;;
+    *)
+    $SCRIPTDIR/ifup-common $NAME
+    ;;
+esac
--- a/etc/net/scripts/wpa_cli.action	
+++ a/etc/net/scripts/wpa_cli.action	
@@ -0,0 +1,17 @@ 
+#!/bin/sh
+
+# This file is /etc/net helper for use with wpa_cli action mode
+# and called from wpa_cli with two parameters:
+# $1 interface name
+# $2 event, CONNECTED|DISCONNECTED
+
+if [ -z "$1" -o -z "$2" ] ; then
+    logger -d "Wrong arguments to $0: '$@'"
+    exit 1
+fi
+
+unset SEEN_IFACES
+[ "$2" = "CONNECTED" ] && exec /etc/net/scripts/ifup-wireless $1
+[ "$2" = "DISCONNECTED" ] && exec /etc/net/scripts/ifdown-wireless $1
+
+exit 0