diff --git a/libnm-core/nm-setting-wireless-security.c b/libnm-core/nm-setting-wireless-security.c
index 977302df02..dd5e9b5a9f 100644
--- a/libnm-core/nm-setting-wireless-security.c
+++ b/libnm-core/nm-setting-wireless-security.c
@@ -1529,6 +1529,14 @@ nm_setting_wireless_security_class_init (NMSettingWirelessSecurityClass *setting
 	 *
 	 * Since: 1.10
 	 **/
+	/* ---ifcfg-rh---
+	 * property: pmf
+	 * variable: PMF(+)
+	 * values: default, disable, optional, required
+	 * description: Enables or disables PMF (802.11w)
+	 * example: PMF=required
+	 * ---end---
+	 */
 	g_object_class_install_property
 		(object_class, PROP_PMF,
 		 g_param_spec_uint (NM_SETTING_WIRELESS_SECURITY_PMF, "", "",
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index f16aaa8420..c4221c8893 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -3294,7 +3294,9 @@ make_wpa_setting (shvarFile *ifcfg,
 {
 	NMSettingWirelessSecurity *wsec;
 	char *value, *psk, *lower;
+	const char *cvalue;
 	gboolean wpa_psk = FALSE, wpa_eap = FALSE, ieee8021x = FALSE;
+	guint pmf = NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT;
 
 	wsec = NM_SETTING_WIRELESS_SECURITY (nm_setting_wireless_security_new ());
 
@@ -3373,6 +3375,24 @@ make_wpa_setting (shvarFile *ifcfg,
 
 	g_free (value);
 
+	cvalue = svGetValue (ifcfg, "PMF", &value);
+	if (cvalue) {
+		int i_pmf;
+
+		if (!nm_utils_enum_from_str (nm_setting_wireless_security_pmf_get_type (),
+		                             cvalue,
+		                             &i_pmf,
+		                             NULL)) {
+			g_set_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION,
+			             "Invalid PMF value '%s'", cvalue);
+			g_free (value);
+			goto error;
+		}
+		pmf = i_pmf;
+		g_free (value);
+	}
+	g_object_set (wsec, NM_SETTING_WIRELESS_SECURITY_PMF, pmf, NULL);
+
 	value = svGetValueStr_cp (ifcfg, "SECURITYMODE");
 	if (NM_IN_STRSET (value, NULL, "open"))
 		g_object_set (wsec, NM_SETTING_WIRELESS_SECURITY_AUTH_ALG, value, NULL);
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
index c6957e8816..3b2b1a5c73 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
@@ -707,6 +707,17 @@ write_wireless_security_setting (NMConnection *connection,
 	            "WPA_PSK_FLAGS",
 	            wpa ? nm_setting_wireless_security_get_psk_flags (s_wsec) : NM_SETTING_SECRET_FLAG_NONE);
 
+
+	if (nm_setting_wireless_security_get_pmf (s_wsec) == NM_SETTING_WIRELESS_SECURITY_PMF_DEFAULT)
+		svUnsetValue (ifcfg, "PMF");
+	else {
+		gs_free char * value = NULL;
+
+		value = nm_utils_enum_to_str (nm_setting_wireless_security_pmf_get_type(),
+		                              nm_setting_wireless_security_get_pmf (s_wsec));
+		svSetValueStr (ifcfg, "PMF", value);
+	}
+
 	return TRUE;
 }
 
diff --git a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
index 057d72d5f6..97b65eaaf7 100644
--- a/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
+++ b/src/settings/plugins/ifcfg-rh/tests/test-ifcfg-rh.c
@@ -5768,6 +5768,7 @@ test_write_wifi_wpa_psk (gconstpointer test_data)
 	g_object_set (s_wsec,
 	              NM_SETTING_WIRELESS_SECURITY_KEY_MGMT, "wpa-psk",
 	              NM_SETTING_WIRELESS_SECURITY_PSK, args.psk,
+	              NM_SETTING_WIRELESS_SECURITY_PMF, (guint) NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED,
 	              NULL);
 
 	if (GPOINTER_TO_INT (args.wep_group_p)) {