Tool/software: WEBENCH® Design Tools
It is said that Unsecured-Rejoin should be denied in zigbee 3.0, but I don't think so.
Unsecured-Rejoin is an important way to recover current-network when the NWK-Key is change.
In zigbee 3.0 network, joined nodes has a unique TC-link-key( Verified Key). When it recover network with unsecured-rejoin mode, the Trust center can send it NWK-Key encrypted by Verified Key . When trust center detect a Node has rejoined with unsecured-rejoin mode, it should match the joiner's ExtAddr with TC-Link-Table.