Configure CB Profile

• Search Wireless Management Group: Groups in the list can be filtered by entering a partial name in the search box.
  The search field lets you enter a partial string to match. The screen displays entries with that string in their name.
  To remove the filter, delete the string from the search field and press enter.
  

  Note

  The search is case-sensitive.

• TQ6702 GEN2 / TQ6602 GEN2:
  7 CB VAPs for each radio band (Radio 1 - 2.4GHz and Radio 2 - 5GHz W52), i.e. 14 CB VAPs in total
  
• TQ6602:
  10 CB VAPs for each radio band (Radio 1 - 2.4GHz and Radio 2 - 5GHz W52), i.e. 20 CB VAPs in total
  
• TQ5403 / TQ5403e:
  3 CB VAPs for each radio band (Radio 1 - 2.4GHz and Radio 2 - 5GHz W52), i.e. 6 CB VAPs in total
  

Note

It is recommended to use 5 or less VAPs per radio band in total, including both multi-channel and blanket VAPs.

Note

"Radio 2 - 5GHz W53" and "Radio 3 - W56" cannot be used for CB VAPs.

Note

When applying a CB profile to TQ6602, TQ6602 GEN2, and TQ6702 GEN2, if the bandwidth is set to 80+80MHz in Radio 2 of the AP profile, only W52 is used, because W53 cannot be used for CB VAP. The APs will operate with 80 MHz bandwidth in that radio band.

Note

If you do not use multi-channel networks, create a dummy multi-channel VAP 1 in an AP Profile, then create a CB VAP with the "VAP number" of 1 to override the dummy multi-channel VAP. We recommend you configure security on the dummy VAP too.

• Radio 1: 1ch to 13ch
  
• Radio 2 (W52) : 36ch, 40ch, 44ch, 48ch
  

Note

Select a channel according to the bandwidth used for the corresponding band set in the AP Profile.
For example, if the bandwidth used for Radio 2 is 40MHz, when creating CB VAP for Radio 2, select the channel from either 36ch or 44ch. 40ch and 48ch are not supported.
Channels that can be selected can be confirmed by "Auto Channel Selection" in the AP Profile.

Note

Selecting a channel that is disabled in "Auto Channel Selection" in the AP Profile is not supported.

• If you select "Enable", the CB VAP is enabled on the APs that are applied to the CB Profile.
  
• If you select "Disable", the CB VAP is not used. The VAP that is properly configured and enabled in the AP Profile will also be disabled.
  

Note

Specify a VLAN ID that is different from the AP's management VLAN. When the AP is detected as a guest device, a parent AMF device is configured to collect the guest device information automatically ("dynamic discovery"), and wireless clients get their IP addresses via DHCP.

• When enabled, the SSID is included in beacons. When you configure a wireless client, you may be able to see the SSID in a list of wireless networks to connect. This setting also allows wireless clients to connect using an "ANY" connection.
  
  
• When disabled, the SSID is not included in beacons. You may not be able to see the SSID in a wireless network list on a wireless client. In this case, you have to enter the same SSID as the AP on a wireless client. This setting also denies wireless clients from connecting using an "ANY" connection.
  

Note

An "ANY" connection is a connection where a wireless client tries to connect to an AP by specifying a wildcard or null as the SSID. Even when an "ANY" connection is allowed, clients cannot connect to APs without knowing the correct security key.

Note

"Static WEP" can be configured only on VAP1 of each radio. In addition, if the Security is set to Static WEP in the VAP Settings of CB Profile, do not use a mode that contains IEEE 802.11n in the Radio Configuration of the AP Profile. Select IEEE 802.11b/g on Radio 1 or IEEE 802.11a on Radio 2 instead.

• None:
  No authentication or encryption is performed. Everyone can connect to the CB VAP.
  

  Note

  If you use "None" to build a network such as a guest hotspot, you should consider the consequences for the overall security of your entire network.

  
  
• Static WEP:
  Uses RC4 encryption with fixed keys. Per-client authentication is not performed. We recommend using "WPA Personal" for fixed key security because WEP is vulnerable.
  
  
• WPA Personal:
  Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated from a pre-shared key (PSK). It uses CCMP (AES) as the encryption algorithm.
  
  
• WPA Enterprise:
  Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated on a RADIUS server. It uses CCMP (AES) as the encryption algorithm.
  

• External RADIUS:
  The APs will query the RADIUS server.
  
• Click-through:
  The APs will display a Click-through page instead of performing RADIUS authentication. The Click-through page does not require authentication with a username/password pair, but can be configured to show an arbitrary "Terms of Use" that users have to accept before use, or to redirect to an external page.
  
• External Page Redirect:
  The clients will be able to connect using third-party web credentials such as social networking sites.
  
• Disable:
  Select to not use Captive Portal.
  

Note

This setting is displayed when "TQ6702 GEN2 / TQ6602 GEN2" or "TQ6602" is selected as AP Model.

Note

Do not enable Captive Portal on the radio used for the WDS connection.

• External RADIUS:
  The APs will query the RADIUS server.
  
• MAC Address List:
  Selecting this option will allow or deny connections only to the MAC addresses recorded in the list, according to the MAC address list selected in the MAC Address List field.
  
• MAC Address List + External RADIUS:
  Selecting this option allows or denies connections only to the MAC addresses recorded in the list. This list refers to both the MAC address list selected in the MAC address list field at the top of the screen and the external RADIUS server.
  Firstly, it will try to authenticate using the MAC Address List. If a connection cannot be established, it will try to authenticate the connection using an External RADIUS server. If the preceding MAC address list allows a user to connect, the user can still connect even if the external RADIUS server does not grant the access.
  
• Disable:
  No MAC access control is performed.
  

Note

When using MAC Access Control with "External RADIUS" on CB VAP, one of the following firmware is required depending on your model.

• TQ5403 and TQ5403e firmware version 6.0.1-2.x or later
  
• TQ6602 firmware version 7.0.1-0.1 or later
  
• TQ6602 GEN2 and TQ6702 GEN2 firmware version 8.0.2-1.1 or later
  

Note

"MAC Address List" is only available if you have selected "TQ Series" for Series and selected a "MAC Address List" in the "Basic Configuration" section in the AP profile.

Note

The option "MAC Address List + External RADIUS" is displayed with selecting "TQ5403 / TQ5403e" or "TQ6702 GEN2 / TQ6602 GEN2" for AP model in "Select an AP model that uses AWC-CB" dialog box.

• 802.11r FT
  
• FT over DS
  
• Mobility Domain
  
• R0 key Lifetime
  
• AES Key
  
• IEEE 802.11k RRM
  
• IEEE 802.11v WNM
  

Note

This setting is displayed when "TQ5403 / TQ5403e" or "TQ6602" is selected as AP Model.

Note

In this version, using the Inactivity Timer is not supported on CB VAPs. Use the default setting.

Note

When "Management Frame Protection" is set to "Capable", "Disconnect" is used regardless of this item's setting.

Note

To make this function take effect, APs on the same subnet must have "Roaming Notification" set to "Enable" for each other.

Note

This setting is used for support purposes. We recommend that you do not change the value.

Note

This setting is used for support purposes. We recommend that you do not change the value.

Note

This setting is used for support purposes. We recommend that you do not change the value.

Note

If you change the Tx Power in the AP-specific configuration settings, the AP-specific setting has priority.

• If enabled, when a managed wireless AP receives an ARP request for a connected client, the wireless AP that has a connection to the client will send an ARP response on behalf of the client. The wireless AP that does not have a connection to the client will discard the ARP request, thereby reducing unnecessary traffic.
  In this case, since multiple wireless APs have connections to the client in a channel blanket, the wireless AP with the strongest connection will send the ARP response representing all the connected APs. Neighboring APs that are more sparsely connected do not send proxy responses even if they hold the ARP information of the corresponding connected client, thus avoiding multiple ARP responses for the same client.
  
• If you select "Disable", Proxy ARP will not be activated. That means ARP requests are broadcasted from all wireless APs to their subordinate clients. The corresponding clients send ARP responses themselves.
  

• Selecting "Enable" will force the wireless power saving setting to be deactivated for the associating clients of the APs under management.
  Although it may eliminate the unstable connectivity caused by the wireless power saving setting, wireless clients such as laptops, smart phones, and tablets may experience shorter battery life than when this setting is disabled.
  
• When "Disable" is selected, the wireless power saving setting will not be removed for the associating clients of the APs under management. Wireless clients such as laptops, smartphones, and tablets may experience longer battery life than when this setting is enabled, but at the same time, their wireless associations may become unstable.
  

Note

TQ6602 does not support this feature.

• 64bit:
  You can directly enter a WEP key with 10 hex digits. Or you can enter 5 ASCII characters to automatically generate a WEP key.
  
• 128bit:
  You can directly enter a WEP key with 26 hex digits. Or you can enter 13 ASCII characters to automatically generate a WEP key.
  

• ASCII:
  Lets you enter an arbitrary string to automatically generate a WEP key. The string is case-sensitive.
  
• Hex:
  Lets you directly enter a WEP key with hexadecimal characters (0 to 9, A to F, a to f). Hex characters are not case-sensitive.
  

• Open System:
  All wireless clients are allowed to connect regardless of whether they have the correct WEP key. But as wireless clients are only allowed to connect, they cannot communicate without a valid WEP key.
  This option is not only for "WEP" but is also used for "None", "WPA Personal" and "WPA Enterprise".
  
• Shared Key:
  Only wireless clients with the correct WEP key can connect. Wireless clients cannot connect without a valid key.
  
• Open System and Shared Key:
  A client configured to use Shared Key can connect if it has a valid WEP key.
  A client configured to use Open System can connect regardless of whether it has a correct key.
  

Note

WPA is based on a draft of IEEE 802.11i while WPA2 is based on the final version of IEEE 802.11i and therefore meets all mandatory items required by the standard.

Note

According to the WPA standard, TKIP is mandatory while CCMP is optional. Our products implement both algorithms.

Note

The option "Capable" is displayed only with "WPA2" for the WPA version.

Note

This setting is displayed when "TQ5403 / TQ5403e" or "TQ6602" is selected as AP Model.

Note

When you create multiple CB VAPs, the Broadcast Key Refresh Rate will be set to a single value common to all VAPs.

Note

This setting is displayed when "TQ5403 / TQ5403e" or "TQ6602" is selected as AP Model.

Note

WPA is based on a draft of IEEE 802.11i while WPA2 is based on the final version of IEEE 802.11i and therefore meets all mandatory items required by the standard.

Note

According to the WPA standard, TKIP is mandatory while CCMP is optional. Our products implement both algorithms.

Note

The option "Capable" is displayed only with "WPA2" for the WPA version.

Note

This setting is displayed when "TQ5403 / TQ5403e" or "TQ6602" is selected as AP Model.

Note

Changing the Broadcast Key Refresh Interval is not supported with channel blanket. Do not change its value from the default "0".

Note

This setting is displayed when "TQ5403 / TQ5403e" or "TQ6602" is selected as AP Model.

Note

This setting is displayed when "TQ5403 / TQ5403e" or "TQ6602" is selected as AP Model.

Note

This item is not supported. Do not enable it.

Note

This setting is displayed when "TQ5403 / TQ5403e" or "TQ6602" is selected as AP Model.

• Enable:
  shows an external authentication page. Specify the page URL in "Base URL".
  
  • Base URL:
    Specify the base URL of the external web authentication page.
    Clients will access the page through the AP's proxy feature instead of direct connection.
    The HTML filename of the external authentication page must be "radius_login.html".
    The AP's proxy will get the page from "Base URL/radius_login.html" and send it back to clients.
    For example, when you specify "http://www.example.com/captive_portal" in "Base URL", the APs will present the content of the page at "http://www.example.com/captive_portal/radius_login.html" to connecting clients.
    For details of the format of radius_login.html, refer to Operation Reference > Authentication > Web Authentication with Captive Portal.
    
• Disable:
  Shows an authentication page embedded in the APs.
  

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL
  Always show a fixed URL that you specify. Should be 1 to 128 characters in length, with alphabets, numbers and symbols (including spaces).
  
• Disable
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address:
    Shows a list of registered addresses that contain the input string.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

• Enable:
  shows an external authentication page. Specify the page URL in "Base URL".
  
  • Base URL:
    Specify the base URL of the external Click-through page.
    Clients will access the page through the AP's proxy feature instead of direct connection.
    The HTML filename of the external Click-through page must be "click_through_login.html".
    The AP's proxy will get the page from "Base URL/click_through_login.html" and send it back to clients.
    For example, when you specify "http://www.example.com/captive_portal" in "Base URL", APs will present the content of the page at "http://www.example.com/captive_portal/click_through_login.html" to connecting clients.
    For details of the format of click_through_login.html, refer to Operation Reference > Authentication > Web Authentication with Captive Portal.
    
• Disable:
  Shows an authentication page embedded in the APs.
  

  Note

  "Terms of Use" to show on the Authentication Page can be configured on each AP's web interface.

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL
  Always show a fixed URL that you specify.
  
• Disable
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address: Searches for a specific address in the list.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL
  Always show a fixed URL that you specify.
  
• Disable
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address: Searches for a specific address in the list.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

• If you select "Fixed Password", a string specified in "User-Password Format Password" is always used as the value of the User-Password attribute.
  
• If you select "User Name", the same string as the User-Name attribute (MAC Address) is sent to the RADIUS server as the value of the User-Password attribute.
  

Note

This is mandatory for every function in the "Fast Roaming" section. Configure this item even if you only use IEEE 802.11k or IEEE 802.11v and you are not going to use IEEE 802.11r fast transition.