Configure AP Profiles

Note

In the AT-VST-APL version, non-ASCII characters (full-width alphabets, numbers, kana, kanji, and symbols) cannot be used.

Note

This item is not supported.

• Search Wireless Management Group: Groups in the list can be filtered by entering a partial name in the search box.
  The search field lets you enter a partial string to match. The screen displays entries with that string in their name.
  To remove the filter, delete the string from the search field and press enter.
  

  Note

  The search is case-sensitive.

• User Settings
  If necessary, select whether to set the Username and Password for logging in to the AP's Web GUI all at once.
  Also, set whether to allow individual user settings to be specified for APs to which this AP Profile is applied.
  

  Note

  This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" for the Profile Type.

  By selecting "Enable", the additional items described below will be displayed.
  
  • Username
    
  • Password
    
  • Password (Confirm)
    
  • AP's User Settings
    
  
  
• User Information
  Set the Username and Password for logging in to the AP's CLI, which is necessary for managing the AP.
  Also, set whether to allow individual user information to be specified for APs to which this AP Profile is applied.
  Configure the following items.
  
  • Username
    
  • Password
    
  • APs User Settings
    

  Note

  This setting is displayed when "Tri[11ax]-R" or "Dual[11ax] GEN2-R" is selected as Profile Type.

Note

Some timezones (e.g. "(UTC+09:00) Asia/Tokyo") don't support Daylight Saving Time.

• Only Tri[11ax] or Tri[11ax] GEN2
  
  • Timezone Name
    
  
  
• In common to all types
  
  • Daylight Saving Time
    (When Daylight Saving Time is set to Enable)
    
    • DST Start (24HR)
      
    • DST End (24HR)
      
    • DST Offset
      

• When enabled, AP clocks are synchronized to the NTP server. By using NTP, you can keep multiple systems' time as accurate as possible.
  
• When disabled, AP clocks are synchronized to the system clock of the PC (server) running Vista Manager EX and the AWC Plug-in.
  

• NTP Server IP Address / Hostname
  
• NTP Synchronization Interval
  

• Syslog Server IP Address / Hostname
  
• Port Number
  
• Severity
  

• Version
  
• Read Only Community Name
  
• Port Number
  
• Full Name
  
• Password
  
• Restrict the source of SNMP requests
  
• Only allow from the designated hosts or subnets
  
• Community name for traps
  
• Trap types
  
• Trap Host IP Address/Hostname
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

• Tri[11ax], Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 With External Antenna, Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] With External Antenna, Dual[11ac Wave2]
  From the drop-down menu, select 15, 30, 45, 60, 75, 90, 105, or 120.
  
  
• Only Tri[11ax] or Tri[11ax] GEN2 Enter a value from 1 to 180.
  

Note

FQDN consists of labels (strings) and periods (.).
Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
A label only cannot be entered. Use an FQDN which contains at least two labels and a period.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", or "Dual[11ax]" for the Profile Type.

Note

When you use the AWC function, do not use an interval larger than the default of 10 minutes.

• Tri[11ax], Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 With External Antenna, Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] With External Antenna, Dual[11ac Wave2]
  Enter the IP address or hostname (FQDN).
  (Example) syslog.your.domain.com, 12.34.56.78
  

  Note

  FQDN consists of labels (strings) and periods (.).
  Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
  A label only cannot be entered. Use an FQDN which contains at least two labels and a period.
  

• Only Tri[11ax] or Tri[11ax] GEN2 Enter the IP address. You cannot specify with the hostname (FQDN).
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" for the Profile Type.

• 0 : Emergency: System is unusable.
  
• 1 : Alert: Immediate action is required.
  
• 2 : Critical: System is in a critical condition.
  
• 3 : Error: An error has occured.
  
• 4 : Warning: Something has occurred that requires attention.
  
• 5 : Notice: A normal but important message.
  
• 6 : Informational: An informational message.
  
• 7 : Debug: Detailed information for debugging.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type, and specified "v1/v2c" as the SNMP Version; or if you select "Dual[11ac Wave2]" for the Profile Type.

Note

This setting is displayed only when "Tri[11ax]-R" or "Dual[11ax] GEN2-R" is selected as Profile Type, and "v1/v2c" is specified for the SNMP Agent Version.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" for the Profile Type.

Note

If the SNMP Plug-in is used for SNMP management of APs, leave it at the default setting.

• Tri[11ax], Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 With External Antenna, Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] With External Antenna, Dual[11ac Wave2]
  Enter a name between 1 to 12 alphanumeric characters. (The string is case-sensitive)
• Only Tri[11ax] or Tri[11ax] GEN2 Should be 1 to 20 characters in length, with alphabets (case-sensitive), numbers and symbols (! # % & ' ( ) * + , - . / : ; < = > @ [ ] ^ _ ` { | } ~ may be used). (The string is case-sensitive)

Note

This is displayed when "v3" is specified for the SNMP Agent Version.

• Tri[11ax], Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 With External Antenna, Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] With External Antenna, Dual[11ac Wave2]
  Should be 8 to 32 characters in length, with alphabets, numbers, and symbols (space ! # % ( ) + , - . / ; = ? @ [ \ ] ^ _ ` { | } ~ may be used).
  
• Only Tri[11ax] or Tri[11ax] GEN2 Should be 1 to 20 characters in length, with alphabets (case-sensitive), numbers and symbols (! # % & ' ( ) * + , - . / : ; < = > @ [ ] ^ _ ` { | } ~ may be used). (The string is case-sensitive)

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type, and "v3" is specified for the SNMP Agent Version.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type, and specified "v1/v2c" as the SNMP Version; or if you select "Dual[11ac Wave2]" for the Profile Type.

Note

FQDN consists of labels (strings) and periods (.).
Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
If the Profile Type is "Dual [11ac Wave2]", "Tri [11ac Wave2]", or "Tri [11ac Wave2] with External Antenna", you cannot enter only the label. Use an FQDN which contains at least two labels and a period.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type, and specified "v1/v2c" as the SNMP Version; or if you select "Dual[11ac Wave2]" for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type, and specified "v1/v2c" as the SNMP Version; or if you select "Dual[11ac Wave2]" for the Profile Type.

• Cold Start: sent when the SNMP Agent starts.
  
• Link Up/Down: sent when a wireless interface link up or down.
  
• Authentication: sent when an SNMP authentication fails.
  

• Trap Host IP Address/Hostname
  Specify IP addresses or hostnames (FQDNs).
  (Example) manager.your.domain.com, 12.34.56.78
  

  Note

  FQDN consists of labels (strings) and periods (.).
  Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
  A label only cannot be entered. Use an FQDN which contains at least two labels and a period.
  

  Note

  This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" for the Profile Type.

• Trap Host IP Address
  Specify the IP address.
  (Example) 12.34.56.78 You cannot specify with the hostname (FQDN).
  

  Note

  This setting is displayed when "Tri[11ax]-R" or "Dual[11ax] GEN2-R" is selected as Profile Type.

• Static LAG:
  Enables link aggregation. A static LAG should also be configured on the switch ports to which the AP connects.
  
  
• Cascade:
  Enables cascading function, the LAN2 port will work as a cascade port.
  
  
• LACP:
  Enables LACP. If LACP is enabled on the switch to which the AP connects, a trunk group will be automatically configured.
  

  Note

  This setting is displayed when "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2" or "Dual[11ax]" is selected as Profile Type.

  
  
• Disable:
  Neither link aggregation nor cascading function will be enabled. The LAN2 port is also disabled. The AP can only use the LAN1/PoE port.
  

Note

If you disable all radios on an AP Profile, it is possible to apply the profile to APs of other Profile Types, this profile will not be valid. Make sure you apply an appropriate AP Profile to APs.

Note

This item is not supported.

• Tri[11ax], Tri[11ax]-R
  
  • Radio 1: b/g, b/g/n, b/g/n/ax (default)
    
  • Radio 2: a, a/n, a/n/ac, a/n/ac/ax (default)
    
  • Radio 3: ax (default)
    

  Note

  To use IEEE 802.11n, IEEE 802.11ac or IEEE 802.11ax in the Profile Mode "Tri[11ax]", "Wi-Fi Multimedia (WMM)" must be enabled.

• Tri[11ax] GEN2
  
  • Radio 1: b/g, b/g/n, b/g/n/ax (default)
    
  • Radio 2: a, a/n, a/n/ac, a/n/ac/ax (default)
    
  • Radio 3: a, a/n, a/n/ac, a/n/ac/ax (default)
    

  Note

  To use IEEE 802.11n IEEE 802.11ac or IEEE 802.11ax, "Wi-Fi Multimedia (WMM)" must be enabled.

• Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R
  
  • Radio 1: b/g, b/g/n, b/g/n/ax (default)
    
  • Radio 2: a, a/n, a/n/ac, a/n/ac/ax (default)
    

  Note

  To use IEEE 802.11n, IEEE 802.11ac or IEEE 802.11ax in the Profile Mode "Dual[11ax] GEN2" or "Dual[11ax] with External Antenna, "Wi-Fi Multimedia (WMM)" must be enabled.

• Dual[11ax]
  
  • Radio 1: b/g, b/g/n/ax (default)
    
  • Radio 2: a, a/n/ac/ax (default)
    

  Note

  To use IEEE 802.11n IEEE 802.11ac or IEEE 802.11ax, "Wi-Fi Multimedia (WMM)" must be enabled.

• Tri[11ac Wave2]
  
  • Radio 1: b/g, b/g/n (default)
    
  • Radio 2: a, a/n/ac (default)
    
  • Radio 3: a, a/n/ac (default)
    

  Note

  To use IEEE 802.11n or IEEE 802.11ac, "Wi-Fi Multimedia (WMM)" must be enabled.

• Tri[11ac Wave2] with External Antenna
  
  • Radio 1: b/g, b/g/n (default)
    
  • Radio 2: none
    
  • Radio 3: a, a/n/ac (default)
    

  Note

  To use IEEE 802.11n or IEEE 802.11ac, "Wi-Fi Multimedia (WMM)" must be enabled.

• Dual[11ac Wave2]
  
  • Radio 1: b/g, b/g/n (default)
    
  • Radio 2: a, a/n/ac (default)
    

  Note

  To use IEEE 802.11n or IEEE 802.11ac, "Wi-Fi Multimedia (WMM)" must be enabled.

• Select either "20MHz" or "40MHz" for IEEE 802.11n.
  
• Select either "20MHz", "40MHz", or "80MHz" for IEEE 802.11ac.
  
• In IEEE 802.11ax, the available bandwidth varies depending on the wireless band.
  
  • Radio 1: "20MHz" and "40MHz"
    
  • Radio 2: "20MHz", "40MHz", "80MHz", and "80+80MHz" (TQ6602 only)
    
  • Radio 3 Tri[11ax], Tri[11ax] GEN2: "20MHz", "40MHz", "80MHz", and "160MHz" (TQ7403 and TQ7403-R only)
    

Note

Emergency Mode cannot be used with channel blanket. You cannot use a channel blanket as an emergency Wi-Fi network.
Do not set this item to "Emergency mode only" for the radio used for channel blanket.

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R:
  Specify "Within AP" to block communication between wireless clients connected to all VAPs in the AP, "Within VAP" to block communication between wireless clients connected to the same VAP, or "Disabled" to not block communication. The default is "Disable".
  When this product is set to "Disabled", you can select "Within AP", "Within VAP", or "Disabled" for each VAP in "Wireless Client Isolation" in the VAP (Multi-SSID) settings. When this item is set to "Within AP" or "Within VAP", only "Within AP" or "Within VAP" will be displayed in "Wireless Client Isolation" in the VAP (Multi-SSID) settings, respectively.
  
  
• Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]:
  Select "Disable" to allow communications between wireless clients. Otherwise select "Enable". The default is "Disable".
  When this product is set to "Disable", you can select "Enable" or "Disable" for each VAP in "Wireless Client Isolation" in the VAP (Multi-SSID) settings. Setting this item "Enable" will activate Wireless Client Isolation for all VAPs, which blocks the communications between the clients connecting to the same VAP.
  
  
• Others:
  Select "Disable" to allow communications between wireless clients. Otherwise select "Enable". The default is "Disable".
  Setting this item "Enable" will activate Wireless Client Isolation for all VAPs, which blocks the communications between the clients connecting to the same VAP.
  Per-VAP setting can not performed.
  

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R
  Choose from the following three options.
  
  • When "Manual" is selected, you can set the priority airtime to be allocated to each VAP in the VAP (Multiple SSID) configuration.
    All associated clients of a VAP are provided with airtime, divided "Pre-allocated Airtime Percentage" equally with the clients.
    The airtime of each VAP in the same radio band must be set so that the total airtime does not exceed 100%.
    The remaining bandwidth, that is the whole bandwidth minus the airtime allocated in priority to each VAP in the same radio band, is divided according to the ratio of airtime allocated. This means that a VAP with an airtime allocation rate of 0% will not be able to communicate when the total airtime consumed by other VAPs reaches 100%.
    
  • Selecting "Evenly" provides equal airtime to all connected clients in the radio band.
    
  • If "Disable" is selected, no airtime adjustment is provided to connected clients.
    If a slow wireless client and a fast wireless client try to receive large amounts of data at the same time, more time may be allocated to the slow wireless client, depriving the fast wireless client of communication opportunities and slowing down the entire network.
    

  Note

  To use the manual setting of airtime fairness, the AP must have the following firmware applied:
  

  • TQ6403 GEN2 and TQm6403 GEN2 Firmware Version 9.0.4-0.1 or later
    
  • TQ6602 GEN2, TQ6702 GEN2, TQm6602 GEN2, and TQm6702 GEN2 Firmware Version 8.0.4-1.1 or later
    
  • TQ6702e GEN2 Firmware Version 9.0.4-3.1 or later
    
  • TQ7403 Firmware Version 10.0.4-0.1 or later
    
  • TQ6702 GEN2-R AlliedWare Plus Firmware Version 5.5.4-2.1 or later
    
  • TQ7403-R AlliedWare Plus Firmware Version 5.5.4-2.1 or later
    

• Dual[[11ax], Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]
  
  • Selecting "Enable" provides equal airtime to all connected clients in the radio band.
    
  • If "Disable" is selected, no airtime adjustment is provided to connected clients.
    If a slow wireless client and a fast wireless client try to receive large amounts of data at the same time, more time may be allocated to the slow wireless client, depriving the fast wireless client of communication opportunities and slowing down the entire network.
    

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2
  Radio 1/2: Specify a number between 0 to 500. The default is 500.
  Radio 3: Specify a number between 0 to 256. The default is 256.
  
  
• Dual[11ax] GEN2, Dual[11ax] GEN2-R
  Specify a number between 0 to 500. The default is 500.
  
  
• Dual[11ax]
  Specify a number between 0 to 320. The default is 200.
  
  
• Dual[11ac Wave2]
  Radio 1: Specify a number between 0 to 120. The default is 120.
  Radio 2: Specify a number between 0 to 200. The default is 200.
  
  
• Other than above
  Specify a number between 0 to 200. The default is 200.
  

• 2.4GHz:
  54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)
  

  Note

  If the Profile Type is set to Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, or Dual[11ac Wave2], for IEEE 802.11b wireless client communication, one or more out of 11, 5.5 , 2, or 1 (Mbps), from the above must be enabled to save the Profile.
  The profile types Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, and Dual[11ax] GEN2-R do not have the limitation that requires one or more of the following speeds to be enabled: 11, 5.5, 2, or 1(Mbps), to saving the Profile. However, if all of these are set to disabled, IEEE 802.11b clients cannot connect.
  

• 5GHz:
  54 48 36 24 18 12 9 6 (Mbps)
  

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R
  
  • Radio 1:
    54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)
    
  • Radio 2 and Radio 3:
    24 12 6 (Mbps)
    
  
  
• Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]
  
  • Radio 1:
    54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)
    
  • Radio 2 and Radio 3:
    54 48 36 24 18 12 9 6 (Mbps)
    

Note

If you select "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type, and "IEEE 802.11a/n/ac" for Mode, RTS packets are not sent to wireless clients connected by IEEE 802.11a. This setting is ignored.

• When enabled, the AP encourages clients supporting both 2.4GHz and 5GHz to prefer a less congested frequency in order to reduce overall congestion.
  
  
• When disabled, the AP doesn't encourage clients to use other frequencies. In that case, a client keeps using the same band with which they connect, even if the client supports both 2.4GHz and 5GHz and the other band is less crowded.
  

Note

Band Steering cannot be used with channel blanket. Disable Band Steering on the AP Profile for APs using channel blanket.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" for the Profile Type.

Note

To use IEEE 802.11n IEEE 802.11ac or IEEE 802.11ax, this must be enabled.

• Dual[11ax]:
  Enable
  
  
• Tri[11ax], Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]:
  Disable
  

Note

This item is displayed if you select "Dual[11ax] GEN2", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.

• Scan Method
  
• Scan Interval
  
• Scan Duration
  
• Scan Data Keep Time
  

Note

If Neighbor AP Detection is supported on the management web interface of the AP system and set to "Enable" in the AWC Plug-in management, the Neighbor AP Detection setting will remain as "Enable".
This is supported on TQ5403, TQ5403e and TQm5403 with firmware version 5.3.1 or later, TQ1402 and TQm1402 with firmware version 6.0.0-0.2 or later, and TQ6602 with firmware version 7.0.0 or later. If Neighbor AP Detection is not supported on the management web interface of the AP system, this feature is disabled in the AWC Plug-in management.

Note

For TQ6602 GEN2/6702 GEN2 and TQm6602 GEN2/6702 GEN2, when neighbor APs are detected, packet loss or communication delay shorter than 3 seconds (firmware version 8.0.3-0.1 or later) or 10 seconds (firmware version 8.0.2-x.x or earlier) may occur repeatedly up to 4 times, for approximately 20 seconds total. In environments where temporary performance degradation is unacceptable, disable neighbor AP detection in the AP profile for profile type "Dual [11ax] GEN2".
If the Neighborhood AP Detection feature is disabled, the following features of the AWC plug-in are affected:

• The AWC calculation cannot select channels that take into account the signal conditions of unmanaged APs.
  

Note

This item is displayed when "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", or "Dual[11ax]" is selected as the Profile Type, and a mode "ac" or "ax" is selected for the Radio Configuration.

Note

This item is displayed when "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", or "Dual[11ax]" is selected as the Profile Type, and a mode "ax" is selected for the Radio Configuration.

Note

This setting is displayed on "Radio 2" when "Dual[11ax] GEN2" or "Dual[11ax] GEN2 with External Antenna" is selected as Profile Type. Other Profile Types will not show this setting.

Note

This setting is displayed on "Radio 2" when "Dual[11ax] GEN2" is selected as Profile Type. Other Profile Types will not show this setting.

• All Channels
  Runs all channels in the selected Radio for Neighbor AP Detection.
  This is the same method as the conventional Neighbor AP Detection. Neighbor AP detection stops its own radio output and detects the presence of surrounding radio output. While it can detect the presence of Neighbor APs even if they are using different channels, it requires longer outage time than when detecting Neighbor APs on only one channel, resulting in packet loss and communication delays.
  In environments where transient performance degradation is not tolerable, specify scanning of only one channel or set the neighbor AP detection function itself to disabled.
  Note that if the Neighbor AP Detection function is disabled, the following functions of the AWC Plug-in will be affected:
  
  • The AWC calculation cannot select channels that take into account the signal conditions of unmanaged APs.
    
  
  
• One Channel
  Neighbor AP Detection is performed for only the channel currently in use.
  Although it takes less time than targeting all channels, it cannot detect the influence of adjacent channels with overlapping radio bands, such as channels 5 and 6, for example. For this reason, the AWC calculation cannot select channels that take into account the signal conditions of unmanaged APs.
  

  Note

  To use this setting, the AP must have one of the following firmware applied:
  

  • TQ7403 Firmware Version 10.0.4-3.1 or later
    
  • TQ6403 GEN2 and TQm6403 GEN2 Firmware Version 9.0.4-3.1 or later
    
  • TQ6602 GEN2, TQ6702 GEN2, TQm6602 GEN2, and TQm6702 GEN2 Firmware Version 8.0.4-1.1 or later
    
  • TQ6702e GEN2 Firmware Version 9.0.4-3.1 or later
    

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2
  16 VAPs per band (Radio 1, Radio 2, Radio 3)
  
• Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R, Dual[11ax]
  16 VAPs per band (Radio 1, Radio 2)
  
• Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]
  8 VAPs per band (Radio 1, Radio 2, Radio 3)
  

Note

It is recommended to use 5 or less VAPs per radio band in total, including both multi-channel and blanket VAPs.

• When set to Enabled, the VAP is always used on the APs to which this AP Profile is applied.
  
• When set to Disabled, the VAP is not used.
  
• When set to Emergency, the VAP becomes active only when the Emergency Mode is enabled in the Management Group.
  

Note

Emergency Mode cannot be used with channel blanket. You cannot use a channel blanket as an emergency Wi-Fi network.
Do not set this item to "Emergency" for the VAP whose number is the same as the CB VAP (VAP for channel blanket).

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" for the Profile Type.

Note

Specify a VLAN ID that is different from the AP's management VLAN. When the AP is detected as a guest device, a parent AMF device is configured to collect the guest device information automatically ("dynamic discovery"), and wireless clients get their IP addresses via DHCP.

• When enabled, the SSID is included in beacons. When you configure a wireless client, you may be able to see the SSID in a list of wireless networks to connect. This setting also allows wireless clients to connect using an "ANY" connection.
  
  
• When disabled, the SSID is not included in beacons. You may not be able to see the SSID in a wireless network list on a wireless client. In this case, you have to enter the same SSID as the AP on a wireless client. This setting also denies wireless clients from connecting using an "ANY" connection.
  

Note

An "ANY" connection is a connection where a wireless client tries to connect to an AP by specifying a wildcard or null as the SSID. Even when an "ANY" connection is allowed, clients cannot connect to APs without knowing the correct security key.

• None:
  No authentication or encryption is performed. Everyone can connect to the VAP.
  

  Note

  If you use "None" to build a network such as a guest hotspot, you should consider the consequences for the overall security of your entire network.

  
  
• Static WEP:
  Uses RC4 encryption with fixed keys. Per-client authentication is not performed. We recommend using "WPA Personal" for fixed key security because WEP is vulnerable.
  

  Note

  "Static WEP" is not displayed when the selected Mode contains "IEEE 802.11n". This can be configured only on VAP 1 of each radio.

  Note

  "Static WEP" can be configured on VAP1 of each radio, only when "b/g" or "a" is specified as Mode.

  
  
• Enhanced Open:
  Open authentication enables connection to the network without entering a user ID or password, but after open authentication, data between the AP and client is encrypted using the Opportunistic Wireless Encryption (OWE) protocol (128-bit CCMP/AES).
  

  Note

  The "Enhanced Open" is only displayed when "Tri[11ax]-R" or "Dual[11ax] GEN2-R" is selected as Profile Type.

  
  
• Enhanced Open Transition Mode:
  Uses VAP1 and VAP2 in a mode that can be configured without concern for whether the wireless client supports Enhanced Open or not. Enhanced Open-enabled clients communicate with the product using VAP2 encrypted with the OWE protocol after open authentication, while Enhanced Open-unenabled clients communicate with the product using VAP1 without OWE encryption after open authentication.
  

  Note

  When VAP1 security is set to "Enhanced Open Transition Mode", VAP2 security will be also set to "Enhanced Open Transition Mode" and the VAP status will be "Enabled". In this case, the VAP2 broadcast is also set to "Disable".

  Note

  The "Enhanced Open Transition Mode" is only displayed in Radio 1 and Radio 2 when "TQ Series" is selected for the Series and "Tri[11ax]" or "Tri[11ax]-R" for the Profile Type.

  
  
• WPA Personal:
  Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated from a pre-shared key (PSK). It uses CCMP (AES) or TKIP for the encryption algorithm.
  
  
• WPA Enterprise:
  Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated on a RADIUS server. It uses CCMP (AES) or TKIP for the encryption algorithm.
  
  
• OSEN:
  Used by the VAP for online sign-up and to configure security settings when communicating with the OSU server.
  

  Note

  "OSEN" is displayed if you select "Tri[11ac]" or "Tri[11ac] with External Antenna" for Profile Type.

• External RADIUS:
  The APs will query the RADIUS server.
  
  
• Click-through:
  The APs will display a Click-through page instead of performing RADIUS authentication. The Click-through page does not require authentication with a username/password pair, but can be configured to show an arbitrary "Terms of Use" that users have to accept before use, or to redirect to an external page.
  
  
• External Page Redirect:
  The clients will be able to connect using third-party web credentials such as social networking sites.
  
  
• Disable:
  Select to not use Captive Portal.
  

Note

"External Page Redirect" will appear when you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]" or "Tri[11ac Wave2] with External Antenna" for Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

Note

Do not enable Captive Portal on the radio used for the WDS connection.

• MAC Address List:
  Selecting this option will allow or deny connections only to the MAC addresses recorded in the list, according to the MAC address list selected in the MAC Address List field at the top of the screen.
  
  
• External RADIUS:
  The APs will query the RADIUS server.
  
  
• MAC Address List + External RADIUS:
  Selecting this option allows or denies connections only to the MAC addresses recorded in the list. This list refers to both the MAC address list selected in the MAC address list field at the top of the screen and the external RADIUS server.
  Firstly, it will try to authenticate using the MAC Address List. If a connection cannot be established, it will try to authenticate the connection using an External RADIUS server. If the preceding MAC address list allows a user to connect, the user can still connect even if the external RADIUS server does not grant the access.
  
  
• AMF Application Proxy:
  Selecting "AMF Application Proxy" allows you to query the whitelist and blacklist of our AMF-SECurity Controller AT-SecureEnterpriseSDN Controller (AT-SESC) or AMF Security mini. You can then take actions such as allowing, denying or quarantining client devices that attempt to connect to the wireless AP, disconnecting connected devices or changing VLANs.
  
  
• Disable:
  No MAC access control is performed.
  

Note

"MAC Address List" and "MAC Address List + External RADIUS" are only available when any of MAC Address List is selected in the "Basic Configuration" section.

Note

"MAC Address List + External RADIUS" is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

Note

"AMF Application Proxy" is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

• 802.11r FT
  
• FT over DS
  
• Mobility Domain
  
• R0 key Lifetime
  
• AES Key
  
• IEEE 802.11k RRM
  
• IEEE 802.11v WNM
  

Note

This item is displayed if you select "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type, and "WPA Personal", "WPA Enterprise" or "OSEN" for Security of VAP.
Only "Disable" is available when you select "Dual[11ax]" for Profile Type, and "WPA2/WPA3" or "WPA3" for WPA versions.

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R:
  
  • If "Wireless Client Isolation" for the entire radio is set to "Within AP" or "Within VAP", only the same option as selected will be displayed in this field.
    
  • If Wireless Client Isolation for the entire radio is set to "Disable", you can specify whether or not to allow communication between wireless clients in individual VAPs in this field.
    Specify "Within AP" to block communication between wireless clients connected to all VAPs in the AP, "Within VAP" to block communication between wireless clients connected to the same VAP, or "Disabled" to not block communication.
    The default is "Disable".
    
  
  
• Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna:
  
  • If "Wireless Client Isolation" for the entire radio is set to " Enable", only "Enable" will be displayed in this field.
    
  • If Wireless Client Isolation for the entire radio is set to "Disable", you can specify whether or not to allow communication between wireless clients in individual VAPs in this field. Select "Disable" to allow communications between wireless clients connected to the same VAP. Otherwise select "Enable".
    The default is "Disable".
    

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2] for the Profile Type.

Note

This feature cannot be used with the OpenFlow feature. Use the default setting.

Note

If you select "Dual[11ax]" for the Profile Type, the setting of this item in any VAP will take effect on the VAPs in the same radio band.

Note

If you select "Dual[11ac]" for the Profile Type, this setting is not supported for Radio 1. Use the default setting.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2] for the Profile Type.

Note

This feature cannot be used with the OpenFlow feature. Use the default setting.

Note

When "Management Frame Protection" is set to "Enable", "Disconnect" is used regardless of this item's setting.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2] for the Profile Type.

Note

To make this function take effect, APs on the same subnet must have "Roaming Notification" set to "Enable" for each other.

• If enabled, when a managed wireless AP receives an ARP request for a connected client, the wireless AP that has a connection to the client will send an ARP response on behalf of the client. The wireless AP that does not have a connection to the client will discard the ARP request, thereby reducing unnecessary traffic.
  
• If you select "Disable", Proxy ARP will not be activated. That means ARP requests are broadcasted from all wireless APs to their subordinate clients. The corresponding clients send ARP responses themselves.
  The default is "Disable".
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

Note

Enabling this function may result in reduced throughput.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", or "Dual[11ax] GEN2-R" for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", or "Dual[11ax] GEN2-R" for the Profile Type, and "Manual" for "Airtime Fairness".

Note

To enable Passpoint, WPA Enterprise must be used as security mode. When enabling this item, a confirmation dialog will appear asking if you allow to change the security mode to WPA Enterprise to continue Passpoint setting.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

• 64bit:
  You can directly enter a WEP key with 10 hex digits. Or you can enter 5 ASCII characters to automatically generate a WEP key.
  
• 128bit:
  You can directly enter a WEP key with 26 hex digits. Or you can enter 13 ASCII characters to automatically generate a WEP key.
  

• ASCII:
  Lets you enter an arbitrary string to automatically generate a WEP key. The string is case-sensitive.
  
• Hex:
  Lets you directly enter a WEP key with hexadecimal characters (0 to 9, A to F, a to f). Hex characters are not case-sensitive.
  

• Open System:
  All wireless clients are allowed to connect regardless of whether they have the correct WEP key. But as wireless clients are only allowed to connect, they cannot communicate without a valid WEP key.
  This option is not only for "WEP" but is also used for "None", "WPA Personal" and "WPA Enterprise".
  
• Shared Key:
  Only wireless clients with the correct WEP key can connect. Wireless clients cannot connect without a valid key.
  

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R:
  
  • WPA3
    
  • WPA3 / WPA2
    
  • WPA2
    
  • WPA2 / WPA
    
• Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna:
  
  • WPA3
    
  • WPA2
    
  • WPA2 / WPA
    
• Dual[11ac Wave2]:
  
  • WPA2
    
  • WPA2 / WPA
    

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R, Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
  The following configuration can be set depending on the choice of WPA version.
  
  
  • WPA3: Fixed to "Required".
    
  • Both WPA3 and WPA2: Fixed to "Capable".
    
  • WPA2: Select from "Capable" or "Disable". The default is "Capable".
    
  • Both WPA2 and WPA: Fixed to "Disable".
    
  
  
• Dual[11ax], Dual[11ac Wave2]
  Select "Enable" to use MFP. Otherwise select "Disable". The default is "Enable".
  

Note

This setting is displayed when Profile Types other than "Dual[11ax]" is selected.

Note

If Profile Type is "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Tri[11ac Wave2]" or "Dual [11ac Wave2]", this item can be configured only on VAP1 of each radio. When you select "Enable", this function is valid for all VAP.

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R:
  
  • WPA3
    
  • WPA3 / WPA2
    
  • WPA2
    
  • WPA2 / WPA
    
• Dual[11ax], Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna:
  
  • WPA3
    
  • WPA2
    
  • WPA2 / WPA
    
• Dual[11ac Wave2]:
  
  • WPA2
    
  • WPA2 / WPA
    

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R, Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
  The following configuration can be set depending on the choice of WPA version.
  
  
  • WPA3: Fixed to "Required".
    
  • Both WPA3 and WPA2: Fixed to "Capable".
    
  • WPA2: Select from "Capable" or "Disable". The default is "Capable".
    
  • Both WPA2 and WPA: Fixed to "Disable".
    
  
  
• Dual[11ax], Dual[11ac Wave2]
  Select "Enable" to use MFP. Otherwise select "Disable". The default is "Enable".
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2] for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2] for the Profile Type.

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

• When the secondary RADIUS server is not used and the number of RADIUS Retransmit is set to "4":
  The primary RADIUS server is attempted a maximum of 5 authentication requests (first time and 4 retransmissions). Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout must be set to "5" or less.
  
• When using the both primary/secondary RADIUS servers and setting the number of RADIUS Retransmit to "2":
  Three authentication requests (the first attempt and two retries) are attempted for each RADIUS server, for a total of up to 6 authentication requests. Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout should be set to "4" or less.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

• Tri[11ax], Tri[11ax]-R, Tri[11ax] GEN2, Dual[11ax] GEN2, Dual[11ax] GEN2 with External Antenna, Dual[11ax] GEN2-R, Dual[11ax]
  The default is "Disable".
  
• Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]
  The default is "Enable".
  

Note

This can be configured only on VAP1 of each radio. When you select "Enable", this function is valid for all VAP.

Note

WPA is based on a draft of IEEE 802.11i while WPA2 is based on the final version of IEEE 802.11i and therefore meets all mandatory items required by the standard.

Note

According to the WPA standard, TKIP is mandatory while CCMP is optional. Our products implement both algorithms.

Note

If the WPA version includes "WPA3", only "CCMP" can be selected. "TKIP" is not displayed.

Note

If the WPA version is set to "WPA2", or both "WPA2" and "WPA", "TKIP" can be selected as necessary.

• WPA3: Fixed to "Required".
  
• Both WPA3 and WPA2: Fixed to "Capable".
  
• WPA2: Select from "Capable" or "Disable". The default is "Capable".
  
• Both WPA2 and WPA: Fixed to "Disable".
  

Note

If the Profile Type is set to "Dual[11ax] GEN2", and the WPA version is set to "WPA2" solely, please do not set to "Required".

• Enable:
  shows an external authentication page. Specify the page URL in "Base URL".
  
  • Base URL:
    Specify the base URL of the external web authentication page.
    Clients will access the page through the AP's proxy feature instead of direct connection.
    The HTML filename of the external authentication page must be "radius_login.html".
    The AP's proxy will get the page from "Base URL/radius_login.html" and send it back to clients.
    For example, when you specify "http://www.example.com/captive_portal" in "Base URL", the APs will present the content of the page at "http://www.example.com/captive_portal/radius_login.html" to connecting clients.
    For details of the format of radius_login.html, refer to Operation Reference > Authentication > Web Authentication with Captive Portal.
    
• Disable:
  Shows an authentication page embedded in the APs.
  When "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" is selected for Profile Type, set the display language of the authentication page in addition.
  
  • Authentication Page Language:
    Select the display language of the authentication page from "Japanese" or "English". The default is "English".
    

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2] for the Profile Type.

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not treated as mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

• Enable:
  Uses RADIUS Accounting. With an external RADIUS server that has authenticated the user, it is possible to record the resources (such as connection time) used by each user during the session. You can also use features such as those provided by external RADIUS. Specify the "RADIUS accounting port" in addition.
  
  • RADIUS Accounting Port Number:
    Enter the port number of the accounting port of the external RADIUS server in the range 0-65535. The default is 1813.
    
• Disable: Does not use RADIUS Accounting.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2] for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL:
  Always show a fixed URL that you specify. Should be 1 to 128 characters in length, with alphabets, numbers and symbols (including spaces).
  
• Disable:
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    When "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", or "Dual[11ax] GEN2-R" is selected as the Profile Type, one asterisk (*) can be used as a wildcard when specifying the FQDN in the walled garden entry.
    For example, "*.example.jp" will get hits for "www.example.jp", "ftp.example.jp", etc. Similarly, "example.*" will get hits for "example.com", "example.jp", etc. Up to one wildcard may be used per entry. Multiple wildcards (e.g., "*.example.*") are not allowed.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address:
    Shows a list of registered addresses that contain the input string.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

• Only if none of the walled garden entries have been registered using wildcards can "Enable" or "Disable" be selected under this item. The default is "Disable".
  
• If at least one wildcard is used in a walled garden entry, it is fixed as "Enable".
  

Note

This setting is displayed when "Dual[11ax] GEN2" or "Dual[11ax] GEN2-R" is selected as Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

• Enable:
  shows an external authentication page. Specify the page URL in "Base URL".
  
  • Base URL:
    Specify the base URL of the external web authentication page.
    Clients will access the page through the AP's proxy feature instead of direct connection.
    The HTML filename of the external authentication page must be "radius_login.html".
    The AP's proxy will get the page from "Base URL/radius_login.html" and send it back to clients.
    For example, when you specify "http://www.example.com/captive_portal" in "Base URL", the APs will present the content of the page at "http://www.example.com/captive_portal/radius_login.html" to connecting clients.
    For details of the format of radius_login.html, refer to Operation Reference > Authentication > Web Authentication with Captive Portal.
    
• Disable:
  Shows an authentication page embedded in the APs.
  When "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" is selected for Profile Type, set the display language of the authentication page, and the text to show as the Terms of Use in addition.
  
  • Authentication Page Language:
    Select the display language of the authentication page from "Japanese" or "English". The default is "English".
    
  • Agreement Message:
    Create the text of the Terms of Use to be displayed on the AP's authentication page with a maximum length of 1,024 characters.
    Each line break counts as four characters.
    Formatting (font size, color, etc.) is not available.
    

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2] for the Profile Type.

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL:
  Always show a fixed URL that you specify. Should be 1 to 128 characters in length, with alphabets, numbers and symbols (including spaces).
  
• Disable:
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    When "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", or "Dual[11ax] GEN2-R" is selected as the Profile Type, one asterisk (*) can be used as a wildcard when specifying the FQDN in the walled garden entry.
    For example, "*.example.jp" will get hits for "www.example.jp", "ftp.example.jp", etc. Similarly, "example.*" will get hits for "example.com", "example.jp", etc. Up to one wildcard may be used per entry. Multiple wildcards (e.g., "*.example.*") are not allowed.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address:
    Shows a list of registered addresses that contain the input string.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

• Only if none of the walled garden entries have been registered using wildcards can "Enable" or "Disable" be selected under this item. The default is "Disable".
  
• If at least one wildcard is used in a walled garden entry, it is fixed as "Enable".
  

Note

This setting is displayed when "Dual[11ax] GEN2" or "Dual[11ax] GEN2-R" is selected as Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not treated as mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

• Enable:
  Uses RADIUS Accounting. With an external RADIUS server that has authenticated the user, it is possible to record the resources (such as connection time) used by each user during the session. You can also use features such as those provided by external RADIUS. Specify the "RADIUS accounting port" in addition.
  
  • RADIUS Accounting Port Number:
    Enter the port number of the accounting port of the external RADIUS server in the range 0-65535. The default is 1813.
    
• Disable:
  Does not use RADIUS Accounting.
  

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL:
  Always show a fixed URL that you specify. Should be 1 to 128 characters in length, with alphabets, numbers and symbols (including spaces).
  
• Disable:
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    When "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", or "Dual[11ax] GEN2-R" is selected as the Profile Type, one asterisk (*) can be used as a wildcard when specifying the FQDN in the walled garden entry.
    For example, "*.example.jp" will get hits for "www.example.jp", "ftp.example.jp", etc. Similarly, "example.*" will get hits for "example.com", "example.jp", etc. Up to one wildcard may be used per entry. Multiple wildcards (e.g., "*.example.*") are not allowed.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address:
    Shows a list of registered addresses that contain the input string.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax] GEN2-R", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

• Only if none of the walled garden entries have been registered using wildcards can "Enable" or "Disable" be selected under this item. The default is "Disable".
  
• If at least one wildcard is used in a walled garden entry, it is fixed as "Enable".
  

Note

This setting is displayed when "Dual[11ax] GEN2" or "Dual[11ax] GEN2-R" is selected as Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Dual[11ax]", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.
This item is displayed if you select "Dual[11ac Wave2]" for Profile Type, however, it is not supported.

Note

You cannot use a different MAC Address List for each radio or VAP. A single list is used for all radios (Radio 1/Radio 2/Radio 3) and VAPs in an AP Profile.

• When you select "Enable", only the wireless clients which succeeded authenticating with MAC Access Control and Captive Portal, will be able to communicate via the relevant VAP.
  
• When you select "Disable", the wireless clients which have succeeded authenticating with either MAC Access Control, or Captive Portal separately will be able to communicate via the relevant VAP.
  

Note

This item is displayed if you select "Dual[11ax] GEN2", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not treated as mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

• When the secondary RADIUS server is not used and the number of RADIUS Retransmit is set to "4":
  The primary RADIUS server is attempted a maximum of 5 authentication requests (first time and 4 retransmissions). Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout must be set to "5" or less.
  
• When using the both primary/secondary RADIUS servers and setting the number of RADIUS Retransmit to "2":
  Three authentication requests (the first attempt and two retries) are attempted for each RADIUS server, for a total of up to 6 authentication requests. Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout should be set to "4" or less.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

• If you select "Fixed Password", a string specified in "User-Password Format Password" is always used as the value of the User-Password attribute.
  
• If you select "User Name", the same string as the User-Name attribute (MAC Address) is sent to the RADIUS server as the value of the User-Password attribute.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax]-R", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", or "Dual[11ax] GEN2-R" for the Profile Type.

• When you select "Enable", only the wireless clients which succeeded authenticating with MAC Access Control and Captive Portal, will be able to communicate via the relevant VAP.
  
• When you select "Disable", the wireless clients which have succeeded authenticating with either MAC Access Control, or Captive Portal separately will be able to communicate via the relevant VAP.
  

Note

This item is displayed if you select "Dual[11ax] GEN2", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

• When set to "Enable", you can specify the URL to which the wireless client detected as a suspected node by the IP Filter action is forwarded in the External page URL field that is displayed additionally.
  
• When set to "Disable", the Redirect-URL function is not used. The suspected node will not be allowed to connect to any page.
  

Note

Web page used in Redirect-URL should not be placed on a server that handles sensitive information.
When a Redirect-URL is used, the host (IP address or domain) specified in the "External Page URL" will be registered in the walled garden information inside the wireless AP.
Thus, even a suspected node that has not been authenticated can browse to any page on the server to which it has been redirected by entering the path in the address field of its Web browser.

Note

This item is displayed if you select "Dual[11ax] GEN2", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

Note

Redirect-URL cannot be used in conjunction with Captive Portal.

Note

If the suspected node uses HTTPS instead of HTTP for access, the user of the node may see screens such as "Your connection is not private", "Your connection is not secure", "Connect to Wi-Fi hotspot", "Connect to Wi-Fi", or "Log in to network". In that case, the user will be redirected to the Redirect-URL page by selecting Refresh, Reload or Connect button on her/his Web browser.
However, due to Web browser specifications, s/he may not be redirected to the Redirect-URL page even if s/he select Refresh or Connect button. In this case, the user will be redirected to the Redirect-URL page by accessing the site via HTTP.

Note

In this version, the secondary AMF Application Server is not available.

Note

In this version, the secondary AMF Application Server is not available.

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not treated as mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", or "Dual[11ax] GEN2 with External Antenna" for the Profile Type.

• With "Enable" selected, in the event the connection between the AWC Plug-in and AMF Application Proxy server is lost, all new client connection requests will be allowed.
  

  Note

  When using the VAP security method together with AMF Application Proxy, only wireless clients that have successfully authenticated using the security method can communicate.

• When you select "Disable", all new client connection requests will be rejected.
  The clients that are already connected before the connection between the AWC Plug-in and AMF Application Proxy server got lost, can now continue the communication.
  

Note

This item is displayed if you select "Tri[11ax]", "Tri[11ax] GEN2", "Dual[11ax] GEN2", "Dual[11ax] GEN2 with External Antenna", "Tri[11ac Wave2]", or "Tri[11ac Wave2] with External Antenna" for the Profile Type.

• When the number of APs using this AP profile changes, the configuration status of the APs that use this AP profile becomes "Modified".
  
• If you make a change that affects the number of APs that use this AP Profile on the Wireless Configuration > AP Settings page, a dialog box will ask you whether to apply the configuration to all APs that use this AP Profile.
  If you click "OK", the configuration will be applied to all APs that use this AP profile.
  

• When enabled, wireless clients send an authentication request to the destination AP via the current (source) AP. (Over The DS.)
  
• When disabled, wireless clients send an authentication request to the destination AP directly over the radio. (Over The Air)
  

Note

Fast roaming with FT over DS enabled is not supported on TQ7403 Radio 3. When "Tri[11ax]" is selected for Profile Type, set this item to "Disable" when using the Fast Roaming function on Radio 3.

Note

This is mandatory for every function in the "Fast Roaming" section. Configure this item even if you only use IEEE 802.11k or IEEE 802.11v and you are not going to use IEEE 802.11r fast transition.

• Private network:
  A network which unauthorized users cannot access.
  
• Private network with guest access:
  A private network that offers guest access to unauthorized users.
  
• Chargeable public network:
  A network that can be accessed by anyone at anytime for a charge. The billing system and other information can be obtained in other ways (IEEE 802.21, http/https redirect or DNS redirection)
  
• Free public network:
  A network that can be accessed by anyone at anytime for free.
  
• Personal device network:
  A network for personal devices such as a camera and printer.
  
• Emergency service-only network:
  A network for limited use for the emergency services (police or fire/disaster management).
  
• Test or experimental:
  A network for testing or experiments.
  
• Wildcard:
  A wildcard access network.
  

• EAP-TLS
  
• EAP-TTLS/MSCHAPv2
  
• EAP-SIM
  
• EAP-AKA
  

Note

Only L2 communication is covered by the protected port. L3 communication through the bridge interface must be controlled by a separate firewall or other means.