Configure AP Profiles

Note

This item is not supported.

• Search Wireless Management Group: Groups in the list can be filtered by entering a partial name in the search box.
  The Search field lets you enter a partial string to match. The screen displays entries with that string in their name.
  To remove the filter, delete the string from the Search field and press Enter.
  

  Note

  The search is case-sensitive.

• User Settings
  If necessary, select whether to set the Username and Password for logging in to the AP's Web GUI all at once.
  Also, set whether to allow individual user settings to be specified for APs to which this AP Profile is applied.
  

  Note

  This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

  By selecting "Enable", the additional items described below will be displayed.
  
  • Username
    
  • Password
    
  • Password (Confirm)
    
  • AP's User Settings
    
  
  
• User Information
  Set the Username and Password for logging in to the AP's CLI, which is necessary for managing the AP.
  Also, set whether to allow individual user information to be specified for APs to which this AP Profile is applied.
  Configure the following items.
  
  • Username
    
  • Password
    
  • APs User Settings
    

  Note

  This setting is displayed when "AT-TQ7403-R" or "AT-TQ6702 GEN2-R" is selected as the Model.

Note

Some timezones (e.g. "(UTC+09:00) Asia/Tokyo") don't support Daylight Saving Time.

• AT-TQ7403-R, AT-TQ6702 GEN2-R only
  
  • Timezone Name
    
  
  
• In common to all types
  
  • Daylight Saving Time
    (When Daylight Saving Time is set to Enable)
    
    • DST Start (24HR)
      
    • DST End (24HR)
      
    • DST Offset
      

• When enabled, AP clocks are synchronized to the NTP server. By using NTP, you can keep multiple systems' time as accurate as possible.
  
• When disabled, AP clocks are synchronized to the system clock of the PC (server) running Vista Manager EX and the AWC Plug-in.
  

• NTP Server IP Address / Hostname
  
• NTP Synchronization Interval
  

• Syslog Server IP Address / Hostname
  
• Port Number
  
• Severity
  

• Version
  
• Read Only Community Name
  
• Port Number
  
• Full Name
  
• Password
  
• Restrict the source of SNMP requests
  
• Only allow from the designated hosts or subnets
  
• Community name for traps
  
• Trap types
  
• Trap Host IP Address/Hostname
  

• AT-TQ7403, AT-TQ6403 GEN2 / AT-TQm6403, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2:
  This item is set as the MAC Address List to be applied to the CB VAP with Channel Blanket. The MAC address list applied to each VAP is configured individually in the "Selected List" section. The "Selected List" section appears when an enabled MAC address list is selected under "MAC Access Control" in the VAP (Multiple SSID) Configuration. If Channel Blanket is not used or MAC Access Control is not used in the CB VAP, no setting is required for this item.
  

  Note

  When both the Basic Configuration and the VAP (Multiple SSID) Configuration specify MAC address lists, the list selected under "MAC Access Control" in the VAP Configuration takes precedence.
  

  Note

  When using the MAC address list feature, if the firmware applied to the AP does not support per-VAP MAC address lists, please specify the same MAC address list for both the "MAC Address List" in the Basic Configuration and the "Selected List" for each VAP under "MAC Access Control" in the VAP (Multi-SSID) Configuration.
  Specifying only one of the items, or assigning different types of MAC address lists is not supported.
  

  
  
• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403-R, AT-TQ6702 GEN2-R, AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402:
  Set as the MAC Address List to be applied to the VAP or CB VAP. In this case, the same MAC Address List is applied to all VAPs and CB VAPs that have MAC Access Control with MAC Address Lists enabled.
  

Note

This item is displayed when "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model.

Note

This setting is displayed when "AT-TQ7613" is selected as the Model.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

• IP addresses are assigned to wireless clients using DHCP
  
• The following DHCP options are used:
  
  • DHCP Option 12 (hostname)
    
  • DHCP Option 55/60 (operating system)
    

Note

This item is displayed when "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model.

Note

When this function is enabled, there are limitations on the management functions available in the Vista Manager EX. For more information, please see Overview > What is the AWC Plug-in > Client Connection History Management and Client Packet Analysis.

Note

When you enable this feature, logs about the network connection will be displayed when the wireless client is connected. For more information on logging, see Screen Reference > Wireless Monitor > Log Management.

• STOAT Destination
  
  • IP Address/Hostname
    
  • Key
    

Note

This setting is displayed when "AT-TQ7403-R" or "AT-TQ6702 GEN2-R" is selected as the Model.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402
  From the drop-down menu, select 15, 30, 45, 60, 75, 90, 105, or 120.
  
  
• AT-TQ7403-R, AT-TQ6702 GEN2-R
  Enter a value from 1 to 180.
  

Note

FQDN consists of labels (strings) and periods (.).
Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
A label only cannot be entered. Use an FQDN which contains at least two labels and a period.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", or "AT-TQ6602" is selected as the Model.

Note

When you use the AWC function, do not use an interval larger than the default of 10 minutes.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402
  Enter the IP address or hostname (FQDN).
  (Example) syslog.your.domain.com, 12.34.56.78
  

  Note

  FQDN consists of labels (strings) and periods (.).
  Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
  A label only cannot be entered. Use an FQDN which contains at least two labels and a period.
  

• AT-TQ7403-R, AT-TQ6702 GEN2-R
  Enter the IP address. You cannot specify with the hostname (FQDN).
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

• 0 : Emergency: System is unusable.
  
• 1 : Alert: Immediate action is required.
  
• 2 : Critical: System is in a critical condition.
  
• 3 : Error: An error has occured.
  
• 4 : Warning: Something has occurred that requires attention.
  
• 5 : Notice: A normal but important message.
  
• 6 : Informational: An informational message.
  
• 7 : Debug: Detailed information for debugging.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

Note

This item is displayed if you select "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" as the Model, and specified "v1/v2c" as the SNMP Version; or if you select "AT-TQ1402 / AT-TQm1402" for the Model.

Note

This setting is displayed only when "AT-TQ7403-R" or "AT-TQ6702 GEN2-R" is selected as the Model, and "v1/v2c" is specified for the SNMP Agent Version.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

Note

If the AP is managed by the SNMP plug-in and the port number has not been changed in the SNMP Plug-in Settings Utility, there is no need to change the settings in this item.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402
  Enter a name between 1 to 12 alphanumeric characters. (The string is case-sensitive)
• AT-TQ7403-R, AT-TQ6702 GEN2-R
  Should be 1 to 20 characters in length, with alphabets (case-sensitive), numbers and symbols (! # % & ' ( ) * + , - . / : ; < = > @ [ ] ^ _ ` { | } ~ may be used). (The string is case-sensitive)

Note

This is displayed when "v3" is specified for the SNMP Agent Version.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402
  Should be 8 to 32 characters in length, with alphabets, numbers, and symbols (space ! # % ( ) + , - . / ; = ? @ [ \ ] ^ _ ` { | } ~ may be used).
  
• AT-TQ7403-R, AT-TQ6702 GEN2-R
  Should be 1 to 20 characters in length, with alphabets (case-sensitive), numbers and symbols (! # % & ' ( ) * + , - . / : ; < = > @ [ ] ^ _ ` { | } ~ may be used). (The string is case-sensitive)

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model, and "v3" is specified for the SNMP Agent Version.

Note

This item is displayed if you select "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" as the Model, and specified "v1/v2c" as the SNMP Version; or if you select "AT-TQ1402 / AT-TQm1402" for the Model.

Note

FQDN consists of labels (strings) and periods (.).
Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
If the Model is "AT-TQ1402 / AT-TQm1402", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e", you cannot enter only the label. Use an FQDN which contains at least two labels and a period.

Note

This item is displayed if you select "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" as the Model, and specified "v1/v2c" as the SNMP Version; or if you select "AT-TQ1402 / AT-TQm1402" for the Model.

Note

This item is displayed if you select "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" as the Model, and specified "v1/v2c" as the SNMP Version; or if you select "AT-TQ1402 / AT-TQm1402" for the Model.

• Cold Start: sent when the SNMP Agent starts.
  
• Link Up/Down: sent when a wireless interface link up or down.
  
• Authentication: sent when an SNMP authentication fails.
  

• Trap Host IP Address/Hostname
  Specify IP addresses or hostnames (FQDNs).
  (Example) manager.your.domain.com, 12.34.56.78
  

  Note

  FQDN consists of labels (strings) and periods (.).
  Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
  A label only cannot be entered. Use an FQDN which contains at least two labels and a period.
  

  Note

  This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

• Trap Host IP Address
  Specify the IP address.
  (Example) 12.34.56.78 You cannot specify with the hostname (FQDN).
  

  Note

  This setting is displayed when "AT-TQ7403-R" or "AT-TQ6702 GEN2-R" is selected as the Model.

Note

This version does not support the STOAT collector function in the AT-TQR series. This only works as a STOAT source, so the STOAT destination must be set to Enable"

• Static LAG:
  Enables link aggregation. A static LAG should also be configured on the switch ports to which the AP connects.
  
  
• Cascade:
  Enables cascading function, the LAN2 port will work as a cascade port.
  
  
• LACP:
  Enables LACP. If LACP is enabled on the switch to which the AP connects, a trunk group will be automatically configured.
  

  Note

  This item is displayed when "AT-TQ7613", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", or "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2" is selected as the Model.

  
  
• Disable:
  Neither link aggregation nor cascading function will be enabled. The LAN2 port is also disabled. The AP can only use the LAN1/PoE port.
  

Note

It is recommended to use 5 or less VAPs per radio band in total, including both multi-channel and blanket VAPs, and MLO Networks.

• When set to Enabled, the MLO Network is always used on the APs to which this AP Profile is applied.
  
• When set to Disabled, the MLO Network is not used.
  

• Enhanced Open:
  Open authentication enables connection to the network without entering a user ID or password, but after open authentication, data between the AP and client is encrypted using the Opportunistic Wireless Encryption (OWE) protocol (128-bit CCMP/AES).
  
  
• WPA Personal:
  Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated from a pre-shared key (PSK). It uses CCMP (AES) or TKIP for the encryption algorithm.
  
  
• WPA Enterprise:
  Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated on a RADIUS server. It uses CCMP (AES) or GCMP for the encryption algorithm.
  

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

• When the secondary RADIUS server is not used and the number of RADIUS Retransmit is set to "4":
  The primary RADIUS server is attempted a maximum of 5 authentication requests (first time and 4 retransmissions). Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout must be set to "5" or less.
  
• When using the both primary/secondary RADIUS servers and setting the number of RADIUS Retransmit to "2":
  Three authentication requests (the first attempt and two retries) are attempted for each RADIUS server, for a total of up to 6 authentication requests. Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout should be set to "4" or less.
  

Note

If you disable all radios on an AP Profile, it is possible to apply the profile to APs of other Profile Types, this profile will not be valid. Make sure you apply an appropriate AP Profile to APs.

Note

This item is not supported.

• AT-TQ7613
  
  • Radio 1: b/g, b/g/n, b/g/n/ax, b/g/n/ax/be (default)
    
  • Radio 2: a, a/n, a/n/ac, a/n/ac/ax, a/n/ac/ax/be (default)
    
  • Radio 3: ax, ax/be (default)
    
• AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R
  
  • Radio 1: b/g, b/g/n, b/g/n/ax (default)
    
  • Radio 2: a, a/n, a/n/ac, a/n/ac/ax (default)
    
  • Radio 3: ax (default)
    
• AT-TQ6403 GEN2 / AT-TQm6403 GEN2
  
  • Radio 1: b/g, b/g/n, b/g/n/ax (default)
    
  • Radio 2: a, a/n, a/n/ac, a/n/ac/ax (default)
    
  • Radio 3: a, a/n, a/n/ac, a/n/ac/ax (default)
    
• AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R
  
  • Radio 1: b/g, b/g/n, b/g/n/ax (default)
    
  • Radio 2: a, a/n, a/n/ac, a/n/ac/ax (default)
    
• TQ6602
  
  • Radio 1: b/g, b/g/n/ax (default)
    
  • Radio 2: a, a/n/ac/ax (default)
    
• AT-TQ5403 / AT-TQm5403
  
  • Radio 1: b/g, b/g/n (default)
    
  • Radio 2: a, a/n/ac (default)
    
  • Radio 3: a, a/n/ac (default)
    
• TQ5403e
  
  • Radio 1: b/g, b/g/n (default)
    
  • Radio 2: none
    
  • Radio 3: a, a/n/ac (default)
    
• AT-TQ1402 / AT-TQm1402
  
  • Radio 1: b/g, b/g/n (default)
    
  • Radio 2: a, a/n/ac (default)
    

Note

To use IEEE 802.11n, IEEE 802.11ac, IEEE 802.11ax or IEEE 802.11be, "Wi-Fi Multimedia (WMM)" must be enabled.

Note

When using IEEE 802.11be, you must configure the VAP security and WPA version using one of the following modes.

• Security: Enhanced Open (Enhanced Open Transition Mode is not applicable)
  
• Security: WPA Personal or WPA Enterprise
  WPA Version: WPA3 or WPA3/WPA2
  

If none of the above conditions apply or if the wireless client is connected via WPA2, it operates using IEEE 802.11ax.

Note

Emergency Mode cannot be used with channel blanket. You cannot use a channel blanket as an emergency Wi-Fi network.
Do not set this item to "Emergency mode only" for the radio used for channel blanket.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R:
  Specify "Within AP" to block communication between wireless clients connected to all VAPs within the AP, use "Within VAP" to block communication between wireless clients connected to the same VAP, or use "Disabled" to not block communication. The default is "Disable".
  When this product is set to "Disabled", you can select "Within AP", "Within VAP", or "Disabled" for each VAP in "Wireless Client Isolation" in the VAP (Multiple SSID) settings. When this item is set to "Within AP" or "Within VAP", only "Within AP" or "Within VAP" will be displayed in "Wireless Client Isolation" in the VAP (Multiple SSID) settings, respectively.
  
  
• AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402:
  Select "Disable" to allow communications between wireless clients. Otherwise select "Enable". The default is "Disable".
  When this is set to "Disable", you can select "Enable" or "Disable" for each VAP in "Wireless Client Isolation" in the VAP (Multiple SSID) settings. Setting this as "Enable" will activate Wireless Client Isolation for all VAPs, which blocks the communications between the clients connecting to the same VAP.
  
  
• Others:
  Select "Disable" to allow communications between wireless clients. Otherwise select "Enable". The default is "Disable".
  Setting this as "Enable" will activate Wireless Client Isolation for all VAPs, which blocks the communications between the clients connecting to the same VAP.
  Per-VAP setting can not performed.
  

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R
  Choose from the following three options.
  
  • Select "Manual" to set the priority airtime to be allocated to each VAP in the VAP (Multiple SSID) configuration.
    All associated clients of a VAP are provided with airtime, divided "Pre-allocated Airtime Percentage" equally with the clients.
    The airtime of each VAP in the same radio band must be set so that the total airtime does not exceed 100%.
    The remaining bandwidth, that the whole bandwidth minus the airtime allocated in priority to each VAP in the same radio band, is pro rata according to the ratio of airtime allocated. This means that a VAP with an airtime allocation rate of 0% will not be able to communicate when the total airtime consumed by other VAPs reaches 100%.
    
  • Select "Evenly" to provide equal airtime to all connected clients in the radio band.
    
  • If "Disable" is selected, no airtime adjustment is provided to connected clients.
    If a slow wireless client and a fast wireless client try to receive large amounts of data at the same time, more time may be allocated to the slow wireless client, depriving the fast wireless client of communication opportunities and slowing down the entire network.
    

  Note

  To use the manual setting of airtime fairness, the AP must have the following firmware applied:
  

  • TQ6403 GEN2 and TQm6403 GEN2 Firmware Version 9.0.4-0.1 or later
    
  • TQ6602 GEN2, TQ6702 GEN2, TQm6602 GEN2, and TQm6702 GEN2 Firmware Version 8.0.4-1.1 or later
    
  • TQ6702e GEN2 Firmware Version 9.0.4-3.1 or later
    
  • TQ7403 Firmware Version 10.0.4-0.1 or later
    
  • TQ6702 GEN2-R AlliedWare Plus Firmware Version 5.5.4-2.1 or later
    
  • TQ7403-R AlliedWare Plus Firmware Version 5.5.4-2.1 or later
    

• AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402
  
  • Selecting "Enable" provides equal airtime to all connected clients in the radio band.
    
  • If "Disable" is selected, no airtime adjustment is provided to connected clients.
    If a slow wireless client and a fast wireless client try to receive large amounts of data at the same time, more time may be allocated to the slow wireless client, depriving the fast wireless client of communication opportunities and slowing down the entire network.
    

Note

The Preferred Scanning Channels (PSCs) refer to the channel on which the wireless client performs a preferred active scan to detect wireless APs on the 6 GHz band.

PSC: 5ch, 21ch, 37ch, 53ch, 69ch, 85ch

Priority is given to scanning PSCs in the 6 GHz band due to the large number of available channels.
Using anything other than PSC is not recommended because some wireless clients may not be able to detect the wireless AP or may cause connectivity problems.

• AT-TQ7613
  Specify a number between 0 to 500. The default is 500.
  
  
• AT-TQ3403 / AT-TQm3403
  Specify a number between 0 to 128. The default is 128.
  
  
• AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2
  Radio 1/2: Specify a number between 0 to 500. The default is 500.
  Radio 3: Specify a number between 0 to 256. The default is 256.
  
  
• AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702 GEN2-R
  Specify a number between 0 to 500. The default is 500.
  
  
• TQ6602
  Specify a number between 0 to 320. The default is 200.
  
  
• AT-TQ1402 / AT-TQm1402
  Radio 1: Specify a number between 0 to 120. The default is 120.
  Radio 2: Specify a number between 0 to 200. The default is 200.
  
  
• Other than above
  Specify a number between 0 to 200. The default is 200.
  

• 2.4GHz:
  54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)
  

  Note

  If the model is set to AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, or AT-TQ1402 / AT-TQm1402, for IEEE 802.11b wireless client communication, any one or more of 11, 5.5, 2 or 1 (Mbps) out of the above must be enabled.
  If the model is AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, or AT-TQ6702 GEN2-R, there is no restriction that one or more of 11, 5.5, 2, or 1 (Mbps) must be enabled. However, if all of these are set to disabled, IEEE 802.11b clients cannot connect.
  

• 5GHz:
  54 48 36 24 18 12 9 6 (Mbps)
  

• AT-TQ7613, AT-TQ3403 / AT-TQm3403
  
  • Radio 1:
    11 5.5 2 1 (Mbps)
    
  • Radio 2 and Radio 3:
    24 12 6 (Mbps)
    
  
  
• AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R
  
  • Radio 1:
    54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)
    
  • Radio 2 and Radio 3:
    24 12 6 (Mbps)
    
  
  
• AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402
  
  • Radio 1:
    54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)
    
  • Radio 2 and Radio 3:
    54 48 36 24 18 12 9 6 (Mbps)
    

Note

If you select "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e" or "AT-TQ1402 / AT-TQm1402" as the Model, and "IEEE 802.11a/n/ac" as the Mode in Radio Configuration, RTS packets are not sent to wireless clients connected by IEEE 802.11a. This setting is ignored.

• When enabled, the AP encourages clients supporting both 2.4GHz and 5GHz to prefer a less congested frequency in order to reduce overall congestion.
  
  
• When disabled, the AP doesn't encourage clients to use other frequencies. In that case, a client keeps using the same band with which they connect, even if the client supports both 2.4GHz and 5GHz and the other band is less crowded.
  

Note

Band Steering cannot be used with channel blanket. Disable Band Steering on the AP Profile for APs using channel blanket.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

Note

To use IEEE 802.11n IEEE 802.11ac or IEEE 802.11ax, this must be enabled.

• TQ6602:
  Enable
  
  
• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402:
  Disable
  

Note

This item is displayed when "AT-TQ613", "AT-TQ3403 / AT-TQm3403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

• Scan Method
  
• Scan Interval
  
• Scan Duration
  
• Scan Data Keep Time
  

Note

If Neighbor AP Detection is supported on the management web interface of the AP system and set to "Enable" in the AWC Plug-in management, the Neighbor AP Detection setting will remain as "Enable". This is supported on TQ5403, TQ5403e and TQm5403 with firmware version 5.3.1 or later, TQ1402 and TQm1402 with firmware version 6.0.0-0.2 or later, and TQ6602 with firmware version 7.0.0 or later.
If Neighbor AP Detection is not supported on the management web interface of the AP system, this feature is disabled in the AWC Plug-in management.

Note

When neighbor APs are detected on TQ6602 GEN2/6702 GEN2 and TQm6602 GEN2/6702 GEN2, packet loss or communication delay shorter than 3 seconds (firmware version 8.0.3-0.1 or later) or 10 seconds (firmware version 8.0.2-x.x or earlier) may occur repeatedly up to 4 times, for approximately 20 seconds total. In environments where temporary performance degradation is unacceptable, disable neighbor AP detection in the AP profile for Model "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2".
If the Neighborhood AP Detection feature is disabled, the following features of the AWC plug-in are affected:

• AWC calculation cannot select channels that take into account the signal conditions of unmanaged APs.
  
• Intrusion detection function is not available.
  

Note

This item is displayed when selected "AT-TQ7613", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", or "AT-TQ6602" as the Model, and the options including "ac" or "ax" as the Mode in Radio Configuration section.

Note

This item is displayed when selected "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", or "AT-TQ6022 as the Model, and the options including "ax" as the Mode in Radio Configuration section.

Note

This setting is displayed when selected "AT-TQ6702 GEN2 / AT-TQ6602 GEN2 / AT-TQ6702e GEN2", "AT-TQ6702e GEN2", or "AT-TQ6702 GEN2-R" as AP Model, and Radio Band as "Radio 2". Other Models will not show this setting.

Note

This setting appears only when AP Model is selected as "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2" and Radio Band as "Radio 2". Other Models will not show this setting.

• All Channels
  Runs all channels in the selected Radio for Neighbor AP Detection.
  This is the same method as the conventional Neighbor AP Detection. Neighbor AP detection stops its own radio output and detects the presence of surrounding radio output. While it can detect the presence of Neighbor APs even if they are using different channels, it requires longer outage time than when detecting Neighbor APs on only one channel, resulting in packet loss and communication delays.
  In environments where transient performance degradation is not tolerable, specify scanning of only one channel or set the neighbor AP detection function itself to disabled.
  Note that if the Neighbor AP Detection function is disabled, the following functions of the AWC Plug-in will be affected:
  
  • AWC calculation cannot select channels that take into account the signal conditions of unmanaged APs.
    
  • Intrusion detection function is not available.
    
  
  
• One Channel
  Neighbor AP Detection is performed one channel at a time across all channels in the same band, based on the scan interval and scan duration.
  It takes time to scan all channels, but the duration per scan is shorter.
  In the initial stage of AWC calculation, data collection takes time. However, since the calculation uses information from the past 24 hours, the accuracy becomes consistent over time regardless of whether All Channels or a Single Channel is selected.
  

  Note

  To use this setting, the AP must have one of the following firmware applied:
  

  • TQ7403 Firmware Version 10.0.4-3.1 or later
    
  • TQ6403 GEN2 and TQm6403 GEN2 Firmware Version 9.0.4-3.1 or later
    
  • TQ6602 GEN2, TQ6702 GEN2, TQm6602 GEN2, and TQm6702 GEN2 Firmware Version 8.0.4-1.1 or later
    
  • TQ6702e GEN2 Firmware Version 9.0.4-3.1 or later
    

• AT-TQ7613, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2
  16 VAPs per band (Radio 1, Radio 2, Radio 3)
  
• AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R, AT-TQ6602
  16 VAPs per band (Radio 1, Radio 2)
  
• AT-TQ3403 / AT-TQm3403, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402
  8 VAPs per band (Radio 1, Radio 2, Radio 3)
  

Note

It is recommended to use 5 or less VAPs per radio band in total, including both multi-channel and blanket VAPs.

• When set to Enabled, the VAP is always used on the APs to which this AP Profile is applied.
  
• When set to Disabled, the VAP is not used.
  
• When set to Emergency, the VAP becomes active only when the Emergency Mode is enabled in the management group.
  

Note

Emergency Mode cannot be used with channel blanket. You cannot use a channel blanket as an emergency Wi-Fi network.
Do not set this item to "Emergency" for the VAP whose number is the same as the CB VAP (VAP for channel blanket).

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

Note

Specify a VLAN ID that is different from the AP's management VLAN. When the AP is detected as a guest device, a parent AMF device is configured to collect the guest device information automatically ("dynamic discovery"), and wireless clients get their IP addresses via DHCP.

• When enabled, the SSID is included in beacons. When you configure a wireless client, you may be able to see the SSID in a list of wireless networks to connect. This setting also allows wireless clients to connect using an "ANY" connection.
  
  
• When disabled, the SSID is not included in beacons. You may not be able to see the SSID in a wireless network list on a wireless client. In this case, you have to enter the same SSID as the AP on a wireless client. This setting also denies wireless clients from connecting using an "ANY" connection.
  

Note

An "ANY" connection is a connection where a wireless client tries to connect to an AP by specifying a wildcard or null as the SSID. Even when an "ANY" connection is allowed, clients cannot connect to APs without knowing the correct security key.

• None:
  No authentication or encryption is performed. Everyone can connect to the VAP.
  

  Note

  If you use "None" to build a network such as a guest hotspot, you should consider the consequences for the overall security of your entire network.

  
  
• Static WEP:
  Uses RC4 encryption with fixed keys. Per-client authentication is not performed. We recommend using "WPA Personal" for fixed key security because WEP is vulnerable.
  

  Note

  "Static WEP" is not displayed when the selected Mode contains "IEEE 802.11n". This can be configured only on VAP 1 of each radio.

  Note

  "Static WEP" can be configured on VAP1 of each radio, only when "b/g" or "a" is specified as Mode.

  
  
• Enhanced Open:
  Open authentication enables connection to the network without entering a user ID or password, but after open authentication, data between the AP and client is encrypted using the Opportunistic Wireless Encryption (OWE) protocol (128-bit CCMP/AES).
  

  Note

  The "Enhanced Open" option is only displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403" or "AT-TQ6702 GEN2-R" is selected as the Model.

  
  
• Enhanced Open Transition Mode:
  Uses VAP1 and VAP2 in a mode that can be configured without concern for whether the wireless client supports Enhanced Open or not. Enhanced Open-enabled clients communicate with the product using VAP2 encrypted with the OWE protocol after open authentication, while Enhanced Open-unenabled clients communicate with the product using VAP1 without OWE encryption after open authentication.
  

  Note

  When VAP1 security is set to "Enhanced Open Transition Mode", VAP2 security will be also set to "Enhanced Open Transition Mode" and the VAP status will be "Enabled". In this case, the VAP2 broadcast is also set to "Disable".

  Note

  The "Enhanced Open Transition Mode" is only displayed in Radio 1 and Radio 2 when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403" or "AT-TQ7403-R" for the Model.

  
  
• WPA Personal:
  Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated from a pre-shared key (PSK). It uses CCMP (AES) or TKIP for the encryption algorithm.
  
  
• WPA Enterprise:
  Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated on a RADIUS server. It uses CCMP (AES) or TKIP for the encryption algorithm.
  
  
• OSEN:
  Used by the VAP for online sign-up and to configure security settings when communicating with the OSU server.
  

  Note

  The "OSEN" option is only displayed when "AT-TQ5403 / AT-TQm5403" or "AT-TQ5403e" is selected as the Model.

Note

For the model "AT-TQ7613", when a mode including IEEE 802.11be is selected, the security setting must be either "Enhanced Open", "WPA Personal", or "WPA Enterprise". VAPs that do not meet the security requirements of Wi-Fi 7 operate using IEEE 802.11ax.

• External RADIUS:
  The APs will query the RADIUS server.
  
  
• Click-through:
  The APs will display a Click-through page instead of performing RADIUS authentication. The Click-through page does not require authentication with a username/password, but can be configured to show an arbitrary "Terms of Use" that users have to accept before use, or to redirect to an external page.
  
  
• External Page Redirect:
  The clients will be able to connect using third-party web credentials such as social networking sites.
  
  
• Disable:
  Select to not use Captive Portal.
  

Note

"External Page Redirect" is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

Note

You can not enable Captive Portal on the radio used for the WDS connection.

• MAC Address List:
  Selecting this option will allow or deny connections only to the MAC addresses recorded in the list, according to the MAC address list selected in the MAC Address List field at the top of the screen.
  
  
• External RADIUS:
  The APs will query the RADIUS server.
  
  
• MAC Address List + External RADIUS:
  Selecting this option allows or denies connections only to the MAC addresses recorded in the list. This list refers to both the MAC address list selected in the MAC address list field at the top of the screen and the external RADIUS server.
  Firstly, it will try to authenticate using the MAC address list. If a connection cannot be established, it will try to authenticate using an External RADIUS server. If the preceding MAC address list allows a user to connect, the user can still connect even if the external RADIUS server does not grant the access.
  
  
• AMF Application Proxy:
  Selecting "AMF Application Proxy" allows you to query the whitelist and blacklist of our AMF-SECurity Controller AT-SecureEnterpriseSDN Controller (AT-SESC) or AMF Security mini. You can then take actions such as allowing, denying or quarantining client devices that attempt to connect to the wireless AP, disconnecting connected devices or changing VLANs.
  
  
• Disable:
  No MAC access control is performed.
  

Note

"MAC Address List" and "MAC Address List + External RADIUS" are only available when any of MAC Address List is selected in the "Basic Configuration" section.

Note

"MAC Address List + External RADIUS" is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

Note

"AMF Application Proxy" is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

Note

This item is displayed when "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model. Take note that "AT-TQ1402 / AT-TQm1402" does not support the Area Authentication in this version.

Note

To use the Area Authentication on a VAP defined in a AP Profile, the following conditions must be met:

• "Location Estimation" in History Data Retention Period Setting is set effectively in the System Setting screen.
  
• AP profile including area authentication enabled is applied to the supported AP in the installed area, and channel blanket is operated.
  
• Wireless client has requested connection to the CB VAP of the corresponding channel blanket.
  

For more details about channel blanket and floor map, refer to Operation Reference > Floor Map > Configure Floor Maps and Operation Reference > Channel Blanket > Overview respectively.

Note

Area Authentication cannot be used in combination with MAC Access Control.

• 802.11r FT
  
• FT over DS
  
• Mobility Domain
  
• R0 key Lifetime
  
• AES Key
  
• IEEE 802.11k RRM
  
• IEEE 802.11v WNM
  

Note

This item is displayed when "WPA Personal", "WPA Enterprise", or "OSEN" is selected for "Security" of the VAP.
Only "Disable" is available when you select "AT-TQ602" for the Model, and "WPA2/WPA3" or "WPA3" for WPA versions.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R:
  
  • If "Wireless Client Isolation" for the entire radio is set to "Within AP" or "Within VAP", only the same option as selected will be displayed in this field.
    
  • If Wireless Client Isolation for the entire radio is set to "Disable", you can specify whether or not to allow communication between wireless clients in individual VAPs in this field.
    Specify "Within AP" to block communication between wireless clients connected to all VAPs within the AP, use "Within VAP" to block communication between wireless clients connected to the same VAP, or use "Disabled" to not block communication.
    The default is "Disable".
    
  
  
• AT-TQ5403 / AT-TQm5403, AT-TQ5403e:
  
  • If "Wireless Client Isolation" for the entire radio is set to "Enable", only "Enable" will be displayed in this field.
    
  • If Wireless Client Isolation for the entire radio is set to "Disable", you can specify whether or not to allow communication between wireless clients in individual VAPs in this field. Select "Disable" to allow communications between wireless clients connected to the same VAP. Otherwise select "Enable".
    The default is "Disable".
    

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

Note

This feature cannot be used with the OpenFlow feature. Use the default setting.

Note

If you select "AT-TQ6602" for the Model, the setting of this item in any VAP will take effect on the VAPs in the same radio band.

Note

If you select "AT-TQ1402 / AT-TQm1402" for the Model, this setting is not supported for Radio 1. Use the default setting.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

Note

This feature cannot be used with the OpenFlow feature. Use the default setting.

Note

When "Management Frame Protection" is set to "Enable", "Disconnect" is used regardless of this item's setting.

Note

To make this function take effect, APs on the same subnet must have "Roaming Notification" set to "Enable" for each other.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

• If enabled, when a managed wireless AP receives an ARP request for a connected client, the wireless AP that has a connection to the client will send an ARP response on behalf of the client. The wireless AP that does not have a connection to the client will discard the ARP request, thereby reducing unnecessary traffic.
  If you select "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2" or "AT-TQ6702e GEN2" as the Model, the following items are additionally displayed.
  
  
  • Transmit Unlearned ARP Packet
    
  
  For APs other than those listed above, when Proxy ARP is enabled, unlearned ARP packets are discarded as same as when "Transmit Unlearned ARP Packet" is disabled.
  For more details, refer to Additional Options for Proxy ARP.
  
  
• If you select "Disable", Proxy ARP will not be activated. That means ARP requests are broadcasted from all wireless APs to their subordinate clients. The corresponding clients send ARP responses themselves.
  The default is "Disable".
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

Note

Enabling this function may result in reduced throughput.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", or "AT-TQ6702 GEN2-R" is selected as the Model.

Note

This item is displayed when selected "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", or "AT-TQ6702 GEN2-R" as the Model, and "Manual" as the Airtime Fairness in Radio Configuration section.

Note

This setting is displayed when "AT-TQ7403-R" or "AT-TQ6702 GEN2-R" is selected as the Model.

Note

To enable Passpoint, WPA Enterprise must be used as security mode. When enabling this item, confirmation dialog will appear asking if you allow to change the security mode to WPA Enterprise to continue Passpoint setting.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

• 64bit:
  You can directly enter a WEP key with 10 hex digits. Or you can enter 5 ASCII characters to automatically generate a WEP key.
  
• 128bit:
  You can directly enter a WEP key with 26 hex digits. Or you can enter 13 ASCII characters to automatically generate a WEP key.
  

• ASCII:
  Lets you enter an arbitrary string to automatically generate a WEP key. The string is case-sensitive.
  
• Hex:
  Lets you directly enter a WEP key with hexadecimal characters (0 to 9, A to F, a to f). Hex characters are not case-sensitive.
  

• Open System:
  All wireless clients are allowed to connect regardless of whether they have the correct WEP key. But as wireless clients are only allowed to connect, they cannot communicate without a valid WEP key.
  This option is not only for "WEP" but is also used for "None", "WPA Personal" and "WPA Enterprise".
  
• Shared Key:
  Only wireless clients with the correct WEP key can connect. Wireless clients cannot connect without a valid key.
  

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R:
  
  • WPA3
    
  • WPA3 / WPA2
    
  • WPA2
    
  • WPA2 / WPA
    
• AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e:
  
  • WPA3
    
  • WPA2
    
  • WPA2 / WPA
    
• AT-TQ1402 / AT-TQm1402:
  
  • WPA2
    
  • WPA2 / WPA
    

Note

For the model "AT-TQ7613", when a mode including IEEE 802.11be is selected, the WPA Version must be either "WPA3", or "WPA3 / WPA2". VAPs that do not meet the security requirements of Wi-Fi 7 operate using IEEE 802.11ax.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R, AT-TQ5403 / AT-TQm5403, AT-TQ5403e
  The following configuration can be set depending on the choice of WPA version.
  
  
  • WPA3: Fixed to "Required".
    
  • Both WPA3 and WPA2: Fixed to "Capable".
    
  • WPA2: Select from "Capable" or "Disable". The default is "Capable".
    
  • Both WPA2 and WPA: Fixed to "Disable".
    
  
  
• AT-TQ6602, AT-TQ1402 / AT-TQm1402
  Select "Enable" to use MFP. Otherwise select "Disable". The default is "Enable".
  

Note

This setting is displayed when Model other than "AT-TQ6602" is selected.

Note

If "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ5403 / AT-TQm5403", or "AT-TQ1402 / AT-TQm1402" is selected as the Model, this item can be set only for the VAP 1 on each radio band. When you select "Enable", this function is valid for all VAP.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R:
  
  • WPA3
    
  • WPA3 / WPA2
    
  • WPA2
    
  • WPA2 / WPA
    
• AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e:
  
  • WPA3
    
  • WPA2
    
  • WPA2 / WPA
    
• AT-TQ1402 / AT-TQm1402:
  
  • WPA2
    
  • WPA2 / WPA
    

Note

For the model "AT-TQ7613", when a mode including IEEE 802.11be is selected, the WPA Version must be either "WPA3", or "WPA3 / WPA2". VAPs that do not meet the security requirements of Wi-Fi 7 operate using IEEE 802.11ax.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R, AT-TQ5403 / AT-TQm5403, AT-TQ5403e
  The following configuration can be set depending on the choice of WPA version.
  
  
  • WPA3: Fixed to "Required".
    
  • Both WPA3 and WPA2: Fixed to "Capable".
    
  • WPA2: Select from "Capable" or "Disable". The default is "Capable".
    
  • Both WPA2 and WPA: Fixed to "Disable".
    
  
  
• AT-TQ6602, AT-TQ1402 / AT-TQm1402
  Select "Enable" to use MFP. Otherwise select "Disable". The default is "Enable".
  

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model. TQ1402 and TQm1402 have this setting item, but are not supported.

• When the secondary RADIUS server is not used and the number of RADIUS Retransmit is set to "4":
  The primary RADIUS server is attempted a maximum of 5 authentication requests (first time and 4 retransmissions). Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout must be set to "5" or less.
  
• When using the both primary/secondary RADIUS servers and setting the number of RADIUS Retransmit to "2":
  Three authentication requests (the first attempt and two retries) are attempted for each RADIUS server, for a total of up to 6 authentication requests. Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout should be set to "4" or less.
  

Note

This item is displayed when "TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model.

Note

This item is displayed when "TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model.

Note

This item is displayed when "TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model.

• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403, AT-TQ7403-R, AT-TQ6403 GEN2 / AT-TQm6403 GEN2, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2, AT-TQ6702 GEN2-R, AT-TQ6602
  The default is "Disable".
  
• AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402
  The default is "Enable".
  

Note

This can be configured only on VAP1 of each radio. When you select "Enable", this function is valid for all VAP.

Note

WPA is based on a draft of IEEE 802.11i while WPA2 is based on the final version of IEEE 802.11i and therefore meets all mandatory items required by the standard.

Note

According to the WPA standard, TKIP is mandatory while CCMP is optional. Our products implement both algorithms.

Note

If the WPA version includes "WPA3", only "CCMP" can be selected. "TKIP" is not displayed.

Note

If the WPA version is set to "WPA2", or both "WPA2" and "WPA", "TKIP" can be selected as necessary.

• WPA3: Fixed to "Required".
  
• Both WPA3 and WPA2: Fixed to "Capable".
  
• WPA2: Select from "Capable" or "Disable". The default is "Capable".
  
• Both WPA2 and WPA: Fixed to "Disable".
  

Note

If the Model is set to "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", and the WPA version is set to "WPA2" solely, please do not set to "Required".

• Enable:
  shows an external authentication page. Specify the page URL in "Base URL".
  
  • Base URL:
    Specify the base URL of the external web authentication page.
    Clients will access the page through the AP's proxy feature instead of direct connection.
    The HTML filename of the external authentication page must be "radius_login.html".
    The AP's proxy will get the page from "Base URL/radius_login.html" and send it back to clients.
    For example, when you specify "http://www.example.com/captive_portal" in "Base URL", the APs will present the content of the page at "http://www.example.com/captive_portal/radius_login.html" to connecting clients.
    For details of the format of radius_login.html, refer to Operation Reference > Authentication > Web Authentication with Captive Portal.
    
• Disable:
  Shows an authentication page embedded in the APs.
  When "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model, set the Authentication Page Language in addition.
  
  • Authentication Page Language:
    Select the display language of the authentication page from "Japanese" or "English". The default is "English".
    

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not treated as mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model. TQ1402 and TQm1402 have this setting item, but are not supported.

• Enable:
  Uses RADIUS Accounting. With an external RADIUS server that has authenticated the user, it is possible to record the resources (such as connection time) used by each user during the session. You can also use features such as those provided by external RADIUS. Specify the "RADIUS accounting port" in addition.
  
  • RADIUS Accounting Port Number:
    Enter the port number of the accounting port of the external RADIUS server in the range 0-65535. The default is 1813.
    
• Disable: Does not use RADIUS Accounting.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL:
  Always show a fixed URL that you specify. Should be 1 to 128 characters in length, with alphabets, numbers and symbols (including spaces).
  
• Disable:
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    When "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", or "AT-TQ6702 GEN2-R" is selected as the Model, one asterisk (*) can be used as a wildcard when specifying the FQDN in the walled garden entry.
    For instance, using an asterisk wildcard in the front of "*.example.jp" will get hits for "www.example.jp", as well as "ftp.example.jp", etc. Similarly, "example.*", with the wildcard at the end, will get hits for "example.com", as well as "example.jp", etc. Up to one wildcard may be used per entry. Multiple wildcards (e.g., "*.example.*") are not allowed.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address:
    Shows a list of registered addresses that contain the input string.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

• "Enable" or "Disable" can be selected if none of the walled garden entries have been registered using wildcards. The default is "Disable".
  
• If at least one wildcard is used in a walled garden entry, it is fixed as "Enable".
  

Note

This setting is displayed when "AT-TQ7403", "AT-TQ6702 GEN2 / AT-TQ6602 GEN2 / AT-TQ6702e GEN2" or "AT-TQ6702 GEN2-R" is selected as Model.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

• Enable:
  shows an external authentication page. Specify the page URL in "Base URL".
  
  • Base URL:
    Specify the base URL of the external web authentication page.
    Clients will access the page through the AP's proxy feature instead of direct connection.
    The HTML filename of the external authentication page must be "radius_login.html".
    The AP's proxy will get the page from "Base URL/radius_login.html" and send it back to clients.
    For example, when you specify "http://www.example.com/captive_portal" in "Base URL", the APs will present the content of the page at "http://www.example.com/captive_portal/radius_login.html" to connecting clients.
    For details of the format of radius_login.html, refer to Operation Reference > Authentication > Web Authentication with Captive Portal.
    
• Disable:
  Shows an authentication page embedded in the APs.
  If "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ702e GEN2" is selected as the Model, specify the Authentication Page Language and Agreement Message in addition.
  
  • Authentication Page Language:
    Select the display language of the authentication page from "Japanese" or "English". The default is "English".
    
  • Agreement Message:
    Create the text of the Terms of Use to be displayed on the AP's authentication page with a maximum length of 1,024 characters.
    Each line break counts as four characters.
    Formatting (font size, color, etc.) is not available.
    

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ602", "AT-TQ5403 / AT-TQm5403", "AT-TQ5403e", or "AT-TQ1402 / AT-TQm1402" is selected as the Model.

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL:
  Always show a fixed URL that you specify. Should be 1 to 128 characters in length, with alphabets, numbers and symbols (including spaces).
  
• Disable:
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    When "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", or "AT-TQ6702 GEN2-R" is selected as the Model, one asterisk (*) can be used as a wildcard when specifying the FQDN in the walled garden entry.
    For instance, using an asterisk wildcard in the front of "*.example.jp" will get hits for "www.example.jp", as well as "ftp.example.jp", etc. Similarly, "example.*", with the wildcard at the end, will get hits for "example.com", as well as "example.jp", etc. Up to one wildcard may be used per entry. Multiple wildcards (e.g., "*.example.*") are not allowed.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address:
    Shows a list of registered addresses that contain the input string.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

• "Enable" or "Disable" can be selected if none of the walled garden entries have been registered using wildcards. The default is "Disable".
  
• If at least one wildcard is used in a walled garden entry, it is fixed as "Enable".
  

Note

This setting is displayed when "AT-TQ7403", "AT-TQ6702 GEN2 / AT-TQ6602 GEN2 / AT-TQ6702e GEN2" or "AT-TQ6702 GEN2-R" is selected as Model.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not treated as mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model. TQ1402 and TQm1402 have this setting item, but are not supported.

• Enable:
  Uses RADIUS Accounting. With an external RADIUS server that has authenticated the user, it is possible to record the resources (such as connection time) used by each user during the session. You can also use features such as those provided by external RADIUS. Specify the "RADIUS accounting port" in addition.
  
  • RADIUS Accounting Port Number:
    Enter the port number of the accounting port of the external RADIUS server in the range 0-65535. The default is 1813.
    
• Disable:
  Does not use RADIUS Accounting.
  

• Keep Session:
  Show the original URL that was entered in the client's browser before web authentication.
  
• Fixed URL:
  Always show a fixed URL that you specify. Should be 1 to 128 characters in length, with alphabets, numbers and symbols (including spaces).
  
• Disable:
  Do not redirect the browser after successful web authentication.
  

• Walled Garden List
  You can register addresses to use the Walled Garden feature.
  
  • Address:
    The address of the site that is accessible from inside the Walled Garden, in the form of an FQDN, an IP address or an IP address/mask. Max 50 entries can be registered.
    When "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", or "AT-TQ6702 GEN2-R" is selected as the Model, one asterisk (*) can be used as a wildcard when specifying the FQDN in the walled garden entry.
    For instance, using an asterisk wildcard in the front of "*.example.jp" will get hits for "www.example.jp", as well as "ftp.example.jp", etc. Similarly, "example.*", with the wildcard at the end, will get hits for "example.com", as well as "example.jp", etc. Up to one wildcard may be used per entry. Multiple wildcards (e.g., "*.example.*") are not allowed.
    
  • "Add" button:
    Registers the address entered in the Address field to the list.
    
  • "Clear" button:
    Deletes the entry of the Address field.
    
  • "Import from CSV file" button:
    Imports the addresses from a CSV file.
    The CSV file can contain one address per line, described in one of the following formats: FQDN, IP address or IP address/mask.
    
  • X Address:
    Shows the number of address entries registered to the list.
    
  • Search Walled Garden Address:
    Shows a list of registered addresses that contain the input string.
    
  • Address:
    Shows an address entry.
    
  • Delete:
    Deletes the selected entry.
    
  • "Save" button:
    Saves changes to the Walled Garden List.
    
  • "Close" button:
    Discard the changes to the Walled Garden List and close the Walled Garden List dialog box.
    

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

• "Enable" or "Disable" can be selected if none of the walled garden entries have been registered using wildcards. The default is "Disable".
  
• If at least one wildcard is used in a walled garden entry, it is fixed as "Enable".
  

Note

This setting is displayed when "AT-TQ7403", "AT-TQ6702 GEN2 / AT-TQ6602 GEN2 / AT-TQ6702e GEN2" or "AT-TQ6702 GEN2-R" is selected as Model.

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6602", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.
This item is displayed if you select "AT-TQ1402 / AT-TQm1402" as the Model, however, it is not supported.

• AT-TQ7403, AT-TQ6403 GEN2 / AT-TQm6403, AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2, AT-TQ6702e GEN2:
  A separate MAC Address List can be selected for each VAP.
  When you click the dropdown list, the "Select MAC Address List" dialog box will appear.
  
  Refer to Configure MAC Address List for detailed instructions on how to create a MAC Address List.
  
  
• AT-TQ7613, AT-TQ3403 / AT-TQm3403, AT-TQ7403-R, AT-TQ6702 GEN2-R, AT-TQ6602, AT-TQ5403 / AT-TQm5403, AT-TQ5403e, AT-TQ1402 / AT-TQm1402:
  Shows the name of the "MAC Address List" selected in the AP Profile's "System" section.
  

  Note

  You cannot use a different MAC Address List for each radio or VAP. A single list is used for all radios (Radio 1/Radio 2/Radio 3) and VAPs in an AP Profile.

• When you select "Enable", only the wireless clients which have been successful with both Captive Portal and MAC Access Control authentication will be able to communicate via the relevant VAP.
  
• When you select "Disable", the wireless clients which have been successful through either MAC Access Control or Captive Portal will be able to communicate via the relevant VAP.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not treated as mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model. TQ1402 and TQm1402 have this setting item, but are not supported.

• When the secondary RADIUS server is not used and the number of RADIUS Retransmit is set to "4":
  The primary RADIUS server is attempted a maximum of 5 authentication requests (first time and 4 retransmissions). Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout must be set to "5" or less.
  
• When using the both primary/secondary RADIUS servers and setting the number of RADIUS Retransmit to "2":
  Three authentication requests (the first attempt and two retries) are attempted for each RADIUS server, for a total of up to 6 authentication requests. Therefore, to keep the entire authentication session within 29 seconds, the RADIUS Timeout should be set to "4" or less.
  

Note

This item is displayed when "TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model.

Note

This item is displayed when "TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model.

Note

This item is displayed when "TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", or "AT-TQ6702e GEN2" is selected as the Model.

• If you select "Fixed Password", a string specified in "User-Password Format Password" is always used as the value of the User-Password attribute.
  
• If you select "User Name", the same string as the User-Name attribute (MAC Address) is sent to the RADIUS server as the value of the User-Password attribute.
  

Note

This item is displayed when "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", or "AT-TQ6702 GEN2-R" is selected as the Model.

• When you select "Enable", only the wireless clients which have been successful with both Captive Portal and MAC Access Control authentication will be able to communicate via the relevant VAP.
  
• When you select "Disable", the wireless clients which have been successful through either MAC Access Control or Captive Portal will be able to communicate via the relevant VAP.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

Note

This setting is displayed when "AT-TQ7403-R" or "AT-TQ6702 GEN2-R" is selected as the Model, and "STOAT" in the Basic Configuration is enabled.

Note

This setting is displayed when "AT-TQ7403-R" or "AT-TQ6702 GEN2-R" is selected as the Model, and "STOAT" in the Basic Configuration is enabled.

Note

This setting is displayed when "AT-TQ7403-R" or "AT-TQ6702 GEN2-R" is selected as the Model, and "STOAT" in the Basic Configuration is enabled.

• When set to "Enable", you can specify the URL to which the wireless client detected as a suspected node by the IP Filter action is forwarded in the External page URL field that is displayed additionally.
  
• When set to "Disable", the Redirect-URL function is not used. The suspected node will not be allowed to connect to any page.
  

Note

Web page used in Redirect-URL should not be placed on a server that handles sensitive information.
When a Redirect-URL is used, the host (IP address or domain) specified in the "External Page URL" will be registered in the walled garden information inside the wireless AP.
Thus, even a suspected node that has not been authenticated can browse to any page on the server to which it has been redirected by entering the path in the address field of its Web browser.

Note

This item is displayed when "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

Note

Redirect-URL cannot be used in conjunction with Captive Portal.

Note

If the suspected node uses HTTPS instead of HTTP for access, the user of the node may see screens such as "Your connection is not private", "Your connection is not secure", "Connect to Wi-Fi hotspot", "Connect to Wi-Fi", or "Log in to network". In that case, the user will be redirected to the Redirect-URL page by selecting Refresh, Reload or Connect button on her/his Web browser.
However, due to Web browser specifications, s/he may not be redirected to the Redirect-URL page even if s/he select Refresh or Connect button. In this case, the user will be redirected to the Redirect-URL page by accessing the site via HTTP.

Note

In this version, the secondary AMF Application Server is not available.

Note

In this version, the secondary AMF Application Server is not available.

• Setting it to "Required" always mandates the use of the RADIUS Message-Authenticator attribute to the RADIUS server. In this case, the RADIUS server must support the RADIUS Message-Authenticator attribute.
  
• When set to "Disable", use of the RADIUS Message-Authenticator attribute is not treated as mandatory. If a malicious user forges a RADIUS packet, a unauthorized client could be allowed to connect.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ7403-R", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ6702 GEN2-R", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

• With "Enable" selected, in the event the connection between the AWC Plug-in and AMF Application Proxy server is lost, all new client connection requests will be allowed.
  

  Note

  When using the VAP security method together with AMF Application Proxy, only wireless clients that have successfully authenticated using the security method can communicate.

• When you select "Disable", all new client connection requests will be rejected.
  The clients that are already connected before the connection between the AWC Plug-in and AMF Application Proxy server got lost, can now continue the communication.
  

Note

This item is displayed when "AT-TQ7613", "AT-TQ3403 / AT-TQm3403", "AT-TQ7403", "AT-TQ6403 GEN2 / AT-TQm6403 GEN2", "AT-TQ6702 GEN2 / AT-TQm6702 GEN2 AT-TQ6602 GEN2 / AT-TQm6602 GEN2", "AT-TQ6702e GEN2", "AT-TQ5403 / AT-TQm5403", or "AT-TQ5403e" is selected as the Model.

• When the number of APs using this AP Profile changes, the configuration status of the APs that use this AP Profile becomes "Modified".
  
• If you make a change that affects the number of APs that use this AP Profile on the Wireless Configuration > AP Settings page, a dialog box will ask you whether to apply the configuration to all APs that use this AP Profile.
  If you click "OK", the configuration will be applied to all APs that use this AP Profile.
  

• When enabled, wireless clients send an authentication request to the destination AP via the current (source) AP. (Over The DS.)
  
• When disabled, wireless clients send an authentication request to the destination AP directly over the radio. (Over The Air)
  

Note

Fast roaming with FT over DS enabled is not supported on TQ7403 Radio 3. When "AT-TQ7403" is selected for the Model, set this item to "Disable" to use the Fast Roaming function on Radio 3.

Note

This is mandatory for every function in the "Fast Roaming" section. Configure this item even if you only use IEEE 802.11k or IEEE 802.11v and you are not going to use IEEE 802.11r fast transition.

• DHCP Ack *1
  
• ARP Announcement *2
  
• ARP Probe *2
  
• ARP request *2
  
• ARP reply *2
  

• Private network:
  A network which unauthorized users cannot access.
  
• Private network with guest access:
  A private network that offers guest access to unauthorized users.
  
• Chargeable public network:
  A network that can be accessed by anyone at anytime for a charge. The billing system and other information can be obtained in other ways (IEEE 802.21, http/https redirect or DNS redirection)
  
• Free public network:
  A network that can be accessed by anyone at anytime for free.
  
• Personal device network:
  A network for personal devices such as a camera and printer.
  
• Emergency service-only network:
  A network for limited use for the emergency services (police or fire/disaster management).
  
• Test or experimental:
  A network for testing or experiments.
  
• Wildcard:
  A wildcard access network.
  

• EAP-TLS
  
• EAP-TTLS/MSCHAPv2
  
• EAP-SIM
  
• EAP-AKA
  

Note

Only L2 communication is covered by the protected port. L3 communication through the bridge interface must be controlled by a separate firewall or other means.