User Guide: Vista Manager AWC Plug-in version 3.3.1

Configure AP Profiles

AWC Plug-in > Operation Reference > Wireless Configuration > Configure AP Profiles

Create AP Profile
Edit AP Profile
Copy AP Profile
Delete AP Profile

This section explains how to create, edit, and delete AP Profiles.

Note
For TQ series APs, LLDP, Ethernet and HTTP/HTTPS configuration is only possible from the AP's own management web interface. Please follow the steps described in Configure AP through Its Own Web Interface to perform that configuration.
For detailed explanation on configuring TQ series APs, refer to the "TQ series Reference Manual" on our website.
Note
AP Profile and AP-specific configuration created in the AWC Plug-in are not instantly applied to wireless APs. They will be applied to APs when:

- an AP is put under the AWC Plug-in's control
- a user manually applys configuration
- a scheduled task for applying configuration is run.

Create AP Profile

Note
To monitor an AP, you have to assign an AP Profile to the AP which has been added to the AWC Plug-in's database.
  1. Select "Wireless Configuration" > "AP Profile" from the AWC Plug-in menu.
    The AP Profile list screen will appear.


  2. Click "Add" at the top right of the Content section.

  3. The "Select Country, AP Series and Profile Type" dialog box will appear.


    Table 1: "Select Country Code/AP Series/Settting Type" dialog box
    Item Name Description
    Country
    		 Specify a country code for the AWC Plug-in's AP Profile. It is used to properly configure APs for radio frequency regulation in the country.
    If you have specified a "Country Code" on the Vista Manager EX "User Management" page, the one you chose is selected by default.
    Series
    		 Select an AP series.

    • TQ Series:
      Select this to create an AP Profile for TQ series.

    • MWS-AP Series:
      Note
      After this version, the AWC Plug-in does not support the management of AT-MWS AP series. Please note that the setting functions for the AT-MWS AP series, such as the AP Profile Type, are retained for compatibility with the backup file of the previous version.

    • TQ Series - SDN/OpenFlow
      Select this to create an AP Profile for TQ series that are using SDN/OpenFlow-capable firmware.
    Profile Type
    		 Select a Profile Type to match the model's radio specifications.

    • TQ series
      • Tri[11ac Wave2]
        Select this for TQ5403 and TQm5403.
      • Tri[11ac Wave2] with External Antenna
        Select this for TQ5403e (indoor/outdoor).
      • Dual[11ac Wave2]
        Select this for TQ1402 and TQm1402.
      • Dual[11ac]
        Select this for TQ4400, TQ4600 and TQ4400e (indoor use).
      • Dual[11n]
        Select this for TQ2450, TQ3400 and TQ3600.
      • 11ac with External Antenna
        Select this for TQ4400e (indoor/outdoor).
      • Single
        Select this for TQ3200.

    • TQ series (SDN/OpenFlow-capable firmware)
      • Tri[11ac Wave2]
        Select this for TQ5403 in SDN/OpenFlow-capable mode.
      • Dual[11ac]
        Select this for TQ4400 and TQ4600 using SDN/OpenFlow-capable firmware.
      • Tri[11ac Wave2] with External Antenna
        Select this for TQ5403e (indoor/outdoor) in SDN/OpenFlow-capable mode.
    Location If the Profile Type is "Tri[11ac Wave2] with External Antenna" or "11ac with External Antenna", select Location ("Indoor" or "Outdoor") to place the Wireless APs.
    "OK" button Create an AP Profile of the selected Profile Type.
    "Cancel" button Stop adding an AP Profile.

  4. Select a Country.
    Note
    An AP Profile with a country code other than "JP - Japan" cannot be applied to Japanese models of TQ series.

  5. Select an AP series to configure.

  6. Select a Profile Type that matches the AP model's radio specifications.

  7. If you chose "Tri[11ac Wave2] with External Antenna" or "11ac with External Antenna" in Step 6, in addition to the settings above, select "Location" from "Indoor" or "Outdoor", which is shown below the list.


  8. Click "OK".

  9. The AP Profile configuration page will appear.

    Configuration items of an AP Profile may vary depending on "Series" and "Profile Type". The following image shows a sample AP Profile for "TQ Series" / "Dual[11ac]".


    Table 2: AP Profile
    Item Name Description
    Top of the Screen
    "Radio 1" / "Radio 2" / "Radio 3" buttons
    		 Select a radio to configure in the "Radio Configuration" and "VAP (Multiple SSID) Configuration" sections.
    The following buttons are displayed depending on the Profile Type.

    • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
      • Radio 1: 2.4GHz
      • Radio 2: 5GHz (W52/W53)
      • Radio 3: 5GHz (W56)
    • Dual[11ac Wave2], Dual[11ac], Dual[11n], 11ac with External Antenna
      • Radio 1: 2.4GHz
      • Radio 2: 5GHz (W52/W53/W56)
    • Single
      • Radio 1: select either 2.4GHz or 5GHz (W52) to configure later.
    Profile Configuration
    AP Profile Name Enter a name for the AP Profile. Max 100 characters (mandatory).
    Profile Type Shows the Profile Type you selected in the earlier step.
    Location Shows the Location (indoor/outdoor) you selected in the earlier step (TQ4400e and TQ5403e only).
    Antenna Model Shows the antenna model (TQ4400e only).
    Country Shows the Country Code you selected in the earlier step.
    Series Shows the Series you selected in the earlier step.
    Management Group
    		 Select Management Groups. You cannot uncheck "Default Wireless Group" (mandatory).

    • Search Wireless Management Group: Groups in the list can be filtered by entering a partial name in the search box.
      The Search field lets you enter a partial string to match. The screen displays entries with that string in their name.
      To remove the filter, delete the string from the Search field and press Enter.
      Note
      The search is case-sensitive.
    Basic Configuration
    User Settings
    		 Select whether to configure the username and password for the AP's management web interface in a batch. When the "User Settings" is set as "Enable", the "Username", "Password", "Password (Confirm)", and "AP's User Settings" fields will be shown.
    Note
    These options will be displayed if the Series and the Profile Type of AP Profile are "TQ Series" or "TQ Series - SDN/OpenFlow"; "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" respectively.
    Other APs must be configured individually through AP-specific settings.
    Username
    		 Specify the username used to logon to the AP's management web interface.
    This setting is mandatory when you change "Password". If both "Username" and "Password" are left blank, they will stay at their previous value or the default value.
    1 to 12 characters in length, with letters and digits. Must begin with a letter.
    Note
    These options will be displayed if the Series and the Profile Type of AP Profile are "TQ Series" or "TQ Series - SDN/OpenFlow"; "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" respectively.
    Other APs must be configured individually through AP-specific settings.
    Password
    		 Specify the password used to logon to the AP's management web interface.
    This setting is mandatory when you change "Username". If both "Username" and "Password" are left blank, they will stay at their previous value or the default value.
    Once the Password is set in the AP Profile and not being changed from that, the string "Configured" will be shown in this field.
    0 to 32 characters in length, with letters, digits, and symbols (except SPACE " $ : < > ' & *).
    The password is case-sensitive.
    Each character in the password is represented by a bullet.
    Note
    These options will be displayed if the Series and the Profile Type of AP Profile are "TQ Series" or "TQ Series - SDN/OpenFlow"; "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" respectively.
    Other APs must be configured individually through AP-specific settings.
    Password (Confirm)
    		 Enter the same login password for confirmation. Each character in the password is represented by a bullet.
    Note
    These options will be displayed if the Series and the Profile Type of AP Profile are "TQ Series" or "TQ Series - SDN/OpenFlow"; "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" respectively.
    AP's User Settings
    		 Can prevent changing the user settings per AP by AP-Specific Configuration.
    Checking "Disable" prevents user settings from being overridden by AP-specific settings. Only batch configuration by AP Profile will be available.
    Unchecking "Disable" allows the user settings to be overridden by AP-specific settings.
    By default this option is not checked.
    Note
    These options will be displayed if the Series and the Profile Type of AP Profile are "TQ Series" or "TQ Series - SDN/OpenFlow"; "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", or "Dual[11ac Wave2]" respectively.
    Timezone
    		 Select a timezone.
    The timezone notation varies depending on the AP Profile type.
    • Tri[11ac Wave2], Tri[11ac Wave2] With External Antenna, Dual[11ac Wave2]
      Described as a region name and a city name (e.g. "(UTC+09:00) Asia/Tokyo"). The default is "Not Set".
    • Dual[11ac], Dual[11n], 11ac With External Antenna, Single
      Described as a country name (e.g. "(UTC+09:00) Japan"). By default, it is set to "(UTC+09:00) Japan".
    You can also narrow down the options displayed in the drop-down list by entering a part of the timezone character string in the search field above the drop-down list.
    Note
    Some timezones (e.g. "(UTC+09:00) Asia/Tokyo" and "(UTC+09:00) Japan") don't support Daylight Saving Time.
    Daylight Saving Time If you select a timezone supporting Daylight Saving Time (DST), radio buttons for enabling/disabling DST are shown. If you select "Enable", the following items are also displayed. The default is "Enable".
    DST Start/End (24HR) The menu pops up and lets you select the starting and ending date/time (week, day of the week, month, hour and minute) of DST. Only displayed when "Daylight Saving Time" is set to "Enable".
    DST Offset Select an offset (minutes) for Daylight Saving Time.
    15, 30, 45, 60, 75, 90, 105, 120
    Only displayed when "Daylight Saving Time" is set to "Enable".
    NTP Client
    		 Specify whether or not to use clock synchronization using an NTP (Network Time Protocol) server.

    • When enabled, AP clocks are synchronized to the NTP server. By using NTP, you can keep multiple systems' time as accurate as possible.
    • When disabled, AP clocks are synchronized to the system clock of the PC (server) running Vista Manager EX and the AWC Plug-in.

    Select "Disable" when NTP servers are not available. Note that without NTP, clocks tend to get faster or slower, and AP clocks will become unsynchronized as time passes. Moreover, because APs do not have real time clocks, AP clocks are reset to the initial value (Wed Jan 01 2014 09:00:00 JST) after system restarts. The default is "Disable".

    ◼NTP Client Configuration:

    • NTP Server IP Address / Hostname:
      Enter an IP address or a hostname (FQDN) of the NTP server to synchronize.
      (Example) ntp.your.domain.com, 12.34.56.78
      Note
      FQDN consists of labels (strings) and periods (.).
      Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
      If the Profile Type is "Dual [11ac Wave2]", "Tri [11ac Wave2]", or "Tri [11ac Wave2] with External Antenna", you cannot enter only the label. Use an FQDN which contains at least two labels and a period.

    • NTP Synchronization Interval:
      Specify a time between synchronizing the clock to the NTP server. It must be in the range of 1 to 9999 (minutes). The default is 10 minutes.
      Note
      This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Dual[11ac]", "Dual[11n]", "11ac With External Antenna" or "Single" for Profile Type.
      Note
      When you use the AWC function, do not use an interval larger than the default of 10 minutes.
    Syslog Client
    		 Specify whether or not to use the Syslog Client function. When enabled, AP log messages can be sent to a Syslog server.

    ◼Syslog Client Configuration:

    • Syslog Server IP Address / Hostname:
      Enter the IP address or hostname (FQDN) of the Syslog server to send log messages to.
      (Example) syslog.your.domain.com, 12.34.56.78
      Note
      FQDN consists of labels (strings) and periods (.).
      Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
      If the Profile Type is "Dual [11ac Wave2]", "Tri [11ac Wave2]", or "Tri [11ac Wave2] with External Antenna", you cannot enter only the label. Use an FQDN which contains at least two labels and a period.

    • Port Number:
      Specify a listening port number on the Syslog Server. The default is 514.

    • Severity:
      Select the lowest log severity that will be sent to the Syslog Server. The default is "7: Debug".
      Severity is a value in the range of 0 to 7; the lower the number, the greater the importance.
      • 0 : Emergency: System is unusable.
      • 1 : Alert: Immediate action is required.
      • 2 : Critical: System is in a critical condition.
      • 3 : Error: An error has occured.
      • 4 : Warning: Something has occurred that requires attention.
      • 5 : Notice: A normal but important message.
      • 6 : Informational: An informational message.
      • 7 : Debug: Detailed information for debugging.
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow".
    SNMP Agent
    		 Specify whether or not to use the SNMP Agent function.

    ◼SNMP Agent Configuration:

    • Read Only Community Name:
      Enter the read-only SNMP community name, using 1 to 256 ASCII characters including letters, digits, and symbols (except " ' \ & < >). The default is "public".

    • Port Number:
      Enter the UDP port that the SNMP agent listens on. The default is 161.

    • Restrict the source of SNMP requests:
      Enable this to accept SNMP requests only from specific source addresses.

    • Only allow from the designated hosts or subnets:
      Enter the IP address or hostname (FQDN) of the SNMP manager.
      (Example) snmpmgr.your.domain.com, 12.34.56.78
      This is only displayed when "Restrict the source of SNMP requests" is enabled.
      Note
      FQDN consists of labels (strings) and periods (.).
      Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
      If the Profile Type is "Dual [11ac Wave2]", "Tri [11ac Wave2]", or "Tri [11ac Wave2] with External Antenna", you cannot enter only the label. Use an FQDN which contains at least two labels and a period.

    • Community name for traps:
      Specify the trap SNMP community name, using 1 to 256 ASCII characters including letters, digits and symbols (except " ' \ & < >). The default is "public".

    • Trap types:
      Select the SNMP Trap types to generate.
      Available messages vary depending on the selected Profile Type.
      • Tri[11ac Wave2], Tri[11ac Wave2] With External Antenna, Dual[11ac Wave2]
        • Cold Start: sent when the SNMP Agent starts.
        • Link Up/Down: sent when a wireless interface link up or down.
        • Authentication: sent when an SNMP authentication fails.
      • Dual[11ac], Dual[11n], 11ac With External Antenna, Single
        • Cold Start: sent when the SNMP Agent starts.
        • Link Up/Down: sent when a wireless interface link up or down.
        • DFS: sent when a radio wave that seems like a weather radar is detected in the currently used channel (not available for "Single").
        • Authentication: sent when an SNMP authentication fails.
        • Association: sent when a wireless client associates or disassociates.
        • Filtered STA: sent when a wireless client is blocked by MAC Address List.
        • RADIUS Authentication(Success): sent when a RADIUS authentication succeeds.
        • RADIUS Authentication(Fail): sent when a RADIUS authentication fails.

    • Trap Host IP Address/Hostname:
      Specify IP addresses or hostnames (FQDNs) to which SNMP traps will be sent.
      (Example) manager.your.domain.com, 12.34.56.78
      A maximum of 3 trap hosts can be configured.
      Note
      FQDN consists of labels (strings) and periods (.).
      Alphanumeric characters and hyphens can be used for each label. Labels can begin with a number. Labels cannot begin or end with a hyphen. Each label should be 63 or fewer characters in length.
      If the Profile Type is "Dual [11ac Wave2]", "Tri [11ac Wave2]", or "Tri [11ac Wave2] with External Antenna", you cannot enter only the label. Use an FQDN which contains at least two labels and a period.
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow".
    MAC Address List
    		 Select a MAC Address List (a whitelist or a blacklist).
    When you click the dropdown list, the "Select MAC Address List" dialog box will appear.

    Refer to Configure MAC Address List for detailed instructions on how to create a MAC Address List.
    Note
    This item is displayed if you selected "TQ Series" for Series, or "TQ Series - SDN/OpenFlow" for Series and "Tri[11ac Wave2]" or "Tri[11ac Wave2] with External Antenna" for Profile Type.
    LED Specify whether or not to turn the LED on.
    Select "Turn On" to turn the LED on. Otherwise select "Turn Off".
    The default is "Turn On".
    Factory Reset Button
    		 Specify whether or not to enable the RESET button.
    Select "Enable" to enable the button. Otherwise select "Disable".
    When disabled, you cannot factory-reset APs with the RESET button. The default is "Enable".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Dual[11ac]", "Dual[11n]", "11ac With External Antenna" or "Single" for Profile Type.
    LAN Configuration ("TQ Series Tri[11ac Wave2]" / "TQ Series - SDN/OpenFlow Tri[11ac Wave2]" only)

    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]" for Profile Type.
    Link Aggregation
    		 Enables/disables link aggregation of LAN1/PoE and LAN2 ports on TQ5403 and TQm5403.
    • Static LAG:
      Enables link aggregation. A static LAG should also be configured on the switch ports to which the AP connects.

    • Disable:
      Disables link aggregation. The LAN2 port is also disabled. The AP can only use the LAN1/PoE port.
    Radio Configuration
    Radio Transmission
    		 Specify whether to transmit/receive in the selected frequency band.
    Select "Enable" to use the radio. Otherwise select "Disable" (mandatory).
    The default is "Enable" for all radio frequencies.
    However, depending on the Country and Profile Type selected, there may be cases where "Enable" cannot be selected due to legal restrictions. (For example: "JP-Japan" as Country, "TQ Series" or "TQ Series-SDN / OpenFlow" as Series, "Tri [11ac Wave2] with External Antenna" as Profile Type, and "Outdoor" as Location, Radio 2 (W52 / W53) only has the option "Disable").
    Note
    If you disable all radios on an AP Profile, it is possible to apply the profile to APs of other Profile Types, this profile will not be valid. Make sure you apply an appropriate AP Profile to APs.
    Band
    		 Select a frequency band (2.4GHz or 5GHz) to use on the radio.
    This item is only available for the Profile Type of "Single".
    It is not displayed for other Profile Types. In these cases, Radio 1 uses 2.4GHz and Radio 2 uses 5GHz.
    Mode
    		 Select a mode (protocol) to use on the Radio band. Available modes vary depending on the selected Profile Type.

    • TQ series
      • Tri[11ac Wave2]
        • Radio 1: b/g, b/g/n (default)
        • Radio 2: a, a/n/ac (default)
        • Radio 3: a, a/n/ac (default)
        Note
        To use IEEE 802.11n or IEEE 802.11ac, "Wi-Fi Multimedia (WMM)" must be enabled.
      • Tri[11ac Wave2] with External Antenna
        • Radio 1: b/g, b/g/n (default)
        • Radio 2: none
        • Radio 3: a, a/n/ac (default)
        Note
        To use IEEE 802.11n or IEEE 802.11ac, "Wi-Fi Multimedia (WMM)" must be enabled.
      • Dual[11ac Wave2]
        • Radio 1: b/g, b/g/n (default)
        • Radio 2: a, a/n/ac (default)
        Note
        To use IEEE 802.11n or IEEE 802.11ac, "Wi-Fi Multimedia (WMM)" must be enabled.
      • Dual[11ac], 11ac with External Antenna
        • Radio 1: b/g, b/g/n (default), n(2.4GHz)
        • Radio 2: a, a/n/ac (default), n/ac(5GHz)
      • Dual[11n]
        • Radio 1: b/g, b/g/n (default), n(2.4GHz)
        • Radio 2: a, a/n (default), n(5GHz)
      • Single
        • Radio 1: 2.4GHz: b/g, b/g/n (default), n(2.4GHz)
        • Radio 1: 5GHz: a, a/n (default), n(5GHz)
        Note
        For "Single" Profile Type, available modes vary depending on the selected "Band", 2.4GHz or 5GHz.

    • TQ series (SDN/OpenFlow-capable firmware)
      • Tri[11ac Wave2]
        • Radio 1: b/g, b/g/n (default)
        • Radio 2: a, a/n/ac (default)
        • Radio 3: a, a/n/ac (default)
        Note
        To use IEEE 802.11n or IEEE 802.11ac, "Wi-Fi Multimedia (WMM)" must be enabled.
      • Tri[11ac Wave2] with External Antenna
        • Radio 1: b/g, b/g/n (default)
        • Radio 2: none
        • Radio 3: a, a/n/ac (default)
        Note
        To use IEEE 802.11n or IEEE 802.11ac, "Wi-Fi Multimedia (WMM)" must be enabled.
      • Dual[11ac]
        • Radio 1: b/g, b/g/n (default), n(2.4GHz)
        • Radio 2: a, a/n/ac (default), n/ac(5GHz)
    Bandwidth
    		 Specify the Bandwidth to use.

    IEEE 802.11n and IEEE 802.11ac allows two or four adjacent channels to be combined and used as a 40MHz or 80MHz bandwidth channel.
    • Select either "20MHz" or "40MHz" for IEEE 802.11n.
    • Select either "20MHz", "40MHz", or "80MHz" for IEEE 802.11ac.
    The default is "20MHz".

    "40MHz" and "80MHz" gives you higher traffic rate, but reduces the number of available channels because they use two or four channels.
    This item is only displayed when the selected mode includes IEEE 802.11n or IEEE 802.11ac.
    Use Conditions
    		 Specify when to use the wireless feature.
    Select "Always" to always use the wireless feature. Select "Only Emergency Mode" to use the radio band only in emergency mode. The default is "Always".
    Refer to Enable Emergency Mode for more details.
    Note
    Emergency Mode cannot be used with channel blanket. You cannot use a channel blanket as an emergency Wi-Fi network.
    Do not set this item to "Emergency mode only" for the radio used for channel blanket.
    Wireless Client Isolation Specify whether to block communication between wireless clients connected to the same VAP. Select "Disable" to allow communications between wireless clients. Otherwise select "Enable". The default is "Disable".
    Airtime Fairness
    		 Specify whether or not to give each client an equal amount of airtime regardless of its speed. Select "Enable" to use Air Time Fairness. Otherwise select "Disable". The default is "Disable".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow".
    Management Frame Protection
    		 Specify whether to protect Management Frames. Select "Enable" to use MFP. Otherwise select "Disable". The default is "Enable".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Dual[11ac]" or "11ac With External Antenna" for Profile Type.
    Note
    If you select "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type, configure per VAP in the "VAP (Multiple SSID) Configuration" section.
    Auto Channel Selection Specify the channels to use. All channels are selected by default.
    Maximum Wireless Clients
    		 Specify the maximum number of clients that can connect to the APs. This number counts wireless clients on all radios (Radio 1 to Radio 3).
    When 0 is specified for a radio, no wireless client can connect to APs on the radio.

    • TQ series
      • Dual[11ac Wave2]
        Radio 1: Specify a number between 0 to 120. The default is 120.
        Radio 2: Specify a number between 0 to 200. The default is 200.

      • Other than Dual[11ac Wave2]
        Specify a number between 0 to 200. The default is 200.

    • TQ Series (SDN/OpenFlow-capable firmware)
      Specify a number between 0 to 200. The default is 200.
    Multicast Tx Rate
    		 Specify a selection method for IEEE 802.3 multicast/broadcast rate.

    • "Auto" uses the lowest selected rate in "2.4G/5G Supported Rate" in "Legacy Rate Sets".

    • "Fast" selects and uses the rate from selected rate in "2.4G/5G Supported Rate" in "Legacy Rate Sets", which is nearest to the lowest rate of the clients in the same VAP. The default is "Fast".

    • "Fixed" uses the "Fixed Tx Rate".

    Beacons are transmitted using the selected lowest rate in "2.4G/5G Basic Rate" in "Legacy Rate Sets".
    Note
    This item is displayed if you selected "TQ Series" and "Dual[11ac]", "11ac With External Antenna", "Dual[11n]" or "Single" for Profile Type. If you select "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]", Multicast Tx Rate options are not displayed, and Fixed Tx Rate is automatically set.
    Fixed Tx Rate
    		 Specify the fixed multicast transmission rate used when "Fixed" is selected for "Multicast Tx Rate".

    • Radio 1:
      54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)

    • Radio 2 and Radio 3:
      54 48 36 24 18 12 9 6 (Mbps)
    Note
    This item is displayed if you selected "TQ Series" for Series, or "TQ Series - SDN/OpenFlow" for Series and "Tri[11ac Wave2]" or "Tri[11ac Wave2] with External Antenna" for Profile Type. It is not displayed if you selected "TQ Series - SDN/OpenFlow" for Series and "Dual[11ac]" for Profile Type.
    Legacy Rate Sets
    		 Specify valid rates to use when IEEE 802.11b/g or IEEE 802.11a is being used.
    Available options vary depending on the selected Profile Type.

    • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]
      Select required rates that must be supported on wireless stations (client or other APs) to be allowed to connect to the APs.
      When a station does not support one or more rates in this list, the station is not allowed to connect. Check the rates to select.
      All supported rates are selected by default.
      • 2.4GHz:
        54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)
      • 5GHz:
        54 48 36 24 18 12 9 6 (Mbps)

    • Dual[11ac], Dual[11n], 11ac with External Antenna, Single
      • 2.4G/5G Supported Rate
        Select the rates to be supported. Check the rates to select.
        All supported rates are selected by default.
        • 2.4GHz:
          54 48 36 24 18 12 11 9 6 5.5 2 1 (Mbps)
        • 5GHz:
          54 48 36 24 18 12 9 6 (Mbps)

      • 2.4G/5G Basic Rate
        Select required 2.4G/5G Supported Rates which must be supported on wireless stations (client or other APs) to be allowed to connect to the APs.
        When a station's 2.4G/5G Supported Rate lacks one or more rates in this 2.4G/5G Basic Rate list, the station is not allowed to connect. In general, if a station's 2.4G/5G Supported Rate contains higher rates than ones in 2.4G/5G Basic Rate, the station connects at higher rate.
        Select rates from the ones selected in "Supported Rate". Check the rates to select. Most of the time it is not necessary to change this setting. Each band has the following default:
        • 2.4GHz:
          11 5.5 2 1 (Mbps)
        • 5GHz:
          24 12 6 (Mbps)

    Note
    This item is displayed if you selected "TQ Series" for Series, or "TQ Series - SDN/OpenFlow" for Series and "Tri[11ac Wave2]" or "Tri[11ac Wave2] with External Antenna" for Profile Type. It is not displayed if you selected "TQ Series - SDN/OpenFlow" for Series and "Dual[11ac]" for Profile Type.
    RTS Threshold
    		 Specify the threshold for sending RTS (Request to Send) packets for IEEE 802.11b/g/a.
    When a packet to send is larger than the specifed size, RTS is transmitted before the packet is sent.

    • If you select "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type, specify RTS Threshold in the range of 0 to 2347. Specifying "2347" disables RTS transmission.
      The default is 2347 (do not transmit RTS).

    • If you select "Dual[11ac]", "Dual[11n]", "11ac with External Antenna" or "Single" for Profile Type, specify Enable or Disable RTS Threshold.
      • If you want to enable RTS transmission, select "Enable" and enter a threshold between 0 and 2347 (Bytes).
        When a packet to send is larger than the specifed size, RTS is transmitted before the packet is sent. Specifying "2347" disables RTS transmission.
      • Select "Disable" if you want to disable RTS transmission.
      The default is "Disable". Default threshold value is 2347 just after setting it to "Enable".

    If you set the RTS threshold to a lower value, RTS packets are transmitted more frequently. It consumes more bandwidth and reduces throughput, but may possibly alleviate collision and interference in a crowded network. Therefore it is not recommended to change the RTS threshold under normal circumstances.
    When using IEEE 802.11n or 802.11ac, RTS packets are transmitted regardless of the RTS Threshold setting.
    Note
    If you select "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type, and "IEEE 802.11a/n/ac" for Mode, RTS packets are not sent to wireless clients connected by IEEE 802.11a. This setting is ignored.
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow".
    DTIM Period
    		 Specify how frequently to insert a DTIM (Delivery Traffic Indication Map) in the AP's beacons (every 1 to 255 beacons)
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Dual[11ac]", "Dual[11n]", "11ac With External Antenna" or "Single" for Profile Type.
    The default is 1. The value of 1 means that a DTIM is inserted in every beacon.

    For example, if you set the DTIM Interval to 2, one in two beacons has a DTIM inserted (i.e. a beacon with a DTIM and one without a DTIM are transmitted in turn).

    When a wireless client operates in power-saving mode, DTIM notifies the client that there is a packet to send to the client. The AP will send the packet to the client once the client is ready to communicate.
    Increasing the DTIM Interval reduces power consumption but also makes communication less responsive.
    Note
    If you select "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]" or "Tri[11ac Wave2] with External Antenna" for Profile Type, configure per VAP in the "VAP (Multiple SSID) Configuration" section.
    Band Steering
    		 Specify whether or not to use Band Steering.

    • When enabled, the AP encourages clients supporting both 2.4GHz and 5GHz to prefer a less congested frequency in order to reduce overall congestion.

    • When disabled, the AP doesn't encourage clients to use other frequencies. In that case, a client keeps using the same band with which they connect, even if the client supports both 2.4GHz and 5GHz and the other band is less crowded.

    The default is "Disable".

    This item is displayed only for "Radio 1" (2.4GHz). To use this feature, make sure you enable two or more bands (Radio 1, 2 and 3) and configure a VAP with the same SSID and security for each radio.
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    If you select "Dual[11ac]", "Dual[11n]" or "11ac with External Antenna", Band Steering can be configured per VAP in the "VAP (Multiple SSID) Configuration" section.
    Note
    Band Steering cannot be used with channel blanket. Disable Band Steering on the AP Profile for APs using channel blanket.
    Wi-Fi Multimedia (WMM)
    		 Specify whether to use Wi-Fi Multimedia (WMM).
    When enabled, WMM information is included in the AP beacon. This shortens the frame transmission interval for video/audio streaming and VoIP traffic and therefore keeps communication quality high.
    The default is "Enable".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    Note
    To use IEEE 802.11n or IEEE 802.11ac, this must be enabled.
    APSD
    		 Specify whether to use APSD (Automatic Power Save Delivery).
    Enabling APSD can lower power consumption of mobile devices (VoIP) and therefore increase the battery life. The mobile device should also support APSD (U-APSD).
    The default is "Disable".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    Neighbor AP Detection
    		 Specify whether or not to detect Neighbor APs.
    When enabled, it scans in-use and other channels of the radio band for Wireless IDS / IPS and AWC Calculation. In this case, the channel currently being used is periodically stopped, so the performance of the wireless network service slightly decreases.
    When disabled, detection does not work. In this case, Wireless IDS / IPS may not work properly, or the effect of surrounding unmanaged APs may not be correctly reflected in the AWC Calculation.
    The default is "Enable".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    Note
    When Neighbor AP Detection settings are supported on the management web interface of the AP System (TQ5403, TQ5403e and TQm5403, Firmware Version 5.3.1 or later, and TQ1402 and TQm1402, Firmware Version 6.0.0-0.2 or later), if this function is set to "Enable" under AWC Plug-in management and then exits from management, the Neighbor AP Detection setting will remain "Enable".
    When Neighbor AP Detection settings are not supported on the management web interface of the AP System, this function is disabled when leaving AWC Plug-in management.
    VAP (Multiple SSID) Configuration
    VAP List Shows a list of configured VAPs (Virtual Access Points).
    Here you can view the status, VLAN ID, SSID, and security settings for each VAP.
    + Add VAP
    		 Creates a new VAP.

    The VAPs will be automatically numbered, starting from 1. The number of VAPs that can be created varies depending on the selected Series and Profile Type.
    • TQ Series
      • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]
        8 VAPs per band (Radio 1, Radio 2, Radio 3)
      • Dual[11ac], Dual[11n] or 11ac with External Antenna
        16 VAPs per band (Radio 1, Radio 2)

    • TQ Series - SDN/OpenFlow
      • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
        8 VAPs per band (Radio 1, Radio 2, Radio 3)
      • Dual[11ac]
        16 VAPs per band (Radio 1, Radio 2)
    Note
    It is recommended to use 5 or less VAPs per radio band in total, including both multi-channel and blanket VAPs.
    VAP Status
    		 Enables or disables the VAP.

    • When set to Enabled, the VAP is always used on the APs to which this AP Profile is applied.
    • When set to Disabled, the VAP is not used.
    • When set to Emergency, the VAP becomes active only when the Emergency Mode is enabled in the Management Group.

    For VAP 1, "Enable" and "Disable" are displayed when "Use Conditions" is set to "Always", and "Disable" and "Emergency" are displayed when "Use Conditions" is set to "Only Emergency Mode".
    For other VAPs, all three options, "Enable", "Disable", and "Emergency" are displayed.

    The default is "Enable".
    Note
    Emergency Mode cannot be used with channel blanket. You cannot use a channel blanket as an emergency Wi-Fi network.
    Do not set this item to "Emergency" for the VAP whose number is the same as the CB VAP (VAP for channel blanket).
    VLAN ID
    		 Specify a VLAN ID (between 1 and 4094) to use on the VAP (mandatory).
    Note
    Specify a VLAN ID that is different from the AP's management VLAN. When the AP is detected as a guest node, a parent AMF node is configured to collect the guest node information automatically ("dynamic discovery"), and wireless clients get their IP addresses via DHCP.
    SSID Specify an SSID (network name) to use on the VAP.

    The SSID is mapped to the VLAN ID. Enter a name with 1 to 32 alphanumeric characters.
    The default is "Default-X" (where X is a VAP number) (mandatory).
    Broadcast SSID
    		 Specify whether to broadcast the SSID on the VAP.

    • When enabled, the SSID is included in beacons. When you configure a wireless client, you may be able to see the SSID in a list of wireless networks to connect. This setting also allows wireless clients to connect using an "ANY" connection.

    • When disabled, the SSID is not included in beacons. You may not be able to see the SSID in a wireless network list on a wireless client. In this case, you have to enter the same SSID as the AP on a wireless client. This setting also denies wireless clients from connecting using an "ANY" connection.

    The default is "Enable".
    Note
    An "ANY" connection is a connection where a wireless client tries to connect to an AP by specifying a wildcard or null as the SSID. Even when an "ANY" connection is allowed, clients cannot connect to APs without knowing the correct security key.
    Band Steering
    		 Specify whether or not to use Band Steering.

    • When enabled, the AP encourages clients supporting both 2.4GHz and 5GHz to prefer 5GHz in order to reduce congestion in 2.4GHz.

    • When disabled, the AP doesn't encourage clients to use 5GHz. In that case, a client keeps using the same band with which they connect, even if the client supports both 2.4GHz and 5GHz and the other band is less crowded.

    The default is "Disable".

    This item is displayed only for "Radio 1" (2.4GHz). To use this feature, make sure you enable both radios (Radio 1 and Radio 2) and configure a VAP with the same SSID and security for each radio.
    Note
    This item is displayed if you selected "TQ Series" and "Dual[11ac]", "Dual[11n]" or "11ac With External Antenna" for Profile Type.
    If you select "Tri[11ac Wave2]" or "Tri[11ac Wave2] with External Antenna", all VAPs can be set with "Radio Configuration" at once.
    Security
    		 Select a security mechanism to use.
    The available options are "None", "Static WEP", "WPA Personal", and "WPA Enterprise".
    The default is "None".
    Note
    "Static WEP" is not displayed when the selected Mode contains "IEEE 802.11n". This can be configured only on VAP 1 of each radio.

    • None:
      No authentication or encryption is performed. Everyone can connect to the VAP.
      Note
      If you use "None" to build a network such as a guest hotspot, you should consider the consequences for the overall security of your entire network.

    • Static WEP:
      Uses RC4 encryption with fixed keys. Per-client authentication is not performed. We recommend using "WPA Personal" for fixed key security because WEP is vulnerable.

    • WPA Personal:
      Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated from a pre-shared key (PSK). It uses CCMP (AES) or TKIP for the encryption algorithm.

    • WPA Enterprise:
      Performs authentication and encryption between an AP and a wireless client. It uses per-client keys which are generated on a RADIUS server. It uses CCMP (AES) or TKIP for the encryption algorithm.

    ◼Static WEP Configuration:

    • Key Length:
      Select the WEP key length. The default is 128bit.
      • 64bit:
        You can directly enter a WEP key with 10 hex digits. Or you can enter 5 ASCII characters to automatically generate a WEP key.
      • 128bit:
        You can directly enter a WEP key with 26 hex digits. Or you can enter 13 ASCII characters to automatically generate a WEP key.

    • Key Type:
      Select a generation method for the WEP key. The default is "Hex".
      • ASCII:
        Lets you enter an arbitrary string to automatically generate a WEP key. The string is case-sensitive.
      • Hex:
        Lets you directly enter a WEP key with hexadecimal characters (0 to 9, A to F, a to f). Hex characters are not case-sensitive.

    • Key Index:
      Specify a key to use. The default is 1.

    • Security Key (WEP Key):
      Enter a WEP key (in hex) or a seed of a key (in ASCII) according to the selected "Key Length" and "Key Type".
      You have to enter the same WEP key as the one specified by "Key Index" on the wireless client.

    • WEP Authentication Method:
      "Open System" is the recommended option here. The default is "Open System".
      It is recommended to use the default "Open System" for security.
      • Open System:
        All wireless clients are allowed to connect regardless of whether they have the correct WEP key. But as wireless clients are only allowed to connect, they cannot communicate without a valid WEP key.
        This option is not only for "WEP" but is also used for "None", "WPA Personal" and "WPA Enterprise".
      • Shared Key:
        Only wireless clients with the correct WEP key can connect. Wireless clients cannot connect without a valid key.
      • Open System and Shared Key:
        A client configured to use Shared Key can connect if it has a valid WEP key.
        A client configured to use Open System can connect regardless of whether it has a correct key.
      This is only available for TQ series.

    ◼WPA Personal Configuration:

    • Security Key (WPA-PSK):
      Specify an encryption key for the VAP. The key should contain 8 to 63 alphanumeric and symbol characters. The key is case-sensitive.

    • WPA Versions:
      Select the WPA version(s) to use.
      • TQ Series
        • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
          You can select "WPA3" only, both "WPA3" and "WPA2", "WPA2" only, or both "WPA" and "WPA2".
          However, you cannot select both "WPA3" and "WPA". Additionally, you cannot select "WPA" only.
        • Dual[11ac Wave2]
          You can select "WPA3" only, both "WPA3" and "WPA2", "WPA2" only, or both "WPA" and "WPA2".
          However, you cannot select both "WPA3" and "WPA". Additionally, you cannot select "WPA" only.
        • Dual[11ac]
          You can select "WPA2" only, or both "WPA2" and "WPA".
        • Dual[11n], 11ac with External Antenna, Single
          You can select either "WPA" or "WPA2", or both "WPA2" and "WPA".
      • TQ Series - SDN/OpenFlow
        • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
          You can select "WPA2" only, or both "WPA2" and "WPA".
        • Dual[11ac]
          Only "WPA2" can be selected.
      The default is "WPA2". Select both for a mixed environment. In that case, the security level of the wireless network is the same as WPA.
      Note
      WPA is based on a draft of IEEE 802.11i while WPA2 is based on the final version of IEEE 802.11i and therefore meets all mandatory items required by the standard.

    • Encryption Protocol:
      • TQ Series
        • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]
          You can select "CCMP" only, or both "TKIP" and "CCMP".
        • Dual[11ac]
          You can select "CCMP" only, or both "TKIP" and "CCMP".
        • Dual[11n], 11ac with External Antenna, Single
          You can select either "TKIP" or "CCMP", or both.
      • TQ Series - SDN/OpenFlow
        • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
          You can select "CCMP" only, or both "TKIP" and "CCMP".
        • Dual[11ac]
          You can select "CCMP" only.
      The default is "CCMP".
      Although "TKIP" uses RC4 as WEP does, TKIP uses a separate encryption key for each client and changes the key after using it for some time.
      "CCMP" uses the standard encryption algorithm approved by the US Secretary of Commerce. This standard has a strong algorithm.
      Note
      According to the WPA standard, TKIP is mandatory while CCMP is optional. Our products implement both algorithms.
      Note
      If the WPA version includes "WPA3", only "CCMP" can be selected. "TKIP" is not displayed.
      Note
      If the WPA version includes "WPA", you have to select both "CCMP" and "TKIP".

    • Management Frame Protection:
      Specify whether to protect Management Frames. Select "Enable" to use MFP. Otherwise select "Disable". The default is "Enable".
      Note
      This item is displayed if you selected "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
      Note
      If you select "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Dual[11ac]" or "11ac With External Antenna" for Profile Type, you specify this item for each band on "Wireless Configuration".
      Note
      If the WPA version includes "WPA3", only "CCMP" can be selected. If the WPA version includes "WPA", only "Disable" can be selected.

    • Broadcast Key Refresh Interval:
      Specify an interval at which to refresh the broadcast key that is sent to clients on the VAP. Specify an interval between 0 and 86400 (seconds). A value of 0 means that the key is never refreshed. The default is 0.

    ◼WPA Enterprise Configuration:

    • RADIUS Server IP Address:
      Enter the IP address of the primary RADIUS server.
      You can configure primary and secondary RADIUS servers. The primary IP address is mandatory while the secondary is optional.

    • RADIUS Server Secret:
      Enter a password to connect to the RADIUS server with 64 or less alphanumeric and symbol characters. The password can contain spaces.
      For TQ series, enter a password for each of the primary and secondary RADIUS server.

    • Port Number:
      Enter a port number between 1 and 65535 on which the external RADIUS server or servers are listening. For TQ series, the port number applies to both primary and secondary. The default is 1812.

    • Pre-authentication:
      When enabled and a client is about to roam, the source (current) AP forwards the client's pre-authentication information to the destination AP. The default is "Enable". This reduces the time required for authentication of roaming clients.
      This is only available for TQ series.
      Note
      If Profile Type is "Tri[11ac Wave2]" or "Dual [11ac Wave2]", this item can be configured only on VAP1 of each radio. When you select "Enable", this function is valid for all VAP.

    • WPA Versions:
      Select the WPA version(s) to use.
      • TQ Series
        • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
          Radio 2: You can select "WPA3" only, "WPA2" only, or both "WPA" and "WPA2".
          You cannot select both "WPA3" and "WPA2", or both "WPA3" and "WPA". "WPA" can be selected only together with "WPA2".
        • Dual[11ac Wave2]
          Radio 1: You can select "WPA2" only, or both "WPA" and "WPA2".
          Radio 2: You can select "WPA3" only, "WPA2" only, or both "WPA" and "WPA2".
        • Dual[11ac]
          You can select "WPA2" only, or both "WPA2" and "WPA".
        • Dual[11n], 11ac with External Antenna, Single
          You can select either "WPA" or "WPA2", or both "WPA2" and "WPA".
      • TQ Series - SDN/OpenFlow
        • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
          You can select "WPA2" only, or both "WPA2" and "WPA".
        • Dual[11ac]
          Only "WPA2" can be selected.
      The default is "WPA2". Select both for a mixed environment. In that case, the security level of the wireless network is the same as WPA.
      Note
      WPA is based on a draft of IEEE 802.11i while WPA2 is based on the final version of IEEE 802.11i and therefore meets all mandatory items required by the standard.

    • Encryption Protocol:
      • TQ Series
        • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna, Dual[11ac Wave2]
          You can select "CCMP" only, or both "TKIP" and "CCMP".
        • Dual[11ac]
          You can select "CCMP" only, or both "TKIP" and "CCMP".
        • Dual[11n], 11ac with External Antenna, Single
          You can select either "TKIP" or "CCMP", or both.
      • TQ Series - SDN/OpenFlow
        • Tri[11ac Wave2], Tri[11ac Wave2] with External Antenna
          You can select "CCMP" only, or both "TKIP" and "CCMP".
        • Dual[11ac]
          You can select "CCMP" only.
      The default is "CCMP".
      Although "TKIP" uses RC4 as WEP does, TKIP uses a separate encryption key for each client and changes the key after using it for some time.
      "CCMP" uses the standard encryption algorithm approved by the US Secretary of Commerce. This standard has a strong algorithm.
      Note
      According to the WPA standard, TKIP is mandatory while CCMP is optional. Our products implement both algorithms.
      Note
      If the WPA version includes "WPA3", only "CCMP" can be selected. "TKIP" is not displayed.
      Note
      If the WPA version includes "WPA", you have to select both "CCMP" and "TKIP".

    • Management Frame Protection:
      Specify whether to protect Management Frames. Select "Enable" to use MFP. Otherwise select "Disable". The default is "Enable".
      Note
      This item is displayed if you selected "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
      Note
      If you select "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Dual[11ac]" or "11ac With External Antenna" for Profile Type, you specify this item for each band on "Wireless Configuration".
      Note
      If the WPA version includes "WPA3", only "CCMP" can be selected. If the WPA version includes "WPA", only "Disable" can be selected.

    • Broadcast Key Refresh Interval:
      Specify an interval at which to refresh the broadcast key that is sent to clients on the VAP. Specify an interval between 0 and 86400 (seconds). A value of 0 means that the key is never refreshed. The default is 0.

    • Session Key Refresh Interval:
      Specify an interval at which to refresh the unicast session key that is sent to clients on the VAP. Specify an interval between 0 and 86400 (seconds). A value of 0 means that key is never refreshed. The default is 0.
      Because keys are generated for every session, there is little need to refresh the key, given that a strong encryption algorithm such as CCMP is used in "WPA Enterprise". A shorter interval may decrease the AP's performance.
      This is only available for TQ series.

    • RADIUS Accounting:
      Specify whether or not to use RADIUS accounting server to record the resources (such as connection time) used by each user. Select "Enable" to perform accounting. Otherwise select "Disable". The default is "Disable".

    • RADIUS Accounting Port Number:
      Specify a port number on which the RADIUS accounting server is listening. This is valid only when RADIUS Accounting is enabled. The default is 1813.

    • Dynamic VLAN:
      When enabled, the VLAN included in a RADIUS response is assigned to the user.
      When disabled, the VLAN configured for the VAP is always applied to the user regardless of the VLAN information in a RADIUS response.
      The default is "Enable".
    Captive Portal
    		 Specify whether to use Captive Portal on the VAP. Captive Portal displays an authentication page before granting web access.

    • If you select "External RADIUS", the APs will query the RADIUS server.
    • If you select "Click-through", APs will display a Click-through page instead of performing RADIUS authentication. The Click-through page does not require authentication with a username/password pair, but can be configured to show an arbitrary "Terms of Use" that users have to accept before use, or to redirect to an external page.
    • Select "Disable" to not use Captive Portal.

    The default is "Disable".
    If you select "External RADIUS" or "Click-through", the following additional items are displayed:
    Note
    This item is displayed if you selected "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", "Dual[11ac Wave2]", "Dual[11ac]", "Dual[11n]", "11ac with External Antenna" or "Single" for Profile Type, or if you selected "TQ Series - SDN/OpenFlow" for Series and "Dual[11ac]" for Profile Type.
    If you select "TQ Series" and "Dual[11n]" or "Single" for Profile Type, or if you selected "TQ Series - SDN/OpenFlow" and "Dual[11ac]" for Profile Type, you can only select "External RADIUS" or "Disable".
    Note
    Do not enable Captive Portal on the radio used for the WDS connection.

    ◼Captive Portal External RADIUS Configuration:
    If you select "External RADIUS" for Captive Portal, configure the following items:

    • Authentication Page Proxy:
      Specify whether to use an external authentication page or not.
      • Enabled:
        Shows an external portal page. Specify the page URL in "Base URL".
        • Base URL:
          Specify the base URL of the external web authentication page.
          Clients will access the page through the AP's proxy feature instead of direct connection.
          The HTML filename of the external authentication page must be "radius_login.html".
          The AP's proxy will get the page from "Base URL/radius_login.html" and send it back to clients.
          For example, when you specify "http://www.example.com/captive_portal" in "Base URL", the APs will present the content of the page at "http://www.example.com/captive_portal/radius_login.html" to connecting clients.
          For details of the format of radius_login.html, refer to Operation Reference > Authentication > Web Authentication with Captive Portal.
      • Disable:
        Shows an authentication page embedded in the APs.
      Note
      This item is displayed if you selected "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    • RADIUS Server Primary IP Address:
      Enter the IP address of the primary RADIUS server. (mandatory).

    • RADIUS Server Primary Secret:
      Enter the password to connect to the primary RADIUS server with 64 or less alphanumeric and symbol characters (mandatory).

    • RADIUS Server Secondary IP Address:
      Enter the IP address of the secondary RADIUS server. Leave it blank if you are not using a secondary RADIUS server.

    • RADIUS Server Secondary Secret:
      Enter the password to connect to the secondary RADIUS server with 64 or less alphanumeric and symbol characters. Leave it blank if you are not using a secondary RADIUS server.

    • Port Number:
      Enter a port number between 1 and 65535 on which the primary and secondary RADIUS server is listening. The default is 1812.

    • Redirect type (after user is authenticated): Specify a page to be shown after the user passes web authentication.
      • Keep Session:
        Show the original URL that was entered in the client's browser before web authentication.
      • Fixed URL
        Always show a fixed URL that you specify.
      • Disable
        Do not redirect the browser after successful web authentication.
      Note
      This item is displayed if you selected "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
      If the Profile Type is "Dual[11ac]" or "11ac with External Antenna", you can only select "Fixed URL" or "Disable".
    ◼Captive Portal Click-through Configuration:
    If you select "Click-through" for Captive Portal, configure the following items:

    • Authentication Page Proxy:
      Specify whether to use an external Click-through page or not.
      • Enabled:
        Shows an external portal page. Specify the page URL in "Base URL".
        • Base URL:
          Specify the base URL of the external Click-through page.
          Clients will access the page through the AP's proxy feature instead of direct connection.
          The HTML filename of the external Click-through page must be "click_through_login.html".
          The AP's proxy will get the page from "Base URL/click_through_login.html" and send it back to clients.
          For example, when you specify "http://www.example.com/captive_portal" in "Base URL", APs will present the content of the page at "http://www.example.com/captive_portal/click_through_login.html" to connecting clients.
          For details of the format of click_through_login.html, refer to Operation Reference > Authentication > Web Authentication with Captive Portal.
      • Disable:
        Shows an authentication page embedded in the APs.
        Note
        "Terms of Use" to show on the Authentication Page can be configured on each AP's web interface.
      Note
      This item is displayed if you selected "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    • Redirect type (after user is authenticated): Specify a page to be shown after the user passes web authentication.
      • Keep Session:
        Show the original URL that was entered in the client's browser before web authentication.
      • Fixed URL
        Always show a fixed URL that you specify.
      • Disable
        Do not redirect the browser after successful web authentication.
      Note
      This item is displayed if you selected "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna", "Dual[11ac Wave2]", "Dual[11ac]" or "11ac with External Antenna" for Profile Type.
      If the Profile Type is "Dual[11ac]" or "11ac with External Antenna", you can only select "Fixed URL" or "Disable".
    MAC Address Authentication
    		 Specify whether to use MAC Address Authentication on the VAP.

    • If you select "External RADIUS", the APs will query the RADIUS server.
    • If you select "MAC Filtering", filtering is performed using the "MAC Address List" which is specified in the "System" section.
    • If you select "Disable", no MAC address authentication is performed.

    The default is "Disable".

    If you select "External RADIUS" or "MAC Filtering", the following additional items are also displayed:
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow".
    Note
    "MAC Filtering" is only available if you have selected "TQ Series" for Series and selected a MAC Address List in "MAC Address List" in the "System" section.

    ◼When "External RADIUS" is selected:

    • RADIUS Server Primary IP Address:
      Enter the IP address of the primary RADIUS server. (mandatory).

    • RADIUS Server Primary Secret:
      Enter the password to connect to the primary RADIUS server with 64 or less alphanumeric and symbol characters

    • RADIUS Server Secondary IP Address:
      Enter the IP address of the secondary RADIUS server. Leave it blank if you are not using a secondary RADIUS server.

    • RADIUS Server Secondary Secret:
      Enter the password to connect to the secondary RADIUS server with 64 or less alphanumeric and symbol characters. Leave it blank if you are not using a secondary RADIUS server.

    • Port Number:
      Enter a port number between 1 and 65535 on which the primary and secondary RADIUS server is listening. The default is 1812.

    • User-Name Format Delimiter:
      A client's MAC address is sent to the RADIUS server as a User-Name attribute.
      Specify an octet delimiter to use in a User-Name attribute from "Hyphen", "Colon" and "None". The default is "Hyphen".

    • User-Name Format Case:
      Specify which case to use in a User-Name attribute from "Upper" and "Lower". The default is "Lower".

    • User-Password Format Type:
      Specify what is used for a User-Password attribute when a client MAC address is sent to the RADIUS server for authentication. The default is "User Name".
      • If you select "Fixed Password", a string specified in "User-Password Format Password" is always used as the value of the User-Password attribute.
      • If you select "User Name", the same string as the User-Name attribute (MAC Address) is sent to the RADIUS server as the value of the User-Password attribute.

    • User-Password Format Password:
      Specify a fixed password string which is used when "User-Password Format Type" is set to "Fixed Password".

    By default (where "User-Name Format Delimiter" is "Hyphen", "User-Name Format Case" is "Lower" and "User-Password Format Type" is "User Name"), authentication credentials (User-Name and User-Password attributes) of a client will be sent to the RADIUS server as follows:

    • User-Name ab-cd-ef-12-34-56
    • User-Password ab-cd-ef-12-34-56

    ◼When "MAC Filtering" is selected:
    Shows the name of the "MAC Address List" selected in the AP Profile's "System" section.
    Note
    You cannot use a different MAC Address List for each radio or VAP. A single list is used for all radios (Radio 1/Radio 2/Radio 3) and VAPs in an AP Profile.
    Area Authentication
    		 Specify whether to use the Area Authentication function.
    When "Enable" is selected, the AWC Plug-in will make use of the Client Location Estimation function to find the wireless clients estimated to be in the specific area on the floor map and allow only these clients to connect to this VAP.
    Specify the area to permit the clients to connect to in the Floor Map screen separately.
    Note
    This item is displayed if you selected "TQ Series" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type. Take note that "Dual[11ac Wave2]" does not support the Area Authentication in this version.
    Note
    To use the Area Authentication on a VAP defined in a AP Profile, the following conditions must be met:
    - "Associated Client Location Estimation History" is set effectively in the System Setting screen.
    - On TQ5403 or TQ5403e APs, Channel Blanket is working, and the VAP with Area Authentication option enabled in the AP Profile is applied.
    - Wireless client has once requested connection to the CB VAP of the corresponding channel blanket
    For more details about Channel Blanket and Floor Map, refer to Operation Reference > Floor Map > Configure Floor Maps and Operation Reference > Channel Blanket > Overview respectively.
    Note
    Area Authentication cannot be used conbined with MAC Address Authentication.
    Fast Roaming
    		 Specify whether to use Fast Roaming of wireless clients.
    When you select "Enable", you can configure various fast roaming functions.
    The default is "Disable".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type, and "WPA Personal" or "WPA Enterprise" for Security of VAP.

    ◼Fast Roaming Configuration
    • Fast Transition:
      Specify whether or not to use IEEE 802.11r (Fast Basic Service Set Transition).
      When enabled, wireless clients can do IEEE 802.11r fast transition when they roam from one AP to another.
      The default is "Disable".

      An AP Profile which contains VAPs using both WPA Enterprise and Fast Transition behaves as follows.

      • When the number of APs using this AP Profile changes, the configuration status of the APs that use this AP Profile becomes "Modified".

      • If you make a change that affects the number of APs that use this AP Profile on the Wireless Configuration > AP Settings page, a dialog box will ask you whether to apply the configuration to all APs that use this AP Profile.
        If you click "OK", the configuration will be applied to all APs that use this AP Profile.

    • Distributed System:
      Specify whether or not to request authentication via distributed system (DS).
      When enabled, wireless clients send an authentication request to the destination AP via the current (source) AP. (Over The DS.)
      When disabled, wireless clients send an authentication request to the destination AP directly over the radio. (Over The Air)
      The default is "Disable".

    • Mobility Domain:
      Specify a mobility domain with 4 hexadecimal digits (0 to 9, A to F, a to f). This is not case-sensitive.
      A wireless client can perform IEEE 802.11r fast transition between the APs in the same mobility domain.
      The default is "a1b2".

    • PMK-R0 Lifetime
      Specify a PMK-R0 lifetime, between 1 and 65535 minutes.
      Once the lifetime expires, IEEE 802.11r fast transition is not performed.
      The default is 10000.

    • AES Key
      Specify an AES key that is used to exchange PMK-R1 between APs with 32 hexadecimal digits (0 to 9, A to F, a to f). This is not case-sensitive. The default is empty.
      Note
      This is mandatory for every function in the "Fast Roaming" section. Configure this item even if you only use IEEE 802.11k or IEEE 802.11v and you are not going to use IEEE 802.11r fast transition.

    • IEEE 802.11k RRM
      Specify whether or not to use IEEE 802.11k RRM (Radio Resource Management).
      The default is "Disable".

    • IEEE 802.11v WNM
      Specify whether or not to use IEEE 802.11v WNM (Wireless Network Management).
      The default is "Disable".
    Inactivity Timer
    		 Specify the time, between 5 and 65535 seconds, after which a client will be disconnected if it disappears without disassociating from an AP.
    The default is 300.
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    Note
    This feature cannot be used with the OpenFlow feature. Use the default setting.
    Note
    If you select "TQ Series" for Series and "Dual[11ac]" for Profile Type, this setting is not supported for Radio 1. Use the default setting.
    Duplicate AUTH received
    		 Select how to process connection requests from clients that have maintained a connection.
    If you select "Disconnect", it disconnects the previous connection and then accepts the new connection.
    If you select "Ignore", it connects as normal, without disconnecting.
    The default is "Disconnect".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    Note
    This feature cannot be used with the OpenFlow feature. Use the default setting.
    Note
    When "Management Frame Protection" is set to "Enable", "Disconnect" is used regardless of this item's setting.
    Association Advertisement
    		 Specify whether to use Association Advertisement.
    When enabled, a notification broadcast frame is sent to the network configured in Control VLAN when a Wireless Client connects to the AP. The AP that receives this frame updates its wireless client connection information.
    The default is "Disable".
    Note
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]", "Tri[11ac Wave2] with External Antenna" or "Dual[11ac Wave2]" for Profile Type.
    Note
    This feature cannot be used with the OpenFlow feature. Use the default setting.
    Note
    To make this function take effect, APs on the same subnet must have "Roaming Notification" set to "Enable" for each other.
    DTIM Period
    		 Specify how frequently to insert a DTIM (Delivery Traffic Indication Map) in the AP's beacons (every 1 to 5 beacons).
    This item is displayed if you selected "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Tri[11ac Wave2]" or "Tri[11ac Wave2] with External Antenna" for Profile Type.
    The default is 1. The value of 1 means that a DTIM is inserted in every beacon.

    For example, if you set the DTIM Interval to 2, one in two beacons has a DTIM inserted (i.e. a beacon with a DTIM and one without a DTIM are transmitted in turn).

    When a wireless client operates in power-saving mode, DTIM notifies the client that there is a packet to send to the client. The AP will send the packet to the client once the client is ready to communicate.
    Increasing the DTIM Interval reduces power consumption but also makes communication less responsive.
    Note
    If you select "TQ Series" or "TQ Series - SDN/OpenFlow" for Series, and "Dual[11ac]", "Dual[11n]", "11ac With External Antenna" or "Single" for Profile Type, you specify this item for each band on "Wireless Configuration".
    OpenFlow Configuration (Only when the Profile Type is "AT-TQ Series - SDN/OpenFlow")
    Controller1/
    Controller2/
    Controller3    		 Enable or disable OpenFlow Controller Configuration.
    You can configure three OpenFlow controllers.
    When you select "Enable", the "IP Address:Port" and "SSL" fields become accessible.
    IP Address:Port Enter the IP address and port of the OpenFlow controller. The port number defaults to 6653.
    SSL
    		 Specify whether or not to encrypt communication with the OpenFlow controller (control plane).

    • When enabled, the communication with the OpenFlow controller is encrypted using SSL.

    • When disabled, the communication with the OpenFlow controller is not encrypted (i.e. plain TCP connection is used).

    The default is "Disable".
    Note
    To use encrypted control plane, the OpenFlow controller must also be configured appropriately.
    Critical Mode
    		 Specify whether or not to use "Critical Mode" which enables traffic to continue to flow even if the connection to the OpenFlow controller is lost for some reason. Options are "Enable(Permit any)", "Enable(Discard any)" or "Disable". The default is "Disable".

    • When disabled, the Critical Mode is not used and the normal OpenFlow behavior is retained. When the connection to the controller is lost, no more new connections from a client are possible because new flow entries cannot be generated.
      Clients which are already connected to APs can continue to communicate, but once the flow entries for the client time out and are deleted, they can no longer communicate.

    • If you select "Enable (Accept All)", all traffic is allowed when the "Fallback Time" expires after the connection to the controller is lost. In this case, the tagged VLAN configured for the VAP is used for all traffic.

    • If you select "Enable (Drop All)", all traffic is discarded after the "Fallback Time" expires.

    If you select "Enable (Accept All)" or "Enable (Drop All)", all flow entries registered on APs are deleted when the "Fallback Time" expires after the connection to the controller is lost.
    Fallback Time
    		 Specify a "Fallback Time" for the "Critical Mode" between 15 and 1000 (seconds). This is valid when the Critical Mode is set to "Enable (Accept All)" or "Enable (Drop All)".
    The default is 15.
    Note
    Actual transition time varies depending on the timing of the health check interval for the OpenFlow controller.
    RADIUS Disconnect
    Note
    This item is not supported.
  10. Configure items as required.

  11. Click "Add" at the top right of the Content section.


Edit AP Profile

  1. Select "Wireless Configuration" > "AP Profile" from the AWC Plug-in menu.

  2. Click "Detail" (magnifying glass icon) of the AP Profile to edit from the List of AP Profiles.

  3. The selected AP Profile will be displayed. Click "Edit" at the top right of the Content section.

  4. Change the information as needed.

  5. Click "Save" at the top right of the Content section.


Copy AP Profile

  1. Select "Wireless Configuration" > "AP Profile" from the AWC Plug-in menu.

  2. Select (Check) the AP Profile to be copied from the list of AP Profiles.

  3. Click "Copy" at the top right of the Content section.
    The selected AP Profile is duplicated.

    The duplicated AP Profile gets a temporary name, which is made by appending "_copy" to the original AP Profile name. Rename it on the Edit page as required.
Note
An AP profile cannot be copied if its name plus a string "_copy" exceeds 101 characters in length.
In that case, a dialog box will appear and tell you that the profile was not copied.


Delete AP Profile

  1. Select "Wireless Configuration" > "AP Profile" from the AWC Plug-in menu.

  2. Click "Detail" (magnifying glass icon) of the AP Profile to delete from the List of AP Profiles.

  3. The selected AP Profile will be displayed. Click "Delete" at the top right of the Content section.

  4. The "Confirm" dialog box will appear.

  5. Click "Delete".


(C) 2020 Allied Telesis, Inc. All rights reserved.

C613-04089-00 Rev A

06 Oct 2020 11:30