User Manual

BE9400 Tri-Band PoE 2.5G
Insight Managed WiFi 7 Access Point
WBE710June 2024
202-12703-01

NETGEAR, Inc.
350 E. Plumeria Drive
San Jose, CA 95134, USA

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Support and Community
Visit netgear.com/support to get your questions answered and access the latest
downloads.
You can also check out our NETGEAR Community for helpful advice atcommunity.netgear.com.
Regulatory and Legal
Si ce produit est vendu au Canada, vous pouvez accéder à ce document en français
canadien à https://www.netgear.com/support/download/.
(If this product is sold in Canada, you can access this document in Canadian French athttps://www.netgear.com/support/download/.)For regulatory compliance information including the EU Declaration of Conformity, visit
https://www.netgear.com/about/regulatory/.
See the regulatory compliance document before connecting the power supply.
For NETGEAR’s Privacy Policy, visit https://www.netgear.com/about/privacy-policy.
By using this device, you are agreeing to NETGEAR’s Terms and Conditions at
https://www.netgear.com/about/terms-and-conditions. If you do not agree, return thedevice to your place of purchase within your return period.
Do not use this device outdoors. The PoE source is intended for intra building connection
only.
Applicable to 6 GHz devices only: Only use the device indoors. The operation of 6 GHz
devices is prohibited on oil platforms, cars, trains, boats, and aircraft, except that
operation of this device is permitted in large aircraft while flying above 10,000 feet.
Operation of transmitters in the 5.925-7.125 GHz band is prohibited for control of orcommunications with unmanned aircraft systems.
Trademarks© NETGEAR, Inc., NETGEAR, and the NETGEAR Logo are trademarks of NETGEAR, Inc.
Any non-NETGEAR trademarks are used for reference purposes only.
Revision History
Publication Part
NumberPublish Date

Comments

202-12703-01

June 2024

First publication.

2

User ManualContents
Chapter 1 Introduction
Additional documentation............................................................... 10
How to manage the AP.................................................................... 10
About the device user interface and NETGEAR Insight............... 11
Chapter 2 Hardware Overview
Unpack the AP................................................................................... 13
Top panel LED................................................................................... 13
Hardware interfaces.......................................................................... 14
Product label..................................................................................... 16
Safety instructions and warnings for an indoor access point...... 16
Chapter 3 Install the AP in Your Network and Access It for Initial
Configuration
Position your AP for best performance.......................................... 20
Set up and connect the AP to your network.................................. 21
Connect to the AP for initial configuration.................................... 23
Connect over the Internet using the NETGEAR Insight Cloud
Portal.............................................................................................. 23
Connect over WiFi using the NETGEAR Insight app............... 26
Connect over WiFi to the device UI for initial configuration.... 28
Connect over the LAN to the device UI for initialconfiguration................................................................................. 32
Configure the AP offline using a directly connected computer........................................................................................................ 36
Log in to the AP after initial setup................................................... 40
What to do if you get a browser security warning........................ 40
Chapter 4 Install the AP in an Insight Instant Mesh WiFi Network
What are a root and a node?........................................................... 44
What is an Insight Instant Mesh WiFi network?............................. 45
Requirements for placing a node in an Insight Instant Mesh WiFi
network............................................................................................... 46
Access the Cloud Portal to set up or manage an Insight Instant Mesh
WiFi network...................................................................................... 46
Connect the AP as a node to a root using the Cloud Portal........ 47
Install the Insight app to manage an Insight Instant Mesh WiFi
network............................................................................................... 49
Connect the AP as a node to a root using the Insight app.......... 50

3

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Chapter 5 Manage the Basic WiFi Features for a WiFi network
Set up an open or secure WiFi network......................................... 55
Display or change the settings of a WiFi network........................ 64
Remove a WiFi network.................................................................... 66
Hide or broadcast the SSID for a WiFi network............................. 67
Change the VLAN ID for a WiFi network........................................ 68
Change the authentication and encryption for a WiFi network... 69
Enable or disable PMF for a WiFi network..................................... 73
Set up Multi PSK for a WiFi network............................................... 74
Disable or enable a WiFi network or set up a WiFi activity
schedule............................................................................................. 77
Enable or disable band steering..................................................... 78
Configure multi-link operation........................................................ 79
Chapter 6 Manage the Basic Radio Features
Manage the basic WiFi settings for the radios.............................. 83
Turn a radio on or off........................................................................ 86
Change the WiFi mode for a radio................................................. 87
Change the channel width for a radio............................................ 89
Change the guard interval for a radio............................................ 91
Change the output power for a radio............................................ 92
Change the channel for a radio...................................................... 93
Manage Quality of Service for a WiFi radio................................... 94
Chapter 7 Set Up and Manage a Captive Portal
Set up a click-through captive portal for a WiFi network............. 97
Set up an external captive portal for a WiFi network................... 98
Chapter 8 Manage Access and Security
Manage user accounts................................................................... 103
Add a user account.................................................................... 103
Change the time-out period for a user session...................... 104
Change the settings for a user account................................... 105
Remove a user account............................................................. 106
Set up RADIUS servers................................................................... 107
Manage neighbor AP detection................................................... 109
Enable neighbor access point detection and move access points
to the Known AP List.................................................................. 109
Import an existing neighbor access point list in the Known AP
List................................................................................................ 111
Manage global MAC ACLs and traffic policies........................... 112
Manage MAC ACLs for broadcast and multicast traffic from thewired LAN.................................................................................... 113

4

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manually set up a MAC ACL for broadcast and multicast traffic
from the wired LAN............................................................... 114
Import an existing MAC ACL for broadcast and multicast traffic
from the wired LAN............................................................... 115
Block all broadcast and multicast traffic from the wired
LAN.......................................................................................... 117
Manage the Wireless Noise Filter............................................ 118
Enable or disable the Wireless Noise Filter....................... 118
Enable, disable, or change a traffic rule in the Wireless Noise
Filter........................................................................................ 119
Change the priority for a traffic rule in the Wireless Noise
Filter........................................................................................ 122
Manage the Global Traffic Filter............................................... 123
Enable or disable the Global Traffic Filter.......................... 124
Add a traffic rule to the Global Traffic Filter....................... 125
Change a traffic rule in the Global Traffic Filter................. 128
Change the priority for a traffic rule in the Global Traffic
Filter........................................................................................ 129
Remove a traffic rule from the Global Traffic Filter........... 130
Manage SSID-based MAC ACLs and traffic policies for WiFi
networks........................................................................................... 131
Manage MAC ACLs for WiFi clients......................................... 131
Manually set up a MAC ACL for WiFi clients...................... 132
Import an existing MAC ACL for WiFi clients..................... 135
Manage MAC ACLs for broadcast and multicast traffic from WiFi
clients........................................................................................... 137
Manually set up a MAC ACL for broadcast and multicast traffic
from WiFi clients.................................................................... 138
Import an existing MAC ACL for broadcast and multicast traffic
from WiFi clients.................................................................... 140
Manage MAC/IP Traffic Filter groups for WiFi networks...... 142
Enable or disable a MAC/IP Traffic Filter group................ 143
Add a traffic rule to a MAC/IP Traffic Filter group............. 144
Change a traffic rule in a MAC/IP Traffic Filter group....... 147
Change the priority for a traffic rule in a MAC/IP Traffic Filtergroup....................................................................................... 148
Remove a traffic rule from a MAC/IP Traffic Filter group.. 149
Enable L2 security........................................................................... 149
Chapter 9 Manage the Local Area Network and IP Settings
Disable the DHCP client and set a fixed IP address................... 152
Enable the DHCP client.................................................................. 153
Set the 802.1Q VLAN and management VLAN.......................... 154
Set an existing domain name........................................................ 155

5BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Enable or disable Spanning Tree Protocol.................................. 156
Enable or disable the network integrity check function............ 157
Enable or disable IGMP snooping................................................ 158
Enable or disable the hardware assisted datapath.................... 159
Enable or disable Ethernet LLDP.................................................. 160
Enable or disable UPnP.................................................................. 161
Manage the multicast DNS gateway............................................ 162
Enable the multicast DNS gateway and add a policy............ 163
Change or remove a multicast DNS policy............................. 164
Chapter 10 Manage and Maintain the AP
Change the management mode to NETGEAR Insight or
Web-browser................................................................................... 167
Change the country or region of operation................................ 168
Change the admin user account password................................. 170
Change the system name.............................................................. 171
Specify a custom NTP server......................................................... 172
Set the time zone............................................................................ 173
Manage the syslog settings........................................................... 173
Manage the firmware of the AP.................................................... 175
Let the AP check for new firmware and update the firmware. 175
Manually download firmware and update the AP................. 177
Revert to the backup firmware................................................. 178
Use an SFTP server to update the AP...................................... 179
Manage the configuration file of the AP...................................... 181
Back up the AP configuration................................................... 181
Restore the AP configuration.................................................... 182
Use the Reset button to reboot the AP........................................ 183
Reboot the AP from the device UI................................................ 184
Schedule the AP to reboot............................................................ 185
Return the AP to its factory default settings................................ 186
Use the Reset button to reset the AP....................................... 186
Use the device UI to reset the AP............................................. 187
Enable SNMP and manage the SNMP settings........................... 188
Manage the LED............................................................................. 189
Manage the Energy Efficiency Mode........................................... 190
Chapter 11 Monitor the AP and the Network
Display the AP Internet, IP, and system settings......................... 193
Display the WiFi radio settings..................................................... 196
Display unknown and known neighbor access points............... 198
Display statistics for MAC and IP-based traffic policies............. 199
Display client distribution, connected clients, and client trends. 201

6

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Display traffic volume, fan information, statistics, and channel
utilization.......................................................................................... 204
Display or download tracked URLs.............................................. 205
Display, save, download, or clear the logs.................................. 207
Display a WiFi bridge connection................................................ 208
Display alarms and notifications................................................... 209
Chapter 12 Manage the Advanced WiFi Features for a WiFi network
Set NAT mode or Bridge mode for addressing and traffic....... 213
Enable or disable client isolation for a WiFi network................. 214
Enable or disable URL tracking for a WiFi network.................... 216
Select a MAC ACL for WiFi clients in a WiFi network................. 217
Set bandwidth rate limits for a WiFi network.............................. 219
Change the format of the DHCP offer messages in a WiFi
network............................................................................................ 220
Select a MAC ACL for broadcast and multicast traffic from WiFi
clients in a WiFi network................................................................ 222
Block all broadcast and multicast traffic for a WiFi network...... 224
Select a MAC/IP Traffic Filter group for a WiFi network............ 225
Configure advanced rate selection for a WiFi network............. 226
Assign host names to WiFi clients and manage the host namelist...................................................................................................... 229
Chapter 13 Set up a WiFi Bridge in a Wireless Distribution System
WiFi base station, WiFi repeater, and WiFi bridge requirements. 233
Set up a WiFi bridge between APs............................................... 234
Chapter 14 Manage the Advanced Radio Features
Manage the advanced WiFi settings for the radios.................... 238
Manage the maximum number of clients for a radio................. 240
Manage the broadcast and multicast settings for a radio......... 241
Manage load balancing for the radios......................................... 243
Manage sticky clients..................................................................... 245
Manage the ARP proxy................................................................... 247
Chapter 15 Diagnostics and Troubleshooting
Capture WiFi and Ethernet packets............................................. 249
Perform a ping test......................................................................... 251
Quick tips for WiFi troubleshooting............................................. 252
Troubleshoot with the LED............................................................ 253
LED remains off.......................................................................... 253
LED remains solid amber.......................................................... 254
The AP functions as a PoE PD and the LED is blinking green
continuously................................................................................ 255

7

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

LED is blinking amber slowly, continuously............................ 255
LED does not light blue in the NETGEAR Insight management
mode............................................................................................ 256
LED does not stop blinking amber, green, and blue............ 257
The node and root cannot connect.............................................. 257
Troubleshoot WiFi connectivity for a WiFi client........................ 258
Troubleshoot Internet browsing................................................... 259
You cannot log in to the AP over a LAN connection.................. 260
Changes are not saved.................................................................. 261
You enter the wrong password and can no longer log in to the
AP...................................................................................................... 261
Troubleshoot your network using the ping utility...................... 261
Test the LAN path to your AP................................................... 262
Test the path from your computer to a remote device......... 262
Appendix A Factory Default Settings and Technical Specifications
Factory default settings.................................................................. 265
Technical specifications................................................................. 270

81
Introduction
This manual is for the NETGEAR BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7
Access Point Model WBE710.
Model WBE710, in this manual referred to as the AP, supports the Wi-Fi 7 standard withIEEE 802.11be, four (2+2) data streams, and tri-band concurrent operation at 6 GHz,
5 GHz, and 2.4 GHz, allowing for a combined throughput of about 9.4 Gbps (5765 Mbps
at 6 GHz, 2882 Mbps at 5 GHz, and 688 Mbps at 2.4 GHz).
The AP can function as a Power over Ethernet plus (PoE+, 802.3at) powered device (PD)in an existing network connected to a PoE+ switch. The AP also supports a power adapter
for connection to a regular switch or router. The PoE+ Ethernet port supports speedsof 100 Mbps, 1 Gbps, and 2.5 Gbps.
This chapter contains the following sections:•

Additional documentation•

How to manage the AP•

About the device user interface and NETGEAR Insight
NOTE: For more information about the topics that are covered in this manual,
visit the support website at netgear.com/support/.
NOTE: Firmware updates with new features and bug fixes are made available
from time to time at netgear.com/support/download/. You can check for anddownload new firmware manually. If the features or behavior of your productdoes not match what is described in this manual, you might need to update thefirmware.
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

9

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Additional documentation
The following documents are available at netgear.com/support/download/:•

Installation guide•

Pro WiFi Mount Installation Guide•

Datasheet

AP management in NETGEAR Insight is described in the NETGEAR knowledge base.
See kb.netgear.com/000044338/.

How to manage the AP
For NETGEAR Insight Premium and Insight Pro subscribers, the AP supports the
NETGEAR Insight Cloud Portal and Insight app:•

Insight Cloud Portal: Lets you configure and manage the AP through the portal of
the Insight cloud-based management platform.

•

Insight app: Lets you configure and manage the AP from your iOS or Android mobile
device and connects to the Insight cloud-based management platform.

You can also manage the AP with the device UI. Management through the Insightcloud-based management platform and management through the device UI are mutually
exclusive.
You can manage and monitor the AP using the following methods:•

Insight-only management: You use only the Insight Cloud Portal or Insight app.
However, if you wish, at any time, you can change to the standalone management
method.

•Standalone management: You use the AP as a standalone device in your networkand manage and monitor the AP using the device UI only. This is the default
management method, However, if you wish, at any time, you can change to theInsight-only management method.

Introduction

10

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

About the device user interface and
NETGEAR InsightThis user manual describes the device user interface (UI), which you use if the AP
functions as a standalone access point.
For information about NETGEAR Insight subscriptions, visit
netgear.com/business/services/insight/ and kb.netgear.com/000061848.
This manual does not describe NETGEAR Insight procedures, which are documented
in the NETGEAR knowledge base. For knowledge base articles about NETGEAR Insight,
visit kb.netgear.com/000044338/.
If you install the AP as a NETGEAR Insight managed device, the settings for featuresthat you can manage through the Insight Cloud Portal and Insight app are masked out
in the device UI. However, using the device UI, you can still manage the settings forcertain features that might not yet be supported in Insight.

Introduction

11

User Manual

2
Hardware Overview
The NETGEAR BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model
WBE710 is an indoor access point.
The chapter contains the following sections:•

Unpack the AP•

Top panel LED•

Hardware interfaces•

Product label•

Safety instructions and warnings for an indoor access point12

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Unpack the AP
The package contains the following items:•

WBE710 AP with the port cover attached•

Mount plate (the adjustable size is set at the “P1” position.)•

Deep clip•

Shallow clip•

Installation guide
NOTE: Depending on the product ordered, the package might not include a
power adapter. You power up the AP by connecting it to a PoE+ switch. If you
ordered a package without a power adapter, you can still order a power adapter
as an option.

For information about the multiple mounting options, see the Pro WiFi Mount Installation
Guide, which you can download by visiting netgear.com/support/download/.

Top panel LED
The LED that provides the status of the AP is located at the edge of the top panel of theAP.
Figure 1. Top panel with LED

Table 1. LED descriptions
Color

Description

Normal behavior

Hardware Overview

Off

No power is supplied to the AP.

Solid amber,
temporarily

The AP is starting or the Reset button was pressed.

Blinking amber
slowly, temporarily

The AP is in the process of getting an IP address.

13

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Table 1. LED descriptions (Continued)
Color

Description
Blinking amber fast,
temporarily

The AP is updating firmware or is being reset to factory default
settings.

Solid blue

The AP started up, functions in Insight mode, and is connected to
the Insight cloud-based management platform.

Solid green

The AP started up and functions either as a standalone access point
or as an Insight discovered access point that is not connected to theInsight cloud-based management platform.

Blinking blue

At least one WiFi client is connected to the AP. The speed of blinking
depends on the transmit and receive data rate of connected clients.

Blinking multicolor

The AP is functioning as a node in an Insight Instant Mesh WiFi
Network and the mesh setup is in progress.

Blinking green,continuously

The PoE power that the AP is receiving is not at the required PoE+
(802.3at) level.

Blinking amber
slowly, continuously

The AP did not receive an IP address from a DHCP server.

Solid amber,continuously

A boot error occurred or the AP is malfunctioning.

Problem indication

NOTE: For information about troubleshooting with the LED, see Troubleshootwith the LED on page 253.

Hardware interfaces
The bottom panel of the AP has a LAN/PoE+ port, DC power connector for an optional
power adapter, and Reset button.

Hardware Overview

14

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Figure 2. Hardware interfaces

The bottom panel contains the following components, in the previous figure shown
from left to right:•

LAN/PoE+ port: You can use the LAN/PoE+ 2.5G RJ-45 LAN port to connect the
AP to a PoE+ (802.3at) switch, or if you use an optional power adapter, to a non-PoE
switch.
If connected to 2.5 Gbps equipment, the LAN/PoE+ port supports Ethernet speeds
up to 2.5 Gbps within your LAN. If your Internet connection, modem, router, andswitch support a speed of 2.5 Gbps, the AP’s Internet connection also functions at
2.5 Gbps. Otherwise, the Internet connection functions at the highest speed thatyour ISP connection, modem, router, and switch support.
For more information about the LAN/PoE+ port connection, see Set up and connect
the AP to your network on page 21.

•

DC power connector: If you do not use a PoE+ switch to provide power to the AP,
connect an optional power adapter to the DC power connector.

•

Reset button: You can use the Reset button to reboot the AP or to reset the AP to
its factory default settings:

Hardware Overview

15

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ Reboot: To reboot the AP, press the Reset button for about two seconds until
the LED lights solid amber, and then immediately release the button. For more
information, see Use the Reset button to reboot the AP on page 183.
○ Reset: To reset the AP to its factory default setting, press the Reset button until
the LED start blinking amber, after which you can release the button. For more
information, see Use the Reset button to reset the AP on page 186.
If you hold the Reset button, the LED first lights solid amber, and then about 5
seconds later, starts blinking amber. If you release the button while the LED lights
solid amber, the AP reboots rather than resets. The LED must be blinking amber.

Product label
The product label of the AP shows the QR code, serial number, MAC address, setup
WiFi network name (SSID), and network key (password) of the AP, as well as the default
IP address, default user name and default password to access the device UI.

Figure 3. Product label

Safety instructions and warnings for
an indoor access point
Use the following safety guidelines to ensure your own personal safety and to help
protect your system from potential damage.
To reduce the risk of bodily injury, electrical shock, fire, and damage to the equipment,
observe the following precautions:Hardware Overview

16

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

This product is designed for indoor use only in a temperature-controlled andhumidity-controlled environment. Note the following:○ For more information about the environment in which this product must operate,
see the environmental specifications in the appendix or the data sheet.
○ If you want to connect the product over an Ethernet cable to a device locatedoutdoors, the outdoor device must be properly grounded and surge protected,
and you must install an Ethernet surge protector inline between the indoor
product and the outdoor device. Failure to do so can damage the product.
○ Before connecting the product to outdoor cables or wired outdoor devices, see
https://kb.netgear.com/000057103 for additional safety and warranty information.
Failure to follow these guidelines can result in damage to your NETGEAR product,
which might not be covered by NETGEAR’s warranty, to the extent permissible byapplicable law.

•

Do not service the product except as explained in your product documentation.
Some devices should never be opened.

•

If any of the following conditions occur, unplug the product from its power source,
and then replace the part or contact your trained service provider:○ Depending on your product, the power adapter, power adapter cable, power
adapter plug, or PoE Ethernet cable is damaged.
○ An object fell into the product.
○ The product was exposed to water.
○ The product was dropped or damaged.
○ The product does not operate correctly when you follow the operating
instructions.

•

Keep the product away from radiators and heat sources. Also, do not block cooling
vents.

•Do not spill food or liquids on your product components, and never operate theproduct in a wet environment. If the product gets wet, see the appropriate section
in your troubleshooting guide, or contact your trained service provider.

•

Do not push any objects into the openings of your product. Doing so can cause fireor electric shock by shorting out interior components.

•

Use the product only with approved equipment.

•

If applicable to your product, allow the product to cool before removing covers or
touching internal components.

•

Be sure that devices that are attached over Ethernet cables are electrically rated tooperate with the power available in your location.

•

Depending on your product, use only the supplied power adapter or an Ethernet
cable that provides PoE.

Hardware Overview

17

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your product uses a power adapter:○ If you were not provided with a power adapter, contact your local NETGEAR
reseller.
○ The power adapter must be rated for the product and for the voltage and current
marked on the product electrical ratings label.
•

To help prevent electric shock, plug any system and peripheral power cables into
properly grounded power outlets.

•

If applicable to your product, the peripheral power cables are equipped withthree-prong plugs to help ensure proper grounding. Do not use adapter plugs orremove the grounding prong from a cable. If you must use an extension cable, usea three-wire cable with properly grounded plugs.

•

Observe extension cable and power strip ratings. Make sure that the total ampere
rating of all products plugged into the extension cable or power strip does notexceed 80 percent of the ampere ratings limit for the extension cable or power strip.

•

To help protect your system from sudden, transient increases and decreases inelectrical power, use a surge suppressor, line conditioner, or uninterruptible power
supply (UPS).

•

Position system cables, power adapter cables, and PoE Ethernet cables carefully.
Route cables so that they cannot be stepped on or tripped over. Be sure that nothing
rests on any cables.

•

Do not modify power adapters, power adapter cables, or plugs. Consult a licensed
electrician or your power company for site modifications.

•

Always follow your local and national wiring rules.

Hardware Overview

18

User Manual

3Install the AP in Your Network andAccess It for Initial Configuration
This chapter describes how you can install and access the AP in your network.
The chapter contains the following sections:•

Position your AP for best performance•

Set up and connect the AP to your network•

Connect to the AP for initial configuration•

Log in to the AP after initial setup•

What to do if you get a browser security warning
CAUTION: This device must be professionally installed. It is the installer’s
responsibility to follow local country regulations, including operations within
legal frequency channels, output power, and DFS requirements. The vendor,
reseller, or distributor is not responsible for illegal wireless operations. For moredetails, see the device’s terms and conditions.
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

19

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Position your AP for best
performance
Before you install and mount your AP as described in the installation guide or an
appendix to this manual, consider how you can position the AP for best performance.
WiFi clients that are within the AP WiFi range can connect to the WiFi network. However,the WiFi range can vary significantly depending on the physical placement of your AP.
For example, the thickness, density, and number of walls the WiFi signal passes throughcan limit the range.
Additionally, other WiFi devices in and around your office, home, yard, or campus, might
affect your AP’s signal. WiFi devices can be other access points, routers, repeaters, WiFi
range extenders, and any other devices that emit WiFi signals to provide network access.
Tips for positioning your AP:•

Place your AP near the center of the area where the WiFi clients operate.
A line of sight between the AP and the WiFi clients is not required for good
performance.

•

If you use a power adapter, make sure that the AP is within reach of an AC power
outlet.

•Place the AP in an elevated location, minimizing the number of walls and ceilings
between the AP and the WiFi clients.

•

Place the AP away from electrical devices such as these:○ Ceiling fans
○ Home security systems○ Microwaves○ Computers○ Bases of cordless phones○ 2.4 GHz and 5.8 GHz cordless phones•

Place the AP away from large metal surfaces, large glass surfaces, insulated walls,
and items such as these:○ Solid metal doors○ Aluminum studs○ Fish tanks○ Mirrors

Install the AP in Your Network
and Access It for Initial
Configuration

20

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ Brick○ Concrete
If you are using adjacent standalone APs, use non-overlapping radio frequency channels
to reduce interference. For more information, see Change the channel for a radio on
page 93.

Set up and connect the AP to yournetwork
You can connect the AP to a Power over Ethernet plus (PoE+, 802.3at) switch in yournetwork. The switch must be connected to a network router that is connected to theInternet. If you use a PoE+ connection, the AP does not require a power adapter.
NOTE: Depending on the product ordered, the package might not include a
power adapter. You power up the AP by connecting it to a PoE+ switch. If you
ordered a package without a power adapter but do not want to use a PoE+
connection, you can still order a power adapter as an option.
If connected to 2.5 Gbps equipment, the AP LAN/PoE+ port supports Ethernet speeds
up to 2.5 Gbps within your LAN. The following figure show a NETGEAR MS510TXUP
switch, which supports speeds of 2.5 Gbps and higher, as well as PoE+ and PoE++. If
your Internet connection, modem, router, and switch support a speed of 2.5 Gbps, theAP’s Internet connection also functions at 2.5 Gbps. Otherwise, the Internet connection
functions at the highest speed that your ISP connection, modem, router, and switch
support.

Install the AP in Your Network
and Access It for Initial
Configuration

21

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The following figure shows the AP connected to a PoE+ switch, which has a redundantconnection to a network router that is connected to the Internet.

2.5G

10G

Figure 4. Set up the AP with a PoE+connection to your network

To set up the AP with an Ethernet connection to your network:
1. Connect an Ethernet cable to the LAN/PoE+ port on the AP.
2. Connect the other end of the Ethernet cable to a port on a switch that is connected
to your network and to the Internet.
If you use a PoE+ switch, the switch port that is connected to the AP must be able
to supply 30W PoE+ power. The AP requires 802.3at (PoE+) input.
NOTE: For optimal functioning, make sure that you use an 802.3at (PoE+)
switch and not an 802.3af (PoE) switch. If the LED remains solid amber fiveminutes after the AP started up, the AP might receive insufficient PoE power.
For more information, see The AP functions as a PoE PD and the LED isblinking green continuously on page 255.
While the AP is starting or in the process of getting an IP address from a DHCP server(or router functioning as a DHCP server) in your network, the LED blinks amber slowly.
After about three minutes, the LED turns solid blue or solid green and the AP is readyfor you to perform the initial configuration.
For information about accessing the AP for initial configuration, see Connect to the AP
for initial configuration on page 23.

Install the AP in Your Network
and Access It for Initial
Configuration

22

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Connect to the AP for initialconfiguration
After you set up the AP, you can use several methods to connect to it for initialconfiguration.
For remote management of the AP (and of multiple devices and networks), you can use
the NETGEAR Insight Cloud Portal on a computer or tablet or the NETGEAR Insight app
on an iOS or Android mobile device. If you use the AP in a standalone configuration,
you can use the device UI on a computer or tablet. For more information, see Aboutthe device user interface and NETGEAR Insight on page 11.
For information about using the Insight Cloud Portal or Insight app, see one of thefollowing sections:•

Connect over the Internet using the NETGEAR Insight Cloud Portal on page 23•

Connect over WiFi using the NETGEAR Insight app on page 26

For information about using the device UI, see one of the following sections:•

Connect over WiFi to the device UI for initial configuration on page 28•

Connect over the LAN to the device UI for initial configuration on page 32•

Configure the AP offline using a directly connected computer on page 36
NOTE: If your network does not include a DHCP server (or a router that functions
as a DHCP server) and you do not perform the initial configuration of the AP as
described in one of these sections, you can connect only to the AP and the AP
can provide an IP address to only five clients. To prevent this situation, makesure that you perform the initial configuration of the AP.

Connect over the Internet using the
NETGEAR Insight Cloud Portal
The Insight Cloud Portal is available for Insight Premium or Insight Pro subscribers. To
use the NETGEAR Insight Cloud Portal to configure and manage the AP, the AP mustalready be connected to the Internet.
For more information about the Insight Cloud Portal, visit the following pages:

Install the AP in Your Network
and Access It for Initial
Configuration

23

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

netgear.com/business/services/insight/•

kb.netgear.com/000061848•

kb.netgear.com/000044343

Your NETGEAR account is also your Insight account. Your NETGEAR account credentials
let you log in as an Insight Premium user, or if you upgrade to an Insight Pro account,as an Insight Pro user.
The following figure shows the AP connected to a PoE+ switch, which has a redundantconnection to a network router that is connected to the Internet. The WiFi clients havethe NETGEAR Insight app installed or have access to the Cloud Portal.

2.5G

10G

Figure 5. Set up the AP in a NETGEAR Insight configuration

To connect to the AP over the Internet through the Insight Cloud Portal:
1. Make sure that the AP is connected to the Internet.
2. On a computer or tablet, visit insight.netgear.com.
The NETGEAR Account Login page displays.
3. If you do not already have an Insight account, you can create an account now.
For information about creating an Insight Premium account or upgrading to an
Insight Pro account, visit kb.netgear.com/000044343.

Install the AP in Your Network
and Access It for Initial
Configuration

24

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

4. Enter the email address and password for your NETGEAR account and click the
NETGEAR Sign In button.
5. Only if you are an Insight Pro user, select the organization to which you want to add
the AP.
6. Add a new network location where you want to add the AP, or select an existing
network location.
7. Click the + (Add Device) button.
NOTE: If you are an Insight Pro user, you can either add a single device or
you can add multiple Insight managed devices by uploading a device list as
a CSV file.
8. In the Add New Device pop-up page, enter the AP’s serial number and MAC address,
and then click Go.
The serial number and MAC address are on the AP label.
9. After Insight verifies that the AP is a valid product, you can optionally change thedevice name of the AP, and then click Next.
When the AP is successfully added to the portal, a page displays a confirmation that
setup is in progress.
NOTE: If the AP is online but Insight does not detect the AP, the firewall at
the physical location where the AP is located might prevent communication
with the Insight cloud. In that situation, add port and DNS entries for outboundaccess to the firewall. For more information, see kb.netgear.com/000062467.
The AP automatically updates to the latest Insight firmware and Insight location
configuration. This might take up to 10 minutes, during which time the AP will restart.
The AP is now an Insight managed device that is connected to the Insight cloud-based
management platform. If the LED was solid green, it lights solid blue.
You can use the Insight Cloud Portal or Insight app to configure and manage theAP.
NOTE: If you add the AP to a NETGEAR Insight network location and manage
the AP through the Insight Cloud Portal or Insight app, the admin password for
the AP changes. That is, after you add the AP to an Insight network location, theInsight network password for that location replaces the admin password. To
access the device UI, you must then enter the Insight network password and not
the admin password. If you later decide to remove the AP from the Insight network
location or change the management mode to Web-browser mode (see Change
the management mode to NETGEAR Insight or Web-browser on page 167), youmust continue to use the Insight network password to access the device UI until
you manually change the admin password on the AP.

Install the AP in Your Network
and Access It for Initial
Configuration

25

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Connect over WiFi using the NETGEAR
Insight app
The NETGEAR Insight app is available for Insight Premium and Insight Pro subscribers.
You can install the NETGEAR Insight app on an iOS or Android mobile device and set
up the AP (and perform many other tasks as well).
For more information about the Insight app, visit the following pages:•

netgear.com/business/services/insight/•

kb.netgear.com/000061848•

kb.netgear.com/000044343

Your NETGEAR account is also your Insight account. Your NETGEAR account credentials
let you log in as an Insight Premium user, or if you upgrade to an Insight Pro account,as an Insight Pro user.
The following figure shows the AP connected to a PoE+ switch, which has a redundantconnection to a network router that is connected to the Internet. The WiFi clients havethe NETGEAR Insight app installed or have access to the Cloud Portal.

2.5G

10G

Figure 6. Set up the AP in a NETGEAR Insight configuration

Install the AP in Your Network
and Access It for Initial
Configuration

26

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To connect to the AP over WiFi using an iOS or Android mobile device:
1. On your mobile device, go to the app store, search for NETGEAR Insight, anddownload the Insight app.

2. On your mobile device, connect over WiFi to the AP’s setup WiFi network using oneof the following methods:•

Scan the QR code: Scan the QR code on the AP label on the bottom of the AP
to connect to the setup WiFi network.

•

Connect manually: The setup WiFi network is on the AP label and is shown in
the format NETGEARxxxxxx-SETUP, where xxxxxx is the last six hexadecimal digitsof the AP’s MAC address. The default password is sharedsecret.

3. Launch the Insight app.
4. If you do not already have an Insight account, you can create an account now.
For information about creating an Insight Premium account or upgrading to an
Insight Pro account, visit kb.netgear.com/000044343.
5. Enter the email address and password for your NETGEAR account and tap LOG IN.
6. Add a new network location where you want to add the AP by tapping the Next
button, and then tapping OK.
You can also select an existing network location.
The device admin password that you entered for the new network location replaces
the existing admin password on all devices that you add to the network location.
In most situations, Insight detects the AP automatically, which can take several
minutes.
7. To add the AP to your network location, do one of the following:•

If the AP is automatically detected and listed in the Insight Manageable Devices
section, tap the icon for the AP, and then tap the ADD DEVICE button.

•

If the AP is not automatically detected, or you prefer to use another method to
add the AP, tap the + icon in the top bar, and do one of the following:○ Tap the SCAN BARCODE OR QR CODE button, and then scan the AP’s code,
which is on the AP label.
○ Tap the Enter Serial Number and MAC Address link, and then manuallyenter the AP’s serial number and MAC address, which are on the AP label.

8. If prompted, name the AP and tap the Next button.
Install the AP in Your Network
and Access It for Initial
Configuration

27

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The AP automatically updates to the latest Insight firmware and Insight location
configuration. This might take up to 10 minutes, during which time the AP will restart.
The AP is now an Insight-managed device that is connected to the Insight cloud-based
management platform. If the LED LED was solid green, it lights solid blue.
You can use the Insight Cloud Portal or Insight app to configure and manage theAP.
NOTE: If you add the AP to a NETGEAR Insight network location and manage
the AP through the Insight Cloud Portal or Insight app, the admin password for
the AP changes. That is, the Insight network password for that location replaces
the admin password. To access the device UI, you must then enter the Insight
network password and not the admin password. If you later decide to remove
the AP from the Insight network location or change the management mode toWeb-browser mode (see Change the management mode to NETGEAR Insightor Web-browser on page 167), you must continue to use the Insight network
password to access the device UI until you manually change the admin password
on the AP.

Connect over WiFi to the device UI for initialconfiguration
This section describes how to connect to the AP for the first time over WiFi using a
WiFi-enabled computer or mobile device (without using the NETGEAR Insight app) andcomplete the initial configuration.
To connect over WiFi to the device UI for initial configuration:
1. From your computer or mobile device, connect over WiFi to the AP’s setup WiFi
network using one of the following methods:•

Scan the QR code: Scan the QR code on the AP label on the bottom of the AP
to connect to the setup WiFi network.

•

Connect manually: The setup WiFi network is on the AP label and is shown in
the format NETGEARxxxxxx-SETUP, where xxxxxx is the last six hexadecimal digitsof the AP’s MAC address. The default password is sharedsecret.

2. On the computer or mobile device, launch a web browser and, in the address bar,
type http://aplogin.net.
NOTE: You can use http://aplogin.net only during initial setup of the AP.
The login page displays.
Your browser might display a security warning because of the self-signed certificate
on the AP, which is expected behavior. You can proceed, or add an exception for
Install the AP in Your Network
and Access It for Initial
Configuration

28

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and default password, and click the Login button.
The user name is admin. The default password is password. The user name andpassword are case-sensitive.
The Day Zero Easy Setup page displays.
4. Select the Web-browser radio button.
The Day Zero Easy Setup page adjusts to display multiple options.
NOTE: After you save the basic settings that are shown on the page, the Day
Zero Easy Setup page no longer displays when you log in. Instead, the login
page displays. After you log in, the Dashboard displays.
5. To let the AP check for the latest firmware, click the Check for Upgrade button.
If new firmware is available for the AP, we recommend that you upgrade the firmware.
After the firmware upgrade completes, the AP restarts. When the AP is ready, goback to Step 1 of this procedure.
6. Specify the settings that are described in the following table.
Setting

Description

Country/Region

From the menu, select the country and region in which the AP is operating.
Note: In some countries, the AP is sold with a preconfigured country or region setting
and you cannot change it.
Note: If you do not see your country or region listed in the menu, update the AP’s firmware
and check again. If you still do not see your country or region listed, contact NETGEAR
support.
Note: Make sure that the country is set to the location where the device is operating. It
might not be legal to operate the AP in a region other than the regions listed in the menu.
You are responsible for complying with the local, regional, and national regulations thatare set for channels, power levels, and frequency ranges.

Time Zone

From the menu, select the time zone for the country and region in which the AP is operating.

DHCP Client

By default, the DHCP client of the AP allows the AP to receive an IP address from a DHCP
server (or router that functions as a DHCP server) in your network.
To set up the AP with a static (fixed) IP address, do the following:a. Select the Disable radio button.
Additional fields display.
b. Specify the IP address, IP subnet mask, IP address of the default gateway, and IP addressof the DNS server.

AP NameAs an option, type a new name for the AP. The name must contain alphanumeric characters,
must contain at least one alphabetical character, cannot be longer than 64 characters,
and can contain hyphens but cannot start or end with a hyphen.
By default, the AP name is Netgearxxxxxx, in which xxxxxx represents the last six
hexadecimal digits of the AP’s MAC address.

Install the AP in Your Network
and Access It for Initial
Configuration

29

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710(Continued)
Setting

Description

AP Login New
Password

Type a new admin password. This is the password that you must use to log in to the AP’s
device UI. (It is not the password that you use for WiFi access.)
The password must be 8 to 63 characters in length and must contain at least one uppercase
letter, one lowercase letter, and one number.
Save the password for future use.

Confirm New
Password

Type exactly the same password that you typed in the AP Login New Password field.

SSID

You cannot use the setup SSID for regular operation. The setup SSID is for initial setup
only. Type a new name with a maximum of 32 characters. You can use a combination ofalphanumeric and special characters, except for quotation marks (") and a backslash (\).

7. From the Authentication menu, select one of the following authentication types for
the WiFi network, and, if applicable, set a new passphrase (network key or WiFi
password) for the WiFi network:•

Open: A legacy open WiFi network does not provide any security. Any WiFi
device can join the network. We recommend that you do not use a legacy open
WiFi network but configure WiFi security. However, a legacy open network might
be appropriate for a WiFi hotspot.
If you select Open from the Authentication menu, the Enhanced Open checkbox displays.
○ Enhanced Open check box cleared: The WiFi network is a legacy open
network without any security. This is the default option for an open network.
Clients are not authenticated, traffic is not encrypted, and 802.11w (PMF) is
automatically disabled.
○ Enhanced Open check box selected: The WiFi enhanced open feature isenabled. This feature is based on opportunistic wireless encryption (OWE).
The encryption is set to CCM mode protocol (CCMP) and 802.11w (PMF) is
automatically set to mandatory. If you select the Enhanced Open check box,
the Allow Devices to Connect with Open check box displays.
If you select the Allow Devices to Connect with Open check box, the WiFi
network can accept both clients that support the WiFi enhanced open featureand clients that do not. For clients that do not support the WiFi open enhanced
feature, traffic is not encrypted.
If you clear the Allow Devices to Connect with Open check box, the WiFi
network can only accept clients that support the WiFi enhanced open feature.

•

WPA2 Personal: This option allows only WiFi clients that support WPA2 toconnect to the SSID. Select this option if all WiFi clients are capable of supporting
WPA2. This option uses AES encryption. In the Passphrase field, type a new

Install the AP in Your Network
and Access It for Initial
Configuration

30

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.
•

WPA2/WPA Personal: This option allows both WPA and WPA2 WiFi clients toconnect to the SSID. This option uses TKIP and AES encryption. Broadcast packets
use TKIP. For unicast (that is, point-to-point) transmissions, WPA clients use TKIP
and WPA2 clients use AES. In the Passphrase field, type a new passphrase for
the WiFi network. The passphrase must be at least 8 characters in length and canbe a maximum of 63 characters in length.

•

WPA3 Personal: This option allows only WiFi clients that support WPA3 toconnect to the SSID. Select this option if all WiFi clients are capable of supporting
WPA3. This option uses SAE encryption. In the Passphrase field, type a new
passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.

•

WPA3/WPA2 Personal: This option allows both WPA2 and WPA3 WiFi clients
to connect to the SSID. This option uses AES and SAE encryption. WPA2 clientsuse AES and WPA3 clients use SAE. In the Passphrase field, type a new
passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.

Note: After you complete the setup process, you can set up WPA2 Enterprise or
WPA3 Enterprise security with RADIUS servers. For more information, see Change
the authentication and encryption for a WiFi network on page 69.
8. Click the Apply button.
Your settings are saved. A pop-up window displays the IP address and the new WiFi
network and password (passphrase).
If you specified a static IP address, save the IP address information because you must
type the IP address when you log in again.
You are disconnected from the AP. If you changed the default country, the AP restarts.
9. Reconnect over WiFi to the AP’s WiFi network using the new SSID and passphrasethat you just defined on the Day Zero Easy Setup page.
10. Type the AP IP address in the browser address bar.
If you changed the IP address, type the IP address that you specified in Step 6.
Your browser might display a security warning because of the self-signed certificate
on the AP, which is expected behavior. You can proceed, or add an exception forthe security warning. For more information, see What to do if you get a browser
security warning on page 40.
The login page displays.
11. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you just defined on the Day
Zero Easy Setup page. The user name and password are case-sensitive.
Install the AP in Your Network
and Access It for Initial
Configuration

31

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The Dashboard displays. You can now customize the AP settings for your network
environment.

Connect over the LAN to the device UI for
initial configuration
The following procedure assumes that your network includes a DHCP server (or routerthat functions as a DHCP server) and that the AP and your computer are on the same
LAN. By default, the AP functions as a DHCP client.
To connect over the LAN to the device UI for initial configuration:
1. To determine the IP address that the DHCP server assigned to the AP, access the
DHCP server or use an IP network scanner.
If you use a Windows-based computer, launch File Explorer (or Windows Explorer),select Network from the Navigation pane, right-click the AP device icon, and selectProperties to display the IP address.
NOTE: You can also use the NETGEAR Insight app to discover the IP addressthat is assigned to the AP. For more information, see Connect over WiFi using
the NETGEAR Insight app on page 26.
2. On the computer, launch a web browser and, in the address bar, type the IP addressthat is assigned to the AP.
The login page displays.
Your browser might display a security warning because of the self-signed certificate
on the AP, which is expected behavior. You can proceed, or add an exception forthe security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and default password, and click the Login button.
The user name is admin. The default password is password. The user name andpassword are case-sensitive.
The Day Zero Easy Setup page displays.
4. Select the Web-browser radio button.
The Day Zero Easy Setup page adjusts to display multiple options.
NOTE: After you save the basic settings that are shown on the page, the Day
Zero Easy Setup page no longer displays when you log in. Instead, the login
page displays. After you log in, the Dashboard displays.
5. To let the AP check for the latest firmware, click the Check for Upgrade button.

Install the AP in Your Network
and Access It for Initial
Configuration

32

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If new firmware is available for the AP, we recommend that you upgrade the firmware.
After the firmware upgrade completes, the AP restarts. When the AP is ready,depending on your situation, go back to Step 2 or Step 3 of this procedure.
6. Specify the settings that are described in the following table.
Setting

Description

Country/Region

From the menu, select the country and region in which the AP is operating.
Note: In some countries, the AP is sold with a preconfigured country or region setting
and you cannot change it.
Note: If you do not see your country or region listed in the menu, update the AP’s firmware
and check again. If you still do not see your country or region listed, contact NETGEAR
support.
Note: Make sure that the country is set to the location where the device is operating. It
might not be legal to operate the AP in a region other than the regions listed in the menu.
You are responsible for complying with the local, regional, and national regulations thatare set for channels, power levels, and frequency ranges.

Time Zone

From the menu, select the time zone for the country and region in which the AP is operating.

DHCP Client

By default, the DHCP client of the AP allows the AP to receive an IP address from a DHCP
server (or router that functions as a DHCP server) in your network.
To set up the AP with a static (fixed) IP address, do the following:a. Select the Disable radio button.
Additional fields display.
b. Specify the IP address, IP subnet mask, IP address of the default gateway, and IP addressof the DNS server.

AP NameAs an option, type a new name for the AP. The name must contain alphanumeric characters,
must contain at least one alphabetical character, cannot be longer than 64 characters,
and can contain hyphens but cannot start or end with a hyphen.
By default, the AP name is Netgearxxxxxx, in which xxxxxx represents the last six
hexadecimal digits of the AP’s MAC address.

AP Login New
Password

Type a new admin password. This is the password that you must use to log in to the AP’s
device UI. (It is not the password that you use for WiFi access.)
The password must be 8 to 63 characters in length and must contain at least one uppercase
letter, one lowercase letter, and one number.
Save the password for future use.

Confirm New
Password

Type exactly the same password that you typed in the AP Login New Password field.

SSID

You cannot use the setup SSID for regular operation. The setup SSID is for initial setup
only. Type a new name with a maximum of 32 characters. You can use a combination ofalphanumeric and special characters, except for quotation marks (") and a backslash (\).

7. From the Authentication menu, select one of the following authentication types for
the WiFi network, and, if applicable, set a new passphrase (network key or WiFi
password) for the WiFi network:

Install the AP in Your Network
and Access It for Initial
Configuration

33

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Open: A legacy open WiFi network does not provide any security. Any WiFi
device can join the network. We recommend that you do not use a legacy open
WiFi network but configure WiFi security. However, a legacy open network might
be appropriate for a WiFi hotspot.
If you select Open from the Authentication menu, the Enhanced Open checkbox displays.
○ Enhanced Open check box cleared: The WiFi network is a legacy open
network without any security. This is the default option for an open network.
Clients are not authenticated, traffic is not encrypted, and 802.11w (PMF) is
automatically disabled.
○ Enhanced Open check box selected: The WiFi enhanced open feature isenabled. This feature is based on opportunistic wireless encryption (OWE).
The encryption is set to CCM mode protocol (CCMP) and 802.11w (PMF) is
automatically set to mandatory. If you select the Enhanced Open check box,
the Allow Devices to Connect with Open check box displays.
If you select the Allow Devices to Connect with Open check box, the WiFi
network can accept both clients that support the WiFi enhanced open featureand clients that do not. For clients that do not support the WiFi open enhanced
feature, traffic is not encrypted.
If you clear the Allow Devices to Connect with Open check box, the WiFi
network can only accept clients that support the WiFi enhanced open feature.

•

WPA2 Personal: This option allows only WiFi clients that support WPA2 toconnect to the SSID. Select this option if all WiFi clients are capable of supporting
WPA2. This option uses AES encryption. In the Passphrase field, type a new
passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.

•

WPA2/WPA Personal: This option allows both WPA and WPA2 WiFi clients toconnect to the SSID. This option uses TKIP and AES encryption. Broadcast packets
use TKIP. For unicast (that is, point-to-point) transmissions, WPA clients use TKIP
and WPA2 clients use AES. In the Passphrase field, type a new passphrase for
the WiFi network. The passphrase must be at least 8 characters in length and canbe a maximum of 63 characters in length.

•

WPA3 Personal: This option allows only WiFi clients that support WPA3 toconnect to the SSID. Select this option if all WiFi clients are capable of supporting
WPA3. This option uses SAE encryption. In the Passphrase field, type a new
passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.

•

WPA3/WPA2 Personal: This option allows both WPA2 and WPA3 WiFi clients
to connect to the SSID. This option uses AES and SAE encryption. WPA2 clientsuse AES and WPA3 clients use SAE. In the Passphrase field, type a new

Install the AP in Your Network
and Access It for Initial
Configuration

34

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.
Note: After you complete the setup process, you can set up WPA2 Enterprise or
WPA3 Enterprise security with RADIUS servers. For more information, see Change
the authentication and encryption for a WiFi network on page 69.
8. Click the Apply button.
Your settings are saved. A pop-up window displays the IP address and the new WiFi
network and password (passphrase).
If you specified a static IP address, save the IP address information because you must
type the IP address when you log in again.
If you changed the default country, the AP restarts.
NOTE: Do not close the page!
After a short period, the Dashboard displays automatically. If the Dashboard does
not display, for example, because you assigned a static IP address, see the next step.
You can now customize the AP settings for your network environment.
9. If the Dashboard does not display automatically, do the following:a. Take one of the following actions:•If you assigned a static IP address to the AP, type the IP address that you
specified in Step 6 in the address bar of the web browser.

•

If you did not assign a static IP address, reenter the IP address that is displayedin the address bar of the web browser. If that does not work, write down the
IP address, close the web browser, launch the web browser again, and thentype the IP address in the address bar of the web browser.

•

If you did not assign a static IP address and you closed the page so that you
cannot see the IP address of the AP, use an IP scanner tool, use a network
discovery tool, or access the DHCP server to discover the IP address of the
AP in your network.
NOTE: You can also use the NETGEAR Insight app to discover the IP
address that is assigned to the AP. For more information, see Connect
over WiFi using the NETGEAR Insight app on page 26.
Then, launch a browser and type the IP address in the address bar.

Your browser might display a security warning because of the self-signed
certificate on the AP, which is expected behavior. You can proceed, or add an
exception for the security warning. For more information, see What to do if you
get a browser security warning on page 40.
The login page displays.
b. Type the AP user name and password, and click the Login button.
Install the AP in Your Network
and Access It for Initial
Configuration

35

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The user name is admin. The password is the one that you just defined on the
Day Zero Easy Setup page. The user name and password are case-sensitive.
The Dashboard displays. You can now customize the AP settings for your network
environment.

Configure the AP offline using a directly
connected computer
You can take the AP offline (that is, disconnect it from your network), connect a computer
through an Ethernet cable to the LAN port of the AP, and connect to the AP over its
default IP address so that you can configure it offline. After you complete theconfiguration, you can bring the AP online.
NOTE: Because the AP is not connected to a PoE+ switch, you can use thisconfiguration method only if you have a power adapter for the AP.
To connect to the AP using a computer that is directly connected to the LAN portof the AP:
1. Record the IP address and subnet mask of your computer so that you can reinstatethese IP address settings later.
2. Temporarily change the IP address on your computer to 192.168.0.210 with
255.255.255.0 as the subnet mask.
(You can actually use any IP address in the 192.168.0.2–192.168.0.254 range, withthe exception of IP address 192.168.0.100, which is the default IP address of the AP.)For more information about changing the IP address on your computer, see the help
or documentation for your computer.
3. Use an Ethernet cable to connect your computer to the LAN port on the AP.
4. On the computer, launch a web browser and type 192.168.0.100 in the addressbar.
The login page displays.
Your browser might display a security warning because of the self-signed certificate
on the AP, which is expected behavior. You can proceed, or add an exception forthe security warning. For more information, see What to do if you get a browser
security warning on page 40.
5. Type the AP user name and default password, and click the Login button.
The user name is admin. The default password is password. The user name andpassword are case-sensitive.
The Day Zero Easy Setup page displays.

Install the AP in Your Network
and Access It for Initial
Configuration

36

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

6. Select the Web-browser radio button.
The Day Zero Easy Setup page adjusts to display multiple options.
NOTE: After you save the basic settings that are shown on the page, the Day
Zero Easy Setup page no longer displays when you log in. Instead, a login
window displays. After you log in, the Dashboard displays.
7. To let the AP check for the latest firmware, click the Check for Upgrade button.
If new firmware is available for the AP, we recommend that you upgrade the firmware.
After the firmware upgrade completes, the AP restarts. When the AP is ready,depending on your situation, go back to Step 4 or Step 5 of this procedure.
8. Specify the settings that are described in the following table.
Setting

Description

Country/Region

From the menu, select the country and region in which the AP is operating.
Note: In some countries, the AP is sold with a preconfigured country or region setting
and you cannot change it.
Note: If you do not see your country or region listed in the menu, update the AP’s firmware
and check again. If you still do not see your country or region listed, contact NETGEAR
support.
Note: Make sure that the country is set to the location where the device is operating. It
might not be legal to operate the AP in a region other than the regions listed in the menu.
You are responsible for complying with the local, regional, and national regulations thatare set for channels, power levels, and frequency ranges.

Time Zone

From the menu, select the time zone for the country and region in which the AP is operating.

DHCP Client

By default, the DHCP client of the AP allows the AP to receive an IP address from a DHCP
server (or router that functions as a DHCP server) in your network.
To set up the AP with a static (fixed) IP address, do the following:a. Select the Disable radio button.
Additional fields display.
b. Specify the IP address, IP subnet mask, IP address of the default gateway, and IP addressof the DNS server.

AP NameAs an option, type a new name for the AP. The name must contain alphanumeric characters,
must contain at least one alphabetical character, cannot be longer than 64 characters,
and can contain hyphens but cannot start or end with a hyphen.
By default, the AP name is Netgearxxxxxx, in which xxxxxx represents the last six
hexadecimal digits of the AP’s MAC address.

AP Login New
Password

Type a new admin password. This is the password that you must use to log in to the AP’s
device UI. (It is not the password that you use for WiFi access.)
The password must be 8 to 63 characters in length and must contain at least one uppercase
letter, one lowercase letter, and one number.
Save the password for future use.

Install the AP in Your Network
and Access It for Initial
Configuration

37

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710(Continued)
Setting

Description

Confirm New
Password

Type exactly the same password that you typed in the AP Login New Password field.

SSID

You cannot use the setup SSID for regular operation. The setup SSID is for initial setup
only. Type a new name with a maximum of 32 characters. You can use a combination ofalphanumeric and special characters, except for quotation marks (") and a backslash (\).

9. From the Authentication menu, select one of the following authentication types for
the WiFi network, and, if applicable, set a new passphrase (network key or WiFi
password) for the WiFi network:•

Open: A legacy open WiFi network does not provide any security. Any WiFi
device can join the network. We recommend that you do not use a legacy open
WiFi network but configure WiFi security. However, a legacy open network might
be appropriate for a WiFi hotspot.
If you select Open from the Authentication menu, the Enhanced Open checkbox displays.
○ Enhanced Open check box cleared: The WiFi network is a legacy open
network without any security. This is the default option for an open network.
Clients are not authenticated, traffic is not encrypted, and 802.11w (PMF) is
automatically disabled.
○ Enhanced Open check box selected: The WiFi enhanced open feature isenabled. This feature is based on opportunistic wireless encryption (OWE).
The encryption is set to CCM mode protocol (CCMP) and 802.11w (PMF) is
automatically set to mandatory. If you select the Enhanced Open check box,
the Allow Devices to Connect with Open check box displays.
If you select the Allow Devices to Connect with Open check box, the WiFi
network can accept both clients that support the WiFi enhanced open featureand clients that do not. For clients that do not support the WiFi open enhanced
feature, traffic is not encrypted.
If you clear the Allow Devices to Connect with Open check box, the WiFi
network can only accept clients that support the WiFi enhanced open feature.

•

WPA2 Personal: This option allows only WiFi clients that support WPA2 toconnect to the SSID. Select this option if all WiFi clients are capable of supporting
WPA2. This option uses AES encryption. In the Passphrase field, type a new
passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.

•

WPA2/WPA Personal: This option allows both WPA and WPA2 WiFi clients toconnect to the SSID. This option uses TKIP and AES encryption. Broadcast packets
use TKIP. For unicast (that is, point-to-point) transmissions, WPA clients use TKIP
and WPA2 clients use AES. In the Passphrase field, type a new passphrase for

Install the AP in Your Network
and Access It for Initial
Configuration

38

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

the WiFi network. The passphrase must be at least 8 characters in length and canbe a maximum of 63 characters in length.
•

WPA3 Personal: This option allows only WiFi clients that support WPA3 toconnect to the SSID. Select this option if all WiFi clients are capable of supporting
WPA3. This option uses SAE encryption. In the Passphrase field, type a new
passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.

•

WPA3/WPA2 Personal: This option allows both WPA2 and WPA3 WiFi clients
to connect to the SSID. This option uses AES and SAE encryption. WPA2 clientsuse AES and WPA3 clients use SAE. In the Passphrase field, type a new
passphrase for the WiFi network. The passphrase must be at least 8 charactersin length and can be a maximum of 63 characters in length.

Note: After you complete the setup process, you can set up WPA2 Enterprise or
WPA3 Enterprise security with RADIUS servers. For more information, see Change
the authentication and encryption for a WiFi network on page 69.
10. Click the Apply button.
Your settings are saved. A pop-up window displays the IP address and the new WiFi
network and password (passphrase).
If you specified a static IP address, save the IP address information because you must
type the IP address when you log in again.
You are disconnected from the AP. If you changed the default country, the AP restarts.
11. After a few minutes, if the login window does not display automatically, type192.168.0.100 in the address bar of your browser.
If you changed the IP address, type the IP address that you saved in Step 8.
Your browser might display a security warning because of the self-signed certificate
on the AP, which is expected behavior. You can proceed, or add an exception forthe security warning. For more information, see What to do if you get a browser
security warning on page 40.
The login page displays.
12. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you just defined on the Day
Zero Easy Setup page. The user name and password are case-sensitive.
The Dashboard displays. You can now customize the AP settings for your network
environment.
13. After you complete the setup process, or both the setup and customization process,you can change the computer back to its original IP address settings.

Install the AP in Your Network
and Access It for Initial
Configuration

39

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Log in to the AP after initial setup
After initial setup, the AP is ready for use and you can change the settings and monitor
the traffic.
To log in to the AP’s device UI:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
The Dashboard displays various panes that let you see the status of your AP at a glance.
For more information about the Dashboard and its various panes, see Monitor the AP
and the Network on page 192.

What to do if you get a browser
security warning
When you enter the IP address that is assigned to the AP in the address field of yourbrowser, a security warning might display because of the self-signed certificate on thedevice. This is expected behavior. You can proceed, or add an exception for the security
warning.
To proceed with a security warning or add an exception for a security warning:

Install the AP in Your Network
and Access It for Initial
Configuration

40

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Google Chrome: Click the ADVANCED link. Then, click the Proceed to x.x.x.x(unsafe) link, in which x.x.x.x represents the domain name or IP address of the device.

•Apple Safari: Click the Show Details button. Then, click the visit this website link.
If a warning pop-up window displays, click the Visit Website button. If anotherpop-up window displays to let you confirm changes to your certificate trust settings,
enter your Mac user name and password and click the Update Setting button.

•

Mozilla Firefox: Click the ADVANCED button. Then, click the Add Exception button.
In the pop-up window that displays, click the Confirm Security Exception button.

•

Microsoft Edge: Select Details > Go on to the webpage.

•

Microsoft Internet Explorer: Click the Continue to this website (notrecommended) link.

Install the AP in Your Network
and Access It for Initial
Configuration

41

User Manual

4Install the AP in an Insight Instant
Mesh WiFi Network
In addition to functioning as a regular standalone access point, the AP can function inan Insight Instant Mesh WiFi network as either a root AP (which we refer to as a root) ora node AP (which we refer to as a node).
This chapter describes how you can use the NETGEAR Insight Cloud Portal or Insight
app to connect the AP to a root so that you can let the AP function as a node in an Insight
Instant Mesh WiFi network. The NETGEAR Insight Cloud Portal and Insight app are
available for Insight Premium and Insight Pro subscribers.
NOTE: To set up a node in a NETGEAR Insight Instant Mesh WiFi network witha connection to a root, you must use either the NETGEAR Insight Cloud Portal
or Insight app. You cannot use the device UI to set up a mesh WiFi connection
to a root.
For information about how you can manage and monitor the node with the Insight
Cloud Portal and Insight app, visit netgear.com/insight. The Insight Cloud Portal andInsight app have embedded help and are documented in multiple knowledge basearticles that you can access by visiting netgear.com/support.
The chapter contains the following sections:•

What are a root and a node?

•

What is an Insight Instant Mesh WiFi network?

•

Requirements for placing a node in an Insight Instant Mesh WiFi network•

Access the Cloud Portal to set up or manage an Insight Instant Mesh WiFi network•

Connect the AP as a node to a root using the Cloud Portal•

Install the Insight app to manage an Insight Instant Mesh WiFi network•

Connect the AP as a node to a root using the Insight app

42

NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

43

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

What are a root and a node?
The AP can function in an Insight Instant Mesh WiFi network as a root or node:•

Root: A mesh-capable AP that you set up with a wired connection to your network
to create a gateway to one or more mesh-capable APs that function as nodes. On
the root, use the Ethernet port for the connection to your network. A root can service
multiple nodes simultaneously.

•

Node: A mesh-capable AP with a WiFi backhaul connection to a root that provides
Internet connectivity. The node is not connected to your network over a wired
connection but over a WiFi connection.

1
2
3
4

3

5
Figure 7. Mesh network with a node and a wired root

Number or Icon and Description

1

A root that is connected over Ethernet to a network switch.

2

A node that is connected over a 6 GHz backhaul WiFi connection to the root.

3

Either a computer or a tablet with access to the Insight Cloud Portal or a mobile phone with the Insight app
The Insight Cloud Portal or Insight app lets you configure and manage the node in the Insight Instant Mesh WiFi
network.

4

A network switch.

5

A network router that is connected to the Internet.

Install the AP in an Insight Instant
Mesh WiFi Network

44

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710(Continued)
Number or Icon and Description

Broadcast in the 2.4 GHz radio band.

Broadcast in the 5 GHz radio band.

Broadcast in the 6 GHz radio band.

What is an Insight Instant Mesh WiFi
network?
A mesh WiFi network consists of at least one mesh-capable root and one or more nodes
that connect to the root over WiFi (see What are a root and a node? on page 44). The
root is connected over Ethernet to a router or Internet gateway and provides Internet
access to its nodes. The root and nodes work together to cover a potentially large areawith WiFi network, which is the mesh network.
A mesh network can be a good solution if you want to bring WiFi to the following
environments:•

Nearby rooms where cabling is not available (in line of sight and in range of thecurrent WiFi reception)•

Neighboring office buildings (in line of sight and in range of the current WiFi
reception)•

Any environment in which you cannot run cables

In the mesh WiFi network, the node connects to the root over a WiFi connection andbroadcasts (extends) the WiFi network to the WiFi clients:•

Backhaul connection: The WiFi connection between the root and the node isreferred to as the backhaul connection.

•

Fronthaul connection: The WiFi connection between the node and its WiFi clientsis referred to as the fronthaul connection.

In a NETGEAR Insight Instant Mesh WiFi network, you must use the Insight Cloud Portal
or Insight app to set up the mesh WiFi connection between the root and the node. Thatis, you cannot do so through the device UI of either the root or the node. In a networkwith multiple roots, NETGEAR Insight automatically connects the node to the root withthe strongest WiFi signal.
Install the AP in an Insight Instant
Mesh WiFi Network

45

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Although the node broadcasts the same WiFi network or networks as the root, you canalso set up a WiFi network on the node, which then can be broadcast by the root andother nodes in the mesh network.
The AP can broadcast on the 2.4 GHz band, the 5 GHz band, and the 6 GHz band (thepreferred band for the backhaul connection on the AP). Depending on the WiFi capabilityof the WiFi client, any band can provide the fronthaul connection.

Requirements for placing a node inan Insight Instant Mesh WiFi
network
The following are the requirements for placing a node in an Insight Instant Mesh WiFi
network:•

The existing WiFi network must include at least one mesh-capable access point thatruns the latest firmware version. On the root, use one Ethernet port for the connection
to your network.

•

The node must be in factory default state. If you previously used the node in yournetwork, reset the AP to factory default settings.

•

The node must be within range of the WiFi signal of a root so that it can sync withthe root. During setup, for a reliable WiFi connection, place the node less than 25 feet
(7.5 m), in a line of sight with minimal obstacles from the closest root.

•

You must use the NETGEAR Insight Cloud Portal or Insight app to install the nodein the existing WiFi network.

For information about the NETGEAR access point models that can function either as aroot or as a node, visit kb.netgear.com/000065847.

Access the Cloud Portal to set up
or manage an Insight Instant Mesh
WiFi network
The NETGEAR Insight Cloud Portal is available for Insight Premium and Insight Pro
subscribers.
Install the AP in an Insight Instant
Mesh WiFi Network

46

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

After you install the AP in an Insight Instant Mesh WiFi network, you can use the Insight
Cloud Portal to set up a mesh WiFi connection and configure, manage, and monitor
the AP.
For more information about the NETGEAR Insight Cloud Portal, visit the following pages:•

netgear.com/business/services/insight•

kb.netgear.com/000061848•

kb.netgear.com/000044338

To connect to the AP over the Internet through the Insight Cloud Portal:
1. On a computer or tablet, visit insight.netgear.com.
The NETGEAR Account Login page displays.
2. If you do not already have an Insight account, you can create an account now.
For information about creating an Insight Premium account or upgrading to an
Insight Pro account, visit kb.netgear.com/000044343.
3. Enter the email address and password for your NETGEAR account and click the
NETGEAR Sign In button.
You can now set up the AP mesh WiFi connection. For more information, see
kb.netgear.com/000061304.

Connect the AP as a node to a root
using the Cloud Portal
The NETGEAR Insight Cloud Portal is available for Insight Premium and Insight Pro
subscribers.
You can use the Insight Cloud Portal to connect the AP as a node to a root. The root
must be set up with a wired connection to a router or Internet gateway so that the root
can provide Internet connectivity to the node.
For more information about the Insight Cloud Portal and the configuration andmanagement options that are available through the Insight Cloud Portal, visit
netgear.com/insight. The Insight Cloud Portal has embedded help and is documented
in multiple knowledge base articles that you can access by visiting netgear.com/support.
The node can use any band to establish the backhaul connection to the root and thefronthaul connection to WiFi clients. However, after the backhaul connection isestablished, if both the root and the node can support the 6 GHz band, the node
automatically switches to the 6 GHz band as the preferred band for its backhaul
connection. Using the Insight Cloud Portal, you can change the backhaul settings.
Install the AP in an Insight Instant
Mesh WiFi Network

47

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To use the Insight Cloud Portal to connect the node to a root in an existing WiFi
network:
1. Make sure that the mesh mode for the Insight network location is set to Auto.
For more information, visit kb.netgear.com/000064932.
2. Make sure that the mesh mode for the root is set to Auto.
For more information, visit kb.netgear.com/000064931.
3. Make sure that node is in factory default state.
If you previously used the AP in your network, reset the AP to factory default settings.
4. For a reliable WiFi connection, place the node less than 25 feet (7.5 m), in a line ofsight with minimal obstacles from the closest root.
5. Connect the node to a power source.
The LED of the node lights amber and then lights green.
NOTE: To prevent a network loop, connect the node to a PoE++ switch thatis not connected to the same network as the root or to the Internet. You canalso use an optional power adapter.
6. Access the Insight Cloud Portal by visiting insight.netgear.com, enter your NETGEAR
email address and password, and click the NETGEAR Sign In button.
7. Only if you are an Insight Pro user, select the organization to which you want to add
the node.
8. Select the location to which you want to add the node.
9. Click the + (Add Device) button.
10. In the Add New Device pop-up page, enter the node’s serial number and MAC
address, and then click Go.
Insight detects the node automatically. This process might take a few minutes.
The node attempts to detect and connect to the root that provides the strongest
WiFi signal in the Insight Instant Mesh WiFi network.
NOTE: The initial connection and configuration process might take up to 10
minutes. The node might restart during the configuration process.
11. Wait for the node to go through the initial connection and configuration process
and for the LED to stop blinking amber, green, and blue and to light solid blue.
NOTE: The initial connection and configuration process might take up to 10
minutes. The node might restart during the configuration process.
The LED lights as follows during the initial connection and configuration process:Install the AP in an Insight Instant
Mesh WiFi Network

48

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Blinking green: The node is attempting to detect a root.

•

Solid green: The node is making its first connection with the root that provides
the strongest WiFi signal.

•

Blinking amber slowly: The node is contacting the network router or DHCP
server to receive an IP address.
If the LED does not stop blinking amber, see LED is blinking amber slowly,
continuously on page 255.

•

Blinking amber, green, and blue: The node is being configured as a managed
device in the Insight Instant Mesh WiFi network.
If the LED does not stop blinking amber, green, and blue, see LED does not stop
blinking amber, green, and blue on page 257.

When the configuration is complete, the LED lights as follows:•

Solid blue: The configuration is complete and the node is ready for operation.
The node functions in the Insight Instant Mesh WiFi network and is connected to
the Insight cloud.

The node is automatically configured to broadcast (extend) the root’s WiFi network.
If you are experiencing difficulty connecting the node with a root, see The node androot cannot connect on page 257.
For information about accessing, managing, and monitoring the node with the NETGEAR
Insight Cloud Portal and Insight app, visit netgear.com/insight. The Insight Cloud Portal
and Insight app have embedded help and are documented in multiple knowledge basearticles that you can access by visiting netgear.com/support.

Install the Insight app to manage an
Insight Instant Mesh WiFi network
The NETGEAR Insight app is available for Insight Premium and Insight Pro subscribers.
Before you can add the AP to an Insight Instant Mesh WiFi network using the NETGEAR
Insight app, you must install the app on an iOS or Android mobile device.
For more information about the NETGEAR Insight app, visit the following pages:•

netgear.com/business/services/insight•

kb.netgear.com/000061848•

kb.netgear.com/000044338

Install the AP in an Insight Instant
Mesh WiFi Network

49

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To install the Insight app to manage an Insight Instant Mesh WiFi network:
1. On your mobile device, go to the app store, search for NETGEAR Insight, anddownload the Insight app.

2. Launch the Insight app.
3. If you do not already have an Insight account, you can create an account now.
For information about creating an Insight Premium account or upgrading to an
Insight Pro account, visit kb.netgear.com/000044343.
4. Enter the email address and password for your NETGEAR account and tap LOG IN.
You can now set up the AP mesh WiFi connection (see Connect the AP as a node to aroot using the Insight app on page 50).

Connect the AP as a node to a root
using the Insight app
You can use the NETGEAR Insight app to connect the AP as a node to a root. The root
must be set up with a wired connection to a router or Internet gateway so that the root
can provide Internet connectivity to the node.
For more information about the Insight app and the configuration and management
options that are available through the Insight app, visit netgear.com/insight. The Insight
app has embedded help and is documented in multiple knowledge base articles thatyou can access by visiting netgear.com/support.
The node can use any band to establish the backhaul connection to the root and thefronthaul connection to WiFi clients. However, after the backhaul connection isestablished, if both the root and the node can support the 6 GHz band, the node
automatically switches to the 6 GHz band as the preferred band for its backhaul
connection. Using the Insight Cloud Portal, you can change the backhaul settings.
To use the NETGEAR Insight app to connect the node to a root in an existing WiFi
network:
1. Make sure that the mesh mode for the Insight network location is set to Auto.
For more information, visit kb.netgear.com/000064932.

Install the AP in an Insight Instant
Mesh WiFi Network

50

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

You cannot use the Insight app to change the mesh mode for the Insight network
location. You must use the Cloud Portal. For all other steps in this procedure, you
can use the Insight app.
2. Make sure that the mesh mode for the root is set to Auto.
For more information, visit kb.netgear.com/000064929.
3. Make sure that node is in factory default state.
If you previously used the AP in your network, reset the AP to factory default settings.
4. For a reliable WiFi connection, place the node less than 25 feet (7.5 m), in a line ofsight with minimal obstacles from the closest root.
5. Connect the node to a power source.
The LED of the node lights amber and then lights green.
NOTE: To prevent a network loop, connect the node to a PoE++ switch thatis not connected to the same network as the root or to the Internet. You canalso use an optional power adapter.
6. Connect your mobile device to the existing WiFi network that includes one or moreroots.
7. Launch the Insight app and sign in to your account.
8. Select the Insight network location with the root.
In most situations, the Insight app detects the node automatically. This process mighttake a few minutes.
9. Do one of the following to add the node to the Insight network location:•

Automatically detected: If the node is automatically detected and listed in the
Insight Manageable Devices section, tap the icon for the node, and then tap theADD DEVICE button.

•

Not automatically detected: If the node is not automatically detected, do thefollowing:a. Tap the + icon in the top bar.
b. Do one of the following:○ Tap the SCAN BARCODE OR QR CODE button, and then scan the node’scode.
○ Tap the Enter Serial Number and MAC address link, and then manuallyenter the node’s serial number and MAC address.
c. If prompted, name the node and tap the Next button.

The node attempts to detect and connect to the root that provides the strongest
WiFi signal in the Insight Instant Mesh WiFi network.

Install the AP in an Insight Instant
Mesh WiFi Network

51

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

NOTE: The initial connection and configuration process might take up to 10
minutes. The node might restart during the configuration process.
10. Wait for the node to go through the initial connection and configuration process
and for the LED to stop blinking amber, green, and blue and to light solid blue.
NOTE: The initial connection and configuration process might take up to 10
minutes. The node might restart during the configuration process.
The LED lights as follows during the initial connection and configuration process:•Blinking green: The node is attempting to detect a root.

•

Solid green: The node is making its first connection with the root that provides
the strongest WiFi signal.

•

Blinking amber slowly: The node is contacting the network router or DHCP
server to receive an IP address.
If the LED does not stop blinking amber, see LED is blinking amber slowly,
continuously on page 255.

•

Blinking amber, green, and blue: The node is being configured as a managed
device in the Insight Instant Mesh WiFi network.
If the LED does not stop blinking amber, green, and blue, see LED does not stop
blinking amber, green, and blue on page 257.

When the configuration is complete, the LED lights as follows:•

Solid blue: The configuration is complete and the node is ready for operation.
The node functions in the Insight Instant Mesh WiFi network and is connected to
the Insight cloud.

The node is automatically configured to broadcast (extend) the root’s WiFi network.
If you are experiencing difficulty connecting the node with a root, see The node androot cannot connect on page 257.
For information about accessing, managing, and monitoring the node with the NETGEAR
Insight Cloud Portal and Insight app, visit netgear.com/insight. The Insight Cloud Portal
and Insight app have embedded help and are documented in multiple knowledge basearticles that you can access by visiting netgear.com/support.

Install the AP in an Insight Instant
Mesh WiFi Network

52

User Manual5Manage the Basic WiFi Features fora WiFi network
The AP can support eight WiFi networks, each with its own unique WiFi settings, including
WiFi security. This chapter describes how you can manage the basic WiFi features fora WiFi network.
For information about the advanced WiFi features for a WiFi network, see Manage theAdvanced WiFi Features for a WiFi network on page 211.
The chapter includes the following sections:•Set up an open or secure WiFi network•

Display or change the settings of a WiFi network•

Remove a WiFi network•

Hide or broadcast the SSID for a WiFi network•

Change the VLAN ID for a WiFi network•

Change the authentication and encryption for a WiFi network•

Enable or disable PMF for a WiFi network•

Set up Multi PSK for a WiFi network•

Disable or enable a WiFi network or set up a WiFi activity schedule•

Enable or disable band steering•

Configure multi-link operation
NOTE: If you want to change the settings of a WiFi network on the AP, use awired connection to avoid being disconnected when the new WiFi settings takeeffect.

53

NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

54

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Set up an open or secure WiFi
network
The AP provides one setup SSID that is enabled by default and that broadcasts on the
2.4 GHz band, 5 GHz band, and 6 GHz band. This is the SSID that you renamed and forwhich you set a new passphrase when you initially connected to the AP. We also referto this SSID as the default WiFi network, and it is displayed as SSID1 in the device UI.
You can add more SSIDs: The AP can support a total of eight SSIDs.
The AP can simultaneously support the 2.4 GHz band for 802.11b/g/n/ax/be WiFi
devices, the 5 GHz band for 802.11a/na/ac/ax/be WiFi devices, and the 6 GHz band for802.11ax/be devices.
SSID stands for service set identifier, which is the WiFi network name. When you create
a new SSID, you are defining the settings for a new WiFi network, also referred to as
virtual access point (VAP). That means that the AP supports up to eight WiFi networks
or VAPs.
If you plan to use WPA2 Enterprise security or WPA3 Enterprise security for your WiFi
network, first set up RADIUS servers (see Set up RADIUS servers on page 107). Note that
WPA2 Enterprise security and WPA3 Enterprise security are not compatible with amulticast DNS (mDNS) gateway (see Manage the multicast DNS gateway on page 162).
To set up a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.

Manage the Basic WiFi Features
for a WiFi network

55

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The page that displays lets you select and add an SSID.
5. Click the + button to the left of Add SSID.
A pop-up page displays the settings for the SSID.
6. Specify the WiFi network name (SSID), select whether the SSID is broadcast, andspecify the VLAN ID as described in the following table.
Setting

Description

Wireless
Network Name
(SSID)The SSID is the WiFi network name of the VAP. Enter a name for the SSID with a maximumof 32 characters. You can use a combination of alphanumeric and special characters, except
for quotation marks (") and a backslash (\).
For a WiFi device to be able to connect to the VAP, the SSID on the WiFi device must matchthe SSID of the VAP.

Broadcast SSID

By default, the VAP broadcasts its SSID so that WiFi clients can detect the SSID in theirscanned network lists. To turn off the SSID broadcast, select the No radio button.
Turning off the SSID broadcast provides additional WiFi security, but users must know the
SSID to be able to join the VAP.

VLAN ID

You can enter the VLAN ID that must be associated with the VAP. By default, the VLAN ID is
1. The VLAN must be between 1 and 4094.
This VLAN ID is not the same as the 802.1Q VLAN ID that is used for the wired network (seeSet the 802.1Q VLAN and management VLAN on page 154).

7. Specify the WiFi security by selecting an option from the Authentication menu and,if applicable, by specifying a passphrase in the Passphrase field or selecting an
option from the Encryption menu:•

Open: A legacy open WiFi network does not provide any security. Any WiFi
device can join the network. We recommend that you do not use a legacy open
WiFi network but configure WiFi security. However, a legacy open network might
be appropriate for a WiFi hotspot.
If you select Open from the Authentication menu, the Enhanced Open checkbox displays.
○ Enhanced Open check box cleared: The WiFi network is a legacy open
network without any security. This is the default option for an open network.
Clients are not authenticated, traffic is not encrypted, and 802.11w (PMF) is
automatically disabled (see Step 8).
○ Enhanced Open check box selected: The WiFi enhanced open feature isenabled. This feature is based on opportunistic wireless encryption (OWE).
The encryption is set to CCM mode protocol (CCMP) and 802.11w (PMF) is
automatically set to mandatory (see Step 8). If you select the Enhanced Opencheck box, the Allow Devices to Connect with Open check box displays.
If you select the Allow Devices to Connect with Open check box, the WiFi
network can accept both clients that support the WiFi enhanced open featureManage the Basic WiFi Features
for a WiFi network

56

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

and clients that do not. For clients that do not support the WiFi open enhanced
feature, traffic is not encrypted.
In this case, the SSID name can have a maximum length of 28 characters. Also,
you can configure a maximum of two WiFi networks with OWE security andthe option to allow both clients that support the WiFi enhanced open featureand clients that do not.
If you clear the Allow Devices to Connect with Open check box, the WiFi
network can only accept clients that support the WiFi enhanced open feature.
•

WPA2 Personal: This option is not available if the 6 GHz band is enabled.
This option, which is the same as WPA2-PSK, uses AES encryption. This type of
security enables only WiFi devices that support WPA2 to join the VAP.
WPA2 provides a secure connection but some legacy WiFi devices do not detect
WPA2 and support only WPA. If your network includes such older devices, selectWPA2/WPA Personal authentication.
In the Passphrase field, enter a phrase of 8 to 63 characters. To join the VAP, auser must enter this passphrase. To display the passphrase in clear text, click theeye icon.

•

WPA2/WPA Personal: This option is not available if the 6 GHz band is enabled.
This option, which is the same as WPA2-PSK/WPA-PSK, enables WiFi devices that
support either WPA2 or WPA to join the VAP. This option uses AES and TKIP
encryption.
WPA-PSK (which uses TKIP) is less secure than WPA2-PSK (which uses AES) andlimits the speed of WiFi devices to 54 Mbps.
In the Passphrase field, enter a phrase of 8 to 63 characters. To join the VAP, auser must enter this passphrase. To display the passphrase in clear text, click theeye icon.

•

WPA2 Enterprise: This option is not available if the 6 GHz band is enabled.
This enterprise-level security uses RADIUS for centralized Authentication,
Authorization, and Accounting (AAA) management. For WPA2 Enterprise security
to function, you must set up RADIUS servers (see Set up RADIUS servers on page107).
WPA2 Enterprise security and a captive portal are mutually exclusive.
From the Encryption menu, select the data encryption mode:○ TKIP + AES. This type of data encryption enables WiFi devices that support
either WPA or WPA2 to join the AP’s WiFi network. This is the default mode.
○ AES. This type of data encryption provides a secure connection but someolder WiFi devices do not detect WPA2 and support only WPA. Therefore, if
your network includes such older devices, select TKIP + AES encryption.

Manage the Basic WiFi Features
for a WiFi network

57

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

When you select WPA2 Enterprise authentication, the Dynamic VLAN radio
buttons display:○ Enable: The RADIUS server can assign a VLAN ID to clients. If the RADIUS
server does not do so, the clients are automatically assigned the VLAN ID thatyou configured for the SSID.
○ Disable: The clients are assigned the VLAN ID that you configured for the
SSID. This is the default setting.
A dynamic VLAN is mutually exclusive with a captive portal, NAT mode, wirelessclient isolation, a multicast DNS (mDNS) gateway, and multi-link operation (MLO).
•

WPA3 Personal: This option is the most secure personal authentication option.
WPA3 uses SAE encryption and enables only WiFi devices that support WPA3
to join the VAP. If you select this option, 802.11w (PMF) is automatically set to
mandatory (see Step 8).
WPA3 provides a secure connection but some legacy WiFi devices do not detect
WPA3 and support only WPA2. If your network also includes WPA2 devices,
select WPA3/WPA2 Personal authentication.
In the Passphrase field, enter a phrase of 8 to 63 characters. To join the VAP, auser must enter this passphrase. To display the passphrase in clear text, click theeye icon.

•

WPA3/WPA2 Personal: This option, which is the same as WPA3/WPA2-PSK, isthe default setting. It enables WiFi devices that support either WPA3 or WPA2
to join the VAP. This option uses SAE and AES encryption.
WPA2-PSK (which uses AES) is less secure than WPA3 (which uses SAE).
In the Passphrase field, enter a phrase of 8 to 63 characters. To join the VAP, auser must enter this passphrase. To display the passphrase in clear text, click theeye icon.

•

WPA3 Enterprise: This enterprise-level security uses RADIUS for centralized
Authentication, Authorization, and Accounting (AAA) management. For WPA3Enterprise security to function, you must set up RADIUS servers (see Set up RADIUS
servers on page 107). If you select this option, 802.11w (PMF) is automatically set
to mandatory (see Step 8).
WPA3 Enterprise security and a captive portal are mutually exclusive.
When you select WPA3 Enterprise security, the encryption is automatically set to
GCMP256, which is a 256-bit encryption protocol.
When you select WPA3 Enterprise authentication, the Dynamic VLAN radio
buttons display:

Manage the Basic WiFi Features
for a WiFi network

58

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ Enable: The RADIUS server can assign a VLAN ID to clients. If the RADIUS
server does not do so, the clients are automatically assigned the VLAN ID thatyou configured for the SSID.
○ Disable: The clients are assigned the VLAN ID that you configured for the
SSID. This is the default setting.
A dynamic VLAN is mutually exclusive with a captive portal, NAT mode, wirelessclient isolation, a multicast DNS (mDNS) gateway, and multi-link operation (MLO).
8. Optionally, enable 802.11w Protected Management Frames (PMF).
Protected Management Frames (PMF), according to the 802.11w standard, is asecurity feature that protects unicast and multicast management frames from being
intercepted and changed for malicious purposes. The type of authentication thatyou select determines if this feature is mandatory, optional, or disabled. You canalso set it manually.
•

Mandatory: This option requires devices to use PMF. Devices that do not support
PMF cannot connect to the WiFi network. If you select Enhanced Openauthentication, WPA3 Personal authentication, or WPA3 Enterprise authentication,
the radio button for PMF is set to Mandatory, and you cannot change it.

•

Optional: This option lets the AP automatically activate PMF based on whether
devices can support PMF. If you select WPA3/WPA2 Personal authentication, theradio button for PMF is set to Optional, but you can change it.

•

Disable: This option disables PMF. If you select Open, WPA2 Personal,
WPA2/WPA Personal, or WPA2 Enterprise authentication, the radio button for
PMF is set to Disabled, but you can change it (except for Open authentication).

9. Optionally, enable Multi Pre-Shared Key (PSK), which lets you segregate the WiFi
network into different VLANs, each accessible with a unique passphrase.
Multi PSK is supported only if the WiFi security is WPA2 Personal or WPA2/WPA
Personal.
In a way, Multi PSK lets you create different sub WiFi networks on the WiFi networkthat you are setting up.
Although you can also configure this feature while you set up a WiFi network, thisfeature is more complex and therefore described separately. For more information,see Set up Multi PSK for a WiFi network on page 74.
10. Optionally, disable the WiFi broadcast or set up a WiFi activity schedule by selecting
one of the following radio buttons:

Manage the Basic WiFi Features
for a WiFi network

59

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Always ON: When you set up an SSID, you are creating a new VAP. By default,
the new VAP is enabled and the Always ON radio button is selected.

•

Always OFF: Select this radio button to set up the SSID but temporarily disable
the VAP.

•

Custom: Select this radio button to set up a broadcast schedule. An icon displays
to the right of the radio button. Do the following:a. Click the icon next to the radio button.
A pop-up window displays.
b. Either select a predefined time from the Preset menu or select custom time
blocks by clicking the time blocks.
A blue color for a time block indicates that the VAP will be enabled (on). A
gray color for a time block indicates that the VAP will be disabled (off).
c. Click the Done button.
The pop-up window closes.
For each SSID, you can create a single custom schedule. In that schedule, foreach day from 12:00 a.m. to the next day 12:00 a.m., you specify the time or times
that the VAP is disabled. You can schedule a maximum of three events for a single
day.

11. Optionally, select one or two radio bands only by clearing one or more check boxes.
Clear one or more check boxes (2.4 GHz, 5 GHz, or 6 GHz) or keep the default
selection. By default, the 2.4 GHz and 5 GHz check boxes are selected but the 6 GHz
check box is cleared, which means that the AP broadcast the SSID on the 2.4 GHz
and 5 GHz bands.
NOTE: If you enable the 6 GHz band, only WiFi clients that support WiFi 6
capabilities can connect to the 6 GHz band, as well as to the 2.4 GHz or 5 GHz
band. WiFi clients that do not support WiFi 6 capabilities can connect to the
2.4 GHz or 5 GHz band.
12. Optionally, enable band steering with 802.11k radio resource management (RRM)
and 802.11v WiFi network management.
By default, band steering with 802.11k RRM and 802.11v WiFi network management
is disabled for the VAP.
To enable band steering with 802.11k RRM and 802.11v WiFi network management,
select the Enable radio button. Doing so allows the AP, under certain channel
conditions, to steer WiFi devices to the 2.4 GHz, 5 GHz, or 6 GHz band of the VAP.
These WiFi devices must be dual-band or tri-band capable. Compared to the 2.4 GHz
band, generally more channels and bandwidth are available in the 5 GHz band, andeven more in the 6 GHz band, causing less interference and allowing for a better
user experience.
Manage the Basic WiFi Features
for a WiFi network

60

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

802.11k RRM and 802.11v WiFi network management affect the network in thefollowing ways:•

802.11k RRM: This feature lets the AP and 802.11k-aware clients dynamicallymeasure the available radio resources. In an 802.11k-enabled network, APs andclients can send neighbor reports, beacon reports, and link measurement reports
to each other, allowing 802.11k-aware clients to automatically select the best AP
for initial connection or for roaming.

•

802.11v WiFi network management: This feature lets the AP steer its WiFi
clients to the 2.4 GHz, 5 GHz, or 6 GHz band, based on the AP’s channel load.

The AP sets the received signal strength indicator (RSSI) threshold automatically.
(That is, you cannot configure the RSSI threshold manually.)
13. Optionally, enable multi-link operation (MLO).
Aggregating the AP’s radios is referred to as multi-link operation (MLO), which is a
key feature of Wi-Fi 7. Devices that communicate using MLO are called multi linkdevices (MLDs).
For MLO to function, enable at least two radios and configure the WiFi mode as
11be for each radio. . MLO improves throughput, latency, and reliability. For more
information, see Configure multi-link operation on page 79.
Under Multi-Link Operation, select one of the following radio buttons:•

Enable: MLO is enabled. The radios on which 11be is enabled are aggregatedto function as if they were a single link.

•

Disable: MLO is disabled. The radios on which 11be is enabled function
independently. This is the default setting.

14. To set the addressing and traffic mode, configure client isolation, configure URL
tracking, configure a captive portal, select a MAC ACL for WiFi clients, configure
bandwidth rate limits, or do all of this, scroll down and click the > Advanced tab.
The pop-up page expands.
15. Optionally, set the NAT mode or Bridge mode for addressing and traffic.
By default, the addressing and traffic mode of the AP is Bridge mode, which meansthat WiFi clients receive IP addresses from a DHCP server (or a router that functions
as a DHCP server) in your network. This is usually the same DHCP server that assigns
an IP address to the AP itself.
You can also set NAT mode, which enables the AP’s DHCP server for WiFi clients.
The AP’s DHCP server assigns an IP address in a different range from the IP addressof the AP itself. NAT mode and Multi PSK (see Step 9) are mutually incompatible.
From the Addressing and Traffic menu, select the addressing and traffic mode:

Manage the Basic WiFi Features
for a WiFi network

61

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Bridge: The WiFi clients receive their IP addresses from the DHCP server in thesame network as the AP. This is the default mode.

•

NAT: WiFi clients receive their IP addresses from a private DHCP address poolon the AP. If you select this mode, by default, the WLAN network address is172.31.0.0. This means that WiFi clients are assigned an IP address in the range
from 172.31.0.2 to 172.31.3.254. The IP address of the default DNS server for
the WLAN is 8.8.8.8. To change the default range for the DHCP address pool,the default DNS server, or the lease time, do the following:a. In the Network Address field, type a network address that is different fromthe network address for the AP. For example, if the AP’s IP address is in therange from 192.168.0.1 to 192.168.0.254 (a common IP address range), typea network address that is different from 192.168.0.0.
b. From the Subnet Mask menu, select one of the preconfigured subnet mask
schemes.
c. In the DNS field, enter the IP address for the DNS server that you want to use.
This IP address must be different from the WLAN network address that you
set in the previous step.
d. In the Lease Time field, type the period in minutes that the address lease isvalid for a WiFi client. The range is from 5 minutes to 43200 minutes. The
default is 1440 minutes (24 hours). After the lease expires, the WiFi client mustreconnect.
NAT mode is mutually exclusive with a dynamic VLAN (DVLAN), Multi PSK (seeStep 9), a multicast DNS (mDNS) gateway, and a management VLAN other than
VLAN 1.

16. Optionally, configure WiFi client isolation.
By default, client isolation is disabled for the VAP, and the Disable radio button is
selected.
To block communication between WiFi clients that are associated with the same
SSID or different SSIDs on the AP, select the Enable radio button.
When you select the Enable radio button, the Allow access to devices listed below
check box displays. You can then select and add static IP addresses or domains (thatresolve to static IP addresses) of network devices that are exempt from isolation sothat clients are allowed to reach them. For more information, see Enable or disable
client isolation for a WiFi network on page 214.
WiFi client isolation is mutually exclusive with a MAC/IP Traffic Filter group (see Step
22), a dynamic VLAN (DVLAN), Multi PSK (see Step 9), and a multicast DNS (mDNS)
gateway. You also cannot enable WiFi client isolation if you disallow broadcast andmulticast traffic (see Step 21) or allow it only from a group of specific devices (seeStep 22).
17. Optionally, enable URL tracking.
Manage the Basic WiFi Features
for a WiFi network

62

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

By default, URL tracking is disabled, and the Disable radio button is selected. To
enable URL tracking for all URLs that are requested by WiFi clients that are connectedto the SSID, select the Enable radio button.
For information about how to display the tracked URLs per SSID or per WiFi client,
see Display or download tracked URLs on page 205.
18. To configure a captive portal, a MAC ACL for WiFi clients, or bandwidth rate limits,
see the information in the following sections:•

Set Up and Manage a Captive Portal on page 96•

Manage MAC ACLs for WiFi clients on page 131 and Select a MAC ACL for WiFi
clients in a WiFi network on page 217•

Set bandwidth rate limits for a WiFi network on page 219

Although you can also configure these features while you set up a WiFi network,
these features are more complex and therefore described separately.
19. To change the DHCP Offer message settings, allow or disallow broadcast andmulticast traffic, select a MAC ACL for broadcast and multicast traffic from WiFi
clients, select a MAC/IP Traffic Filter group, or do all of this, scroll down and clickthe >Traffic Policy tab.
The pop-up page expands.
20. Optionally, change the DHCP Offer message settings.
When a device tries to associate with the WiFi network and negotiates an IP address,
the AP converts the broadcast DHCP offer message that it receives from the DHCP
server to a unicast message, and forwards it to the device. This is the default option(that is, the Enable radio button is selected). To disable this option so that the APdoes not convert the broadcast DHCP offer messages to unicast messages, selectthe Disable radio button.
The DHCP Offer message settings are not available and do not display on the page
if you enable multi-link operation (MLO, see Step 13).
21. To disallow broadcast and multicast traffic in the WiFi network, clear the Allow
Broadcast/Multicast Traffic check box.
By default, broadcast and multicast traffic is allowed.
22. To select a MAC ACL for broadcast and multicast traffic from WiFi clients or selecta MAC/IP Traffic Filter group, see the information in the following sections:•Manage MAC ACLs for broadcast and multicast traffic from WiFi clients on page
137 and Select a MAC ACL for broadcast and multicast traffic from WiFi clients in
a WiFi network on page 222•

Manage MAC/IP Traffic Filter groups for WiFi networks on page 142 and Select a
MAC/IP Traffic Filter group for a WiFi network on page 225

Manage the Basic WiFi Features
for a WiFi network

63

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Although you can also configure these features while you set up a WiFi network,
these features are more complex and therefore described separately.
23. To configure advance rate selection for the 2.4 GHz band and 5 GHz band, scroll
down and click the >Advanced Rate Selection tab.
For more information, see Configure advanced rate selection for a WiFi network on
page 226.
Although you can also configure this feature while you set up a WiFi network, thefeature is more complex and therefore described separately.
24. Click the Apply button.
Your settings are saved.
25. Make sure that you can connect to the new WiFi network.
If you cannot connect to the new WiFi network, check the following:•If your WiFi-enabled computer or mobile device is already connected to another
WiFi network in your area, disconnect it from that WiFi network and connect it to
the correct WiFi network. Some WiFi devices automatically connect to the first
open network without WiFi security that they discover.

•If your WiFi-enabled computer or mobile device is trying to connect to yournetwork with its old settings (before you changed the settings), update the WiFi
network selection in your WiFi-enabled computer or mobile device to match thecurrent settings for your network.

•

Does your WiFi device display as a connected client? (See Display client
distribution, connected clients, and client trends on page 201.) If it does, it isconnected to the network.

•

Are you using the correct WiFi network name (SSID) and password?

•

If the WiFi authentication and encryption is set to WPA3 Personal, make sure that
the WiFi adapter device driver is updated to the latest version on yourWiFi-enabled computer or mobile device.

Display or change the settings of a
WiFi network
You can display or change the settings of the default WiFi network (SSID or VAP) or any
custom WiFi network. The default WiFi network is the SSID that you renamed and forwhich you set a new passphrase when you initially connected to the AP. This SSID isdisplayed as SSID1 in the device UI.

Manage the Basic WiFi Features
for a WiFi network

64

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To display or change the settings of a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Change the settings of the WiFi network as needed.
For detailed descriptions of the settings, see Set up an open or secure WiFi networkon page 55.
7. If you made changes, click the Apply button.
Your settings are saved.
8. If you made changes, make sure that you can reconnect over WiFi to the networkwith its new settings.
If you cannot connect over WiFi, check the following:•If your WiFi-enabled computer or mobile device is already connected to another
WiFi network in your area, disconnect it from that WiFi network and connect it to
the correct WiFi network. Some WiFi devices automatically connect to the first
open network without WiFi security that they discover.

•If your WiFi-enabled computer or mobile device is trying to connect to yournetwork with its old settings (before you changed the settings), update the WiFi
network selection in your WiFi-enabled computer or mobile device to match thecurrent settings for your network.

Manage the Basic WiFi Features
for a WiFi network

65

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Does your WiFi device display as a connected client? (See Display client
distribution, connected clients, and client trends on page 201.) If it does, it isconnected to the network.

•

Are you using the correct WiFi network name (SSID) and password?

Remove a WiFi network
You can remove a custom WiFi network (SSID or VAP) that you no longer need. You
cannot remove the default WiFi network. The default WiFi network is the SSID that you
renamed and for which you set a new passphrase when you initially connected to the
AP. This SSID is displayed as SSID1 in the device UI.
To remove a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the trash can icon to the right of the SSID.
A warning pop-up window displays.
6. Click the Delete button.
The pop-window closes and the WiFi network is removed.

Manage the Basic WiFi Features
for a WiFi network

66

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Hide or broadcast the SSID for a
WiFi network
By default, a WiFi network (SSID or VAP) broadcasts its network name (also referred toas the SSID) so that WiFi clients can detect the SSID in their scanned network lists. For
additional security, you can turn off the SSID broadcast and hide the SSID so that users
must know the SSID to be able to join the WiFi network.
NOTE: If you set up a wireless distribution system (WDS; see Set up a WiFi
Bridge in a Wireless Distribution System on page 232), you must keep the SSID
broadcast enabled.
To hide or broadcast the network name for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Under Broadcast SSID, select one of the following radio buttons:•

No: The SSID is hidden for the WiFi network.

•

Yes: The SSID is broadcast for the WiFi network.

7. Click the Apply button.
Manage the Basic WiFi Features
for a WiFi network

67

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Your settings are saved.

Change the VLAN ID for a WiFi
network
The VLAN ID for a WiFi network is not the same as the 802.1Q VLAN ID that is used forthe wired network (see Set the 802.1Q VLAN and management VLAN on page 154).
CAUTION: Before you change the VLAN ID, be sure that the VLAN is configuredon the network switch and the DHCP server and that the AP and its clients canget IP addresses over the new VLAN.
To change the VLAN ID for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. In the VLAN ID field, enter an ID (that is, a number).
By default, the VLAN ID for a WiFi network is 1. The VLAN must be between 1 and4094.
7. Click the Apply button.
Manage the Basic WiFi Features
for a WiFi network

68

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Your settings are saved.

Change the authentication andencryption for a WiFi network
You can change the authentication and encryption of the default WiFi network (SSID or
VAP) or any custom WiFi network. The default WiFi network is the SSID that you renamed
and for which you set a new passphrase when you initially connected to the AP. This
SSID is displayed as SSID1 in the device UI.
Before you change the authentication and encryption, consider the types of clients thatmust be able to connect to the WiFi network. WPA3 provides a more secure connection
than WPA2, but some WiFi devices might not yet detect WPA3 and support only WPA2.
Similarly, WPA2 provides a more secure connection than WPA, but some legacy WiFi
devices do not detect WPA2 and support only WPA.
If you plan to use WPA2 Enterprise security or WPA3 Enterprise security for your WiFi
network, first set up RADIUS servers (see Set up RADIUS servers on page 107).
To change the authentication and encryption for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select and add an SSID.
5. Click the + button to the left of Add SSID.

Manage the Basic WiFi Features
for a WiFi network

69

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The settings for the selected SSID display.
6. From the Authentication menu, select one of the following authentication types for
the WiFi network, and, if applicable, set a new passphrase (network key or WiFi
password) in the Passphrase field or select an option from the Encryption menu:•

Open: A legacy open WiFi network does not provide any security. Any WiFi
device can join the network. We recommend that you do not use a legacy open
WiFi network but configure WiFi security. However, a legacy open network might
be appropriate for a WiFi hotspot.
If you select Open from the Authentication menu, the Enhanced Open checkbox displays.
○ Enhanced Open check box cleared: The WiFi network is a legacy open
network without any security. This is the default option for an open network.
Clients are not authenticated, traffic is not encrypted, and 802.11w (PMF) is
automatically disabled (see Enable or disable PMF for a WiFi network on page73).
○ Enhanced Open check box selected: The WiFi enhanced open feature isenabled. This feature is based on opportunistic wireless encryption (OWE).
The encryption is set to CCM mode protocol (CCMP) and 802.11w (PMF) is
automatically set to mandatory (see Enable or disable PMF for a WiFi networkon page 73). If you select the Enhanced Open check box, the Allow Devices
to Connect with Open check box displays.
If you select the Allow Devices to Connect with Open check box, the WiFi
network can accept both clients that support the WiFi enhanced open featureand clients that do not. For clients that do not support the WiFi open enhanced
feature, traffic is not encrypted.
In this case, the SSID name can have a maximum length of 28 characters. Also,
you can configure a maximum of two WiFi networks with OWE security andthe option to allow both clients that support the WiFi enhanced open featureand clients that do not.
If you clear the Allow Devices to Connect with Open check box, the WiFi
network can only accept clients that support the WiFi enhanced open feature.

•

WPA2 Personal: This option is not available if the 6 GHz band is enabled.
This option, which is the same as WPA2-PSK, uses AES encryption. This type of
security enables only WiFi devices that support WPA2 to join the VAP.
WPA2 provides a secure connection but some legacy WiFi devices do not detect
WPA2 and support only WPA. If your network includes such older devices, selectWPA2/WPA Personal authentication.
In the Passphrase field, enter a phrase of 8 to 63 characters. To join the VAP, auser must enter this passphrase. To display the passphrase in clear text, click theeye icon.

Manage the Basic WiFi Features
for a WiFi network

70

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

WPA2/WPA Personal: This option is not available if the 6 GHz band is enabled.
This option, which is the same as WPA2-PSK/WPA-PSK, enables WiFi devices that
support either WPA2 or WPA to join the VAP. This option uses AES and TKIP
encryption.
WPA-PSK (which uses TKIP) is less secure than WPA2-PSK (which uses AES) andlimits the speed of WiFi devices to 54 Mbps.
In the Passphrase field, enter a phrase of 8 to 63 characters. To join the VAP, auser must enter this passphrase. To display the passphrase in clear text, click theeye icon.

•

WPA2 Enterprise: This option is not available if the 6 GHz band is enabled.
This enterprise-level security uses RADIUS for centralized Authentication,
Authorization, and Accounting (AAA) management. For WPA2 Enterprise security
to function, you must set up RADIUS servers (see Set up RADIUS servers on page107).
WPA2 Enterprise security and a captive portal are mutually exclusive.
From the Encryption menu, select the data encryption mode:○ TKIP + AES. This type of data encryption enables WiFi devices that support
either WPA or WPA2 to join the AP’s WiFi network. This is the default mode.
○ AES. This type of data encryption provides a secure connection but someolder WiFi devices do not detect WPA2 and support only WPA. Therefore, if
your network includes such older devices, select TKIP + AES encryption.
When you select WPA2 Enterprise authentication, the Dynamic VLAN radio
buttons display:○ Enable: The RADIUS server can assign a VLAN ID to clients. If the RADIUS
server does not do so, the clients are automatically assigned the VLAN ID thatyou configured for the SSID.
○ Disable: The clients are assigned the VLAN ID that you configured for the
SSID. This is the default setting.
A dynamic VLAN is mutually exclusive with a captive portal, NAT mode, wirelessclient isolation, a multicast DNS (mDNS) gateway, and multi-link operation (MLO).

•

WPA3 Personal: This option is the most secure personal authentication option.
WPA3 uses SAE encryption and enables only WiFi devices that support WPA3
to join the VAP. If you select this option, 802.11w (PMF) is automatically set to
mandatory (see Enable or disable PMF for a WiFi network on page 73).
WPA3 provides a secure connection but some legacy WiFi devices do not detect
WPA3 and support only WPA2. If your network also includes WPA2 devices,
select WPA3/WPA2 Personal authentication.

Manage the Basic WiFi Features
for a WiFi network

71

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

In the Passphrase field, enter a phrase of 8 to 63 characters. To join the VAP, auser must enter this passphrase. To display the passphrase in clear text, click theeye icon.
•

WPA3/WPA2 Personal: This option, which is the same as WPA3/WPA2-PSK, isthe default setting. It enables WiFi devices that support either WPA3 or WPA2
to join the VAP. This option uses SAE and AES encryption.
WPA2-PSK (which uses AES) is less secure than WPA3 (which uses SAE).
In the Passphrase field, enter a phrase of 8 to 63 characters. To join the VAP, auser must enter this passphrase. To display the passphrase in clear text, click theeye icon.

•

WPA3 Enterprise: This enterprise-level security uses RADIUS for centralized
Authentication, Authorization, and Accounting (AAA) management. For WPA3Enterprise security to function, you must set up RADIUS servers (see Set up RADIUS
servers on page 107). If you select this option, 802.11w (PMF) is automatically set
to mandatory (see Enable or disable PMF for a WiFi network on page 73).
WPA3 Enterprise security and a captive portal are mutually exclusive.
When you select WPA3 Enterprise security, the encryption is automatically set to
GCMP256, which is a 256-bit encryption protocol.
When you select WPA3 Enterprise authentication, the Dynamic VLAN radio
buttons display:○ Enable: The RADIUS server can assign a VLAN ID to clients. If the RADIUS
server does not do so, the clients are automatically assigned the VLAN ID thatyou configured for the SSID.
○ Disable: The clients are assigned the VLAN ID that you configured for the
SSID. This is the default setting.
A dynamic VLAN is mutually exclusive with a captive portal, NAT mode, wirelessclient isolation, a multicast DNS (mDNS) gateway, and multi-link operation (MLO).

7. Click the Apply button.
Your settings are saved.
8. Make sure that you can connect to the new WiFi network.
If you cannot connect to the new WiFi network, check the following:•If your WiFi-enabled computer or mobile device is already connected to another
WiFi network in your area, disconnect it from that WiFi network and connect it to
the correct WiFi network. Some WiFi devices automatically connect to the first
open network without WiFi security that they discover.

•If your WiFi-enabled computer or mobile device is trying to connect to yournetwork with its old settings (before you changed the settings), update the WiFi

Manage the Basic WiFi Features
for a WiFi network

72

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

network selection in your WiFi-enabled computer or mobile device to match thecurrent settings for your network.
•

Does your WiFi device display as a connected client? (See Display client
distribution, connected clients, and client trends on page 201.) If it does, it isconnected to the network.

•

Are you using the correct WiFi network name (SSID) and password?

•

If you changed the WiFi authentication and encryption to WPA3 Personal, makesure that the WiFi adapter device driver is updated to the latest version on yourWiFi-enabled computer or mobile device.

Enable or disable PMF for a WiFi
network
Protected Management Frames (PMF), according to the 802.11w standard, is a security
feature that protects unicast and multicast management frames from being interceptedand changed for malicious purposes. The type of authentication that you selectdetermines if this feature is mandatory, optional, or disabled. You can also set it manually.
To enable or disable PMF for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
Manage the Basic WiFi Features
for a WiFi network

73

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Under 802.11w (PMF), select one of the following radio buttons:•

Mandatory: Requires devices to use PMF. Devices that do not support PMF
cannot connect to the WiFi network. If you select Enhanced Open authentication,
WPA3 Personal authentication, or WPA3 Enterprise authentication, the radio
button for PMF is set to Mandatory, and you cannot change it.

•

Optional: Lets the AP automatically activate PMF based on whether devices can
support PMF. If you select WPA3/WPA2 Personal authentication, the radio button
for PMF is set to Optional, but you can change it.

•

Disable: PMF is disabled for the WiFi network. If you select Open, WPA2 Personal,
WPA2/WPA Personal, or WPA2 Enterprise authentication, the radio button for
PMF is set to Disabled, but you can change it (except for Open authentication).

7. Click the Apply button.
Your settings are saved.

Set up Multi PSK for a WiFi network
Multi Pre-Shared Key (PSK) is supported only if the WiFi security is WPA2 Personal or
WPA2/WPA Personal.
Multi PSK lets you segregate a single WiFi network into different VLANs, each accessible
with a unique passphrase. In a way, Multi PSK lets you create different sub WiFi networks
on a single WiFi network. When connecting to the WiFi network, the passphrase that auser enters determines the VLAN that the WiFi client is placed in.
In addition to a VLAN and passphrase, you can associate a key identifier with the
VLAN-to-passphrase mapping. The key identifier lets you identify the VLANs in the WiFi
network for network monitoring purposes. For example, when you display WiFi clients,
the key identifier can also display (see Display client distribution, connected clients, andclient trends on page 201).
As examples of key identifiers, you could use terms such as corporatenetwork_22,
corporatenetwork_23, and corporatenetwork_24. These key identifiers (or the associated
VLAN IDs) are not visible to a user trying to connect to the WiFi network: the user sees
the SSID and enters the passphrase.
If you enable Multi PSK, the WiFi network’s passphrase and VLAN are replaced by the
passphrases and VLANs that are part of the Multi PSK configuration.

Manage the Basic WiFi Features
for a WiFi network

74

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

NOTE: To configure Multi PSK on the default WiFi network (displayed as SSID1
in the device UI), which is the WiFi network that you defined when you initiallyconnected to the AP, you must first change the WiFi security to WPA2 Personalor WPA2/WPA Personal.
In addition, the following restrictions apply to Multi PSK:•

You cannot enable Multi PSK for a WiFi network in the 6 GHz band.

•

You can configure Multi PSK on a maximum of four WiFi networks.

•

Each WiFi network on which you configure Multi PSK can support a maximum ofeight VLAN-to-passphrase mappings. (Within each WiFi network, each passphrase
and key identifier must be unique.) The AP can support a maximum of 32 Multi PSK
VLAN-to-passphrase mappings. For example, four WiFi networks each can support
eight Multi PSK VLAN-to-passphrase mappings.

•

Within a Multi PSK on a single WiFi network, you can map the same VLAN ID todifferent passphrases. You can also use the same VLAN ID for Multi PSK in different
WiFi networks.

•

If inter-VLAN routing is disabled in the network to which the AP is connected, thefollowing applies:○ WiFi clients that are connected to different VLANs on the same WiFi network (thatis, the WiFi clients use different passphrases to connect to the same WiFi network)
cannot communicate with each other and remain isolated.
○ WiFi clients that are connected to the same VLAN on different WiFi networks cancommunicate with each other.

•

Multi PSK and the following features are mutually exclusive:○ Multi-link operation (see Configure multi-link operation on page 79)○ Captive portal (see Set Up and Manage a Captive Portal on page 96)○ mDNS gateway (see Manage the multicast DNS gateway on page 162)
○ NAT mode (see Set NAT mode or Bridge mode for addressing and traffic on
page 213)○ Client isolation (see Enable or disable client isolation for a WiFi network on page214)

To set up Multi PSK for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.

Manage the Basic WiFi Features
for a WiFi network

75

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
You cannot configure Multi PSK on the default WiFi network (displayed as SSID1 in
the device UI), which is the WiFi network that you defined when you initially connectedto the AP.
6. Select the Multi PSK Enable radio button.
The page adjusts.
7. Configure the Multi PSK settings:
a. To add a new Multi PSK entry, specify the following settings:•

VLAN ID: The VLAN ID, which is the VLAN that a WiFi client becomes a
member of.
The VLAN ID must be between 1 and 4094.

•

Passphrase: The unique passphrase (WiFi password) that a user must enter
to let the WiFi client connect to the associated VLAN of the WiFi network.
The passphrase must be between 8 and 63 characters.

•

Key Identifier: The phrase or term that lets you identify the VLAN in the WiFi
network for monitoring purposes. The maximum length is 30 alphanumericcharacters, including the following special characters: hyphen (-) andunderscore (_).

b. To add another Multi PSK entry, click the + button to the left of Add New
Passphrase and repeat the previous step a.
c. To remove a Multi PSK entry, click the trash can icon to the right of the entry.
8. Click the Apply button.
Your settings are saved.
Manage the Basic WiFi Features
for a WiFi network

76

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Disable or enable a WiFi networkor set up a WiFi activity schedule
You can temporarily disable a WiFi network (SSID or VAP), you can reenable the WiFi
network, or you can set up a schedule that specifies when the WiFi network is active.
Scheduling a WiFi network a green feature that allows you to turn off the WiFi network
during scheduled vacations, office shutdowns, on evenings, or on weekends.
For each SSID, you can create a single custom schedule. In that schedule, for each dayfrom 12:00 a.m. to the next day 12:00 a.m., you specify the time or times that the VAP
is disabled. You can schedule a maximum of three events for a single day.
To disable or enable a WiFi network or set up a WiFi activity schedule:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Under Schedule, select one of the following radio buttons:•

Always ON: The WiFi network is enabled.

•

Always OFF: The WiFi network is disabled.

•

Custom: The WiFi network is enabled or disabled according to a schedule thatyou must set up.

Manage the Basic WiFi Features
for a WiFi network

77

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

An icon displays to the right of the radio button.
7. If you selected Custom in the previous step, do the following:a. Click the icon next to the radio button.
A pop-up window displays.
b. Either select a predefined time from the Preset menu or select custom time
blocks by clicking the time blocks.
A blue color for a time block indicates that the WiFi network will be enabled (on).
A gray color for a time block indicates that the WiFi network will be disabled (off).
c. Click the Done button.
The pop-up window closes.
8. Click the Apply button.
Your settings are saved.

Enable or disable band steering
Band steering lets the AP identify the WiFi devices that are dual-band or tri-band capableand steer those devices to the 2.4 GHz, 5 GHz, or 6 GHz band of a WiFi network (SSID
or VAP). Compared to the 2.4 GHz band, generally more channels and bandwidth areavailable in the 5 GHz band, and even more in the 6 GHz band, causing less interference
and allowing for a better user experience. Band steering includes 802.11k radio resource
management (RRM) and 802.11v WiFi network management. By default, band steering
is disabled.
802.11k RRM and 802.11v WiFi network management affect the network in the following
ways:•

802.11k RRM: This feature lets the AP and 802.11k-aware clients dynamicallymeasure the available radio resources. In an 802.11k-enabled network, APs andclients can send neighbor reports, beacon reports, and link measurement reports
to each other, allowing 802.11k-aware clients to automatically select the best AP for
initial connection or for roaming.

•

802.11v WiFi network management: This feature lets the AP steer its WiFi clientsto the 2.4 GHz, 5 GHz, or 6 GHz band, based on the AP’s channel load. In an
environment with multiple APs, 802.11v WiFi network management helps WiFi clientsthat are roaming to select the best AP.

The AP sets the received signal strength indicator (RSSI) threshold automatically. (Thatis, you cannot configure the RSSI threshold manually.)

Manage the Basic WiFi Features
for a WiFi network

78

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To enable or disable band steering with 802.11k RRM and 802.11v WiFi network
management for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Under Band Steering / 802.11 k/v, select one of the following radio buttons:•

Disable: Band steering is disabled for the VAP. This is the default setting.

•

Enable: Under certain channel conditions, the AP steers WiFi devices to the
2.4 GHz, 5 GHz, or 6 GHz band of the VAP. These WiFi devices must be dual-bandor tri-band capable.

7. Click the Apply button.
Your settings are saved.

Configure multi-link operation
Aggregating the AP’s radios is referred to as multi-link operation (MLO), which is a key
feature of Wi-Fi 7. Devices that communicate using MLO are called multi link devices(MLDs).
For MLO to function, enable at least two radios and configure the WiFi mode as 11befor each radio.
Manage the Basic WiFi Features
for a WiFi network

79

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

MLO improves throughput, latency, and reliability:•

WiFi devices are no longer limited to operating on a single channel of the 2.4 GHz,
5 GHz, or 6 GHz radio but can now utilize multiple links across frequency bands.

•

Simultaneous MLO allows traffic to be aggregated across multiple radios, which
results in the following:○ Peak throughput and low latency○ Traffic being dynamically switched between radio bands to avoid WiFi interference○ Deterministic and predictable low latency even in heavily congested environments
By default, MLO is disabled. Enabling MLO allows the MLO-capable clients to send
traffic on multiple bands at the same time.
MLO and the following features are mutually incompatible:•

MAC ACLs for WiFi networks (see Manage MAC ACLs for WiFi clients on page 131
and Manage MAC ACLs for broadcast and multicast traffic from WiFi clients on page
137)•

Multi PSK (see Set up Multi PSK for a WiFi network on page 74)•

WPA2 Enterprise security and WPA3 Enterprise security that use a dynamic VLAN
(DVLAN, see Set up an open or secure WiFi network on page 55 and Change theauthentication and encryption for a WiFi network on page 69)

To configure multi-link operation:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
Manage the Basic WiFi Features
for a WiFi network

80

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The settings for the selected SSID display.
6. Under Multi-Link Operation, select one of the following radio buttons:•

Enable: MLO is enabled. The radios on which 11be is enabled are aggregatedto function as if they were a single link.

•

Disable: MLO is disabled. The radios on which 11be is enabled function
independently. This is the default setting.
CAUTION: After you click the Apply button, all WiFi clients are temporarily
disconnected before they are automatically reconnected.

7. Click the Apply button.
Your settings are saved.

Manage the Basic WiFi Features
for a WiFi network

81

User Manual6Manage the Basic Radio Features
This chapter describes how you can manage the basic radio features of the AP. For
information about the advanced radio features, see Manage the Advanced Radio
Features on page 237.
CAUTION: If you change a radio feature on the 2.4 GHz radio, the change affects
all WiFi networks that broadcast on the 2.4 GHz radio. Similarly, if you change aradio feature on the 5 GHz or 6 GHz radio, the change affects all WiFi networks
that broadcast on the 5 GHz or 6 GHz radio. If the change is not specific to one
radio, the change affects all WiFi networks on the AP.
The chapter includes the following sections:•Manage the basic WiFi settings for the radios•

Turn a radio on or off•

Change the WiFi mode for a radio•

Change the channel width for a radio•

Change the guard interval for a radio•

Change the output power for a radio•

Change the channel for a radio•

Manage Quality of Service for a WiFi radio
NOTE: If you want to change the radio settings, use a wired connection to avoid
being disconnected when the new radio settings take effect.
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

82

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manage the basic WiFi settings forthe radios
The basic WiFi settings for each radios apply to all WiFi networks (VAPs or SSIDs) thatare configured on the radio. You can specify the radio settings for the 2.4 GHz, 5 GHz,and 6 GHz band radios individually.
To manage the basic WiFi settings for the radios:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The Wireless Settings page displays, showing the same types of settings for eachradio.
The following descriptions apply to all radios, but you can specify the radio settings
for the 2.4 GHz, 5 GHz, and 6 GHz radios individually.
5. Keep a radio on or turn it off:•

Turn Radio ON check box selected: By default, the Turn Radio ON check box
is selected and the radio broadcasts.

•

Turn Radio ON check box cleared: Turning off a radio disables WiFi access forthe band, which can be helpful during configuration, network tuning, or
troubleshooting.

6. Select one of the following Wireless Mode radio buttons for a radio, which
determines if you can set the channel width, and if so, which channel widths areavailable:
Manage the Basic Radio
Features83

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

2.4 GHz:○ 11be: 802.11be, 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clientscan connect to the AP. This is the default setting.
○ 11ax: 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clients can connect
to the AP. This is the default setting.
○ 11ng: 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clients can connect
to the AP. However, the speed of 802.11ax clients is limited to the maximum
speed that is supported by 802.11ng (about 450 Mbps).
○ 11bg: 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clients can connect
to the AP. However, the speed of 802.11ax and 802.11ng clients is limited tothe maximum speed that is supported by 802.11bg (about 54 Mbps).
○ 11b: 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clients can connect
to the AP. However, the speed of 802.11ax, 802.11n, and 802.11bg clients islimited to the maximum speed that is supported by 802.11b (about 11 Mbps).

•

5 GHz:○ 11be: 802.11be, 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients canconnect to the AP. This is the default setting.
○ 11ax: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect
to the AP.
○ 11ac: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect
to the AP. However, the speed of 802.11be and 802.11ax clients is limited tothe maximum speed that is supported by 802.11ac (about 867 Mbps).
○ 11na: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect
to the AP. However, the speed of 802.11be, 802.11ax, and 802.11ac clients
is limited to the maximum speed that is supported by 802.11na (about 450Mbps).
○ 11a: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect to
the AP. However, the speed of 802.11ax, 802.11ac, 802.11na clients is limited
to the maximum speed that is supported by 802.11a (up to about 54 Mbps).

•

6 GHz:○ 11be: 802.11be and 802.11ax WiFi clients can connect to the AP. This is thedefault setting.
○ 11ax: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect
to the AP.

7. From the Channel Width menu for a radio, select the channel width, keeping in
mind that a wider channel improves the performance (no or minimal interference
and better data rates):•

2.4 GHz: The channel width depends on the wireless mode:

Manage the Basic Radio
Features84

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ 11be, 11ac, and 11ng: 20 MHz, 40 MHz, or Dynamic 20 / 40 MHz. The default
is 20 MHz.
○ 11bg and 11b: You cannot select the channel width.
•

5 GHz: The channel width depends on the wireless mode:○ 11be, 11ax, and 11ac: 20 MHz, 40 MHz, 80 MHz, 160 MHz, or Dynamic 20/ 40 /80 / 160 MHz. The default is 40 MHz.
○ 11na: 20 MHz, 40 MHz, or Dynamic 20 / 40 MHz. The default is 40 MHz.
○ 11a: You cannot select the channel width.
The 40 MHz, 80 MHz, and 160 MHz channels enable higher data rates but leave
fewer channels available for use on the 5 GHz radio.

•

6 GHz: The channel width depends on the wireless mode:○ 11be: 20 MHz, 40 MHz, 80 MHz, 160 MHz, 320 MHz or Dynamic 20 / 40 /80/ 160 / 320 MHz. The default is 80 MHz.
○ 11ax: 20 MHz, 40 MHz, 80 MHz, 160 MHz, or Dynamic 20 / 40 /80 / 160 MHz.
The default is 80 MHz.

For more information, see Change the channel width for a radio on page 89.
8. Guard Interval: The guard interval protects radio transmissions from interference.
Your selection from the Wireless Mode menu determines if you can set the guardinterval, and if so, which guard intervals are available. For the 11a, 11b, and 11bg
WiFi modes, you cannot set the guard interval at all.
From the menu, select one of the following settings:•

Auto: The guard interval is set automatically by the AP. This option is not available
in the 11be and 11ax WiFi modes.

•

Long-800 ns: This option is available in the 11ax, 11ac, 11na, and 11ng modes.
In the 11be and 11ax WiFi modes, this option is the default setting.

•

Double Long-1600 ns: This option is available only in the 11be and 11ax WiFi
modes.

•

Quadruple Long-3200 ns: This option is available only in the 11be and 11ax
WiFi modes

9. Output power: From the menu, select the transmission power of the radio. You canselect 100%(Max), 50%, 25%, 12.5%, or 4%(Min). The default is 100%(Max).
NOTE: If two or more access points are operating in the same area and on
the same channel, interference can occur. In this situation, you might want
to decrease the output power for the AP. Make sure that you comply with theregulatory requirements for total radio frequency (RF) output power in yourcountry.

Manage the Basic Radio
Features85

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

10. Channel: From the menu, select the WiFi channel for the radio. The available WiFi
channels and frequencies depend on the country that you selected for the AP andon the radio. The default is Auto, which enables a radio to automatically select themost suitable channel.
NOTE: You do not need to change the WiFi channel unless you experienceinterference (which is indicated by lost connections).
NOTE: If you use multiple access points, reduce interference by selecting
non-overlapping channels for adjacent access points. We recommend achannel spacing of four channels between adjacent access points (forexample, in the 2.4 GHz band, use channels 1 and 5, or 6 and 10).
11. Click the Apply button.
A warning pop-up window displays.
12. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Turn a radio on or off
By default, the 2.4 GHz, 5 GHz , and 6 GHz radios broadcast. Turning off a radio disables
WiFi access for the associated band, which affects all WiFi networks (VAPs or SSIDs) inthat band. Turning off a radio can be helpful during configuration, network tuning, or
troubleshooting.
To turn a radio on or off:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network

Manage the Basic Radio
Features86

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The Wireless Settings page displays.
5. Take one of the following actions:•

Turn a radio on: Select the Turn Radio ON check box for the radio.

•

Turn a radio off: Clear the Turn Radio ON check box for the radio.

6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Change the WiFi mode for a radio
By default, all types of WiFi clients can access a WiFi network on the AP, that is, the WiFi
modes on the AP support 802.11be, 802.11ax, 802.11ac, 802.11na, 802.11ng, 802.11bg,
802.11b, and 802.11a clients. You can change the WiFi modes to limit access to certain
types of clients.
To change the WiFi mode for a radio:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.

Manage the Basic Radio
Features87

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The Wireless Settings page displays.
5. Select one of the following Wireless Mode radio buttons for a radio, which
determines if you can set the channel width, and if so, which channel widths areavailable:•

2.4 GHz:○ 11be: 802.11be, 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clientscan connect to the AP. This is the default setting.
○ 11ax: 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clients can connect
to the AP. This is the default setting.
○ 11ng: 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clients can connect
to the AP. However, the speed of 802.11ax clients is limited to the maximum
speed that is supported by 802.11ng (about 450 Mbps).
○ 11bg: 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clients can connect
to the AP. However, the speed of 802.11ax and 802.11ng clients is limited tothe maximum speed that is supported by 802.11bg (about 54 Mbps).
○ 11b: 802.11ax, 802.11ng, 802.11bg, and 802.11b WiFi clients can connect
to the AP. However, the speed of 802.11ax, 802.11n, and 802.11bg clients islimited to the maximum speed that is supported by 802.11b (about 11 Mbps).

•

5 GHz:○ 11be: 802.11be and 802.11ax Wi-Fi clients can connect to the AP. This is thedefault setting.
○ 11ax: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect
to the AP.
○ 11ac: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect
to the AP. However, the speed of 802.11be and 802.11ax clients is limited tothe maximum speed that is supported by 802.11ac (about 867 Mbps).
○ 11na: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect
to the AP. However, the speed of 802.11be, 802.11ax, and 802.11ac clients
is limited to the maximum speed that is supported by 802.11na (about 450Mbps).
○ 11a: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect to
the AP. However, the speed of 802.11ax, 802.11ac, 802.11na clients is limited
to the maximum speed that is supported by 802.11a (up to about 54 Mbps).

•

6 GHz:

Manage the Basic Radio
Features88

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ 11be: 802.11be and 802.11ax Wi-Fi clients can connect to the AP. This is thedefault setting.
○ 11ax: 802.11ax, 802.11ac, 802.11na, and 802.11a WiFi clients can connect
to the AP.
6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Change the channel width for aradio
Use the following guidelines when you determine the channel width for a radio:•

A wider channel generally improves the performance (no or minimal interference
and better data rates).

•

A narrower channel generally results in lower throughput but might provide a morestable connection in a demanding situation, such as an environment with a long
distance between the AP and WiFi clients and more than normal interference.

•

The 802.11n specification allows a 40 MHz–wide channel in addition to the legacy
20 MHz channel width that is available with other WiFi modes.

•

The 802.11ac and 802.11ax specifications for the 5 GHz band (and, by extension forthe 6 GHz radio) allow an 80 MHz–wide channel and 160–wide channel in addition
to the 20 MHz and 40 MHz channel widths that are available with other WiFi modes.

•

The 802.11be specification for the 6 GHz radio allows a 320–wide MHz channel in
addition to the 20 MHz, 40 MHz, 80 MHz, and 160 MHz channel widths that areavailable with other WiFi modes.
NOTE: We recommend that you leave the default options: 20 MHz for the
2.4 GHz radio, 40 MHz for the 5 GHz radio, and 80 MHz for the 6 GHz radio.

The WiFi mode (see Change the WiFi mode for a radio on page 87) determines if you
can set the channel width, and if so, which channel widths are available.
To change the channel width for a radio:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
Manage the Basic Radio
Features89

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The Wireless Settings page displays.
5. From the Channel Width menu for a radio, select the channel width, keeping in
mind that a wider channel improves the performance (no or minimal interference
and better data rates):•

2.4 GHz: The channel width depends on the wireless mode:○ 11be, 11ax, and 11ac: 20 MHz, 40 MHz, or Dynamic 20 / 40 MHz. The default
is 20 MHz.
○ 11bg and 11b: You cannot select the channel width.

•

5 GHz: The channel width depends on the wireless mode:○ 11be, 11ax, and 11ac: 20 MHz, 40 MHz, 80 MHz, 160 MHz, or Dynamic 20/ 40 /80 / 160 MHz. The default is 40 MHz.
○ 11na: 20 MHz, 40 MHz, or Dynamic 20 / 40 MHz. The default is 40 MHz.
○ 11a: You cannot select the channel width.
The 40 MHz, 80 MHz, and 160 MHz channels enable higher data rates but leave
fewer channels available for use on the 5 GHz radio.

•

6 GHz: The channel width depends on the wireless mode:○ 11be: 20 MHz, 40 MHz, 80 MHz, 160 MHz, 320 MHz or Dynamic 20 / 40 /80/ 160 / 320 MHz. The default is 80 MHz.
○ 11ax: 20 MHz, 40 MHz, 80 MHz, 160 MHz, or Dynamic 20 / 40 /80 / 160 MHz.
The default is 80 MHz.

6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
Manage the Basic Radio
Features90

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Change the guard interval for a
radio
From the menu, select the guard interval, which protects radio transmissions frominterference. The WiFi mode (see Change the WiFi mode for a radio on page 87)
determines if you can set the guard interval, and if so, which guard intervals are available.
For the 11a, 11b, and 11bg WiFi modes, you cannot set the guard interval at all.
Use the following guidelines:•

A shorter guard interval supports more throughput in an environment in which WiFi
devices operate at a shorter distance from the AP.

•

A longer guard interval works well in an environment with multiple SSIDs and WiFi
devices that operate at a longer distance from the AP.

•

Some legacy devices can operate with a long –800ns guard interval only.

To change the guard interval for a radio:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The Wireless Settings page displays.
5. From the Guard Interval menu for the radio, select one of the following settings:
Manage the Basic Radio
Features91

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Auto: The guard interval is set automatically by the AP. This option is not available
in the 11be and 11ax WiFi modes.

•

Long-800 ns: This option is available in the 11ax, 11ac, 11na, and 11ng modes.
In the 11be and 11ax WiFi modes, this option is the default setting.

•

Double Long-1600 ns: This option is available only in the 11be and 11ax WiFi
modes.

•

Quadruple Long-3200 ns: This option is available only in the 11be and 11ax
WiFi modes

6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Change the output power for aradio
By default, the output power of the AP is set at the maximum. If two or more accesspoints are operating in the same area and on the same channel, interference can occur.
In such a situation, you might want to decrease the output power for the AP. Make surethat you comply with the regulatory requirements for total radio frequency (RF) output
power in your country.
To change the output power for a radio:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
Manage the Basic Radio
Features92

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The Wireless Settings page displays.
5. From the Output Power menu for the radio, select 100%(Max), 50%, 25%, 12.5%,
or 4%(Min).
The default is 100%(Max).
6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Change the channel for a radio
The available WiFi channels and frequencies depend on the country that you select for
the AP and the radio. The default is Auto, which enables a radio to automatically selectthe most suitable channel.
NOTE: You do not need to change the WiFi channel unless you experienceinterference (which is indicated by lost connections).
NOTE: If you use multiple access points, reduce interference by selecting
non-overlapping channels for adjacent access points. We recommend a channel
spacing of four channels between adjacent access points (for example, in the
2.4 GHz band, use channels 1 and 5, or 6 and 10).
To change the channel for a radio:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.

Manage the Basic Radio
Features93

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The Wireless Settings page displays.
5. From the Channel menu for the radio, select a channel.
The default is Auto. When you select a particular channel, the channel selection
becomes static.
6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Manage Quality of Service for a
WiFi radio
You can specify the Quality of Service (QoS) setting for the 2.4 GHz, 5 GHz, and 6 GHz
radios separately. These settings are enabled by default for each radio. Disabling QoS
for a radio might impact the throughput and speed of WiFi traffic on the AP.
To manage the QoS settings for a WiFi radio:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
Manage the Basic Radio
Features94

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > QoS Settings.
The QoS Settings page displays.
5. Enable or disable the following features for the radio by selecting the applicable
Enable or Disable radio buttons:•

Wi-Fi Multimedia (WMM): WiFi Multimedia (WMM) is a subset of the 802.11e
standard. Time-dependent information such as video or audio is given higher
priority than normal traffic. For WMM to function correctly, WiFi clients must also
support WMM. By enabling WMM, you allow WMM to control upstream traffic
flowing from WiFi devices to the AP and downstream traffic flowing from the AP
to WiFi devices. WMM defines the following four queues in decreasing order ofpriority:○ Voice: The highest priority queue with minimum delay, which makes it very
suitable for applications such as VoIP and streaming media.
○ Video: The second highest priority queue with low delay. Video applications
are routed to this queue.
○ Best effort: The medium priority queue with medium delay. Most standard
IP applications use this queue.
○ Background: The low priority queue with high throughput. Applications suchas FTP that are not time-sensitive but require high throughput can use thisqueue.

•WMM Powersave: Enabling the WMM Powersave feature saves power forbattery-powered devices and fine-tunes power consumption.

6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Manage the Basic Radio
Features95

User Manual

7
Set Up and Manage a Captive Portal
This chapter describes how you can set up and manage a captive portal on the AP.
A captive portal is a web page that users see when they attempt to connect to a WiFi
network. A captive portal includes a splash page and usually requires some form ofauthentication for the user. The AP supports two types of captive portals:•

Click-through captive portal: A basic portal for which the splash page is stored on
the AP. For each WiFi network, you can set up a unique click-through captive portal.

•

External captive portal: A portal that is hosted by an external captive portal vendor.
You can apply an external captive portal to multiple WiFi networks or you can apply
a unique external captive portal to each WiFi network.

The chapter includes the following sections:•Set up a click-through captive portal for a WiFi network•

Set up an external captive portal for a WiFi network
NOTE: A captive portal is not compatible with Multi PSK. To enable a captive
portal, first disable Multi PSK (see Set up Multi PSK for a WiFi network on page74).
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

96

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Set up a click-through captive portal
for a WiFi network
A click-through captive portal is a basic portal for which the splash page is stored on
the AP, that is, it is not an external captive portal. Use a click-through captive portal towelcome or instruct WiFi users and limit their sessions. You can require users to agree
to an end user license agreement (EULA) and redirect them to a specific website. A
click-through captive portal is specific to the WiFi network (SSID) on which you set it up.
To set up a click-through captive portal for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Select the Captive Portal check box.
The page adjusts. By default, the Click Through radio button is selected.
8. Specify the click-through settings as described in the following table.

Set Up and Manage a Captive
Portal97

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Setting

Description

Session Timeout (inmin)

Enter the number of minutes from 1 to 1440 after which a WiFi session is terminatedand a user must log in again. The default is 60 minutes.

Redirect URL

To redirect a user to a specific website after login, select the Redirect URL check box
and enter the URL. If the Redirect URL check box is cleared, a user is directed to thedefault web page.

Title

Enter the title that is displayed on the captive portal login page. If you do notcustomize the title, the default title displays on the captive portal login page.

MessageEnter a message to the user. This message is displayed on the captive portal login
page. If you do not customize the message, the default message displays on thecaptive portal login page.

JPEG/JPG Image(Max 500 KB)

To customize the image that is displayed on the captive portal login page, click theBrowse button and navigate to and select an image. If you do not customize theimage, the default image displays on the captive portal login page.

EULA (Max 1 KB)

The field includes a default end user license agreement (EULA). You can enter or
copy custom text into the field. To show the EULA on the captive portal login page,
select the EULA check box.

9. To preview the captive portal login page, click the Preview button.
10. Click the Apply button.
Your settings are saved. WiFi clients attempting to connect to the SSID are presented
with the captive portal login page.
NOTE: An HTTPS session is blocked until after the captive portal
authentication occurs.

Set up an external captive portal fora WiFi network
An external captive portal is a portal that is hosted by an external captive portal vendor.
That is, this type of portal is not stored on the AP. For an external captive portal, you
generally must register your devices with and purchase licenses from the vendor.
You can apply an external captive portal to multiple WiFi networks or you can apply aunique external captive portal to each WiFi network
To set up an external captive portal for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
Set Up and Manage a Captive
Portal98

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > WLAN Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Select the Captive Portal check box.
The page adjusts. By default, the Click-Through radio button is selected.
8. Click the External Captive Portal radio button.
The page adjusts.
9. In the Splash Page URL field, enter the URL that is provided by the vendor.
This URL redirects a user to the splash page on the website that hosts the captive
portal. The length of the splash page URL can be up to 256 characters.
10. Select one of the following Captive Portal Authentication Type radio buttons:•

Web/HTTP: Authentication for access to the splash page occurs on the AP using
the HTTPS protocol. Specify the following settings:○ Web Authentication URL: Enter the web authentication URL that is provided
by the vendor.
The length of the web authentication URL can be up to 256 characters.
○ Key: Enter the key credential that is provided by the vendor. This field is
optional and depends on the authentication requirements of the vendor.
The length of the key can be up to 31 characters.
○ Secret: Enter the secret credential that is provided by the vendor. This field
is optional and depends on the authentication requirements of the vendor.

Set Up and Manage a Captive
Portal99

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The length of the key can be up to 63 characters.
•

Radius: Authentication for access to the splash page occurs on an external RADIUS
authentication server (a secondary RADIUS authentication server is an option).
The vendor might also require an accounting RADIUS server (a secondary RADIUS
accounting server is an option).
Specify the following settings for each RADIUS server, as directed by the vendor:○ IPv4 Address: Enter the IP address of the server. The IP address is provided
by the vendor.
○ Port: Enter the port number that is used by the server. The IP port number isprovided by the vendor. By default, an authentication server uses port number
1812; an accounting server uses port number 1813.
The port number range can be from 1 to 65335.
○ Password: Enter the password (shared secret) for interaction with the server.
The password is provided by the vendor.
The password must be a minimum of 8 characters and can be a maximum of
64 characters.

11. Select one of the following FailSafe buttons to specify if users are allowed to reachthe splash page and access the Internet if authentication is not possible:•

Enable: If authentication is not possible—for example, because captive portal
servers do not respond—users are still allowed to access the Internet for a periodof 30 minutes.

•

Disable: This is the default setting. If authentication is not possible, users cannot
reach the splash page and cannot access the Internet. Instead, they get a message
Oops. Something went wrong. Please try after some time.

12. Select one of the following Allow HTTPS buttons to specify when secure HTTP
(HTTPS) traffic is allowed to pass through:•Enable: Before authentication occurs, HTTPS traffic is allowed to pass through.

•Disable: This is the default setting. HTTPS traffic is allowed only after
authentication occurs.

13. Configure the walled garden settings.
The walled garden specifies the external applications and sites that a user can accessfrom the captive portal. Generally, the vendor provides information about theapplications and sites. The vendor splash page, domain name, and authentication
servers must also be included in the walled garden. Follow the directions of thevendor.
You can do the following to configure the walled garden:

Set Up and Manage a Captive
Portal100

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Add a single URL: In the right field, type the URL, press Enter, and click the Movebutton.

•Add multiple URLs: In the right field, paste a list of URLs, and click the Movebutton.

•Remove one or more URLs: Select the check boxes for URLs, and click theRemove button.

•

Remove all URLs: Select the Select All check box, and click the Remove button.

14. Click the Apply button.
Your settings are saved. WiFi clients attempting to connect to the SSID are presented
with the captive portal login page.

Set Up and Manage a Captive
Portal101

User Manual

8Manage Access and Security
This chapter describes how you can manage access and security features and user
accounts.
The chapter includes the following sections:•Manage user accounts•

Set up RADIUS servers•

Manage neighbor AP detection•

Manage global MAC ACLs and traffic policies•

Manage SSID-based MAC ACLs and traffic policies for WiFi networks•

Enable L2 security
NOTE: For information about essential WiFi security (network authenticationand encryption), see Set up an open or secure WiFi network on page 55 or
Change the authentication and encryption for a WiFi network on page 69.
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

102

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manage user accounts
User accounts provide either read/write or read-only access to the device UI of the AP.
You cannot delete the admin user account or change its user name, but you can change
its password. You can add accounts for other users, and you can change or delete theseaccounts.
The following sections describe how you can manage user accounts:•

Add a user account•

Change the time-out period for a user session•

Change the settings for a user account•Remove a user account

For information about changing the password for the default admin user account, see
Change the admin user account password on page 170.

Add a user accountTo add a user account:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > User Accounts.
The User Accounts page displays.
5. Click the add user account icon.
Manage Access and Security

103

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Additional fields and a menu display.
6. Specify the settings for the new user account:•

User Name: Enter a user name.
The user name must consist of up to 15 alphanumeric characters without any
special characters. Do not use admin or Admin as the user name.

•

Password: Enter a password between 8 and 63 characters in length and confirm
the password.
The password must contain at least one uppercase letter, one lowercase letter,and one number.

•

Privilege: From the menu, select Read-Write or Read Only.

•

Session Timeout: Use the Hours and Minutes fields to specify the period after
which a session automatically expires and the user must log in again.
By default, a session expires after 45 minutes.

7. Click the Apply button.
Your settings are saved.

Change the time-out period for a user
sessionWhen a user logs in to the device UI, the session times out automatically after 45 minutes.
You can change the time-out period, which applies to all users, including the adminuser.
To change the time-out period for a user session:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network

Manage Access and Security

104

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > User Accounts.
The User Accounts page displays.
5. Under Session Timeout, use the Hours and Minutes fields to specify the period after
which a session automatically expires and the user must log in again.
By default, a session expires after 45 minutes.
6. Click the Apply button.
Your settings are saved. Your session is terminated and you must log in again.

Change the settings for a user account
You cannot change the access privilege for the default admin user account.
To change the user name, password, or access privilege for a user account:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > User Accounts.
The existing user accounts display.
5. To the right of the user account, change the existing settings as needed:•

User Name: Enter another user name.

Manage Access and Security

105

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The user name must consist of up to 15 alphanumeric characters without any
special characters. Do not use admin or Admin as the user name.
•

Password: Enter another password between 8 and 63 characters in length, andconfirm the password.
The password must contain at least one uppercase letter, one lowercase letter,and one number.

•

Privilege: From the menu, select Read-Write or Read Only.

6. Click the Apply button.
Your settings are saved.

Remove a user account
You can remove a user account that you no longer need. You cannot remove the default
admin user account.
To remove a user account:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > User Accounts.
The User Accounts page displays, showing the existing user accounts.
5. Click the X to the right of the user account.
A warning pop-up window displays.
6. Click the Delete button.
The pop-up windows closes and the user account is removed.
Manage Access and Security

106

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Set up RADIUS servers
If you use WPA2 Enterprise security, WPA3 Enterprise security, or a RADIUS MAC ACL,
you must set up RADIUS servers for authentication or both authentication and accounting
using RADIUS. You must set up a primary IPv4 server and you can set up a secondary
IPv4 server. These RADIUS server settings apply either to all WiFi networks that use
WPA2 Enterprise security or WPA3 Enterprise security (see Set up an open or secure
WiFi network on page 55) or to all WiFi networks that use a RADIUS MAC ACL.
NOTE: Either WPA2 Enterprise security or WPA3 Enterprise security and a
RADIUS MAC ACL are mutually exclusive. If you want to use a RADIUS MAC ACL
for a WiFi network, select a different type of WiFi security (see Set up an open
or secure WiFi network on page 55). If you want to use WPA2 Enterprise security
or WPA3 Enterprise security for a WiFi network, use a local MAC ACL (see Manage
MAC ACLs for WiFi clients on page 131).
If you use a RADIUS MAC ACL, you must define the ACL on the RADIUS server, using
the format in the following example for client MAC addresses in the RADIUS server: If
the client MAC address is 00:0a:95:9d:68:16, specify it as 000a959d6816 in the RADIUS
server.
To set up RADIUS servers:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > RADIUS Settings.
The RADIUS Settings page displays.
5. For each RADIUS server that you want to set up, configure the following settings:
Manage Access and Security

107

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

IPv4 Address: Enter the IPv4 address of the RADIUS server. The AP must be able
to reach this IP address.

•

Port: Enter the number of the UDP port on the AP that is used to access the
RADIUS server. You can enter a number in the range from 1 to 65535. The default
port number is 1812.

•

Password: Enter the password (shared key) that is used between the AP and the
RADIUS server during the authentication or accounting process. The password
must be between 8 and 128 characters. By default, the password is sharedsecret.

6. To enable accounting on the authentication servers, click the Enable Accounting
button so that the button displays blue.
7. Configure the following authentication settings, which apply to all RADIUS serverthat you set up:•

Reauthentication time: Enter the interval in seconds after which the supplicant(the WiFi client) must be reauthenticated with the RADIUS server. You can enter
an interval in the range from 0 to 99999. The default interval is 3600 seconds (1hour). Enter 0 to disable reauthentication.

•

Update Global Key: Select the check box to allow the global key update, andenter the interval in seconds. You can enter an interval in the range from 0 to
99999. The check box is selected by default, and the default interval is 1800
seconds (30 minutes). Clear the check box to prevent the global key update.

8. Click the Apply button.
Your settings are saved.
9. To test if the configured RADIUS servers can be reached by the AP, do the following:a. Click the Test RADIUS Settings tab.
The page expands.
b. In the Username field, type a user name that must already be defined on the
RADIUS server, and in the Passphrase field, type the associated passphrase toaccess the RADIUS server.
The password must be between 8 and 128 characters. The passphrase must also
be between 8 and 128 characters.
c. Click the Begin Test button.
The AP attempts to reach the configured RADIUS servers using the user nameand passphrase.
The results of the test display in the Test RADIUS Result field.

Manage Access and Security

108

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manage neighbor AP detection
The AP can detect neighbor access points (APs) in a radio band and you can classify
them as known APs.
If you enable neighbor AP detection for a radio band, the AP regularly scans the WiFi
network, collects information about all access points on the channels, and maintains alist of access points it detects in the area. Initially all detected access points are displayedin the Unknown AP List. You can add access points that you are familiar with to theKnown AP List. You can also import a list of known access points in the Known AP List.
CAUTION: Access points in the Unknown AP List require further investigation.
They could be rogue access points, which use the SSID of a legitimate network.
These types of access points can present a serious security threat.
The following sections describe how you can manage neighbor AP detection and add
neighbor access points to the Known AP List:•

Enable neighbor access point detection and move access points to the Known AP
List•

Import an existing neighbor access point list in the Known AP List
NOTE: If you enable Energy Efficiency Mode, the AP cannot detect neighbor
APs in the 5 GHz and 6 GHz radio bands. To use neighbor AP detection in the
5 GHz and 6 GHz radio bands, first disable Energy Efficiency Mode. For more
information, see Manage the Energy Efficiency Mode on page 190.

Enable neighbor access point detection andmove access points to the Known AP List
The AP can detect neighbor access points (APs) and lets you classify them as known
APs. After you enable neighbor AP detection, the AP maintains a list of access points it
detects in the area. Initially all detected access points are displayed in the Unknown AP
List. You can manually move access points from the Unknown AP List to the Known AP
List.
By default neighbor access point detection is disabled.

Manage Access and Security

109

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To enable neighbor access point detection and move detected access points to
the Known AP List:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > Neighbor AP.
The page that displays lets you select a radio band (2.4 GHz, 5 GHz, or 6 GHz).
5. Click the > button to the left of the radio band.
The Neighbor AP page displays for the selected radio band.
6. Select the Enable Neighbor AP check box.
7. Click the Apply button.
Your settings are saved. Neighbor AP detection is now enabled.
8. From the Detection Policy menu, select the scan method:•

Mild: The AP scans for neighbor access points every hour. This is the default
setting.

•

Moderate: The AP scans for neighbor access points every 30 minutes.

•

Aggressive: The AP scans for neighbor access points every 15 minutes.

Detected neighbor access points display in the Unknown AP List.
9. To display detected neighbor access points and move them from the Unknown AP
List to the Known AP List, do the following:a. Click the Unknown AP List tab.
The page adjusts to display the unknown access points.
b. If no access points display, click the Refresh button.

Manage Access and Security

110

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

c. Select the check boxes for the access points that you are familiar with and thatyou trust.
d. Click the << Move to Known AP List button.
e. Click the Known AP List tab.
The selected access points display in the Known AP List.
NOTE: You can delete access points from the Known AP List. After being
detected, these access points once more display in the Unknown AP List.
10. Click the Apply button.
Your settings are saved.

Import an existing neighbor access point listin the Known AP List
You can import a list with MAC addresses of known neighbor access points in the Known
AP List.
The file with MAC addresses must be in the following format:•

Entries in the file must be MAC addresses only in hexadecimal format with each octet
separated by a hyphen, for example 00-11-22-33-44-55.

•

You must separate entries with a comma, or place entries on separate lines.

•

The file must be in text format (that is, with a .txt or extension).

For information about enabling neighbor AP detection, see Enable neighbor accesspoint detection and move access points to the Known AP List on page 109.
To import a list with MAC addresses of known neighbor access points in the Known
AP List:1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.

Manage Access and Security

111

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > Neighbor AP.
The page that displays lets you select the radio band (2.4 GHz, 5 GHz, or 6 GHz).
5. Click the > button to the left of the radio band.
The Neighbor AP page displays for the selected radio band.
6. To download a sample of an AP list in the format that is required for importing in
the Known AP List, click the Download Sample link.
7. Import and compose the Known AP List in the following way:a. Replace or merge the MAC addresses in the import list with the MAC addresses
in the Known AP List by selecting one of the following radio buttons:•

Replace: MAC addresses in the Known AP List are replaced with the ones in
the import list.

•

Merge: MAC addresses in the Known AP List are merged with the ones in theimport list.

b. Click the Browse button and navigate to and select the import file.
The MAC addresses on the import list are placed in the Known AP List.
c. To remove a MAC address from the Known AP List, select the MAC address andclick the Delete button.
When you remove a device from the Known AP List, after the AP redetects thedevice, the device is once again placed in the Known AP List.
8. Click the Apply button.
Your settings are saved.

Manage global MAC ACLs andtraffic policies
Global MAC ACLs allow you to control broadcast and multicast traffic from the wired
LAN; global traffic policies allow you to control traffic coming in from the wired LAN,
traffic going out to the wired LAN, and traffic between different VAPs on the AP. (A VAP
is a virtual access point that broadcasts on the same SSID and same radio.)Manage Access and Security

112

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The AP applies these global MAC ACLs and traffic policies in the following order ofprecedence:
1. Broadcast and multicast traffic: Allows incoming broadcast and multicast traffic
from all devices on the wired LAN or only from specific devices on the wired LAN.
Incoming traffic from the wired LAN can be from a connected router, switch, a wired
client, and so on.
For more information, see Manually set up a MAC ACL for broadcast and multicast
traffic from the wired LAN on page 114.
2. Wireless Noise Filter: Lets you enable and modify eight generic traffic rules for
specific incoming and outgoing DHCP, ARP, IPv6, broadcast, and multicast traffic.
These eight rules are preconfigured, but not enabled by default.
For more information, see Enable or disable the Wireless Noise Filter on page 118
and Enable, disable, or change a traffic rule in the Wireless Noise Filter on page 119.
3. Global Traffic Filter: Lets you add and enable custom traffic rules that allow or denytraffic based on the network layer (MAC addresses or IP addresses) and a selected
protocol. This traffic can be incoming, outgoing, or in both directions.
For more information, see Manage the Global Traffic Filter on page 123.
These global MAC ACLs and traffic policies apply to all WiFi networks (SSIDs). You canalso manage MAC ACLs and traffic policies that you can apply to individual SSIDs (seeManage SSID-based MAC ACLs and traffic policies for WiFi networks on page 131).

Manage MAC ACLs for broadcast andmulticast traffic from the wired LAN
By default, any device is allowed to send broadcast and multicast traffic from the wired
LAN to the AP.
However, you can set up an access control list (ACL) that is based on up to 256 MAC
addresses for devices that are allowed to send broadcast and multicast traffic from thewired LAN. Broadcast and multicast traffic from devices on the wired LAN that are noton this ACL is rejected by the AP.
The ACL functions as follows:•

A device for which you place the MAC address in the ACL is allowed to send
broadcast and multicast traffic from the LAN into any WiFi network on the AP.

•

Broadcast and multicast traffic from all other devices on the LAN is rejected by theAP.

The ACL takes effect only after you enable it.
The following sections describe how you can manage MAC ACLs for broadcast andmulticast traffic from devices on the wired LAN:Manage Access and Security

113

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Manually set up a MAC ACL for broadcast and multicast traffic from the wired LAN•

Import an existing MAC ACL for broadcast and multicast traffic from the wired LAN•

Block all broadcast and multicast traffic from the wired LAN

Manually set up a MAC ACL for broadcast and multicast
traffic from the wired LAN
By default, broadcast and multicast traffic from any device on the wired LAN can reachthe WiFi networks on the AP.
You can compose a single MAC access control list (ACL) to allow broadcast and multicast
traffic only from specific devices on the wired LAN. When you enable this ACL, broadcast
and multicast traffic from devices on the ACL is allowed to reach the WiFi networks on
the AP. Broadcast and multicast traffic from other devices on the wired LAN is rejectedby the AP. The ACL can contain up to 256 MAC addresses. If enabled, this ACL applies
to all WiFi networks on the AP.
By default, this MAC ACL is disabled and does not include any stations. You can manually
add devices, import devices (see Import an existing MAC ACL for broadcast and multicast
traffic from the wired LAN on page 115), or do both.
To manually set up a MAC ACL for broadcast and multicast traffic from the wiredLAN:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
Manage Access and Security

114

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

5. Click the > Allow Broadcast/Multicast Traffic – LAN tab.
The pages adjusts.
By default, the Allow Broadcast/Multicast Traffic - LAN check box is selected and theAllow all devices radio button is selected.
6. Select the Allow traffic only from specified devices radio button.
The page adjusts.
7. Compose the ACL in the following way:•

To manually add a device to the Allowed Stations table, enter the MAC addressin the format 00-00-00-00-00-00 in the table to the right, and click the << Movebutton.
The device is added to the Allowed Stations table. You can add multiple devices
simultaneously.

•

To remove a device from the Allowed Stations table, select the check box for thedevice, and click the Remove button.
You can search the Available Stations table.

•

To remove all devices from the Allowed Stations table so that you can recompose
the ACL, select the Select-all check box, and click the Remove button.

8. Click the Apply button.
Your settings are saved.
Broadband and multicast traffic from devices in the Allowed Stations table is allowed
to reach the WiFi networks on the AP.

Import an existing MAC ACL for broadcast and multicast
traffic from the wired LAN
You can import an existing access control list (ACL) that is based on up to 256 MAC
addresses. You can import the list into any MAC ACL, but the MAC addresses on thelist are available only for the MAC ACL into which you import the list. That is, if you want
to use the same list in another (type of) MAC ACL, you must also import the list into that
MAC ACL.
The file with MAC addresses must be in the following format:•

Entries in the file must be MAC addresses only in hexadecimal format with each octet
separated by a hyphen, for example 00-11-22-33-44-55.

•

You must separate entries with a comma, or place entries on separate lines.

• The file must be in text format (that is, with a .txt or extension).
You can use the MAC ACL to allow broadcast and multicast traffic only from specificdevices on the wired LAN. If enabled, this ACL applies to all WiFi networks on the AP.
Manage Access and Security

115

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To import an existing MAC ACL for broadcast and multicast traffic from the wiredLAN:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > Allow Broadcast/Multicast Traffic – LAN tab.
The pages adjusts.
By default, the Allow Broadcast/Multicast Traffic - LAN check box is selected and theAllow all devices radio button is selected.
6. Select the Allow traffic only from specified devices radio button.
The page adjusts.
7. To download a sample of a MAC ACL in the format that is required for importing,click the Download Sample link.
8. Import and compose the ACL in the following way:a. Replace or merge the MAC addresses in the import list with the MAC addresses
in the Allowed Stations table (if any are already in the table) by selecting one of
the following radio buttons:•

Replace: MAC addresses in the Allowed Stations table are replaced with theones in the import list.

•

Merge: MAC addresses in the Allowed Stations table are merged with theones in the import list.

b. Click the Browse button and navigate to and select the import file.

Manage Access and Security

116

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The MAC addresses on the import list are placed in the Allowed Stations table.
c. To remove a MAC address from the Allowed Stations table, select the MAC
address and click the Remove button.
You can search the Allowed Stations table.
9. Click the Apply button.
Your settings are saved.
For information about manually adding MAC addresses to those in the Allowed
Stations table, see Manually set up a MAC ACL for broadcast and multicast traffic
from the wired LAN on page 114.
Broadband and multicast traffic from devices in the Allowed Stations table is allowed
to reach the WiFi networks on the AP.

Block all broadcast and multicast traffic from the wired LAN
By default, broadcast and multicast traffic from any device on the wired LAN can reachthe WiFi networks on the AP. You can block all broadcast and multicast traffic from thewired LAN, preventing this type of traffic from reaching the WiFi networks on the AP.
To block all broadcast and multicast traffic from the wired LAN:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > Allow Broadcast/Multicast Traffic – LAN tab.
The pages adjusts.
Manage Access and Security

117

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

6. Clear the Allow Broadcast/Multicast Traffic - LAN radio button.
7. Click the Apply button.
Your settings are saved.
Broadband and multicast traffic from the wired LAN is not allowed to reach the WiFi
networks on the AP.

Manage the Wireless Noise Filter
By default, no restrictions exist for DHCP, ARP, IPv6, broadcast, and multicast traffic forany port, IP address, or traffic direction.
The AP provides eight preconfigured traffic policies (that is, traffic rules) that can prevent
generic traffic from flooding the WiFi networks. These rules are referred to as the Wireless
Noise Filter and are disabled by default. You can enable the Wireless Noise Filter andthen enable or disable individual traffic rules.
The MAC ACL that controls incoming broadcast and multicast traffic takes precedence
over traffic policies in the Wireless Noise Filter.
The following sections describe how you can manage the Wireless Noise Filter:•

Enable or disable the Wireless Noise Filter•

Enable, disable, or change a traffic rule in the Wireless Noise Filter•

Change the priority for a traffic rule in the Wireless Noise Filter

Enable or disable the Wireless Noise Filter
By default, the Wireless Noise Filter is disabled and so are all individual traffic rules in
the Wireless Noise Filter. A rule can become active only after you enable both the
Wireless Noise Filter and the rule (see Enable, disable, or change a traffic rule in the
Wireless Noise Filter on page 119).
You cannot add or delete a traffic rule in the Wireless Noise Filter but you can edit eachtraffic rule to adapt it for your specific network situation.
To enable or disable the Wireless Noise Filter:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
Manage Access and Security

118

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > MAC/IP Traffic Filters tab.
The page adjusts.
6. Click the > Wireless Noise Filter tab.
The table with traffic rules displays.
7. Select or clear the Enable Wireless Noise Filter check box:•

Check box selected: The Wireless Noise Filter is enabled.

•

Check box cleared: The Wireless Noise Filter is disabled.

8. Click the Apply button.
Your settings are saved.

Enable, disable, or change a traffic rule in the Wireless Noise
FilterYou cannot add or delete a traffic policy (that is, a traffic rule) from the Wireless Noise
Filter but you can change each traffic rule to adapt it for your specific network situation.
You can also enable or disable individual traffic rules.
CAUTION: Other than enabling or disabling traffic rules in the Wireless Noise
Filter, we recommend that you change the settings for the traffic rules only if you
fully understand the consequences. Incorrect configuration might cause
connectivity problems for all devices that are connected or are trying to connect
to the AP.
To enable, disable, or change an individual traffic rule in the Wireless Noise Filter:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
Manage Access and Security

119

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > MAC/IP Traffic Filters tab.
The page adjusts.
6. Click the > Wireless Noise Filter tab.
The table with traffic rules displays. By default, all traffic rules are disabled.
7. If the Wireless Noise Filter is disabled, select the Enable Wireless Noise Filter checkbox.
8. Select the check box for a traffic rule, and click the pencil icon.
The Add / Edit Rule pop-up window displays.
9. Configure the following settings as needed:
NOTE: You can enable or disable the Drop IPv6 traffic rule, but you cannotchange it.
•

Rule Name: You can change the default name. The following applies to thename:○ must be a unique alpha-numeric name○ can be a maximum length of 32 characters○ can include only the special characters ‘ ‘, ‘-’ and ‘_’○ must start and end with alphanumeric characters•State: Select a radio button:

Manage Access and Security

120

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ Enable: After you click the Apply button, the rule takes effect if the Wireless
Noise Filter is enabled.
○ Disable: You can change the rule, but after you click the Apply button, therule takes does not take effect, even if the Wireless Noise Filter is enabled.
By default, a rule is disabled.
•

Action: Select a radio button:○ Allow: Traffic that matches the rule is allowed to pass through the WiFi
network.
○ Deny: Traffic that matches the rule is dropped.

•

Direction: Select a radio button:○ In: The traffic rule is applied only to traffic flowing in from a WiFi network.
○ Out: The traffic rule is applied only to traffic flowing out to a WiFi network.
○ Both: The traffic rule is applied to both traffic flowing in from a WiFi networkand traffic flowing out to a WiFi network.

•

Network Layer: Select a radio button:○ MAC: The traffic rule filters packets at the MAC level.
○ IP: The traffic rule filters packets at the IP level.

•

Protocol: From the Protocol menu, select a protocol:○ ANY: The traffic rule applies to any traffic.
○ ARP: The traffic rule applies only to Address Resolution Protocol (ARP) traffic.
○ TCP: The traffic rule applies only to Transmission Control Protocol (TCP) traffic.
○ UDP: The traffic rule applies only to User Datagram Protocol (UDP) traffic.
○ ICMP: The traffic rule applies only to Internet Control Message Protocol (ICMP)
traffic.
○ IGMP: The traffic rule applies only to Internet Group Management Protocol(ICMP) traffic.

•

Source: To set the source for the traffic to which the traffic rule must apply, do
the following:a. From the Type menu, select the type of source MAC address or IP address,
depending on the network layer (MAC or IP) that you selected:○ ANY: The traffic rule is applied to any source MAC address or IP address.
○ MAC Address (MAC level only): The traffic rule is applied only to thesource MAC address that you specify in the MAC Address field.

Manage Access and Security

121

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ IP Address (IP level only): The traffic rule is applied only to the source IP
address that you specify in the IP Address field.
○ IP Subnet (IP level only): The traffic rule is applied only to the source IP
subnet that you specify in the Network Address and Network Mask fields.
The length of the network mask must be from 8 to 32 numbers.
b. In the Port field, type a source port number to which the traffic rule must
apply.
The port number must be in the range from 1 to 65535.
•

Destination: To set the destination for the traffic to which the traffic rule must
apply, do the following:a. From the Type menu, select the type of destination MAC address or IP address,
depending on the network layer (MAC or IP) that you selected:○ ANY: The traffic rule is applied to any destination MAC address or IP
address.
○ MAC Address (MAC level only): The traffic rule is applied only to thedestination MAC address that you specify in the MAC Address field.
○ IP Address (IP level only): The traffic rule is applied only to the destination
IP address that you specify in the IP Address field.
○ IP Subnet (IP level only): The traffic rule is applied only to the destination
IP subnet that you specify in the Network Address and Network Mask
fields.
The length of the network mask must be from 8 to 32 numbers.
b. In the Port field, type a destination port number to which the traffic rule must
apply.
The port number must be in the range from 1 to 65535.

10. In the pop-up window, click the Apply button.
The Wireless Noise Filter page displays again.
11. To change the priority of the traffic rule, point to the six dots icon at the left of thetraffic rule, click and hold, and then move the traffic rule up or down in the table.
12. Click the Apply button.
Your settings are saved.

Change the priority for a traffic rule in the Wireless Noise
FilterYou can change the priority for a traffic rule in the Wireless Noise Filter.

Manage Access and Security

122

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To change the priority for an individual traffic rule in the Wireless Noise Filter:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > MAC/IP Traffic Filters tab.
The page adjusts.
6. Click the > Wireless Noise Filter tab.
The table with traffic rules displays.
7. If the Wireless Noise Filter is disabled, select the Enable Wireless Noise Filter checkbox.
8. Point to the six dots icon at the left of the traffic rule for which you want to change
the priority, click and hold, and then move the traffic rule up or down in the table.
9. Click the Apply button.
Your settings are saved.

Manage the Global Traffic Filter
The Global Traffic Filter lets you add custom traffic policies that you can apply globallyto incoming and outgoing traffic for all WiFi networks.
Both the MAC ACL that controls incoming broadcast and multicast traffic and the traffic
polices in the Wireless Noise Filter take precedence over traffic policies that you add
to the Global Traffic Filter.
Manage Access and Security

123

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The following sections describe how you can manage the Global Traffic Filter:•

Enable or disable the Global Traffic Filter•

Add a traffic rule to the Global Traffic Filter•

Change a traffic rule in the Global Traffic Filter•

Change the priority for a traffic rule in the Global Traffic Filter•

Remove a traffic rule from the Global Traffic Filter

Enable or disable the Global Traffic Filter
By default, the Global Traffic Filter does not contain any traffic policies (that is, traffic
rules). You can add a rule (see Add a traffic rule to the Global Traffic Filter on page 125),change an existing rule, and delete a rule that you no longer need.
Disabling the Global Traffic Filter does not delete traffic rules that you added to the
Global Traffic Filter.
To enable or disable the Global Traffic Filter:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > MAC/IP Traffic Filters tab.
The page adjusts.
6. Click the > Global Traffic Filter tab.
The table with traffic rules displays. If you did not yet add any rules, the table is empty.
Manage Access and Security

124

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

7. Select or clear the Enable Global Traffic Filter check box:•

Check box selected: The Global Traffic Filter is enabled.

•

Check box cleared: The Global Traffic Filter is disabled.

8. Click the Apply button.
Your settings are saved.

Add a traffic rule to the Global Traffic Filter
You can add up to16 traffic policies (that is, traffic rules) to the Global Traffic Filter. The
priority of the traffic rules is assigned in the order in which you add the rules. That is,
the first rule that you add is assigned the first (highest) priority, the second rule isassigned the second priority, and so on. However, you can change the priority.
CAUTION: We recommend that you add global traffic rules only if you fully
understand the consequences. Incorrect configuration might cause connectivity
problems for all devices that are connected or are trying to connect to the AP.
To add a traffic rule to the Global Traffic Filter:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > MAC/IP Traffic Filters tab.
The page adjusts.
6. Click the > Global Traffic Filter tab.

Manage Access and Security

125

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The table with traffic rules displays. If you did not yet add any rules, the table is empty.
7. Click the plus icon.
The Add / Edit Rule pop-up window displays.
8. Configure the following settings as needed:•

Rule Name: You can change the default name. The following applies to thename:○ must be a unique alpha-numeric name○ can be a maximum length of 32 characters○ can include only the special characters ‘ ‘, ‘-’ and ‘_’○ must start and end with alphanumeric characters•State: Select a radio button:○ Enable: After you click the Apply button, the rule takes effect if the Global
Traffic Filter is enabled.
○ Disable: You can change the rule, but after you click the Apply button, therule takes does not take effect, even if the Global Traffic Filter is enabled. By
default, a rule is disabled.

•

Action: Select a radio button:○ Allow: Traffic that matches the rule is allowed to pass through the WiFi
network.
○ Deny: Traffic that matches the rule is dropped.

•

Direction: Select a radio button:○ In: The traffic rule is applied only to traffic flowing in from a WiFi network.
○ Out: The traffic rules is applied only to traffic flowing out to a WiFi network.
○ Both: The traffic rule is applied to both traffic flowing in from a WiFi networkand traffic flowing out to a WiFi network.

•

Network Layer: Select a radio button:○ MAC: The traffic rule filters packets at the MAC level.
○ IP: The traffic rule filters packets at the IP level.

•

Protocol: From the Protocol menu, select a protocol:○ ANY: The traffic rule applies to any traffic.
○ ARP: The traffic rule applies only to Address Resolution Protocol (ARP) traffic.
○ TCP: The traffic rule applies only to Transmission Control Protocol (TCP) traffic.
○ UDP: The traffic rule applies only to User Datagram Protocol (UDP) traffic.

Manage Access and Security

126

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ ICMP: The traffic rule applies only to Internet Control Message Protocol (ICMP)
traffic.
○ IGMP: The traffic rule applies only to Internet Group Management Protocol(ICMP) traffic.
•

Source: To set the source for the traffic to which the traffic rule must apply, do
the following:a. From the Type menu, select the type of source MAC address or IP address,
depending on the network layer (MAC or IP) that you selected:○ ANY: The traffic rule is applied to any source MAC address or IP address.
○ MAC Address (MAC level only): The traffic rule is applied only to thesource MAC address that you specify in the MAC Address field.
○ IP Address (IP level only): The traffic rule is applied only to the source IP
address that you specify in the IP Address field.
○ IP Subnet (IP level only): The traffic rule is applied only to the source IP
subnet that you specify in the Network Address and Network Mask fields.
The length of the network mask must be from 8 to 32 numbers.
b. In the Port field, type a source port number to which the traffic rule must
apply.
The port number must be in the range from 1 to 65535.

•

Destination: To set the destination for the traffic to which the traffic rule must
apply, do the following:a. From the Type menu, select the type of destination MAC address or IP address,
depending on the network layer (MAC or IP) that you selected:○ ANY: The traffic rule is applied to any destination MAC address or IP
address.
○ MAC Address (MAC level only): The traffic rule is applied only to thedestination MAC address that you specify in the MAC Address field.
○ IP Address (IP level only): The traffic rule is applied only to the destination
IP address that you specify in the IP Address field.
○ IP Subnet (IP level only): The traffic rule is applied only to the destination
IP subnet that you specify in the Network Address and Network Mask
fields.
The length of the network mask must be from 8 to 32 numbers.
b. In the Port field, type a destination port number to which the traffic rule must
apply.
The port number must be in the range from 1 to 65535.

9. In the pop-up window, click the Apply button.
Manage Access and Security

127

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The Global Traffic Filter page displays again.
10. To change the priority of the traffic rule, point to the six dots icon at the left of thetraffic rule, click and hold, and then move the traffic rule up or down in the table.
The priority number adjusts.
11. Click the Apply button.
Your settings are saved.

Change a traffic rule in the Global Traffic Filter
You can change an existing traffic rule in the Global Traffic Filter.
To change an existing traffic rule in the Global Traffic Filter:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > MAC/IP Traffic Filters tab.
The page adjusts.
6. Click the > Global Traffic Filter tab.
The table with traffic rules displays.
7. If the Global Traffic Filter is disabled, select the Enable Global Traffic Filter checkbox.
8. Select the check box for the traffic rule, and click the pencil icon.
The Add / Edit Traffic Rule pop-up window displays.
Manage Access and Security

128

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

9. Change the settings as needed.
For more information about the settings, see Add a traffic rule to the Global Traffic
Filter on page 125.
10. In the pop-up window, click the Apply button.
The Global Traffic Filter page displays again.
11. To change the priority of the traffic rule, point to the six dots icon at the left of thetraffic rule, click and hold, and then move the traffic rule up or down in the table.
The priority number adjusts.
12. Click the Apply button.
Your settings are saved.

Change the priority for a traffic rule in the Global Traffic
FilterYou can change the priority for an existing traffic rule in the Global Traffic Filter.
To change the priority for an existing traffic rule in the Global Traffic Filter:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > MAC/IP Traffic Filters tab.
The page adjusts.
6. Click the > Global Traffic Filter tab.
Manage Access and Security

129

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The table with traffic rules displays.
7. If the Global Traffic Filter is disabled, select the Enable Global Traffic Filter checkbox.
8. Point to the six dots icon at the left of the traffic rule for which you want to change
the priority, click and hold, and then move the traffic rule up or down in the table.
The priority number adjusts.
9. Click the Apply button.
Your settings are saved.

Remove a traffic rule from the Global Traffic Filter
You can remove a traffic rule that you no longer need.
To remove a traffic rule from the Global Traffic Filter:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Traffic Policies.
The Traffic Policies page displays.
5. Click the > MAC/IP Traffic Filters tab.
The page adjusts.
6. Click the > Global Traffic Filter tab.
The table with traffic rules displays.
7. If the Global Traffic Filter is disabled, select the Enable Global Traffic Filter checkbox.

Manage Access and Security

130

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

8. Select the check box for the traffic rule, and click the trash can icon.
The traffic rule is removed.
9. Click the Apply button.
Your settings are saved.

Manage SSID-based MAC ACLs andtraffic policies for WiFi networks
In addition to global MAC ACLs and traffic policies that apply to traffic to and from thewired LAN (see Manage global MAC ACLs and traffic policies on page 112), the APsupports SSID-based MAC ACLs and traffic policies that allow you to control which WiFi
clients can connect to a WiFi network and which WiFi traffic can enter and leave a WiFi
network:•

MAC ACLs for WiFi clients: Allow or reject WiFi clients from connecting to a WiFi
network based on their MAC address.
For more information, see Manage MAC ACLs for WiFi clients on page 131.

•

MAC ACLs for broadcast and multicast traffic: Allow incoming broadcast andmulticast traffic only from specific devices on a WiFi network.
For more information, see Manage MAC ACLs for broadcast and multicast traffic
from WiFi clients on page 137.

•

MAC/IP Traffic Filter groups: Add custom traffic rules to a group and apply thegroup to a WiFi network. These traffic rules can allow or deny traffic based on the
network layer (MAC addresses or IP addresses) and a selected protocol, and canaffect incoming or outgoing WiFi traffic, or WiFi traffic in both directions.
For more information, see Manage MAC/IP Traffic Filter groups for WiFi networks
on page 142.
NOTE: Global traffic rules in the Wireless Noise Filter (see Manage the
Wireless Noise Filter on page 118) and, if enabled, Global Traffic Filter (seeManage the Global Traffic Filter on page 123) take higher precedence thantraffic rules in MAC/IP Traffic Filter groups for WiFi networks.

Manage MAC ACLs for WiFi clients
The AP supports eight local access control lists (ACLs) that let you control which WiFi
clients are allowed access and which WiFi clients are denied access. These ACLs are
Manage Access and Security

131

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

based on MAC addresses, and each local MAC ACL can contain a total number of 512
MAC addresses..
If you set up an ACL with a policy that allows access and you apply that ACL to a WiFi
network (that is, to an SSID), the ACL functions as follows:•

A WiFi device for which you place the MAC address in the ACL is allowed access tothe WiFi network.

• All other WiFi devices are denied access to the WiFi network.
If you set up an ACL with a policy that denies access and you apply that ACL to a WiFi
network (that is, to an SSID), the ACL functions as follows:•

A WiFi device for which you place the MAC address in the ACL is denied access tothe WiFi network.

•

All other WiFi devices are allowed access to the WiFi network.

An ACL takes effect only after you apply it to a WiFi network. For information about
applying an ACL for WiFi clients to a WiFi network, see Select a MAC ACL for WiFi clientsin a WiFi network on page 217. You can apply a MAC ACL for WiFi clients to more than
one WiFi network.
The following sections describe how you can manage MAC ACLs for WiFi clients:•

Manually set up a MAC ACL for WiFi clients•

Import an existing MAC ACL for WiFi clients

Manually set up a MAC ACL for WiFi clients
You can compose up to eight access control lists (ACLs) that are each based on up to
512 MAC addresses. The AP includes MAC ACLs with the following default group names
and settings, which you can change:•

Management: If enabled, allows access to trusted stations by default.

•

Guest: If enabled, allows access to trusted stations by default.

•

Guest 1: If enabled, denies access to untrusted stations by default.

•

Custom: If enabled, denies access to untrusted stations by default.

•

Custom 1: If enabled, allows access to trusted stations by default.

•

Custom 2: If enabled, allows access to trusted stations by default.

•

Custom 3: If enabled, allows access to trusted stations by default.

•

Custom 4: If enabled, allows access to trusted stations by default.

By default, these MAC ACLs are disabled and do not include any stations. You canmanually add devices, import devices (see Import an existing MAC ACL for WiFi clientson page 135), or do both.
Manage Access and Security

132

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

You can use a MAC ACL to control which WiFi devices (stations) can access a WiFi
network. You can apply one MAC ACL to more than one WiFi network.
To manually set up a MAC ACL for WiFi clients:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > Wireless Clients.
The page shows all MAC ACLs.
5. Click the group name for the MAC ACL that you want to set up.
The MAC ACL page displays, showing the settings for the selected MAC ACL.
Devices in the Available Stations table are automatically detected by the AP and arecommon to all MAC ACLs, which allows you to add a device to more than one MAC
ACL. A neighboring station displays as Neighbor and a connected station displays
as Connected.
6. To change the group name, enter a new name in the Group Name field.
The default group names for the eight MAC ACLs are Management, Guest, Guest
1, Custom, Custom 1, Custom 2, Custom 3, and Custom 4.
A group name can have a length of maximum 32 characters. You cannot use special
characters except for a hyphen (-), underscore (_), and space ( ).
7. Select the ACL Policy Allow or Deny radio button.
If you select the Allow radio button, a WiFi device for which you place the MAC
address in the ACL is allowed access to the WiFi network, but all other WiFi devices
are denied access to the WiFi network.

Manage Access and Security

133

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If you select the Deny radio button, a WiFi device for which you place the MAC
address in the ACL is denied access to the WiFi network, but all other WiFi devices
are allowed access to the WiFi network.
8. Compose the ACL in the following way:•

For an ACL for which you selected the Allow radio button in Step 7, do thefollowing:○ To manually add a device to the Trusted Stations table, enter the MAC addressin the format 00-00-00-00-00-00 in the field below the Trusted Stations table,
and click the Add button.
The device is added to the Trusted Stations table.
○ To move a device from the Available Stations table to the Trusted Stations
table, select the check box for the device and click the << Move button.
You can search the Available Stations table. You can also filter devices in the
Available Stations table by clicking the filter icon.
○ To remove a device from the Trusted Stations table, select the check box forthe device and click the Remove button.
You can search the Trusted Stations table.
When you remove a device from the Trusted Stations table, after the AP
redetects the device, the device is once again placed in the Available Stations
table.

•For an ACL for which you selected the Deny radio button in Step 7, do thefollowing:○ To manually add a device to the Untrusted Stations table, enter the MAC
address in the format 00-00-00-00-00-00 in the field below the Untrusted
Stations table, and click the Add button.
The device is added to the Untrusted Stations table.
○ To move a device from the Available Stations table to the Untrusted Stations
table, select the check box for the device and click the << Move button.
You can search the Available Stations table. You can also filter devices in the
Available Stations table by clicking the filter icon.
○ To remove a device from the Untrusted Stations table, select the check box
for the device and click the Remove button.
You can search the Untrusted Stations table.
When you remove a device from the Untrusted Stations table, after the AP
redetects the device, the device is once again placed in the Available Stations
table.

9. Click the Apply button.
Your settings are saved.
Manage Access and Security

134

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

For more information about applying an ACL to a WiFi network, see Select a MAC
ACL for WiFi clients in a WiFi network on page 217.
WiFi devices in the Trusted Stations table can access the WiFi network to which you
apply the ACL. WiFi devices in the Untrusted Stations table cannot access the WiFi
network to which you apply the ACL.

Import an existing MAC ACL for WiFi clients
You can import an existing access control list (ACL) that is based on up to 512 MAC
addresses. You can import the list into any MAC ACL, but the MAC addresses on thelist are available only for the MAC ACL into which you import the list. That is, if you want
to use the same list in another MAC ACL, you must also import the list into that MAC
ACL.
The file with MAC addresses must be in the following format:•

Entries in the file must be MAC addresses only in hexadecimal format with each octet
separated by a hyphen, for example 00-11-22-33-44-55.

•

You must separate entries with a comma, or place entries on separate lines.

•

The file must be in text format (that is, with a .txt or extension).

You can use a MAC ACL to control which WiFi devices can access a WiFi network. You
can apply a MAC ACL to more than one WiFi network.
To import an existing MAC ACL for WiFi clients:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > Wireless Clients.
The page shows all MAC ACLs.
Manage Access and Security

135

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

5. Click the group name for the MAC ACL that you want to set up.
The MAC ACL page displays, showing the settings for the selected MAC ACL.
Devices in the Available Stations table are automatically detected by the AP and arecommon to all MAC ACLs, which allows you to add a device to more than one MAC
ACL. A neighboring station displays as Neighbor and a connected station displays
as connected.
6. To change the group name, enter a new name in the Group Name field.
The default group names for the eight MAC ACLs are Management, Guest, Guest
1, Custom, Custom 1, Custom 2, Custom 3, and Custom 4.
A group name can have a length of maximum 32 characters. You cannot use special
characters except for a hyphen (-), underscore (_), and space ( ).
7. Select the ACL Policy Allow or Deny radio button.
If you select the Allow radio button, a WiFi device for which you import the MAC
address into the ACL is allowed access to the WiFi network, but all other WiFi devices
are denied access to the WiFi network.
If you select the Deny radio button, a WiFi device for which you import the MAC
address into the ACL is denied access to the WiFi network, but all other WiFi devices
are allowed access to the WiFi network.
8. To download a sample of a MAC ACL in the format that is required for importing,click the Download Sample link.
9. Import and compose the ACL in the following way:•

For an ACL for which you selected the Allow radio button in Step 7, do thefollowing:a. Replace or merge the MAC addresses in the import list with the MAC
addresses in the Trusted Stations table (if any are already in the table) byselecting one of the following radio buttons:○ Replace: MAC addresses in the Trusted Stations table are replaced withthe ones in the import list.
○ Merge: MAC addresses in the Trusted Stations table are merged with theones in the import list.
b. Click the Browse button and navigate to and select the import file.
The MAC addresses on the import list are placed in the Trusted Stations table.
c. To remove a MAC address from the Trusted Stations table, select the MAC
address and click the Remove button.
You can search the Trusted Stations table.

Manage Access and Security

136

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

When you remove a device from the Trusted Stations table, after the AP
redetects the device, the device is once again placed in the Available Stations
table.
•For an ACL for which you selected the Deny radio button in Step 7, do thefollowing:a. Replace or merge the MAC addresses in the import list with the MAC
addresses in the Untrusted Stations table (if any are already in the table) byselecting one of the following radio buttons:○ Replace: MAC addresses in the Untrusted Stations table are replaced withthe ones in the import list.
○ Merge: MAC addresses in the Untrusted Stations table are merged withthe ones in the import list.
b. Click the Browse button and navigate to and select the import file.
The MAC addresses on the import list are placed in the Untrusted Stations
table.
c. To remove a MAC address from the Untrusted Stations table, select the MAC
address and click the Remove button.
You can search the Untrusted Stations table.
When you remove a device from the Untrusted Stations table, after the AP
redetects the device, the device is once again placed in the Available Stations
table.

10. Click the Apply button.
Your settings are saved. For information about manually adding MAC addresses tothose in the Trusted Stations table or Untrusted Stations table, see Manually set up
a MAC ACL for WiFi clients on page 132.
For more information about applying an ACL to a WiFi network, see Select a MAC
ACL for WiFi clients in a WiFi network on page 217.
WiFi devices in the Trusted Stations table can access the WiFi network to which you
apply the ACL. WiFi devices in the Untrusted Stations table cannot access the WiFi
network to which you apply the ACL.

Manage MAC ACLs for broadcast andmulticast traffic from WiFi clients
The AP supports eight local access control lists (ACLs) that let you control which WiFi
clients are allowed to send broadcast and multicast traffic into a WiFi network (that is,Manage Access and Security

137

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

into an SSID). These ACLs are based on MAC addresses, and each local MAC ACL cancontain a total number of 256 MAC addresses.
The ACL functions as follows:•

A WiFi device for which you place the MAC address in the ACL is allowed to send
broadcast and multicast traffic into the WiFi network.
The broadcast and multicast traffic is allowed within the same SSID on which the
WiFi client sends the traffic, regardless of the radio on which the SSID broadcasts.
If another SSID is using the same VLAN, clients on the other SSID can also receive
the broadcast or multicast traffic.
For example:○ The “Main Lobby” SSID uses VLAN 1 and broadcasts on both the 2.4 GHz radio
and the 5 GHz radio.
○ The MAC address of Client 1 is on the MAC ACL, and Client 1 sends multicast
traffic on the 5 GHz radio of the “Main Lobby” SSID.
○ The “Auditorium” SSID is also configured on the same VLAN 1 and broadcasts
on the 2.4 GHz radio.
○ The “Accounting Department” SSID is configured on VLAN 2 and broadcasts on
both the 2.4 GHz radio and the 5 GHz radio.
In this situation, the multicast traffic from Client 1 can reach all clients that areconnected to the “Main Lobby” SSID as well as all clients that are connected to the“Auditorium” SSID, but it cannot reach clients that are connected to the “Accounting
Department” SSID.

•

Broadcast and multicast traffic from all other WiFi devices is rejected by the WiFi
network.

An ACL takes effect only after you apply it to a WiFi network. For information about
applying an ACL for broadcast and multicast traffic to a WiFi network, see Select a MAC
ACL for broadcast and multicast traffic from WiFi clients in a WiFi network on page 222.
You can apply an ACL for broadcast and multicast traffic to more than one WiFi network.
The following sections describe how you can manage MAC ACLs for broadcast andmulticast traffic from WiFi clients:•

Manually set up a MAC ACL for broadcast and multicast traffic from WiFi clients•

Import an existing MAC ACL for broadcast and multicast traffic from WiFi clients

Manually set up a MAC ACL for broadcast and multicast
traffic from WiFi clients
You can compose up to eight access control lists (ACLs) for broadcast and multicast
traffic from WiFi clients. Each ACL is based on up to 256 MAC addresses. The AP includes
Manage Access and Security

138

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

MAC ACLs with the default group names Group 1 through Group 8. You can changethese names.
By default, these MAC ACLs are disabled and do not include any stations. You canmanually add devices, import devices (see Import an existing MAC ACL for broadcast
and multicast traffic from WiFi clients on page 140), or do both.
You can use a MAC ACL to control which WiFi clients (stations) are allowed to send
broadcast and multicast traffic into a WiFi network (that is, into an SSID). You can apply
one MAC ACL to more than one WiFi network.
To manually set up a MAC ACL for broadcast and multicast traffic from WiFi clients:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > Allow
Broadcast/Multicast Traffic.
The Allow Broadcast/Multicast Traffic page displays.
5. Click the group name for the MAC ACL that you want to set up.
The page adjusts.
Devices in the Connected Stations table are automatically detected by the AP and
are common to all MAC ACLs, which allows you to add a device to more than one
MAC ACL. A neighboring station displays as Neighbor and a connected station
displays as Connected.
6. To change the group name, enter a new name in the Group Name field.
The default group names for the eight MAC ACLs are Group 1, Group 2, Group 3,
Group 4, Group 5, Group 6, Group 7, and Group 8.
A group name can have a length of maximum 32 characters. You cannot use special
characters except for a hyphen (-), underscore (_), and space ( ).
Manage Access and Security

139

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

7. Compose the ACL in the following way:•

To manually add a device to the Allowed Stations table, enter the MAC addressin the format 00-00-00-00-00-00 in the field below the Allowed Stations table,
and click the Add button.
The device is added to the Allowed Stations table.

•

To move a device from the Connected Stations table to the Allowed Stations
table, select the check box for the device and click the << Move button.
You can search the Connected Stations table.

•

To remove a device from the Allowed Stations table, select the check box for thedevice and click the Remove button.
You can search the Allowed Stations table.
When you remove a device from the Allowed Stations table, after the AP redetects
the device, the device is once again placed in the Connected Stations table.

8. Click the Apply button.
Your settings are saved.
For more information about applying an ACL for broadcast and multicast traffic from
WiFi clients to a WiFi network, see Select a MAC ACL for broadcast and multicast
traffic from WiFi clients in a WiFi network on page 222.
WiFi devices in the Allowed Stations table are allowed to send broadcast andmulticast traffic into a WiFi network to which you apply the ACL.

Import an existing MAC ACL for broadcast and multicast
traffic from WiFi clients
You can import an existing access control list (ACL) that is based on up to 256 MAC
addresses. You can import the list into any MAC ACL, but the MAC addresses on thelist are available only for the MAC ACL into which you import the list. That is, if you want
to use the same list in another MAC ACL, you must also import the list into that MAC
ACL.
The file with MAC addresses must be in the following format:•

Entries in the file must be MAC addresses only in hexadecimal format with each octet
separated by a hyphen, for example 00-11-22-33-44-55.

•

You must separate entries with a comma, or place entries on separate lines.

•

The file must be in text format (that is, with a .txt or extension).

You can use a MAC ACL to control which WiFi clients (stations) are allowed to send
broadcast and multicast traffic into a WiFi network (that is, into an SSID). You can apply
one MAC ACL to more than one WiFi network.

Manage Access and Security

140

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To import an existing MAC ACL for broadcast and multicast traffic from WiFi clients:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > Allow
Broadcast/Multicast Traffic.
The Allow Broadcast/Multicast Traffic page displays.
5. Click the group name for the MAC ACL that you want to set up.
The page adjusts.
Devices in the Connected Stations table are automatically detected by the AP and
are common to all MAC ACLs, which allows you to add a device to more than one
MAC ACL. A neighboring station displays as Neighbor and a connected station
displays as Connected.
6. To change the group name, enter a new name in the Group Name field.
The default group names for the eight MAC ACLs are Group 1, Group 2, Group 3,
Group 4, Group 5, Group 6, Group 7, and Group 8.
A group name can have a length of maximum 32 characters. You cannot use special
characters except for a hyphen (-), underscore (_), and space ( ).
7. To download a sample of a MAC ACL in the format that is required for importing,click the Download Sample link.
8. Import and compose the ACL in the following way:a. Replace or merge the MAC addresses in the import list with the MAC addresses
in the Allowed Stations table (if any are already in the table) by selecting one of
the following radio buttons:

Manage Access and Security

141

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Replace: MAC addresses in the Allowed Stations table are replaced with theones in the import list.

•

Merge: MAC addresses in the Allowed Stations table are merged with theones in the import list.

b. Click the Browse button and navigate to and select the import file.
The MAC addresses on the import list are placed in the Allowed Stations table.
c. To remove a MAC address from the Allowed Stations table, select the MAC
address and click the Remove button.
You can search the Allowed Stations table.
When you remove a device from the Allowed Stations table, after the AP redetects
the device, the device is once again placed in the Connected Stations table.
9. Click the Apply button.
Your settings are saved.
For information about manually adding MAC addresses to those in the Allowed
Stations table, see Manually set up a MAC ACL for broadcast and multicast traffic
from WiFi clients on page 138.
For more information about applying an ACL for broadcast and multicast traffic from
WiFi clients to a WiFi network, see Select a MAC ACL for broadcast and multicast
traffic from WiFi clients in a WiFi network on page 222.
WiFi devices in the Allowed Stations table are allowed to send broadcast andmulticast traffic into a WiFi network to which you apply the ACL.

Manage MAC/IP Traffic Filter groups for WiFi
networks
A MAC/IP Traffic Filter group is a collection of custom MAC-based and IP-based traffic
rules that you can apply to incoming and outgoing traffic in a WiFi network (SSID). Eachrule can allow or deny a specific type of traffic.
The AP provides eight MAC/IP Traffic Filter groups. You can add up to 16 traffic rules
to each group. You can apply a single group to more than one SSID.
NOTE: Global traffic rules in the Wireless Noise Filter (see Manage the Wireless
Noise Filter on page 118) and, if enabled, Global Traffic Filter (see Manage the
Global Traffic Filter on page 123) take higher precedence than traffic rules in
MAC/IP Traffic Filter groups for WiFi networks.
NOTE: If you apply a MAC/IP Traffic Filter group to a WiFi network, thethroughput might be affected and could be lower than normal.
Manage Access and Security

142

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The following sections describe how you can manage MAC/IP Traffic Filter groups:•

Enable or disable a MAC/IP Traffic Filter group•

Add a traffic rule to a MAC/IP Traffic Filter group•

Change a traffic rule in a MAC/IP Traffic Filter group•

Change the priority for a traffic rule in a MAC/IP Traffic Filter group•

Remove a traffic rule from a MAC/IP Traffic Filter group

Enable or disable a MAC/IP Traffic Filter group
By default, a MAC/IP Traffic Filter group does not contain any traffic policies (that is,traffic rules). You can add a rule (see Add a traffic rule to a MAC/IP Traffic Filter groupon page 144), change an existing rule, and delete a rule that you no longer need.
Disabling a group does not delete traffic rules that you added to the group.
To enable or disable a MAC/IP Traffic Filter group:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > MAC/IP Traffic Filters.
The MAC/IP Traffic Filters page displays.
5. Click the group that you want enable or disable.
The page adjusts.
6. Select or clear the Enable Group check box.

Manage Access and Security

143

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Check box selected: The group is enabled.

•

Check box cleared: The group is disabled.

7. Click the Apply button.
Your settings are saved.

Add a traffic rule to a MAC/IP Traffic Filter group
You can add one or more traffic policies (that is, traffic rules) to a MAC/IP Traffic Filtergroup. The priority of the traffic rules is assigned in the order in which you add the rules.
That is, the first rule that you add is assigned the first (highest) priority, the second rule
is assigned the second priority, and so on. However, you can change the priority.
CAUTION: We recommend that you add traffic rules only if you fully understandthe consequences. Incorrect configuration might cause connectivity problems
for all devices that are connected or are trying to connect to the WiFi network
to which you apply the MAC/IP Traffic Filter group.
To add a traffic rule to a MAC/IP Traffic Filter group:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > MAC/IP Traffic Filters.
The MAC/IP Traffic Filters page displays.
5. Click the group to which you want to add a traffic rule and then select the Enable
Group check box.
6. Click the plus icon.
The Add / Edit Rule pop-up window displays.
Manage Access and Security

144

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

7. Configure the following settings as needed:•

Rule Name: You can change the default name. The following applies to thename:○ must be a unique alpha-numeric name○ can be a maximum length of 32 characters○ can include only the special characters ‘ ‘, ‘-’ and ‘_’○ must start and end with alphanumeric characters•State: Select a radio button:○ Enable: After you click the Apply button, the rule takes effect if the MAC/IP
Traffic Filter is enabled.
○ Disable: You can change the rule, but after you click the Apply button, therule takes does not take effect, even if the MAC/IP Traffic Filter is enabled. By
default, a rule is disabled.

•

Action: Select a radio button:○ Allow: Traffic that matches the rule is allowed to pass through the WiFi
network.
○ Deny: Traffic that matches the rule is dropped.

•

Direction: Select a radio button:○ In: The traffic rule is applied only to traffic flowing in from a WiFi network.
○ Out: The traffic rules is applied only to traffic flowing out to a WiFi network.
○ Both: The traffic rule is applied to both traffic flowing in from a WiFi networkand traffic flowing out to a WiFi network.

•

Network Layer: Select a radio button:○ MAC: The traffic rule filters packets at the MAC level.
○ IP: The traffic rule filters packets at the IP level.

•

Protocol: From the Protocol menu, select a protocol:○ ANY: The traffic rule applies to any traffic.
○ ARP: The traffic rule applies only to Address Resolution Protocol (ARP) traffic.
○ TCP: The traffic rule applies only to Transmission Control Protocol (TCP) traffic.
○ UDP: The traffic rule applies only to User Datagram Protocol (UDP) traffic.
○ ICMP: The traffic rule applies only to Internet Control Message Protocol (ICMP)
traffic.
○ IGMP: The traffic rule applies only to Internet Group Management Protocol(ICMP) traffic.

Manage Access and Security

145

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Source: To set the source for the traffic to which the traffic rule must apply, do
the following:a. From the Type menu, select the type of source MAC address or IP address,
depending on the network layer (MAC or IP) that you selected:○ ANY: The traffic rule is applied to any source MAC address or IP address.
○ MAC Address (MAC level only): The traffic rule is applied only to thesource MAC address that you specify in the MAC Address field.
○ IP Address (IP level only): The traffic rule is applied only to the source IP
address that you specify in the IP Address field.
○ IP Subnet (IP level only): The traffic rule is applied only to the source IP
subnet that you specify in the Network Address and Network Mask fields.
The length of the network mask must be from 8 to 32 numbers.
b. In the Port field, type a source port number to which the traffic rule must
apply.
The port number must be in the range from 1 to 65535.

•

Destination: To set the destination for the traffic to which the traffic rule must
apply, do the following:a. From the Type menu, select the type of destination MAC address or IP address,
depending on the network layer (MAC or IP) that you selected:○ ANY: The traffic rule is applied to any destination MAC address or IP
address.
○ MAC Address (MAC level only): The traffic rule is applied only to thedestination MAC address that you specify in the MAC Address field.
○ IP Address (IP level only): The traffic rule is applied only to the destination
IP address that you specify in the IP Address field.
○ IP Subnet (IP level only): The traffic rule is applied only to the destination
IP subnet that you specify in the Network Address and Network Mask
fields.
The length of the network mask must be from 8 to 32 numbers.
b. In the Port field, type a destination port number to which the traffic rule must
apply.
The port number must be in the range from 1 to 65535.

8. In the pop-up window, click the Apply button.
The MAC/IP Traffic Filters page displays again.
9. To change the priority of the traffic rule, point to the six dots icon at the left of thetraffic rule, click and hold, and then move the traffic rule up or down in the table.

Manage Access and Security

146

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The priority number adjusts.
10. Click the Apply button.
Your settings are saved.

Change a traffic rule in a MAC/IP Traffic Filter group
You can change an existing traffic rule in a MAC/IP Traffic Filter group.
To change an existing traffic rule in a MAC/IP Traffic Filter group:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > MAC/IP Traffic Filters.
The MAC/IP Traffic Filters page displays.
5. Click the group in which you want to change a traffic rule.
The table shows the traffic rules that you added to the group.
6. If the group is disabled, click the Enable Group check box.
7. Select the check box for the traffic rule, and click the pencil icon.
The Add / Edit Traffic Rule pop-up window displays.
8. Change the settings as needed.
For more information about the settings, see Add a traffic rule to a MAC/IP Traffic
Filter group on page 144.
9. In the pop-up window, click the Apply button.
The MAC/IP Traffic Filters page displays again.

Manage Access and Security

147

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

10. To change the priority of the traffic rule, point to the six dots icon at the left of thetraffic rule, click and hold, and then move the traffic rule up or down in the table.
The priority number adjusts.
11. Click the Apply button.
Your settings are saved.

Change the priority for a traffic rule in a MAC/IP Traffic Filter
group
You can change the priority for a traffic rule in a MAC/IP Traffic Filter group.
To change the priority for a traffic rule in a MAC/IP Traffic Filter group:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > MAC/IP Traffic Filters.
The MAC/IP Traffic Filters page displays.
5. Click the group in which you want to change the priority for a traffic rule.
The table with traffic rules displays.
6. If the group is disabled, click the Enable Group check box.
7. Point to the six dots icon at the left of the traffic rule for which you want to change
the priority, click and hold, and then move the traffic rule up or down in the table.
The priority number adjusts.
8. Click the Apply button.
Your settings are saved.
Manage Access and Security

148

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Remove a traffic rule from a MAC/IP Traffic Filter group
You can remove a traffic rule that you no longer need.
To remove a traffic rule from a MAC/IP Traffic Filter group:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > ACLs > MAC/IP Traffic Filters.
The MAC/IP Traffic Filters page displays.
5. Click the group from which you want to remove a traffic rule.
The table with traffic rules displays.
6. If the group is disabled, click the Enable Group check box.
7. Select the check box for the traffic rule, and click the trash can icon.
The traffic rule is removed.
8. Click the Apply button.
Your settings are saved.

Enable L2 security
L2 security can prevent attacks via VLAN stacking by blocking VLAN-tagged packets on
the WiFi interface. If you enable L2 security, the AP allows only certain types of client
traffic, such as ARP, IPv4, and IPv6 traffic, on any WiFi network. L2 security is disabled
by default.

Manage Access and Security

149

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To enable L2 security:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Security > L2 Security.
The L2 Security page displays.
5. Select the Yes radio button.
By default the No radio button is selected, and L2 security is disabled.
6. Click the Apply button.
Your settings are saved.

Manage Access and Security

150

User Manual9Manage the Local Area Network
and IP Settings
This chapter describes how you can manage the local area network (LAN) and IP settingsof the AP.
The chapter includes the following sections:•

Disable the DHCP client and set a fixed IP address•

Enable the DHCP client•

Set the 802.1Q VLAN and management VLAN•

Set an existing domain name•Enable or disable Spanning Tree Protocol•

Enable or disable the network integrity check function•

Enable or disable IGMP snooping•

Enable or disable the hardware assisted datapath•

Enable or disable Ethernet LLDP•

Enable or disable UPnP•Manage the multicast DNS gateway
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

151

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Disable the DHCP client and set a
fixed IP address
By default, the DHCP client of the AP is enabled and the AP receives an IP address froma DHCP server (or a router that functions as a DHCP server) in your network. If yournetwork does not include a DHCP server or you prefer to specify a fixed (static) IP
address, disable the DHCP client of the AP.
To disable the DHCP client and set a fixed IP address:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > IP > LAN.
The IPv4 Settings page displays. The fields are masked because the DHCP client isenabled.
5. Select the Disable radio button.
The fields are unmasked.
6. Specify the settings that are described in the following table.
Setting

Description

IP Address

IP address in the range that is used by your LAN. By default, the IP address is
192.168.0.100.

Subnet Mask

The subnet mask must be compatible with your LAN. By default, the network mask
is 255.255.255.0.

Gateway

IP address of the gateway on your LAN.

Manage the Local Area Network
and IP Settings

152

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710(Continued)
Setting

Description

Primary DNS

IP address of the primary Domain Name System (DNS) server on your LAN.

Secondary DNS

IP address of the secondary DNS server on your LAN, or leave this field blank.

7. Click the Apply button.
Your settings are saved. The AP restarts with the new IP settings.

Enable the DHCP client
By default, the DHCP client of the AP is enabled and the AP receives an IP address froma DHCP server (or a router that functions as a DHCP server) in your network.
If you disabled the DHCP client, you can reenable it.
To enable the DHCP client:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > IP > LAN.
The IPv4 Settings page displays.
5. Select the Enable radio button.
The fields are masked.
6. Click the Apply button.

Manage the Local Area Network
and IP Settings

153

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Your settings are saved. The AP restarts with the new IP settings. It might take a while
before the AP receives its IP address setting from the DHCP server.

Set the 802.1Q VLAN andmanagement VLAN
The 802.1Q VLAN protocol on the AP logically separates traffic on the same physical(wired) network. This protocol can work with tagged and untagged VLANs, as follows:•

Untagged VLAN: The AP sends untagged frames from its Ethernet interface.
Incoming untagged frames are assigned to the untagged VLAN. By default, theuntagged VLAN is VLAN 1. By default, the AP functions with an untagged VLAN.

•

Tagged VLAN: The AP tags all frames that it sends from its Ethernet interface. Only
the incoming frames that are tagged with known VLAN IDs are accepted.

The management VLAN is used for managing traffic such as Telnet, SNMP, HTTP, andHTTPS traffic sent to and from the AP. Frames that belong to the management VLAN
and that are sent over the trunk do not receive an 802.1Q header. If a port is a memberof a single VLAN, its traffic can be untagged.
A management VLAN other than the default VLAN 1 and the following features aremutually exclusive:•

mDNS gateway (see Manage the multicast DNS gateway on page 162)•

NAT mode (see Set NAT mode or Bridge mode for addressing and traffic on page
213)

To set the 802.1Q VLAN and management VLAN:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network

Manage the Local Area Network
and IP Settings

154

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > IP > LAN.
The IPv4 Settings page displays.
5. To change the 802.1Q VLAN, either clear or select the Untagged VLAN check box:•

Untagged VLAN: By default, the Untagged VLAN check box is selected. The
AP sends untagged frames from its Ethernet interface. Incoming untagged frames
are assigned to the untagged VLAN. By default, the untagged VLAN is VLAN 1
but you can enter another VLAN ID in the field if that VLAN ID is supported onyour network.

•

Tagged VLAN: Clear the Untagged VLAN check box only if the hubs and switcheson your LAN support the 802.1Q VLAN protocol. The AP tags all frames that it
sends from its Ethernet interface. Only the incoming frames that are tagged withknown VLAN IDs are accepted. Similarly, change the ID for the untagged VLAN
only if the hubs and switches on your LAN support the 802.1Q VLAN protocol
and the new VLAN ID is supported on your network.

A VLAN ID must be in the range from 1 to 4094.
6. To change the VLAN ID for the management VLAN, enter another VLAN ID in theManagement VLAN field.
By default, the management VLAN is VLAN 1. If you change the VLAN ID, be surethat the VLAN ID is supported on your network.
7. Click the Apply button.
Your settings are saved. The AP restarts with the new VLAN settings.

Set an existing domain name
You can specify an existing fully qualified domain name (FQDN) for the AP so that you
can access the AP by using a domain name instead of an IP address.
The FQDN must be a domain name that is registered with a Domain Name System(DNS) provider.
The following are the requirements for the FQDN:•

The maximum length of the FQDN is 255 characters, with a maximum of 63 characters
per label, separated by a dot (.) between each label.

•

Alphanumeric characters are allowed (a–z and 1–9).

•

A space is not allowed.

Manage the Local Area Network
and IP Settings

155

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

A dot (.) and a hyphen (-) are allowed but the name cannot start with either.

•

Numbers and special characters are not allowed in the last label of the FQDN.

An example is myap01-firstfloor-myorganization.com.
To set an existing FQDN:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > IP > LAN.
The IPv4 Settings page displays.
5. In the Fully Qualified Domain Name field, specify the FQDN.
6. Click the Apply button.
Your settings are saved. The AP attempts to resolve the FDQN to an IP address.

Enable or disable Spanning Tree
ProtocolFor locations where multiple APs are active and redundant network paths might bepresent, Spanning Tree Protocol (STP) can prevent network loops. If your location might
include redundant network paths, we recommend that you enable STP.

Manage the Local Area Network
and IP Settings

156

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To enable or disable Spanning Tree Protocol:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > General.
The General page displays.
5. Select a Spanning Tree Protocol radio button:•

Enable: STP is enabled.

•

Disable: STP is disabled. This is the default setting.

6. Click the Apply button.
Your settings are saved.

Enable or disable the network
integrity check function
The network integrity check function enables the AP to validate whether the upstream
link is active before the AP allows WiFi associations. Make sure that the default gateway
is configured correctly. By default, the network integrity check function is disabled.
To enable or disable the network integrity check function:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
Manage the Local Area Network
and IP Settings

157

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > General.
The General page displays.
5. Select a Network Integrity Check radio button:•

Enable: The network integrity check function is enabled.

•

Disable: The network integrity check function is disabled. This is the default
setting.

6. Click the Apply button.
Your settings are saved.

Enable or disable IGMP snooping
IGMP snooping allows IP multicast packets to be transmitted only to the members of acorresponding multicast group. Enabling IGMP snooping prevents flooding of multicast
traffic to all the ports in a broadcast domain. By default, IGMP snooping is disabled on
the AP.
To enable or disable IGMP snooping:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
Manage the Local Area Network
and IP Settings

158

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > General.
The General page displays.
5. Select an IGMP Snooping radio button:•

Enable: IGMP snooping is enabled.

•

Disable: IGMP snooping is disabled. This is the default setting.

6. Click the Apply button.
Your settings are saved.

Enable or disable the hardware
assisted datapath
The hardware assisted datapath, which is enabled by default, increases the maximum
throughput on the AP.
We recommend that you leave the hardware assisted datapath enabled unless youneed to enable inter-VLAN routing or support jumbo frames in the network. Disabling
the hardware assisted datapath reduces the maximum throughput, but the throughput
is still high enough for an enterprise deployment.
To enable or disable the hardware assisted datapath:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.

Manage the Local Area Network
and IP Settings

159

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > General.
The General page displays.
5. Select a Hardware Assisted Datapath radio button:•

Enable: The hardware assisted datapath is enabled. This is the default setting.

•

Disable: The hardware assisted datapath is disabled.

6. Click the Apply button.
Your settings are saved.

Enable or disable Ethernet LLDP
Link Layer Discovery Protocol (LLDP), as specified in IEEE 802.1AB, can provide link-layer
messages to adjacent network devices. For example, LLDP lets network devices suchas switches and management devices discover the AP in a network.
LLDP can also detect if the AP receives power through PoE. By default, LLDP is enabled.
To enable or disable the LLDP:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
Manage the Local Area Network
and IP Settings

160

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Ethernet LLDP.
The Ethernet LLDP page displays.
5. Select a radio button:•

Enable: LLDP is enabled. This is the default setting.

•

Disable: LLDP is disabled.
CAUTION: If the AP receives power from a PoE switch and you disable LLDP,
power to the AP might be turned off after you click the Apply button. In thatcase, restart the AP.

6. Click the Apply button.
Your settings are saved.

Enable or disable UPnP
Universal Plug and Play (UPnP) lets the AP be discovered by other devices in a networkthat support UPnP. UPnP is enabled by default.
To enable or disable UPnP:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > UPnP.
The UPnP page displays.
5. Select a radio button:
Manage the Local Area Network
and IP Settings

161

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Enable: UPnP is enabled. This is the default setting.

•

Disable: UPnP is disabled.

6. Click the Apply button.
Your settings are saved.

Manage the multicast DNS gateway
The AP can function as a multicast DNS (mDNS) gateway to allow devices and services
to be shared across different VLANs and WiFi networks. mDNS works even if inter-VLAN
routing is disabled in the network to which the AP is connected.
Shared devices include printers, scanners, storage devices, and other hardware devices.
Services include multiple predefined telephone, music, and video streaming services,
file sharing services, and other services and applications.
For example, if a group of WiFi clients are on VLAN 20 and a printer is on VLAN 1, an
mDNS gateway policy can make the printer available to the WiFi clients. Or, if a meeting
participant wants to use a phone connected to a WiFi network on VLAN 20 to cast apresentation to a large-screen device connected to a WiFi network on VLAN 30, anothermDNS gateway policy can make this possible.
A service can run either on a wired or WiFi device, but for a WiFi client to be able toaccess the service, the WiFi client must be connected to a WiFi network on an AP thathas the mDNS gateway feature enabled.
In a network with multiple APs that support the mDNS gateway feature, you can set one
AP as the mDNS reflector AP, which re-advertises shared devices and services throughout
the network.
An mDNS gateway and the following features are mutually exclusive:•

WPA2 Enterprise security and WPA3 Enterprise security that use a dynamic VLAN
(see Set up an open or secure WiFi network on page 55)•

Multi PSK (see Set up Multi PSK for a WiFi network on page 74)•

Management VLAN (see Set the 802.1Q VLAN and management VLAN on page 154)•

NAT mode (see Set NAT mode or Bridge mode for addressing and traffic on page
213)•

Client isolation (see Enable or disable client isolation for a WiFi network on page
214)

Manage the Local Area Network
and IP Settings

162

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Enable the multicast DNS gateway and add
a policy
After you enable the multicast DNS (mDNS) gateway and add a policy, the AP canautomatically discover devices and services that can be shared. The policy forms a
bridge between the following two VLANs:•

Service VLAN: The VLAN that includes shared devices or services as members. For
example, the type of shared device can be printer, in which case the service VLAN
is the VLAN of which the printer is a member. Or, the type of shared service can be
Googlecast, in which case the service VLAN is the VLAN of which the Googlecast
device is a member.

•

VLANs on allowed WiFi networks: The VLAN that includes as members the WiFi
devices that must be able to use the shared devices or service on the service VLAN.

You can add up to eight policies. A policy enables access to a shared device or service.
A WiFi client can access a shared device or service if the AP to which the client isconnected has a policy configured for the shared device of service.
To enable the multicast DNS gateway and add a policy:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > mDNS Gateway.
The mDNS Gateway page displays.
5. Select the mDNS Gateway Enable radio button.
By default, the mDNS gateway is disabled and the Disable radio button is selected.

Manage the Local Area Network
and IP Settings

163

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

6. If your network includes multiple APs that support the mDNS gateway feature andthis AP must function as the mDNS reflector AP in your network, select the Yes radio
button.
By default, the No radio button is selected.
7. Click the Apply button.
Your settings are saved. A section with policy information displays.
8. Click the Add Policy + button.
A row is added to the table the with mDNS gateway policies. (You can add multiple
rows for multiple policies.)
9. Define the mDNS gateway policy by specifying the following:•

Policy Name: A name that lets you identify the policy. You can use up to 32
alphanumeric and special characters, except for the double quote (“”) andbackslash (\) characters.

•

Shared Services: From the Shared Services menu, select the type of device (forexample, printer) or service (for example, Googlecast) that must be shared.

•

Service VLAN: In the Service VLAN field, enter the VLAN ID that includes as
members the type of shared device or service that you select from the Shared
Services menu.
The VLAN ID can be in the range from 1 to 4094.

•

Service IP: Enter the IP address of the shared device or service that you selectfrom the Shared Services menu.

•

Allowed WiFi Network: From the Allowed WiFi Network menu, select the
WiFi networks with their associated VLANs, which include as members the WiFi
devices that must be able to use the type of shared devices or service that you
select from the Shared Services menu.

10. To add another mDNS policy, click the Add Policy + button, and repeat the previous
step.
11. Click the Apply button.
Your settings are saved.

Change or remove a multicast DNS policy
You can change or remove a multicast DNS (mDNS) policy.
To change or remove an mDNS policy:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
Manage the Local Area Network
and IP Settings

164

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > mDNS Gateway.
The mDNS Gateway page displays.
5. To change a policy:
a. Click the pencil and notebook icon to the right of the policy.
b. Change the settings.
For more information about the settings, see Enable the multicast DNS gateway
and add a policy on page 163.
c. Click the Apply button.
Your settings are saved.
6. To remove a policy:
a. Click the trash can icon to the right of the policy.
b. Confirm the deletion.

Manage the Local Area Network
and IP Settings

165

User Manual

10Manage and Maintain the AP
This chapter describes how you can manage and maintain the AP.
The chapter includes the following sections:•

Change the management mode to NETGEAR Insight or Web-browser•

Change the country or region of operation•

Change the admin user account password•

Change the system name•Specify a custom NTP server•

Set the time zone•

Manage the syslog settings•

Manage the firmware of the AP•

Manage the configuration file of the AP•

Use the Reset button to reboot the AP•

Reboot the AP from the device UI•Schedule the AP to reboot•

Return the AP to its factory default settings•

Enable SNMP and manage the SNMP settings•

Manage the LED•

Manage the Energy Efficiency Mode
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

166

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Change the management mode to
NETGEAR Insight or Web-browser
The AP can function in either of the following management modes:•

NETGEAR Insight (Cloud/Remote): For NETGEAR Insight Premium and Insight Pro
subscribers, you can manage the AP remotely through the Insight Cloud Portal orfrom a mobile device on which the NETGEAR Insight app is installed.
The NETGEAR Insight mode is the default setting. In this mode, you can connect to
the AP over the device UI, but only a basic and limited device UI is available. For
information about the NETGEAR Insight Cloud Portal and Insight app, visit
insight.netgear.com and see the NETGEAR knowledge base atnetgear.com/support/product/insight.aspx.
CAUTION: When you change the management mode from Web-browser
mode to NETGEAR Insight mode, the configuration of the AP is reset (cleared)
with the exception of the IP address, AP name, and password for the device
UI. The AP restarts and broadcasts SSID Netgearxxxxxx, in which xxxxxx
represents the last six hexadecimal digits of the AP’s MAC address. The MAC
address is listed on the product label. The default WiFi passphrase issharedsecret.

•Web-browser (Local): You can manage the AP locally from a WiFi or wired device
through the device UI. In this mode, the AP functions as a standalone device and is
not connected to the Insight cloud-based management platform.
NOTE: If you first add the AP to a NETGEAR Insight network location andmanage the AP through the Insight Cloud Portal or Insight app and then you
change the management mode to Web-browser mode, you must continue
to use the Insight network password to access the device UI until you manuallychange the admin password on the AP.

To change the management mode to NETGEAR Insight mode or Web-browser
mode:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.

Manage and Maintain the AP

167

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Basic > Management Mode.
The Management Mode page displays.
5. Select one of the following radio buttons:•

NETGEAR Insight (Cloud/Remote): The AP functions in NETGEAR Insight
management mode.

•

Web-browser (Local): The AP functions in Web-browser management mode.
CAUTION: When you change the management mode from Web-browser
mode to NETGEAR Insight mode, the configuration of the AP is reset (cleared)
with the exception of the IP address, AP name, and password for the device
UI. The AP restarts and broadcasts SSID Netgearxxxxxx, in which xxxxxx
represents the last six hexadecimal digits of the AP’s MAC address. The MAC
address is listed on the product label. The default WiFi passphrase issharedsecret.

6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The AP restarts in the new
management mode.

Change the country or region ofoperation
You can change the country or region in which the AP operates. Note the following:

Manage and Maintain the AP

168

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

In some countries, the AP is sold with a preconfigured country or region setting andyou cannot change it.

•

If you do not see your country or region listed in the menu, update the AP’s firmware
and check again. If you still do not see your country or region listed, contact NETGEAR
support.

•Make sure that the country is set to the location where the device is operating. It
might not be legal to operate the AP in a region other than the regions listed in themenu. You are responsible for complying with the local, regional, and national
regulations that are set for channels, power levels, and frequency ranges.

To change the country or region of operation:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Basic > General.
The General page displays the basic system settings.
5. Select a country or region from the Country / Region menu.
6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The AP restarts with thedefault WiFi and radio settings that are specific to the selected country or region.

Manage and Maintain the AP

169

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Change the admin user accountpassword
This admin user account password is the password that you use to log in to the device
UI of the AP with the user name admin. (It is not the passphrase that you use for WiFi
access.)The password must be 8 to 63 characters in length and must contain at least one
uppercase letter, one lowercase letter, and one number.
To change the password for the user name admin:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > User Accounts.
The page that displays lets you change the user accounts.
5. Next to admin, in the Password field, enter the new password.
6. In the Confirm Password field, enter the same new password.
NOTE: You cannot change the user name. The name must remain admin.
7. Click the Apply button.
Your settings are saved. The next time that you log in to the AP, you must use thenew password. If you forget the new password, you must reset the AP to factory
default settings. Doing so restores the password to the default password.

Manage and Maintain the AP

170

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Change the system name
The system name (also referred to as AP name, or AP name) is a unique NetBIOS namefor the AP. The default system name is located on the AP label. By default, the systemname is Netgearxxxxxx, in which xxxxxx represents the last six hexadecimal digits of the
AP’s MAC address.
To change the system name:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Basic > General.
The General page displays the basic system settings.
5. Enter a new name in the System Name field.
Use the following guidelines:•

The name must contain alphanumeric characters, can contain hyphens, andcannot be longer than 64 characters.

•

The name cannot start or end with a hyphen.

•

The name must contain at least one alphabetical character.

6. Click the Apply button.
Your settings are saved.

Manage and Maintain the AP

171

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Specify a custom NTP server
By default, the AP receives its time from a default NETGEAR Network Time Protocol(NTP) server, but you can also specify a custom NTP server.
To specify a custom NTP server:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Basic > Time.
The Time page displays.
By default, the Enable radio button is selected and the AP functions as an NTP clientthat receives its time from a default NETGEAR NTP server.
5. Select the Use Custom NTP Server check box.
6. Take one of the following actions:•Enter the host name of the NTP server.
By default, the Hostname radio button is selected.

•

Select the IP address radio button and enter the IP address of the NTP server.

7. Click the Apply button.
Your settings are saved. When the AP connects over the Internet to the new NTP
server, the date and time that display on the page are adjusted according to yoursettings.
For information about setting the time zone, see Set the time zone on page 173.

Manage and Maintain the AP

172

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Set the time zone
When the AP synchronizes its clock with a Network Time Protocol (NTP) server, the pageshows the date and time. If the page does not show the correct date and time, you mightneed to set the time zone.
To set the time zone:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Basic > Time.
The page that displays lets you change the time settings.
5. From the Time Zone menu, select the time zone for the area in which the AP operates.
6. Click the Apply button.
Your settings are saved. When the AP connects over the Internet to an NTP server,
the date and time that display on the page are adjusted according to your settings.
For information about other time settings, see Specify a custom NTP server on page
172.

Manage the syslog settings
If a syslog server is present on your network, you can configure the AP to send its systemlogs to the syslog server.

Manage and Maintain the AP

173

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To manage the syslog settings and enable the syslog function:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Syslog.
The Syslog page displays.
5. To enable the syslog server function, select the Enable Syslog check box.
6. Specify the IP address and port number for the syslog server:•

Syslog Server IP Address: Enter the IP address of the syslog server on yournetwork.

•

Port Number: Enter the port number at which the syslog can be reached. The
port number can be in the range from 1 to 65535. By default, the port number
is 514.

7. To log information that is collected from devices that are actively seeking network
connections on the configured syslog server, select the Log Probing Clients checkbox.
The log message uses the following format:
Probe request-Client:<aa:bb:cc:dd:ee:ff>, SSID: <Name>, BSSID:<aa:bb:cc:dd:ff:ee>, RSSI: <-xx dbM>, Radio: <x>, Channel: <y>The fields in a log message mean the following:•

Probe request-Client: MAC address•

SSID: Name•

BSSID: MAC address•

RSSI: Negative value in dBm

Manage and Maintain the AP

174

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Radio: Value in GHz•

Channel: Value in GHz

8. Click the Apply button.
Your settings are saved.

Manage the firmware of the AP
The AP firmware is stored in flash memory.
You can check to see if new firmware is available and update the AP to the new firmware.
You can also visit the NETGEAR support website, download the firmware manually toa local computer, and update the AP to the new firmware. If someone (usually the
network administrator) places new firmware on a secure FTP (SFTP) server in the network,
you can load the firmware from the server and update the firmware of the AP.
Depending on how you are connected to the AP, we recommend the following firmware
update methods:•

WiFi connection: If you are connected over WiFi to the AP, let the AP check theInternet to see if new firmware is available. See Let the AP check for new firmware
and update the firmware on page 175.
With this method, if new firmware is available, it is downloaded directly to the AP.

•

LAN connection: If you are connected over the LAN to the AP, manually update thefirmware from a computer or SFTP server. See Manually download firmware andupdate the AP on page 177 or Use an SFTP server to update the AP on page 179.
With this mode, if new firmware is available, you must either download it to yourcomputer and then upload it to the AP or upload it from an SFTP server to the AP.

The following sections describe the firmware management methods:•

Let the AP check for new firmware and update the firmware•

Manually download firmware and update the AP•

Revert to the backup firmware•

Use an SFTP server to update the AP

Let the AP check for new firmware andupdate the firmware
For you to let the AP check for new firmware, the AP must be connected to the Internet.
Manage and Maintain the AP

175

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To let the AP check for new firmware and update the AP:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Click the Check for Upgrade button.
The AP detects new firmware if any is available and displays the latest version
available.
5. To read the release notes if any are available, click the Release Notes link.
A web page displays the release notes.
6. To download and install the new firmware, click the Upgrade Now button, andfollow the prompts and dialog boxes.
The AP locates the firmware, downloads it, and begins the update.
WARNING: To avoid the risk of corrupting the firmware, do not interrupt
the update. For example, do not close the browser, click a link, or load a new
page. Do not turn off the AP. Wait until the AP finishes restarting and the LEDremains solid green or solid blue.
The firmware update process takes several minutes. When the update is complete,your AP restarts.
7. Verify that the AP runs the new firmware version by logging back in to the AP.
The firmware version is displayed on the Dashboard.
8. Read the new firmware release notes to determine whether you must reconfigure
the AP after updating.

Manage and Maintain the AP

176

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manually download firmware and update
the AP
Downloading firmware to a local computer and updating the AP are two separate tasks
that are combined in the following procedure. After you update the AP to new firmware,
the old firmware is saved as backup firmware so that you can revert to it (see Revert tothe backup firmware on page 178).
CAUTION: When you install an older firmware version (or the backup firmware
version), that is, you downgrade rather than update the firmware, theconfiguration of the AP is reset (cleared) with the exception of the IP address,
AP name, and password for the device UI. The AP restarts and broadcasts SSID
Netgearxxxxxx, in which xxxxxx represents the last six hexadecimal digits of the
AP’s MAC address. The MAC address is listed on the product label. The default
WiFi passphrase is sharedsecret.
To download firmware manually and update the AP:
1. Visit netgear.com/support/download/, locate the support page for your product,and download the new firmware.
2. Read the new firmware release notes to determine whether you must reconfigure
the AP after upgrading.
3. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
4. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
5. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
6. Select Management > Maintenance > Upgrade > Firmware Upgrade.
The Firmware Upgrade page displays.
7. Make sure that Local is selected from the Upgrade Options menu.
Manage and Maintain the AP

177

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Local is the default selection.
8. Locate and select the firmware file on your computer by doing the following:a. Click the Browse button.
b. Navigate to the firmware file.
The file name ends in .tar.
c. Select the firmware file.
9. Click the Upgrade button.
WARNING: To avoid the risk of corrupting the firmware, do not interrupt
the update. For example, do not close the browser, click a link, or load a new
page. Do not turn off the AP. Wait until the AP finishes restarting and the LEDremains solid green or solid blue.
The firmware update process takes several minutes. When the update is complete,
the AP restarts.
10. Verify that the AP runs the new firmware version by logging back in to the AP.
The firmware version is displayed on the Dashboard.

Revert to the backup firmware
After you upgrade the AP to new firmware, the old firmware is saved as backup firmware
so that you can revert to it.
CAUTION: When you revert to the backup firmware and the backup firmware
is an earlier version than the firmware version that is running on the AP, theconfiguration of the AP is reset (cleared) with the exception of the IP address,
AP name, and password for the device UI. The AP restarts and broadcasts SSID
Netgearxxxxxx, in which xxxxxx represents the last six hexadecimal digits of the
AP’s MAC address. The MAC address is listed on the product label. The default
WiFi passphrase is sharedsecret.
To revert to the backup firmware on the AP:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
Manage and Maintain the AP

178

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Maintenance > Upgrade > Firmware Upgrade.
The Firmware Upgrade page displays. The page shows both the current firmware
version and the backup firmware version.
5. Click the Boot up Backup Firmware button.
A warning pop-up window displays.
CAUTION: When you revert to the backup firmware, the configuration of
the AP is reset (cleared) with the exception of the IP address, AP name, andpassword for the device UI. The AP restarts and broadcasts SSID
Netgearxxxxxx, in which xxxxxx represents the last six hexadecimal digits of
the AP’s MAC address. The MAC address is listed on the product label. The
default WiFi passphrase is sharedsecret.
6. Click the Swap button.
The pop-up window closes, the firmware reversion process initiates, and the APrestarts.
WARNING: To avoid the risk of corrupting the firmware, do not interrupt
the reversion. For example, do not close the browser, click a link, or load a
new page. Do not turn off the AP. Wait until the AP finishes restarting andthe LED remains solid green or solid blue.
7. Verify that the AP runs the backup firmware version by logging back in to the AP.
The firmware version is displayed on the Dashboard.

Use an SFTP server to update the AP
If someone (usually the network administrator) places new firmware on a secure FTP(SFTP) server in the network, you can load the firmware from the SFTP server and update
the firmware of the AP.
To update the firmware of the AP from an SFTP server:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
Manage and Maintain the AP

179

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Maintenance > Upgrade > Firmware Upgrade.
The Firmware Upgrade page displays.
5. From the Upgrade Options menu, select SFTP.
6. Specify the following server settings:•

Firmware File: The name of the AP firmware file on the SFTP server.

•

SFTP Server IP: The IP address of the SFTP server on your network.

•

User Name: The user name that is required to access the SFTP server.

•

Password: The password that is required to access the SFTP server.

7. Click the Upgrade button.
WARNING: To avoid the risk of corrupting the firmware, do not interrupt
the update. For example, do not close the browser, click a link, or load a new
page. Do not turn off the AP. Wait until the AP finishes restarting and the LEDremains solid green or solid blue.
The firmware update process takes several minutes. When the update is complete,
the AP restarts.
8. Verify that the AP runs the new firmware version by logging back in to the AP.
The firmware version is displayed on the Dashboard.

Manage and Maintain the AP

180

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manage the configuration file of theAP
The configuration settings of the AP are stored within the AP in a configuration file. You
can back up (save) this file to your computer or restore it.

Back up the AP configuration
You can save a copy of the current configuration settings. If necessary, you can restore
the configuration settings later.
NOTE: The backup file is saved in a binary format so that it is protected andcannot be opened by a regular application.
To back up the AP’s configuration settings:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Maintenance > Upgrade > Backup and Restore > Backup
Settings.
The Backup Settings page displays.
5. Click the Backup button.
A pop-up window displays.
6. Enter a password to protect the backup file, and click the Continue button.
Manage and Maintain the AP

181

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

You can either use your existing password (the one that you use to log in to the AP)or enter a unique password.
The password must be 8 to 63 characters in length and must contain at least one
uppercase letter, one lowercase letter, and one number. The following special
characters are allowed:!@#$%^&*()
NOTE: We recommend that you save the password because you must enterit again if you restore the configuration from the backup file.
7. Choose a location to store the file on your computer.
The name of the backup file can be
WBE7XX-NETGEARYYYYYY-dd-mm-yy_hh-mm-ss-config.tar or
WBE7XX-WBE7XX-YYYYYY-dd-mm-yy_hh-mm-ss-config.tar.
7XX represents the model number, YYYYYY represents the last six hexadecimal
digits of the AP’s MAC address (or the system name), dd is the date, mm is the month,
yy is the year, hh is the hour (in 24-hour format), mm is the minutes, and ss is theseconds.
Examples of the name of a backup file are
WBE7XX-NETGEAR1A2B3C-02-18-24_16-44-12-config.tar and
WBE7XX-WBE7XX-1A2B3C-02-18-24_16-44-12-config.tar.
8. Follow the directions of your browser to save the file.

Restore the AP configuration
If you backed up the configuration file, you can restore the configuration from this file.
To restore configuration settings that you backed up:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
Manage and Maintain the AP

182

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Maintenance > Upgrade > Backup and Restore > Restore
Settings.
The Restore Settings page displays.
5. Click the Browse button and navigate to and select the saved configuration file.
The name of the backup file can be
WBE7XX-NETGEARYYYYYY-dd-mm-yy_hh-mm-ss-config.tar or
WBE7XX-WBE7XX-YYYYYY-dd-mm-yy_hh-mm-ss-config.tar.
7XX represents the model number, YYYYYY represents the last six hexadecimal
digits of the AP’s MAC address (or the system name), dd is the date, mm is the month,
yy is the year, hh is the hour (in 24-hour format), mm is the minutes, and ss is theseconds.
Examples of the name of a backup file are
WBE7XX-NETGEAR1A2B3C-02-18-24_16-44-12-config.tar and
WBE7XX-WBE7XX-1A2B3C-02-18-24_16-44-12-config.tar.
6. Click the Restore button.
A pop-up window displays.
7. Enter the password that you specified when you saved the backup file, and click theContinue button.
8. Click the Restore button.
The pop-up window closes and the configuration is uploaded to the AP. When therestoration is complete, the AP reboots. This process takes about two minutes.
WARNING: To avoid the risk of corrupting the firmware, do not interrupt
the restoration. For example, do not close the browser, click a link, or load a
new page. Do not turn off the AP. Wait until the AP finishes restarting andthe LED turns solid green or solid blue.

Use the Reset button to reboot theAP
You can use the Reset button to reboot the AP.

Manage and Maintain the AP

183

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To reboot the AP using the Reset button:
1. On the bottom panel of the AP, locate the recessed Reset button.
2. Using a straightened paper clip, press and hold the Reset button for about two
seconds until the LED lights solid amber, and then immediately release the button.
CAUTION: If you continue to hold the Reset button, the AP might return toits factory default settings. Release the button as soon as the LED lights solidamber.
The AP reboots, which takes about two minutes.
WARNING: To avoid the risk of corrupting the firmware, do not interrupt
the reboot. Do not turn off the AP. Wait until the AP finishes restarting andthe LED turns solid green or solid blue.

Reboot the AP from the device UI
If you cannot physically access the AP to reboot it (that is, disconnect the power andreconnect the power), you can use the device UI to reboot the AP.
To reboot the AP from the device UI:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Maintenance > Reset > Reboot AP.
The Reboot AP page displays.
5. Click the Reboot AP button.
Manage and Maintain the AP

184

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

A warning pop-up window displays.
6. Click the Reboot button.
The pop-up window closes and the AP reboots, which takes about one minute.

Schedule the AP to reboot
You can schedule the AP to reboot at a time that is more convenient for the network,for example, when you do not expect any (or only a few) WiFi clients to be connectedto the AP. The schedule that you set up is a recurring schedule.
To schedule the AP to reboot:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Maintenance > Reset > Reboot AP.
The Reboot AP page displays.
5. Click the Enable Scheduled Reboot button so that the button displays blue.
The scheduling controls display.
6. Select the check box for the day on which you want the AP to reboot.
You can select multiple days.
7. Using the Start Time menus, specify the hour and minutes for the time at which the
AP must reboot.
Specify the hour in 24-hour format.
8. Click the Apply button.
Manage and Maintain the AP

185

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Your settings are saved.

Return the AP to its factory default
settings
Under some circumstances (for example, if you lost track of the changes that you madeto the AP settings or you move the AP to a different network), you might want to erase
the configuration and reset the AP to factory default settings.
If you do not know the current IP address of the AP, first try to use an IP scanner
application to detect the IP address before you reset the AP to factory default settings.
NOTE: You can also use the NETGEAR Insight app to discover the IP addressthat is assigned to the AP. For more information, see Connect over WiFi using
the NETGEAR Insight app on page 26.
To reset the AP to factory default settings, you can use either the Reset button on the
AP or the reset function in the device UI. However, if you cannot find the IP address or
you lost the password to access the AP, you must use the Reset button.
After you reset the AP to factory default settings, the password for the admin user nameis password, the AP’s DHCP client is enabled, the setup SSID is shown in the format
NETGEARxxxxxx-SETUP, and the default password for WiFi access is sharedsecret. If
the AP does not receive an IP address from a DHCP server, the LAN IP address is set to192.168.0.100.
For an extensive list of factory default settings, see Factory default settings on page 265.

Use the Reset button to reset the AP
You can use the Reset button to return the AP to its factory default settings.
CAUTION: This process erases all settings that you configured in the AP.
To reset the AP to factory default settings:
1. On the bottom panel of the AP, locate the recessed Reset button.
2. Using a straightened paper clip, press and hold the Reset button until the LED starts
blinking amber.

Manage and Maintain the AP

186

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

NOTE: If you hold the Reset button, the LED first lights solid amber, andthen about 5 seconds later, starts blinking amber. If you release the button
while the LED lights solid amber, the AP reboots rather than resets. The LED
must be blinking amber.
3. Release the Reset button.
The configuration is reset to factory default settings. When the reset is complete,
the AP reboots. This process takes about two minutes.
WARNING: To avoid the risk of corrupting the firmware, do not interrupt
the reset. Do not turn off the AP. Wait until the AP finishes restarting and the
LED turns solid green or solid blue.

Use the device UI to reset the AP
You can use the AP’s device UI to return the AP to its factory default settings.
CAUTION: This process erases all settings that you configured in the AP.
To reset the AP to factory default settings through the device UI:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Maintenance > Reset > Restore Defaults.
The Restore Defaults page displays.
5. Click the Restore Defaults button.

Manage and Maintain the AP

187

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

A warning pop-up window displays.
6. Click the Restore button.
The pop-up windows closes and the configuration is reset to factory default settings.
When the reset is complete, the AP reboots. This process takes about two minutes.
WARNING: To avoid the risk of corrupting the firmware, do not interrupt
the reset. For example, do not close the browser, click a link, or load a new
page. Do not turn off the AP. Wait until the AP finishes restarting and the LED
turns solid green or solid blue.

Enable SNMP and manage the
SNMP settings
You can access the AP over a Simple Network Management Protocol (SNMP) connection,
which allows SNMP network management software such as HP OpenView to manage
the AP by using the SNMPv1 or SNMPv2 protocol. By default, SNMP is disabled.
To enable SNMP and manage the SNMP settings:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Maintenance > Remote Management.
The Remote Management page displays.
5. Select the SNMP Enable radio button.
By default, SNMP is disabled.
Manage and Maintain the AP

188

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

6. Specify the following settings:•

Read-Only Community Name: The community string that allows the SNMP
manager to read the AP’s MIB objects. The default is public. This name must be
different from the read-write community name.

•Read-Write Community Name: The community string that allows the SNMP
manager to read and write the AP’s MIB objects. The default is private. This namemust be different from the read-only community name.

•Trap Community Name: The community name that is associated with the IP
address that must receive traps. The default is trap.

•

IP Address (to receive traps): The IP address of the SNMP manager that mustreceive traps.

•

Trap Port: The port number at which the SNMP manager must receive traps. The
default port number is 162. The only other option is port number 161.
NOTE: For the read-only community name, read-write community name,and the trap community name each, the name can be a maximum of 32
characters, and the following special characters are supported: - _ \ / : . , @7. Click the Apply button.
Your settings are saved.

Manage the LED
By default, the single LED is enabled and functions as described in Top panel LED on
page 13. You can manage whether the LED lights at all. This function is useful if you
want the AP to function in a dark environment.
To enable or disable the LED:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.

Manage and Maintain the AP

189

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > LED Control.
The LED Control page displays.
5. Select or clear one of the following radio buttons:•

Enable the LED: The LED is enabled. This is the default setting.

•

Disable the LED: The LED is disabled.

•

Enable the LED for power and cloud functions: The LED is enabled for powerand cloud functions only.

6. Click the Apply button.
Your settings are saved.

Manage the Energy Efficiency Mode
If no WiFi clients are connected to the AP, the AP can automatically enter Energy
Efficiency Mode (EEM) to reduce power consumption and save energy. When one ormore WiFi clients connect, the AP automatically leaves the EEM to resume normal
operation.
If EEM is enabled and no WiFi clients are connected to the AP, antenna stream operation
is limited to 1x1. (Under normal circumstances, the AP can support multiple antenna
streams.) If a WiFi client initiates a connection to the AP, the antenna streams resume
normal operation.
Note the following restrictions:•

Wireless distribution system: EEM is mutually exclusive with a wireless distribution
system (WDS, see Set up a WiFi Bridge in a Wireless Distribution System on page
232).

•

Neighbor AP detection: EEM does not let the 5 GHz and 6 GHz radios detect
neighbor APs (see Manage neighbor AP detection on page 109).

•

DFS channels: When WiFi clients connect to the AP and the AP resumes normal
operation, 5 GHz radio transmissions can be temporarily suspended if the AP operates
in a DFS channel (about 1 minute suspension for a DFS channel; about 10 minutes
suspension for a weather DFS channel).

Manage and Maintain the AP

190

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

NOTE: If use you use EEM, we recommend that you enable band steering inyour WiFi networks. Band steering lets 5-GHz-capable WiFi clients that areconnected to the 2.4 GHz band to be steered to the 5 GHz or 6 GHz band for
improved performance. For more information, see Enable or disable bandsteering on page 78.
To enable or disable the Energy Efficiency Mode:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > System > Advanced > Energy Efficiency
Mode.
The Energy Efficiency Mode page displays.
5. Select a radio button:•

Enable: Energy Efficiency Mode is enabled.

•

Disable: Energy Efficiency Mode is disabled. This is the default setting.

6. Click the Apply button.
Your settings are saved.

Manage and Maintain the AP

191

User Manual

11
Monitor the AP and the Network
This chapter describes how you can monitor the AP and the network.
The chapter includes the following sections:•

Display the AP Internet, IP, and system settings•

Display the WiFi radio settings•

Display unknown and known neighbor access points•

Display statistics for MAC and IP-based traffic policies•

Display client distribution, connected clients, and client trends•

Display traffic volume, fan information, statistics, and channel utilization•

Display or download tracked URLs•

Display, save, download, or clear the logs•

Display a WiFi bridge connection•

Display alarms and notifications
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

192

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Display the AP Internet, IP, andsystem settings
To display the AP, Internet, IP, and system settings:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Locate the Connection Status Information pane (usually at the left of the page),
System Information pane (usually at the upper center of the page), and IP Settings
Information pane (usually at the lower center of the page).
If the page width on your device is narrow, these panes might be located elsewhereon the Dashboard.
For information about the radio settings pane (usually at the right of the page), see
Display the WiFi radio settings on page 196.
The following settings are displayed:•

Connection Status Information pane: This pane is in the top, left corner of the
Dashboard (if the page width on your device is sufficient; otherwise, it might beelsewhere) and displays the following:○ Status of the connection to the NETGEAR Insight cloud-based management
platform, if any○ Status of the Internet connection

Monitor the AP and the Network

193

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ Functioning mode of the AP, which is always Access Point○ Number of devices connected to the AP•

System Information pane: This pane is in the center at the top of the Dashboard(if the page width on your device is sufficient; otherwise, it might be elsewhere)
and displays the following:○ System name of the AP and country or region of operation○ Ethernet MAC address○ The serial number○ AP uptime○ Firmware version○ The date and time that the AP itself or someone manually last checked if new
firmware was available
This pane also contains a button that you can click to check for firmware updates
for the AP. If an update is available, the Update Available button displays. (Formore information about firmware updates, see Let the AP check for new firmware
and update the firmware on page 175).

•

IP Settings Information pane: This pane is in the center of the Dashboard (ifthe page width on your device is sufficient; otherwise, it might be elsewhere) anddisplays the following:○ IP address of the AP and its DHCP status○ Gateway IP address○ Gateway status○ Wired traffic volume

5. To display more detailed information, select Management > Monitoring > System.
The System page displays.
The page shows five sections:•

System Information section: The following settings are displayed:○ System Name: The AP NetBIOS name○ System Mode: The AP system mode (AP)○ LAN MAC Address: The MAC address of the LAN Ethernet port of the AP○ Wireless MAC Address for 2.4 GHz: The MAC address of 2.4 GHz WiFi
interface (radio) of the AP○ Wireless MAC Address for 5 GHz: The MAC address of 5 GHz WiFi interface(radio) of the AP

Monitor the AP and the Network

194

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ Wireless MAC Address for 6 GHz: The MAC address of 6 GHz WiFi interface(radio) of the AP○ Power Source: The type of power source (the detected level of PoE poweror Power Adapter)
For more information about the PoE level, see The AP functions as a PoE PD
and the LED is blinking green continuously on page 255.
○ Ethernet LLDP: The status of Ethernet LLDP feature (Enabled or Disabled)○ LLDP Neighbor: The neighbor that LLDP detected○ Country / Region: The country or region in which the AP operates or forwhich the AP is licensed○ Current Firmware Version: The version of the firmware that is running on
the AP○ Backup Firmware Version: The version of the backup firmware on the AP○ Bootloader Version: The primary bootloader (U-Boot) version that is installedon the AP○ Serial Number: The serial number of the AP○ Current Time: The current system time of the AP○ Uptime: The time since the AP was last restarted•

AP Interface Status: A green icon indicates that the interface is in use. A grayicon indicates that the interface is not in use.

•

IPv4 Settings section: The following settings are displayed:○ IPv4 Address: The IPv4 address of the AP○ Subnet Mask: The subnet mask of the AP○ Default Gateway: The default gateway for the AP○ DHCP Client: The status of DHCP client (Enabled or Disabled)•

Fan Operational Status: The following settings are displayed:○ System Temperature (°C): The internal temperature of the AP in Celsius○ Fan RPM: The revolutions per minute (RPM) speed of the internal fan•

Wireless Settings section: The following settings are displayed, with separate
columns for the radios:○ Antenna: The type of antenna (by default, 2x2).
○ Wireless Mode: The operating WiFi mode of the radio.
○ Channel / Frequency: The channel and frequency that are used by the radio.
○ Tx Power (in dBm): The transmit power in dBm.

Monitor the AP and the Network

195

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Display the WiFi radio settings
To display the WiFi radio settings of the AP:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Locate the Radio Information pane at the top, right corner of the Dashboard (if thepage width on your device is sufficient; otherwise, it might be elsewhere).
The following settings are displayed:•

Radio status (If the 2.4 GHz, 5 GHz, or 6 GHz icon is displayed as gray, the radio
is turned off.)

•

Mode

•

Channel•Channel width•

Number of connected clients and maximum number of supported clients•

WiFi traffic volume•

Channel utilization•

Antenna

5. To display information about another radio, click the 2.4 GHz, 5 GHz, or 6 GHz tab.
The pane adjusts.
6. To display more detailed information, select Management > Monitoring > System.
The System page displays.

Monitor the AP and the Network

196

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The page shows five sections:•

System Information section: The following settings are displayed:○ System Name: The AP NetBIOS name○ System Mode: The AP system mode (AP)○ LAN MAC Address: The MAC address of the LAN Ethernet port of the AP○ Wireless MAC Address for 2.4 GHz: The MAC address of 2.4 GHz WiFi
interface (radio) of the AP○ Wireless MAC Address for 5 GHz: The MAC address of 5 GHz WiFi interface(radio) of the AP○ Wireless MAC Address for 6 GHz: The MAC address of 6 GHz WiFi interface(radio) of the AP○ Power Source: The type of power source (the detected level of PoE poweror Power Adapter)
For more information about the PoE level, see The AP functions as a PoE PD
and the LED is blinking green continuously on page 255.
○ Ethernet LLDP: The status of Ethernet LLDP feature (Enabled or Disabled)○ LLDP Neighbor: The neighbor that LLDP detected○ Country / Region: The country or region in which the AP operates or forwhich the AP is licensed○ Current Firmware Version: The version of the firmware that is running on
the AP○ Backup Firmware Version: The version of the backup firmware on the AP○ Bootloader Version: The primary bootloader (U-Boot) version that is installedon the AP○ Serial Number: The serial number of the AP○ Current Time: The current system time of the AP○ Uptime: The time since the AP was last restarted•

AP Interface Status: A green icon indicates that the interface is in use. A grayicon indicates that the interface is not in use.

•

IPv4 Settings section: The following settings are displayed:○ IPv4 Address: The IPv4 address of the AP○ Subnet Mask: The subnet mask of the AP○ Default Gateway: The default gateway for the AP○ DHCP Client: The status of DHCP client (Enabled or Disabled)•

Fan Operational Status: The following settings are displayed:

Monitor the AP and the Network

197

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710○ System Temperature (°C): The internal temperature of the AP in Celsius○ Fan RPM: The revolutions per minute (RPM) speed of the internal fan•

Wireless Settings section: The following settings are displayed, with separate
columns for the radios:○ Antenna: The type of antenna (by default, 2x2).
○ Wireless Mode: The operating WiFi mode of the radio.
○ Channel / Frequency: The channel and frequency that are used by the radio.
○ Tx Power (in dBm): The transmit power in dBm.

Display unknown and known
neighbor access points
If you enabled neighbor access point (AP) detection (see Manage neighbor AP detection
on page 109), you can display the unknown access points in the Unknown AP list andthe known access points in the Known AP list.
To display the detected neighbor access points:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Monitoring > Neighbor AP.
The Neighbor AP page displays.

Monitor the AP and the Network

198

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

At the top of the page, for each radio band, the page displays the total number of
unknown access points.
For information about moving unknown access points to the Known AP list, see
Enable neighbor access point detection and move access points to the Known AP
List on page 109.
5. To display the most recent unknown access points, click the Refresh button.
6. To display the Known AP list, click the Known AP tab.
The page adjusts.
At the top of the page, for each radio band, the page displays the total number ofknown access points.
7. To display the most recent known access points, click the Refresh button.

Display statistics for MAC andIP-based traffic policies
You can display the traffic statistics for global and SSID-specific MAC and IP-based traffic
policies (traffic rules). For each rule, these statistics consist of the number of packets
and the number of bytes that a rule has taken effect on.
In order to display traffic statistics, you must have enabled traffic rules:•

Wireless Noise Filter: If you enable the Wireless Noise Filter (see Enable or disable
the Wireless Noise Filter on page 118) and you enable one or more global traffic rules(see Enable, disable, or change a traffic rule in the Wireless Noise Filter on page 119),you can display the traffic statistics that are associated with the MAC level or IP levelof the traffic rules.

•

Global Traffic Filter: If you enable the Global Traffic Filter (see Enable or disable
the Global Traffic Filter on page 124) and you add and enable one or more global
traffic rules (see Add a traffic rule to the Global Traffic Filter on page 125), you candisplay the traffic statistics that are associated with the MAC level or IP level of thetraffic rules.

•

SSID-Specific Group: If you enable at least one MAC/IP Traffic Filter group (seeEnable or disable a MAC/IP Traffic Filter group on page 143), add and enable one ormore traffic rules (see Add a traffic rule to a MAC/IP Traffic Filter group on page 144),and attach the group to a WiFi network (see Select a MAC/IP Traffic Filter group fora WiFi network on page 225), you can display the traffic statistics that are associatedwith the MAC level or IP level of the traffic rules.

Monitor the AP and the Network

199

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To display statistics for MAC and IP-based traffic policies:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. To display traffic statistics, select Management > Monitoring > MAC/IP Traffic
Filter Statistics.
The MAC/IP Traffic Filters Statistics page displays.
5. To display traffic statistics for the Wireless Noise Filter, in the System-Wide Groups
section, click the > Wireless Noise Filter tab. (The tab might be selected by default.)
The page displays the following information and statistics for each enabled trafficrule in the Wireless Noise Filter:•

Priority: The priority order of the rule.

•

Rule Name: The rule name.

•

Action: Indicates whether traffic is allowed or denied.

•

Network Layer: Indicates whether the rule operates at the MAC or IP level.

•

Packets: The number of packets that the rule has taken effect on.

•

Bytes: The number of bytes that the rule has taken effect on.

6. To display traffic statistics for the Global Traffic Filter, in the System-Wide Groups
section, click the > Global Traffic Filter tab.
The page displays the following information and statistics for each enabled trafficrule in the Global Traffic Filter:•

Priority: The priority order of the rule.

•

Rule Name: The rule name.

•

Action: Indicates whether traffic is allowed or denied.

Monitor the AP and the Network

200

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Network Layer: Indicates whether the rule operates at the MAC or IP level.

•

Packets: The number of packets that the rule has taken effect on.

•

Bytes: The number of bytes that the rule has taken effect on.

7. To display traffic statistics for a specific group that you associated with a WiFi network(SSID), in the SSID-Specific Groups section, click the > Group tab for the group
number.
The page displays the following information and statistics for each enabled trafficrule in the group:•

Priority: The priority order of the rule.

•

Rule Name: The rule name.

•

Action: Indicates whether traffic is allowed or denied.

•

Network Layer: Indicates whether the rule operates at the MAC or IP level.

•

Packets: The number of packets that the rule has taken effect on.

•

Bytes: The number of bytes that the rule has taken effect on.

8. To display the most recent statistics, click the Refresh button.
9. To let the page refresh automatically, click the Auto Refresh button.
When the page is set to refresh automatically, the Auto Refresh button displays blue,
and the page is refreshed every 30 seconds.
10. To reset all counters, click the Reset Counters button.

Display client distribution,connected clients, and client trends
To display the clients that are connected to the AP over WiFi:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.

Monitor the AP and the Network

201

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Locate the Client Distribution pane (usually at the middle left of the page) and the
Recent Clients pane (usually at the middle right of the page).
The Client Distribution pane shows the types of clients (Windows, Mac, iOS, Android,
Linux, and other operating systems) and how these clients are distributed over the
networks. (By default, the Network button is selected.)
The Recent Clients pane shows the top 5 recently connected clients list.
5. To display how the clients are distributed over the radios, click the Radio button in
the Client Distribution pane.
The page adjusts and shows the types of clients for each radio.
6. To display recent clients for all networks or a single network, in the Recent Clients
pane, click the filter icon, and select All WiFi Clients or the clients for a specific WiFi
network (SSID).
For your selection, the pane displays the total number of connected clients and thedevice names of the connected clients.
7. To display information about a connected client, click its device name.
The page displays the MAC address, device type, IP address, and SSID for the client.
You can also display more information, including very detailed information (see Step
11 and Step 12).
8. To display trends about clients, scroll down to the Hours Trend pane (usually at thebottom of the page).
The Hours Trend pane shows a graph with the number of clients, the traffic in MBps,
the channel utilization, or the fan condition over a period that you can select.
By default, the client information is selected (that is, the Client button is selected)
and the graph shows the total number of clients for all radios and the number ofclients for each radio (2.4 GHz, 5 GHz, and 6 GHz).
You can also click the Traffic button, the Channel Utilization button, or the Fan
button. For more information, see Display traffic volume, fan information, statistics,
and channel utilization on page 204.
9. To display more information, point to a node on one of the lines on the graph.
10. To change the period over which information is filtered and displayed, select the
number of recent hours from the menu to the right of the buttons.
Monitor the AP and the Network

202

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

11. To display more information about currently connected clients, select Management> Monitoring > Connected Clients.
The Connected Clients page displays.
For each radio, the page displays the number of connected clients and the maximum
number of supported clients. Connected clients that support multi-link operation(MLO) are highlighted under the partner radios on the page.
For each radio and each WiFi client, the page displays the SSID, MAC address, IP
address, host name (for more information, see Assign host names to WiFi clientsand manage the host name list on page 229), operating system (OS), WiFi mode,
VLAN ID, and user name or key identifier (for a Multi PSK configuration).
12. To display very detailed information about a WiFi client, click the information (I) icon
to the left of the client.
The Detailed Client Information page displays and shows the following information:•

MAC Address: The MAC address of the client.

•

IP Address: The IP address associated with the client.

•

Host Name: The host name of the client.

•

OS: The operating system that runs on the client.

•

BSSID: The BSSID that the client connects to.

•

SSID: The SSID of the radio that the client connects to.

•

Channel: The channel that the client connects to.

•

Channel Width: The width of the channel that the client connects to.

•Tx Rate: The rate of traffic transmission of the client.

•Rx Rate: The rate of traffic reception of the client.

•

RSSI: The RSSI threshold value of the client.

•Tx Bytes: The number of bytes that the client transmitted.

•

Rx Bytes: The number of bytes that the client received.

•

State: The QoS state of the connection.

•

Type: The type of WiFi security that is used for the connection.

•

Device Type: The type of device that the client is.

•

Mode: The WiFi mode of the connection.

•

MLO Supported: Indicates if the client supports MLO.

•

MLD Address: If the client supports MLO, the multi link device (MLD) MAC
address.

•

Status: The security status of the connection.

Monitor the AP and the Network

203

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Idle Time: The time that the client remained idle.

•

Assoc Time Stamp: The time that is associated with the information on the
Detailed Client Information page.

•

VLAN ID: The VLAN in which the client is placed.

•

User Name / Key Identifier: The user name or key identifier (for a Multi PSK
configuration) of the client.

•PMF Support: If PMF is enabled on the AP, indicates if the client supports PMF.

13. If you opened the Detailed Client Information page, click the Close button.
The Detailed Client Information page closes.
14. To display the most recent information, click the Refresh button.

Display traffic volume, faninformation, statistics, and channel
utilization
To display WiFi and Ethernet (wired LAN) traffic, fan information, traffic and ARP
statistics, and channel utilization:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Scroll down to the Hours Trend pane at the bottom of the Dashboard.
Monitor the AP and the Network

204

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

By default, the Clients button is selected. (For more information, see Display client
distribution, connected clients, and client trends on page 201.)
5. To display traffic information, do the following:a. Click the Traffic button.
The graph shows the information for Ethernet (wired LAN) traffic, total WiFi traffic,
WiFi traffic for the 2.4 GHz radio, WiFi traffic for each 5 GHz radio, and WiFi traffic
for the 6 GHz radio.
b. To display more information, point to a node on one of the lines on the graph.
6. To display channel utilization, do the following:a. Click the Channel Utilization button.
The graph shows the channel utilization for the 2.4 GHz radio.
b. To display the channel utilization for another radio, click the 5 GHz or 6 GHz
button.
c. To display more information, point to a bar.
7. To display fan information, do the following:a. Click the Fan button.
The graph shows the system temperature and fan RPM.
b. To display more information, point to a bar.
8. To change the period over which information is filtered and displayed, select the
number of recent hours from the menu to the right of the buttons.
9. To display traffic statistics, select Management > Monitoring > Statistics.
The Statistics page displays.
The page shows the network traffic statistics and number of packets and bytes forboth the WiFi and Ethernet interfaces of the AP since the AP started or rebooted.
The page also displays the number of clients that are associated with each radio.
If the ARP proxy is enabled (see Manage the ARP proxy on page 247), the page also
displays the ARP statistics, including the number of proxied and dropped packets.
10. To display the most recent information, click the Refresh button.

Display or download tracked URLs
If you enabled URL tracking for a WiFi network (see Enable or disable URL tracking fora WiFi network on page 216), you can display the tracked URLs by URL, WiFi client, andSSID. You can also download a URL tracking report as a .csv file.

Monitor the AP and the Network

205

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To display or download tracked URLs:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Monitoring > URL Tracking.
The URL Tracking page displays.
By default, the table shows the URLs that were accessed, each with the MAC addressof the WiFi client that accessed the URL, the associated SSID, and the number oftimes that the WiFi client accessed the URL.
5. To display additional information, click the … link to the right of a MAC address or
SSID.
6. To display URL tracking information by WiFi client, do the following:a. From the List by menu, select Client.
The table shows the MAC addresses of the WiFi clients, each with the client hostname, and the first URL of the list of URLs that the client accessed.
b. To display all URLs that a WiFi client accessed, click the … link to the right of thefirst URL.
A pop-up window displays all URLs that the WiFi client accessed.
c. Click the Close button.
The pop-up window closes.
7. To display URL tracking information by SSID, do the following:a. From the List by menu, select SSID.

Monitor the AP and the Network

206

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The table shows the SSIDs and the first URL of the list of URLs that were accessedon the SSID.
b. To display all URLs that were accessed on the SSID, click the … link to the rightof the first URL.
A pop-up window displays all URLs that the were accessed on the SSID.
c. Click the Close button.
The pop-up window closes.
8. To download a URL tracking report as a .csv file, click the Download button, andfollow the directions of your browser.
9. To display the most recent information, click the Refresh button.
10. To clear all URL tracking information, do the following:a. Click the Clear button.
A warning pop-up window displays.
b. Click the OK button.
The pop-up window closes and the information is cleared.

Display, save, download, or clear
the logs
You can display and manage the activity logs of the AP. You can also download a detailed
log file.
NOTE: If the AP functions in the NETGEAR Insight management mode, you canalso display and manage the cloud activity logs, which show the connection of
the AP to the Insight cloud-based management platform. If the AP functions in
the NETGEAR Insight management mode, this is option is available from the
Dashboard by selecting Management > Monitoring > Cloud Logs.
To display, save, download, or clear the logs:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
Monitor the AP and the Network

207

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Monitoring > Logs.
The Logs page displays, showing all recent events with a date and time stamp.
5. To save the logs, do the following:a. Click the Save button.
b. Follow the directions of your browser to save the file to your computer.
6. To download the detailed log entries as zip file, do the following:a. Click the Download Detailed Logs button.
Depending on the size of the file, downloading the detailed log entries mighttake several minutes.
b. Follow the directions of your browser to save the file to your computer.
7. To refresh the log entries onscreen, click the Refresh button.
CAUTION: After you clear the log entries, you can no longer save or
download them.
8. To clear the log entries, click the Clear button.

Display a WiFi bridge connection
You can configure a wireless distribution system (WDS) that consists of point-to-point
WiFi bridge connections between two APs (see Set up a WiFi Bridge in a WirelessDistribution System on page 232). This is different from a NETGEAR Insight Instant Mesh
WiFi network.
You can display whether a WiFi bridge is established and display the function (basestation or repeater), MAC addresses, and IP addresses of the APs that form the WiFi
bridge.

Monitor the AP and the Network

208

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To display a WiFi bridge connection:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Monitoring > Wireless Bridge.
The page that displays lets you select a WDS profile (WDS 1, WDS 2, WDS 3, or
WDS 4).
5. Click the > button to the left of a WDS profile.
The Wireless Bridge page displays for the selected WDS profile.
6. To display the function, MAC address, and IP address of an AP, point to the AP.

Display alarms and notifications
You can display the alarms and notifications from any AP page. The following proceduredescribes how you can display them from the Dashboard.
To display the alarms and notifications:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.

Monitor the AP and the Network

209

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Locate the alarm bell icon at the top-right of the page.
The icon shows a number, indicating the total number of new alarms and notifications
since the last time that you displayed alarms and notifications.
5. Click the alarm bell icon.
The pop-up window shows the alarms (indicated by a red bell) and notifications(indicated by a blue bell) with a description and time.
6. To display more alarms and notification, scroll down in the pop-up window.

Monitor the AP and the Network

210

User Manual

12Manage the Advanced WiFi
Features for a WiFi network
This chapter describes how you can manage the advanced WiFi features for a WiFi
network.
For information about the basic WiFi features for a WiFi network, see Manage the Basic
WiFi Features for a WiFi network on page 53.
The chapter includes the following sections:•

Set NAT mode or Bridge mode for addressing and traffic•

Enable or disable client isolation for a WiFi network•

Enable or disable URL tracking for a WiFi network•

Select a MAC ACL for WiFi clients in a WiFi network•

Set bandwidth rate limits for a WiFi network•

Change the format of the DHCP offer messages in a WiFi network•

Select a MAC ACL for broadcast and multicast traffic from WiFi clients in a WiFi
network•

Block all broadcast and multicast traffic for a WiFi network•

Select a MAC/IP Traffic Filter group for a WiFi network•

Configure advanced rate selection for a WiFi network•

Assign host names to WiFi clients and manage the host name list
NOTE: If you want to change the settings of a WiFi network on the AP, then use
a wired connection to avoid being disconnected when the new WiFi settings
take effect.

211

NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

212

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Set NAT mode or Bridge mode foraddressing and traffic
By default, the addressing and traffic mode of the AP is Bridge mode, which means that
WiFi clients receive IP addresses from a DHCP server (or a router that functions as a
DHCP server) in your network. This is usually the same DHCP server that assigns an IP
address to the AP itself.
You can also set NAT mode, which enables the AP’s DHCP server for WiFi clients. The
AP’s DHCP server assigns an IP address in a different range from the IP address of the
AP itself.
NAT mode and the following features are mutually exclusive:•

Dynamic VLAN (see Set up an open or secure WiFi network on page 55)•

Multi PSK (see Set up Multi PSK for a WiFi network on page 74)•

mDNS gateway (see Manage the multicast DNS gateway on page 162)•

Management VLAN other than the default VLAN 1 (see Set the 802.1Q VLAN andmanagement VLAN on page 154)

To set NAT mode or Bridge mode for addressing and traffic:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
Manage the Advanced WiFi
Features for a WiFi network

213

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. From the Addressing and Traffic menu, select the addressing and traffic mode:•

Bridge: The WiFi clients receive their IP addresses from the DHCP server in thesame network as the AP. This is the default mode.

•

NAT: WiFi clients receive their IP addresses from a private DHCP address poolon the AP. If you select this mode, by default, the WLAN network address is172.31.4.0 and the default subnet mask is 255.255.252.0. This means that WiFi
clients are assigned an IP address in the range from 172.31.4.2 to 172.31.7.254.
The IP address of the default DNS server for the WLAN is 8.8.8.8, and the default
lease time is 1440 minutes (24 hours).
To change the default range for the DHCP address pool, the default DNS server,
the lease time, or all NAT settings, do the following:a. In the Network Address field, enter a network address that is different fromthe network address for the AP. For example, if the AP’s IP address is in therange from 192.168.0.1 to 192.168.0.254 (a common IP address range), entera network address that is different from 192.168.0.0.
b. From the Subnet Mask menu, select the subnet mask that is appropriate foryour network address.
c. In the DNS field, enter the IP address for the DNS server that you want to use.
This IP address must be different from the WLAN network address that you
set in the previous step.
d. In the Lease Time (in mins) field, enter the lease time that is applied to WiFi
clients.
The lease time can be from 5 to 43200 minutes.

8. Click the Apply button.
Your settings are saved.

Enable or disable client isolation fora WiFi network
By default, client isolation is disabled for a WiFi network (SSID or VAP), allowing
communication between WiFi clients that are associated with the same or different WiFi
networks on the AP. For additional security, you can enable client isolation so that clientsManage the Advanced WiFi
Features for a WiFi network

214

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

that are associated with the same or different WiFi networks cannot communicate witheach other, except for communication over the Internet, which remains possible.
WiFi client isolation is mutually exclusive with the following features:•

MAC/IP Traffic Filter group (see Select a MAC/IP Traffic Filter group for a WiFi networkon page 225)•

WPA2 Enterprise security and WPA3 Enterprise security that use a dynamic VLAN
(DVLAN, see Set up an open or secure WiFi network on page 55 and Change theauthentication and encryption for a WiFi network on page 69)•

Multi Pre-Shared Key (PSK, see Set up Multi PSK for a WiFi network on page 74)•

Multicast DNS (mDNS) gateway (see Manage the multicast DNS gateway on page
162)•

Blocking of broadcast and multicast traffic (see Block all broadcast and multicast
traffic for a WiFi network on page 224)•

A MAC ACL for broadcast and multicast traffic from WiFi clients (see Select a MAC
ACL for broadcast and multicast traffic from WiFi clients in a WiFi network on page
222)

To enable or disable client isolation for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
Manage the Advanced WiFi
Features for a WiFi network

215

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The page expands.
7. Under Wireless Client Isolation, select one of the following radio buttons:•

Disable: Client isolation is disabled for the WiFi network. This is the default
setting.

•

Enable: Client isolation is enabled for the WiFi network. The following checkboxes display:

If you select the Enable radio button, a check box displays (see the following step).
8. If the Allow access to devices listed below check box displays: To add network
devices that are exempt from isolation so that clients are allowed to reach them, do
the following:a. Select the Allow access to devices listed below check box.
By default, the check box is cleared.
The Allowlist displays.
b. In the field to the right, enter up to 16 static IP addresses and domain names ofdevices that clients are allowed to reach over the WiFi network.
For example, you could enter the static IP address or domain name of a network
printer that you want to make available to WiFi clients. A domain name on the
Allowlist must resolve to a static IP address. A domain name can be up to 255
characters.
c. Click the Move button.
The addresses and domain names are added to the Allowlist.
d. To remove one, several, or all addresses and domain names, select individual
check boxes or the Select All check box, and click the Remove button.
9. Click the Apply button.
Your settings are saved.

Enable or disable URL tracking fora WiFi network
You can enable the AP to track all URLs that are requested by WiFi clients that areconnected to a WiFi network (SSID or VAP). This feature is disabled by default, but you
can enable it.
For information about how to display the tracked URLs per SSID or per WiFi client, see
Display or download tracked URLs on page 205.

Manage the Advanced WiFi
Features for a WiFi network

216

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To enable or disable URL tracking for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Under URL Tracking, select one of the following radio buttons:•

Enable: URL Tracking is enabled for the WiFi network.

•

Disable: URL Tracking is disabled for the WiFi network.

8. Click the Apply button.
Your settings are saved.

Select a MAC ACL for WiFi clientsin a WiFi network
After you set up one or more local MAC access control lists (ACLs, also referred to asaccess lists; see Manage MAC ACLs for WiFi clients on page 131), you can select an ACL
for use with an SSID.
Manage the Advanced WiFi
Features for a WiFi network

217

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Depending on the policy that you defined for an ACL, WiFi devices for which the MAC
address is on the MAC ACL are either allowed access to the AP through this SSID or
denied access to the SSID. If denied access to the SSID, these devices might be able toconnect to the AP through another SSID if you did not set up MAC ACL security for thatSSID.
You can also set up a RADIUS server (see Set up RADIUS servers on page 107) and selectthe RADIUS MAC ACL. You must define the ACL on the RADIUS server, using thefollowing format for client MAC addresses in the RADIUS server: If the client MAC
address is 00:0a:95:9d:68:16, specify it as 000a959d6816 in the RADIUS server.
NOTE: A RADIUS MAC ACL cannot function if the WiFi security is WPA2Enterprise or WPA3 Enterprise. If you want to use a RADIUS MAC ACL, select a
different type of WiFi security for the WiFi network (see Change the authenticationand encryption for a WiFi network on page 69).
Before you select a MAC ACL for a WiFi network, review the policy of the ACL:•

ACL policy that allows access: A WiFi device on the ACL is allowed access to the
SSID while all other WiFi devices are denied access to the SSID.

•

ACL policy that denies access: A WiFi device on the ACL is denied access to the
SSID while all other WiFi devices are allowed access to the SSID.

To select a MAC ACL for WiFi clients in a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.

Manage the Advanced WiFi
Features for a WiFi network

218

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Select the MAC ACL check box.
8. Do one of the following:•

Select the Local MAC ACL radio button, and from the Select Group menu, selectthe MAC ACL that you defined earlier.
To change the MAC ACL policy, MAC addresses in the ACL, or both, click thelink next to the group. For more information, see Manage MAC ACLs for WiFi
clients on page 131.

•

Select the Radius MAC ACL radio button.
This option functions only if you set up a RADIUS server (see Set up RADIUS
servers on page 107).
CAUTION: If you are accessing the device UI of the AP over a WiFi
connection, make sure that your device is allowed access to the SSID.
Otherwise, your device is denied access to the device UI after you click the
Apply button.

9. Click the Apply button.
Your settings are saved.

Set bandwidth rate limits for a WiFi
network
You can set rate limits for the upload and download bandwidths for devices that areconnected to a WiFi network. The minimum bandwidth rate is 64 Kbps, the maximum
bandwidth rate is 1024 Mbps. You can set one rate for the upload bandwidth andanother rate for the download bandwidth.
NOTE: You can set bandwidth rate limits for a maximum of two WiFi networks
on the AP.
To set bandwidth rate limits for devices that are connected to a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
Manage the Advanced WiFi
Features for a WiFi network

219

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Select the Rate Limit check box.
8. Specify the values:•

Upload: For the upload bandwidth limitation, enter a value from 64 to 1024 andselect Kbps or Mbps from the menu.

•

Download: For the download bandwidth limitation, enter a value from 64 to
1024 and select Kbps or Mbps from the menu.

9. Click the Apply button.
Your settings are saved.

Change the format of the DHCP
offer messages in a WiFi network
When a device tries to associate with the WiFi network and negotiates an IP address,
the AP converts the broadcast DHCP offer message that it receives from the DHCP
server to a unicast message, and forwards it to the device. This is the default
configuration. For the DHCP message exchange, unicast packets are more reliable andminimize the traffic in the network.

Manage the Advanced WiFi
Features for a WiFi network

220

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your situation requires that DHCP offer messages must be distributed as broadcast
packets in a specific WiFi network, you can change the message format for that WiFi
network so that the AP does not convert the broadcast DHCP offer messages to unicast
messages.
To change the format of the DHCP offer messages in a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Scroll down and click the > Traffic Policy tab.
The page expands.
8. Under DHCP Offer Broadcast to Unicast, select one of the following radio buttons:•

Enable. The AP forwards DHCP offer messages as unicast packets in the WiFi
network. This is the default selection.

•

Disable. The AP forwards DHCP offer messages as broadcast packets in the WiFi
network.

9. Click the Apply button.
Your settings are saved

Manage the Advanced WiFi
Features for a WiFi network

221

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Select a MAC ACL for broadcast
and multicast traffic from WiFi
clients in a WiFi network
After you set up one or more local MAC access control lists (ACLs, also referred to asaccess lists) for broadcast and multicast traffic from WiFi clients, you can select an ACL
for use with an SSID. For more information about setting up ACLs for broadcast andmulticast traffic from WiFi clients, see Manage MAC ACLs for broadcast and multicast
traffic from WiFi clients on page 137.
By default, all WiFi devices allowed to send broadcast and multicast traffic into a WiFi
network. If you allow traffic only from specified devices and select an ACL, the ACL
functions as follows:•

A WiFi device for which you place the MAC address in the ACL is allowed to send
broadcast and multicast traffic into the WiFi network.
The broadcast and multicast traffic is allowed within the same SSID on which the
WiFi client sends the traffic, regardless of the radio on which the SSID broadcasts.
If another SSID is using the same VLAN, clients on the other SSID can also receive
the broadcast or multicast traffic.
For example:○ The “Main Lobby” SSID uses VLAN 1 and broadcasts on both the 2.4 GHz radio
and the 5 GHz radio.
○ The MAC address of Client 1 is on the MAC ACL, and Client 1 sends multicast
traffic on the 5 GHz radio of the “Main Lobby” SSID.
○ The “Auditorium” SSID is also configured on the same VLAN 1 and broadcasts
on the 2.4 GHz radio.
○ The “Accounting Department” SSID is configured on VLAN 2 and broadcasts on
both the 2.4 GHz radio and the 5 GHz radio.
In this situation, the multicast traffic from Client 1 can reach all clients that areconnected to the “Main Lobby” SSID as well as all clients that are connected to the“Auditorium” SSID, but it cannot reach clients that are connected to the “Accounting
Department” SSID.

•

Broadcast and multicast traffic from all other WiFi devices is rejected by the WiFi
network.

Manage the Advanced WiFi
Features for a WiFi network

222

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To select a MAC ACL for broadcast and multicast traffic from WiFi clients a WiFi
network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Scroll down and click the > Traffic Policy tab.
The page expands.
By default, the Allow Broadcast/Multicast Traffic check box is selected.
8. Select the Allow traffic only from specified devices radio button.
9. From the Allowed Device Group menu, select the MAC ACL that you defined earlier.
To change the MAC addresses in the ACL, click the Edit Group link next to the menu.
For more information, see Manage MAC ACLs for broadcast and multicast traffic
from WiFi clients on page 137.
10. Click the Apply button.
Your settings are saved.

Manage the Advanced WiFi
Features for a WiFi network

223

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Block all broadcast and multicast
traffic for a WiFi network
By default, broadcast and multicast traffic from any device can reach a WiFi network.
You can also block all broadcast and multicast traffic on a WiFi network.
To block all broadcast and multicast traffic on a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Scroll down and click the > Traffic Policy tab.
The page expands.
By default, the Allow Broadcast/Multicast Traffic check box is selected.
8. Clear the Allow Broadcast/Multicast Traffic check box.
9. Click the Apply button.
Your settings are saved.
Broadband and multicast traffic is not allowed to reach the WiFi network.
Manage the Advanced WiFi
Features for a WiFi network

224

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Select a MAC/IP Traffic Filter groupfor a WiFi network
After you enable a MAC/IP Traffic Filter group and add one or more traffic rules to thegroup, you can select the group for use with a WiFi network (SSID). Depending on thesettings of the traffic rules in the group, the traffic rules then apply to incoming, outgoing,or both incoming and outgoing traffic in the SSID.
For more information about setting up MAC/IP Traffic Filter group, see Manage MAC/IP
Traffic Filter groups for WiFi networks on page 142.
NOTE: If you apply a MAC/IP Traffic Filter group to a WiFi network, thethroughput might be affected and could be lower than normal.
To select a MAC/IP Traffic Filter group for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the > Advanced tab.
The page expands.
7. Scroll down and click the > Traffic Policy tab.

Manage the Advanced WiFi
Features for a WiFi network

225

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The page expands.
8. Select the MAC/IP Traffic Filters check box.
9. From the Select Group menu, select a group that you defined earlier.
To change the traffic rules in the group, click the Edit Group link next to the menu.
For more information, see Manage MAC/IP Traffic Filter groups for WiFi networks
on page 142.
10. Click the Apply button.
Your settings are saved.

Configure advanced rate selection
for a WiFi network
Advanced rate selection lets you improve the capacity of an individual WiFi network (asopposed to a radio, which affects all WiFi network on the radio) so that you can reachthe optimal balance between the following components in the WiFi network:•

Types of traffic (multicast, management, control, and data traffic)•

Number and proximity of clients (the client density)•

Types of clients (the WiFi modes that clients can support, including legacy WiFi
modes)•

Throughput speed for clients•

Area that the WiFi network must coverTo successfully configure advanced rate selection, we recommend that you determine
what the clients in your network can require (the types of traffic, the supported WiFi
modes, and the expected throughput speed), how many clients potentially can connect
simultaneously to the WiFi network, and where the clients can be located.
NOTE: By default, advanced rate selection is disabled. If you enable advanced
rate selection, the AP applies rate control settings to WiFi connections in a regular
WiFi network but not to connections in a wireless distribution system (WDS) or
Insight Instant Mesh WiFi network.
Advanced rate selection lets you configure the following settings for the 2.4 GHz and
5 GHz radio bands in a WiFi network (the feature does not apply to the 6 GHz radioband):

Manage the Advanced WiFi
Features for a WiFi network

226

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Fixed multicast rate: The multicast traffic transmission rate that you select is
automatically applied. The rates that you can select are the basic multicast rates thatthe radio band supports.

•

Rate control: The rate that you select is automatically applied to beacon and othermanagement frames and to control and data frames. If you enable rate control, you
can set the density level, which consists of four components that are described below.
That is, the density level includes much more than the client density (the number
and proximity of clients in the WiFi network).
The available settings for the density level in the WiFi network depend on the WiFi
mode in which the radio operates. (For more information about WiFi modes, see
Change the WiFi mode for a radio on page 87.)
You can set a density level of 0 (actually spanning 0–4, the default setting), 1 (spanning
1–4), 2 (spanning 2–4), 3 (spanning 3–4), or 4. The setting is then applied to thefollowing interdependent components, which you cannot set individually precisely
because they are interdependent:○ Density: The density (the number and proximity) of clients in the WiFi network.
(The density is one of the four components of the density level.) A setting of 0means a very low client density. A setting of 4 means a very high client density.
○ Compatibility: The compatibility with WiFi modes for legacy clients in the WiFi
network. For the 2.4 GHz radio, a setting of 0 means compatibility with
802.11b/g/n/ax clients; A setting of 4 means compatibility with 802.11g/n/ax
clients but not with 802.11b legacy clients.
○ Overall performance: The throughput speed for the clients in the WiFi network.
A setting of 0 means a reduced performance. A setting of 4 means an optimal
performance. As an example, you can deliberately select a reduced performance
if you require a very wide coverage area.
○ Coverage: The area that the WiFi network must cover. A setting of 0 means avery wide coverage area. A setting of 4 means a very narrow coverage area. As
an example, you can deliberately select a very narrow area if you require an
optimal performance.

Another way to describe the density level is that a selected level is mapped to acorresponding client density level, WiFi mode, minimum legacy rate, beacon rate, andminimum Modulation Coding Scheme (MCS) rate.
To configure advanced rate selection for a WiFi network:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.

Manage the Advanced WiFi
Features for a WiFi network

227

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Basic > Wireless Settings.
The page that displays lets you select and add an SSID.
5. Click the > button to the left of the SSID.
The settings for the selected SSID display.
6. Scroll down and click the Advanced Rate Selection tab.
The page adjusts and displays rate selection settings for the 2.4 GHz and 5 GHz radio
bands.
NOTE: For the selected SSID, you can specify the radio settings for the 2.4
GHz and 5 GHz radio bands individually. The descriptions in the following
steps apply to both radios.
7. To apply basic fixed multicast rates, from the Fixed Multicast Rate menu, selectone of the following rates, depending on the radio band:•

2.4 GHz: 1, 2, 5.5, or 11 Mbps or Auto (the default setting).

•

5 GHz: 6, 12, or 24 Mbps or Auto (the default setting).

8. To enable automatic minimum rate control for beacon and other management frames
and for control and data frames, select the Rate Control check box.
If you select the Rate Control check box, the Density Level slider becomes available.
9. To set the density level for your environment, move the Density Level slider to 0,
1, 2, 3, or 4.
As you move the slider, the selected density level is mapped to a corresponding
WiFi mode, beacon rate, minimum legacy rate, and minimum MCS rate. The available
settings depend on the WiFi mode that you select for the radio (see Change the
WiFi mode for a radio on page 87). By default, the WiFi mode for each radio is 11ax.
The density level for the WiFi network is based on the following interdependent
components, for which a setting is assigned by the position of the slider but which
you cannot set individually:
Manage the Advanced WiFi
Features for a WiFi network

228

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Density of the WiFi clients: In the default 11ax WiFi mode for the radios, thesetting can be very low, low, medium, high, or very high, depending on theposition of the slider.

•Compatibility with WiFi modes for legacy clients: In the default 11ax WiFi
mode for the radios, this setting can be as follows:○ 2.4 GHz: The 802.11b/g/n/ax setting, which supports 802.11b clients, or the802.11g/n/ax setting, which does not support 802.11b clients.
○ 5 GHz: The 802.11a/n/ac/ax/be setting, which supports all types of clients inthe 5 GHz radio band in any position of the slider.

•

Overall performance for the WiFi clients: In the default 11ax WiFi mode forthe radios, the setting can be reduced, moderate, good, very good, or optimal,
depending on the position of the slider.

•

WiFi coverage: In the default 11ax WiFi mode for the radios, the setting can bevery narrow, narrow, average, wide, or very wide, depending on the position of
the slider.
NOTE: The help text in the device UI provides a table with detailed
information about how the WiFi mode of a radio affects these components
and how these components depend on each other.

10. Click the Apply button.
Your settings are saved.

Assign host names to WiFi clientsand manage the host name list
You can manually assign host names to WiFi clients for easier identification. The AP cansupport a maximum of 600 host name entries.
You must know the MAC address of the WiFi client for which you want to add a hostname. The MAC address might be displayed on the Connected Clients page (see Display
client distribution, connected clients, and client trends on page 201).
NOTE: You cannot assign a host name for a randomized MAC address.
To assign host names to WiFi clients and manage the host name list:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.

Manage the Advanced WiFi
Features for a WiFi network

229

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > HostName Override.
The HostName Override page displays.
5. To manually add a host name for a WiFi client, do the following in the fields below
the Client Hostnames List:
a. In the left field, type or copy the MAC address of the client in the format
00-00-00-00-00-00.
b. In the Enter a host name field, type a name for the client.
The host name must contain alphanumeric characters, can contain hyphens, andcannot be longer than 32 characters. The host name cannot start or end with ahyphen.
c. To add another host name, repeat the previous two substeps.
You can add a maximum of 10 host names at a time.
d. Click the Add button.
Your settings are saved.
6. To change a host name, do the following in the Client Hostnames List:
a. Select the check box for the name.
b. Click the Edit button.
c. Change the host name.
d. To change another host name, repeat the previous three substeps.
You can change a maximum of 10 host names at a time.
e. Click the Apply button.
Your settings are saved.
7. To delete one or more host names, do the following in the Client Hostnames List:

Manage the Advanced WiFi
Features for a WiFi network

230

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

a. Select the check boxes for the names.
You can delete a maximum of 10 host names at a time.
b. Click the Delete button.
The host names are removed.

Manage the Advanced WiFi
Features for a WiFi network

231

User Manual

13
Set up a WiFi Bridge in a WirelessDistribution System
This chapter describes how you can configure a wireless distribution system (WDS) thatconsists of point-to-point WiFi bridge connections between two APs. Each WiFi bridgeconnection requires a WDS profile for which the settings must match on the APs thatmake up the bridge.
A WDS is not the same as a NETGEAR Insight Instant Mesh WiFi network, which requires
you to use NETGEAR Insight and one access point to function as a root (see Install the
AP in an Insight Instant Mesh WiFi Network on page 42).
The chapter includes the following sections:•

WiFi base station, WiFi repeater, and WiFi bridge requirements•

Set up a WiFi bridge between APs
NOTE: If you enable Energy Efficiency Mode, you cannot use a WDS. To use a
WDS, first disable Energy Efficiency Mode. For more information, see Manage
the Energy Efficiency Mode on page 190.
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

232

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

WiFi base station, WiFi repeater,and WiFi bridge requirements
If the AP is connected to the Internet over a wired connection, the AP can function as
the WiFi base station for up to four other APs that function as WiFi repeaters. The AP
itself can also function as a WiFi repeater if it is connected to another AP that functions
as a WiFi base station.
A WiFi base station connects to the Internet, wired and WiFi clients can connect to thebase station, and the base station sends its WiFi signal to one or more APs that function
as WiFi repeaters. Wired and WiFi clients can also connect to a WiFi repeater, but therepeater connects to the Internet through the WiFi base station.
The following figure shows two APs in a WiFi repeating setup with a WiFi base stationon the left side and a single WiFi repeater on the right side.

Figure 8. WiFi bridge configuration between two APs in the 5 GHz radio band

To use a WiFi bridge, you cannot use the auto channel feature for the AP and the SSID
broadcast must be enabled.
For a WiFi bridge, you must set up one AP as a WiFi base station and another AP as a
WiFi repeater:

Set up a WiFi Bridge in a
Wireless Distribution System

233

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

WiFi base station: The base station is connected over Ethernet to a network switch(usually with an Internet connection) and bridges traffic to and from the repeater.
The base station also handles local WiFi and wired traffic. To configure this mode,
you must know the MAC address of the 2.4 GHz, 5 GHz, or 6 GHz radio on therepeater.

WiFi repeater: The repeater sends all traffic from its local WiFi or wired devices tothe WiFi base station. Similarly, the repeater receives all traffic for its local WiFi or
wired computers from the base station. The repeater is connected to the network(and Internet) over the WiFi connection to the base station. To configure this mode,
you must know the MAC address of the 2.4 GHz, 5 GHz, or 6 GHz radio on the basestation.
Before you can set up a WiFi network with WDS, your configuration must meet thefollowing conditions:••

Both APs must use the same WiFi channel and WiFi security settings.

•

Both APs must be on the same LAN IP subnet. That is, all of the AP LAN IP addresses
are in the same network.

•

All LAN devices (wired and WiFi computers) are configured to operate in the same
LAN network address range as the APs.
NOTE: If you are using the AP as the base station with a non-NETGEAR accesspoint as a repeater, you might need to change more configuration settings. In
particular, you might need to disable the DHCP server function on the
non-NETGEAR access point that is the repeater.
CAUTION: Before you set up a WiFi bridge between two APs, enable STP on
the APs (see Enable or disable Spanning Tree Protocol on page 156) and on theswitches to which the APs are connected. If your switches do not support STP,
after the WiFi bridge is established, disconnect one of the APs from its switch toprevent a network loop and connectivity problems. If you used a PoE+ switch
for that AP, you now must use a power adapter.

Set up a WiFi bridge between APs
The following procedure describes how you can configure the WiFi bridge settings on
one AP and then do the same on another AP, allowing the WiFi bridge to be established.
To set up a WiFi bridge between two APs:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
Set up a WiFi Bridge in a
Wireless Distribution System

234

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless Bridge.
The page that displays lets you select a WDS profile (WDS 1, WDS 2, WDS 3, or WDS
4).
5. Click the > button to the left of a WDS profile.
The WDS profile page displays.
6. Select the Band 2.4 GHz, 5 GHz, or 6 GHz radio button.
Your selection determines the radio band on which the WDS is established. For
countries that do not support dual-band or tri-band operation, you cannot selectthe radio.
7. Select the VAP Enable radio button.
By default, a WDS profile is disabled.
8. Configure the WDS profile settings as described in the following table.
Setting

Description

Wireless Network
Name (SSID)

The WiFi network name of the network on which the WDS is established. The default
name is Netgear-WDS-x, in which x is the number of the WDS (1, 2, 3, or 4).
The WiFi name can be up to 32 characters in length and cannot include backslashor double quote characters.
Note: The WiFi network name must be identical on the WiFi base station and the
WiFi repeater.

Local MAC Address

The MAC address of the local WDS radio interface, that is, the MAC address of thelocal radio on which the WDS is established. You cannot change this MAC addresson this page. The MAC address is displayed for your information.
Enter this MAC address on the remote AP of the WDS connection.
Note: The local MAC address must be different from the remote MAC address.

Set up a WiFi Bridge in a
Wireless Distribution System

235

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710(Continued)
Setting

Description

Remote MAC Address

The MAC address of the remote WDS radio interface, that is, the MAC address of
the remote radio on which the WDS is established.
Note: The remote MAC address must be different from the local MAC address.

Network
Authentication, Data
Encryption, andPassphrase

If you configure the WDS on the 2.4 GHz or 5 GHz radio, the default selection fromthe menu is Open, in which case authentication and data encryption are notapplicable. To secure the WDS connection, select WPA2 Personal.
If you configure the WDS on the 6 GHz radio, the default and only selection from themenu is WPA3 Personal.
For WPA Personal or WPA3 Personal security, specify the following settings:• Encryption: The data encryption is AES and you cannot change this setting.
• Passphrase: The passphrase for the WDS connection. The passphrase can be
between 8 and 63 characters in length.
For you to enable the WDS connection, the passphrase on the remote AP mustmatch the passphrase that you define in this field.

9. Click the Apply button.
Your settings are saved.
10. Configure the WiFi bridge settings on the AP at the other end of the WiFi bridge
and restart that AP.
NOTE: If the device at the other end of the WiFi bridge is a NETGEAR accesspoint, you might not need to restart it.
The WiFi bridge is established.
11. Verify connectivity across the LANs of both APs.
If the configuration is set up correctly, a computer on any WiFi or wired LAN segmentof the AP that functions as the WiFi repeater can connect to the Internet or sharefiles and printers with any other computer or server connected to the AP that functions
as the WiFi base station.
NOTE: After the WiFi bridge is established, you cannot change the WiFi channel
for the radio on which the WiFi bridge is established.

Set up a WiFi Bridge in a
Wireless Distribution System

236

User Manual

14Manage the Advanced Radio
FeaturesThis chapter describes how you can manage the advanced radio features of the AP. For
information about the basic radio features, see Manage the Basic Radio Features on
page 82.
CAUTION: If you change a radio feature on the 2.4 GHz radio, the change affects
all WiFi networks that broadcast on the 2.4 GHz radio. Similarly, if you change aradio feature on the 5 GHz or 6 GHz radio, the change affects all WiFi networks
that broadcast on the 5 GHz or 6 GHz radio. If the change is not specific to one
radio, the change affects all WiFi networks on the AP.
The chapter includes the following sections:•Manage the advanced WiFi settings for the radios•

Manage the maximum number of clients for a radio•

Manage the broadcast and multicast settings for a radio•

Manage load balancing for the radios•

Manage sticky clients•Manage the ARP proxy
NOTE: If you want to change the radio settings, use a wired connection to avoid
being disconnected when the new radio settings take effect.
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

237

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manage the advanced WiFi settings
for the radios
The advanced WiFi settings for the radios apply to all WiFi networks (VAPs or SSIDs).
Although these settings work fine for most network environments and it is unlikely thatyou need to change them, you can change the radio settings, and you can do so for the
2.4 GHz, 5 GHz, and 6 GHz radios individually.
CAUTION: We recommend that you change these advanced WiFi settings only
if you fully understand the consequences. Incorrect configuration might cause
connectivity problems for devices trying to connect to the AP.
A radio must be turned on for you to change the settings. For more information about
turning on a radio, see Turn a radio on or off on page 86.
To manage the advanced WiFi settings for the radios:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Advanced > Wireless Settings.
The Wireless Settings page for advanced settings displays.
5. Configure the settings as described in the following table.
The descriptions in the table apply to all radios. You can specify the radio settings
for the 2.4 GHz, 5 GHz, and 6 GHz radios individually, but the check box for the802.11n 256 QAM feature applies to the 2.4 GHz radio only (the feature is always

Manage the Advanced Radio
Features

238

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

enabled for the 5 GHz and 6 GHz radios). In addition, you can enable or disable
802.11h for the 5 GHz and 6 GHz radios but not for the 2.4 GHz radio.
Setting

Description

Max. Wireless ClientsEnter the maximum number of WiFi clients that can simultaneously associate withthe radio.
For the each radio, the range is from 1 to 200 WiFi clients, and the default is 200.

RTS Threshold(256-2346)

Enter the Request to Send (RTS) threshold. The range is from 256 to 2346. The default
is 2346.
If the packet size is equal to or less than the RTS threshold, the radio uses the Carrier
Sense Multiple Access with Collision Detection (CSMA/CD) mechanism and the data
frame is transmitted immediately after the silence period. If the packet size is larger
than the RTS threshold, the system uses the CSMA with Collision Avoidance(CSMA/CA) mechanism. In this situation, the transmitting device sends the RTS packet
to the receiving device and waits for the receiving device to return a Clear to Send
(CTS) packet before sending the actual packet data.

Beacon Interval(100-300)

Enter an interval between 100 ms and 300 ms for each beacon transmission, whichallows the radio to synchronize the WiFi network. The default is 100 ms.
Note: If you set up more than four WiFi networks, the beacon interval is automaticallychanged to 300.

802.11n 256 QAM

When the WiFi mode is 802.11n, you can select the 802.11n 256 QAM check box
to enable the 2.4 GHz radio to function over 256-quadrature amplitude modulation(QAM), which can increase the 2.4 GHz radio throughput for 802.11n clients that arecapable of supporting 256 QAM. By default, 256 QAM is enabled for the 2.4 GHz
radio, that is, the check box is selected.
By default, 256-QAM is enabled for the 5 GHz radio and you cannot disable it (thepage does not provide a check box for the 5 GHz radio). The 6 GHz radio uses ahigher QAM (the page does not provide a check box for the 6 GHz radio).

DTIM Interval (1-255)

Move the slider to specify the delivery traffic indication message (DTIM) interval or
the data beacon rate, which indicates the beacon delivery traffic indication message
period in multiples of beacon intervals. This value must be between 1 and 255. The
default is 3.

Broadcast/Multicast
Rate Limiting

Multicast and broadcast rate limiting is enabled by default to improve the overall
network performance by limiting the number of packets that are transmitted acrossthe network. By default, the setting is 50 (the maximum possible value), which specifies
a maximum rate limit of 50 packets per second. To change the setting, move theslider. To disable multicast and broadcast rate limiting, clear the small check box.

Manage the Advanced Radio
Features239

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710(Continued)
Setting

Description

MU-MIMO

By default, the MU-MIMO Enable radio button is selected and multiuser MIMO
(MU-MIMO) is enabled. To disable MU-MIMO, select the MU-MIMO Disable radio
button.
MU-MIMO enables multiple users to receive data from the AP simultaneously using
the same channel. With MU-MIMO, the AP can transmit to multiple clientssimultaneously using the same channel. MU-MIMO is used in the downstream direction
and requires both the AP and the WiFi clients to be capable of 802.11ac Wave 2 or802.11ax.

802.11h

Select the 802.11h Enable radio button to enable 802.11h-capable WiFi clients toautomatically switch to a new channel without disconnecting from the AP and without
losing any data when the AP changes to another channel. To disable the feature,
select the Disable radio button. By default, the 802.11h Enable radio button is
selected and 802.11h is enabled.
You can enable or disable 802.11h for the 5 GHz and 6 GHz radios but not for the
2.4 GHz radio.

6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Manage the maximum number ofclients for a radio
The number of clients that are allowed to associate with a radio affects the reliability
and throughput of the WiFi connection. A smaller number can increase the reliability
and throughput and a large number can decrease the reliability and throughput.
By default, each radio allows up to 200 client associations. You can specify a lower
number of clients. If the number of associated clients exceeds the maximum numberthat you specify, the radio rejects new client associations until the number drops belowthat maximum number.
To manage the maximum number of clients for a radio:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
Manage the Advanced Radio
Features

240

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Advanced > Wireless Settings.
The Wireless Settings page for advanced settings displays.
5. In the Max.Wireless Clients field for the radio, enter the maximum number of WiFi
clients that can simultaneously associate with the radio.
The range is from 1 to 200 WiFi clients, and the default is 200.
6. Click the Apply button.
A warning pop-up window displays.
7. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Manage the broadcast andmulticast settings for a radio
Because multicast and broadcast traffic can adversely affect the throughput and latencyof a WiFi network, you can change the multicast and broadcast rate limiting settings fora radio.
By default, multicast and broadcast rate limiting is enabled to improve the overall
network performance by limiting the number of packets that are transmitted across the
network. By default, the setting is 50 (the maximum possible value), which specifies amaximum rate limit of 50 packets per second. You can lower this number.

Manage the Advanced Radio
Features

241

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To manage the broadcast and multicast settings for a radio:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Advanced > Wireless Settings.
The Wireless Settings page for advanced settings displays.
5. To change the multicast and broadcast rate limiting setting for a radio, move theBroadcast/Multicast Rate Limiting slider.
By default, the setting is 50 (the maximum possible value), which specifies a maximum
rate limit of 50 packets per second.
6. To disable or enable multicast and broadcast rate limiting for a radio, clear or selectthe Broadcast/Multicast Rate Limiting check box.
7. Click the Apply button.
A warning pop-up window displays.
8. Click the OK button.
The pop-up window closes and your settings are saved. The radio or radios restartand WiFi clients might need to reconnect.

Manage the Advanced Radio
Features242

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manage load balancing for theradios
You can configure the radio utilization thresholds to enable each radio to maintain the
speed and performance of the WiFi network as clients associate with and disassociatefrom the WiFi network.
If you enable load balancing, client associations depend on the maximum number ofclients per radio, the channel load per radio, and each client’s Received Signal Strength
Indicator (RSSI). New client associations are allowed if a radio’s utilization remains within
the defined load balancing settings. If a radio’s utilization exceeds the defined loadbalancing settings, new client associations are temporary halted until the radio’s
utilization falls within the defined load balancing settings.
NOTE: The Dashboard can show information about the client and traffic
distribution per radio as well as the client, traffic, and channel utilization for eachradio (see Display client distribution, connected clients, and client trends on
page 201 and Display traffic volume, fan information, statistics, and channel
utilization on page 204).
By default, all of the following types of load balancing are enabled with their default
settings:•

Load balancing based on the maximum number of clients: The AP allows client
associations up to the specified maximum number of clients. After the maximum
number is exceeded, new clients are rejected. Even though this is a global setting,it is implemented per radio.

•

Load balancing based on the channel load: The AP allows client associations up
to the defined maximum channel utilization. After the maximum channel utilization
is exceeded, new clients are rejected. Even though this is a global setting, it is
implemented per radio.
NOTE: If a client is rejected but persistently tries to associate with the AP,
the AP grants access to that client.

•

Load balancing based on the RSSI of the client: Clients with an RSSI that is equal
to or higher than the defined minimum are allowed to associate with the AP. Clientswith an RSSI below the defined minimum are rejected. Even though this is a global
setting, it is implemented per radio.
NOTE: If a client is rejected but persistently tries to associate with the AP,
the AP grants access to that client.

You can change the default settings for each type of load balancing, or completely
disable one or more types of load balancing.
Manage the Advanced Radio
Features243

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To manage load balancing for the radios:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Advanced > Load Balancing.
The Load Balancing page displays.
5. To globally enable load balancing for the radios, select the Load Balancing Mode
Enable radio button.
The page adjusts and displays a slider for each type of load balancing and eachradio.
By default, load balancing is disabled. When you enable load balancing, all three
types of load balancing are enabled. You can individually disable one or more typesof load balancing.
6. To individually enable or disable one or more types of load balancing, do thefollowing:•

To disable a particular type of load balancing, clear the small blue check box tothe left of the Based On ... text.

•

To enable a particular type of load balancing, select the small blue check box tothe left of the Based On ... text.

7. To change the load balancing settings, do the following:•

Based On Maximum Number Of Clients: For each radio, move the associatedslider to specify the maximum number of clients allowed, before the radio stops
accepting new client associations.

Manage the Advanced Radio
Features244

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

For each radio, the minimum number of clients is 5 and the maximum number
is 200, and the default number is 200.
•

Based On Channel Load: For each radio, move the associated slider to specify
the maximum percentage of channel load that is allowed on the radio, before it
stops accepting new client associations.
For each radio, the minimum percentage of channel load is 50, the maximum
percentage is 90, and the default percentage is 70.

•

Based on Channel Receive Signal Strength: For each radio, move the associatedslider to specify the minimum required RSSI value for an individual client, below
which the radio does not accept the client association.
For each radio, the minimum RSSI value is 1, the maximum value is 50, and thedefault value is 23.

8. Click the Apply button.
Your settings are saved.

Manage sticky clients
During roaming, sticky clients do not change to an access point with a better signal but
remain associated with (that is, stick to) their initial access point, even though the qualityof the connection to that access point is degraded. Such a situation causes delay forother clients that are associated with that access point.
NOTE: For a home WiFi network with a single access point, a sticky client isuseful because no other access point is available to associate with during roaming.
For a business or enterprise network with multiple access points, a sticky client
can cause a drain on WiFi resources.
You can force sticky clients to disassociate from the radios of the AP.
If load balancing based on the RSSI of the client is enabled (see Manage load balancing
for the radios on page 243), after a client is forced to disassociate, the client can join
again in the following situations:•

The client can associate again if its RSSI is equal to or higher than the minimum
required RSSI.

•

If the client persistently tries to associate with the AP, the AP grants access to thatclient, even if its RSSI is below minimum required RSSI.

Manage the Advanced Radio
Features245

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

To manage sticky clients:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Advanced > Load Balancing.
The Load Balancing page displays.
5. Either select or clear the Force Sticky Clients To Disassociate check box:•

Sticky clients are forced to disassociate: Select the check box. If a client’s RSSI
value falls below the minimum required RSSI value that you set for a radio, theclient is forcibly disassociated.
For each radio, you can move the Based on Channel Receive Signal Strength
slider to specify the minimum required RSSI value for an individual client, below
which the radio does not accept the client association.
For each radio, the minimum RSSI value is 1, the maximum value is 50, and thedefault value is 23.

•

Sticky clients are allowed to remain associated: Clear the check box. This is
the default setting.

6. Click the Apply button.
Your settings are saved.

Manage the Advanced Radio
Features

246

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Manage the ARP proxy
By default, the ARP proxy is enabled on the AP, allowing it to inspect all ARP broadcast
packets for its clients. In this way, the AP responds to ARP requests for its clients,
preventing unnecessary broadcast traffic on the radios.
For information about the ARP statistics, including the number of proxied and dropped
packets, see Display traffic volume, fan information, statistics, and channel utilization
on page 204.
To manage the ARP proxy:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Configuration > Wireless > Advanced > ARP Proxy.
The ARP Proxy page displays.
5. Select one of the following radio buttons•

Enable: The ARP proxy is enabled. This is the default setting.

•

Disable: The ARP proxy is disabled. Broadcast traffic on the radios might increase.

6. Click the Apply button.
Your settings are saved.

Manage the Advanced Radio
Features247

User Manual

15
Diagnostics and TroubleshootingThis chapter describes how you can capture WiFi packets and troubleshoot the AP and
network.
The chapter includes the following sections:•Capture WiFi and Ethernet packets•

Perform a ping test•

Quick tips for WiFi troubleshooting•

Troubleshoot with the LED•

The node and root cannot connect•

Troubleshoot WiFi connectivity for a WiFi client•

Troubleshoot Internet browsing•

You cannot log in to the AP over a LAN connection•

Changes are not saved•

You enter the wrong password and can no longer log in to the AP•

Troubleshoot your network using the ping utility
NOTE: In this manual, WiFi network means the same as SSID (service set identifieror WiFi network name) or VAP (virtual access point). That is, when we refer to a
WiFi network we mean an individual SSID or VAP.

248

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Capture WiFi and Ethernet packets
You can capture WiFi and Ethernet packets that are received and transmitted by the AP
and save the file with captured packets to your computer. During the packet capture
process, normal functioning of the AP is not affected.
The packet capture capability can be useful for analyzing a WiFi deployment, monitoringa WiFi network, debugging protocols, determining WiFi network bottlenecks, and, ingeneral, troubleshooting any irregularities in a WiFi network.
You can select to capture all packets or selected packets only.
NOTE: To display the captured packets, you need an application that can open
.pcap files.
To capture packets:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Diagnostics > Packet Capture.
The Packet Capture page displays.
5. Specify the settings that are described in the following table.

Diagnostics andTroubleshooting

249

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Setting

Description

Capture Interface

From the Capture Interface menu, select one of the following interfaces on whichpackets must be captured:• br-lan. All packets are captured, that is, packets on the Ethernet interfaces, 2.4
GHz radio, 5 GHz radio, and 6 GHz radio. This is the default setting.
• eth0. Only packets on the LAN Ethernet interface are captured.
• radio1. Only packets on the 2.4 GHz radio are captured.
• radio2. Only packets on the 5 GHz radio are captured.
• radio3. Only packets on the 6 GHz radio are captured.

Max. Capture File Size
(64-12288 KB)Enter the maximum size that the file with captured packets is limited to. The range
is from 64 to 12288 KB. The default is 1024 KB.

Promiscuous Capture

To enable the AP to capture packets in promiscuous mode, select the Enable checkbox. By default, promiscuous mode is disabled.
In promiscuous mode the radio or radios receive all traffic on the channel, including
traffic that is not destined for the AP. While the radio or radios are operating inpromiscuous mode, they continue to serve associated clients. Packets that are notdestined for the AP are not forwarded. When the capture process stops, the radioor radios revert to nonpromiscuous mode.

Client Filter

To capture packets for a specific client only, select the Client Filter check box andenter the client’s MAC address in the Client Filter MAC Address field.

Client Filter MAC
AddressIf you select the Client Filter check box, enter the client’s MAC address to capture
the packets only for the specific client on the selected interface.
You must enter the MAC address in hexadecimal format with each octet separated
by a hyphen, for example 00-11-22-33-44-55.

Capture Duration(10-3600 secs)

Enter the maximum duration of the capture process (that is, if you do not click the
Stop button).
The range is from 10 to 3600 seconds. By default, the maximum duration is 300
seconds.

6. To start the packet capture process, click the Start button.
If any captured packets are already stored on the AP, you are prompted to allow thepacket capture process to overwrite the old information.
7. To stop the packet capture process, click the Stop button.
If you do not stop the process manually, the process is automatically stopped when
the capture duration period is exceeded.
8. To download the file with captured packets, do the following:a. Click the Download button.
b. Follow the directions of your browser to save the file to your computer.
9. To display the latest information on the page, click the Refresh button.

Diagnostics andTroubleshooting

250

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Perform a ping test
You can ping the IP address of a device or network location from the AP and display
the results of the ping test.
To perform a ping test:
1. Launch a web browser from a computer that is connected to the same network as
the AP or directly to the AP through an Ethernet cable or WiFi connection.
2. In the browser address bar, type the IP address that is assigned to the AP.
The login page displays.
If your browser displays a security warning, you can proceed, or add an exception
for the security warning. For more information, see What to do if you get a browser
security warning on page 40.
3. Type the AP user name and password, and click the Login button.
The user name is admin. The password is the one that you specified. The user nameand password are case-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.
The Dashboard displays.
4. Select Management > Diagnostics > Ping Test.
The Ping Test page displays.
5. Specify the settings that are described in the following table.
Setting

Description

Ping CountThe number of pings that the AP must send. The number can be between 1 and1024. The default number is 16.

Packet Size (in Bytes)

The size of each ping packet. The size can be between 4 and 1024 bytes. The default
size is 64 bytes.

Ping Interval (in sec)

The interval between pings. The interval can be between 0.5 and 10 seconds. The
default interval is 1 second.

Ping Timeout (in sec)

The period after which a ping times out. The period can be between 1 and 300
seconds. The default period is 60 seconds.

Remote HostThe IP address that the AP must ping. This field can contain a maximum of 100
characters. The default address is 8.8.8.8.

6. To start the ping test, click the Start button.

Diagnostics andTroubleshooting

251

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The results of the ping test display in the Ping Result field.
7. To stop the ping test before the ping count is reached or if the ping times out, click
the Stop button.

Quick tips for WiFi troubleshooting
Problems with a WiFi network
If one or more WiFi networks do not function normally, consider to repower the AP:
1. Unplug the Ethernet cable from the AP to the network switch.
2. If you use a power adapter, disconnect it from the AP.
3. Plug in the Ethernet cable from the AP to the network switch. Wait two minutes.
4. If you use a power adapter, connect it to the AP. Wait two minutes.
Problems with a WiFi client
If a WiFi client cannot connect to the AP, check the following:•

Make sure that the WiFi radios are not off. For more information about the WiFi
radios, see Turn a radio on or off on page 86.

•

Make sure that the WiFi settings in the WiFi client and AP match exactly.
The WiFi network name (SSID) and WiFi security settings of the AP and WiFi client
must match exactly.
For information about accessing the AP for initial configuration over a WiFi
connection, see Connect to the AP for initial configuration on page 23.

•

Make sure that the WiFi client supports the authentication and encryption that you
are using for the WiFi network. For more information, see Change the authenticationand encryption for a WiFi network on page 69.
NOTE: If the AP’s WiFi authentication and encryption is set to WPA3 Personal
and the WiFi client does support WPA3, make sure that the WiFi adapter
device driver is updated to the latest version on the WiFi client.

•

Make sure that the WiFi client is not too far from the AP or too close. To see if thesignal strength improves, move the WiFi client near the AP but at least 6 feet
(1.8 meters) away.

•

Make sure that the WiFi signal is not blocked by objects between the AP and the
WiFi client.

•

Make sure that the AP’s SSID broadcast is not disabled.
If the AP’s SSID broadcast is disabled, the WiFi network name is hidden and does
not display in the WiFi client’s scanning list. To connect to a hidden network, theDiagnostics andTroubleshooting

252

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

user must enter the network name and the WiFi password. For more information
about the SSID broadcast, see Hide or broadcast the SSID for a WiFi network on
page 67.
•

Make sure that the WiFi client does not use a static IP address but is configured toreceive an IP address automatically with DHCP. (For most devices, DHCP is the default
setting.)

Troubleshoot with the LED
For general information about the LED, see Top panel LED on page 13.
When you connect the AP to a power source and you did not disable the LED (seeManage the LED on page 189), the LED lights as described here:
1. The LED lights solid amber initially and then blinks amber slowly. After about two
minutes, the LED turns either solid green or solid blue, indicating that the startup
procedure is complete and the AP is ready:•Solid green: The AP functions either as a standalone AP, or as an Insight
discovered AP that is not connected to the Insight cloud-based management
platform.

•

Solid blue: The AP functions in Insight mode and is connected to the Insightcloud-based management platform.

2. When the startup procedure is complete, if clients are connected to a radio, the LED
is blinking blue.
You can use the LED for troubleshooting. For more information, see the following
sections:•

LED remains off•

LED remains solid amber•

The AP functions as a PoE PD and the LED is blinking green continuously•

LED is blinking amber slowly, continuously•

LED does not light blue in the NETGEAR Insight management mode•

LED does not stop blinking amber, green, and blue

LED remains off
If you use a PoE+ connection and the LED is off when the Ethernet cable is connected
to a PoE+ switch, do the following:
Diagnostics andTroubleshooting

253

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Make sure that the LED is not disabled (see Manage the LED on page 189).

•

Make sure that the Ethernet cable between the AP and the PoE+ switch is correctly
connected at both ends.

•

Make sure that the other end of the Ethernet cable is plugged into a PoE+ port ona PoE+ switch that is receiving power.

•

Make sure that the PoE power budget of the PoE+ switch is not oversubscribed sothat the PoE+ switch is capable of delivering PoE+ (802.3at) power to the AP.

If you use an optional power adapter and the LED remains off when the AP is turnedon, do the following:•

Make sure that the LED is not disabled (see Manage the LED on page 189).

•

Make sure that the power adapter is correctly connected to the AP, and that thepower adapter is correctly connected to a functioning power outlet. If it is plugged
into a power strip, make sure that the power strip is turned on. If it is plugged directly
into the wall, verify that the outlet is not switched off.

•

Make sure that you are using the NETGEAR power adapter for this product. That is,
do not use the NETGEAR power adapter for another NETGEAR product or athird-party power adapter.

If the error persists, a hardware problem might exist. For recovery instructions or help
with a hardware problem, contact technical support at netgear.com/support.

LED remains solid amber
When you connect the AP to a power source, the LED lights solid amber initially, thenblinks amber slowly, and finally turns solid green or solid blue, indicating that the startup
procedure is complete and the AP is ready.
If the LED remains solid amber after five minutes, either a boot error occurred or the
AP is malfunctioning.
Do the following:
1. Disconnect the AP from its power source, reconnect it, and wait several minutes tosee if the startup procedure completes successfully.
2. If the startup procedure still does not complete successfully and the LED remains
solid amber after five minutes, use the Reset button to return the AP to its factory
default settings.
For more information, see Use the Reset button to reset the AP on page 186.
If the AP functions as a PoE PD, see The AP functions as a PoE PD and the LED is blinking
green continuously on page 255.
If the error persists, a hardware problem might exist. For recovery instructions or help
with a hardware problem, contact technical support at netgear.com/support.
Diagnostics andTroubleshooting

254

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The AP functions as a PoE PD and the LED
is blinking green continuously
When you connect the AP to a power source, the LED lights solid amber initially, thenblinks amber slowly, and finally turns solid green or solid blue, indicating that the startup
procedure is complete and the AP is ready.
If the AP functions as a PoE powered device (PD) and the LED is blinking green
continuously, the AP might not be receiving power at the required 802.3at (PoE+) level.
For example, this situation might occur if the AP is connected to a switch that provides
only 802.3af (PoE) rather than 802.3at (PoE+).
NOTE: If the AP receives insufficient power at the 802.3af (PoE) level, the AP
reduces the transmit power on the 2.4 GHz and 5 GHz radios, and disables the
6 GHz radio.
Do the following:
1. Disconnect and reconnect the Ethernet cable at the LAN/PoE+ port on the AP andat the 802.3at (PoE+) port on the PoE+ switch.
The AP restarts.
2. If the LED continuous to blink green, check to see why the PoE+ switch cannot provide
sufficient PoE power to the AP.
Most likely, the PoE power budget of the PoE+ switch is oversubscribed and you
might need to disconnect another PoE device from the PoE+ switch to make sufficient
PoE power available for the AP.

LED is blinking amber slowly, continuously
When you connect the AP to a power source, the LED lights solid amber temporarily
and then turns solid green or solid blue, indicating that the startup procedure is complete
and the AP is ready. During regular operation, the only time that the LED blinks amber
temporarily is when firmware is being upgraded. Also, in that situation, the LED blinks
amber quickly, not slowly.
If the blinks amber slowly and continuously, the AP did not receive an IP address froma DHCP server.
Check to make sure that the DHCP client of the AP is enabled (see Enable the DHCP
client on page 153), that your network includes a DHCP server (or a router that functions
as a DHCP server), and that the DHCP server can reach the AP (both must be on thesame network).

Diagnostics andTroubleshooting

255

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

In the unlikely situation that your network does not include a DHCP server, you mightneed to configure a fixed (static) IP address on the AP (see Disable the DHCP client andset a fixed IP address on page 152).

LED does not light blue in the NETGEAR
Insight management mode
If the AP functions in the Web-browser management mode, the LED lights green. This
is normal LED behavior.
However, if the AP functions in the NETGEAR Insight management mode and the LED
does not light blue but remains green, the AP is not connected to the Insight cloud-based
management platform.
If the AP functions in the NETGEAR Insight management mode and the LED does notlight blue, try the following troubleshooting steps until the problem is resolved:
1. Verify that the management mode of the AP is NETGEAR Insight.
For more information, see Change the management mode to NETGEAR Insight or
Web-browser on page 167.
2. Make sure that the Ethernet cable connection between the AP and your network is
good.
3. Make sure that the AP is connected to the Internet and that the Internet connection
is good.
4. Make sure that the AP is running the latest firmware version.
For more information, see Manage the firmware of the AP on page 175.
5. Disconnect and reconnect the Ethernet cable at the LAN/PoE+ port and wait fiveminutes to see if the LED lights solid blue.
If you use a power adapter with the AP, disconnect and reconnect the power adapter
and wait five minutes to see if the LED lights solid blue.
6. If the problem is still not resolved, use the Reset button to return the AP to its factory
default settings, and reconfigure the AP.
For more information, see Use the Reset button to reset the AP on page 186.
If the error persists, a hardware problem might exist. For recovery instructions or help
with a hardware problem, contact technical support at netgear.com/support.

Diagnostics andTroubleshooting

256

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

LED does not stop blinking amber, green,
and blue
During the initial installation and configuration process in an Insight Instant Mesh WiFi
network, the LED blinks amber, green, and blue while the AP is being configured as anode. For more information, see Connect the AP as a node to a root using the Insightapp on page 50.
If the LED does not stop blinking amber, green, and blue, the node cannot connect.
Check the following items or try the following troubleshooting steps:•

Make sure that at least one root is available for the node to connect to.

•Make sure that all roots run the latest firmware version.

•

Make sure that the output power of each radio on each root is at its maximum level.
By default, the output power for a radio is at its maximum level. For more information,
see Change the output power for a radio on page 92.

•

Make sure that the node is not too far away from a root. For more information, see
The node and root cannot connect on page 257.

•

Restart the node.

•

Remove the node from your Insight network location and from your Insight account.
Then, add the node to your Insight account again and to your Insight network location.

The node and root cannot connect
When you add the AP as a node to an Insight network location that includes one ormore roots (see Connect the AP as a node to a root using the Insight app on page 50),
we recommend that you place the node in the same room as a root during the initialsync. After a successful sync, move the node to the location where you intend to use it.
For a reliable WiFi connection, place the node less than 25 feet (7.5 m), in a line of sightwith minimal obstacles from the closest root.
To sync the node and the root after you already added the node to an Insight
network location:
1. Place the node in the same room as the root.
Use this node location only during the sync process.
2. Connect the node to a power source.
If you do not use a PoE+connection to a PoE+ switch, connect a power adapter tothe DC power connector.
Diagnostics andTroubleshooting

257

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

The LED on the node lights solid amber.
3. Wait for the node to go through the initial connection and configuration process
and for the LED to stop blinking amber, green, and blue and to light solid blue.
NOTE: The initial connection and configuration process might take up to 10
minutes. The node might restart during the configuration process.
The LED lights as follows during the initial connection and configuration process:•Blinking green: The node is attempting to detect a root.

•

Solid green: The node is making its first connection with the root that provides
the strongest WiFi signal.

•

Blinking amber slowly: The node is contacting the network router or DHCP
server to receive an IP address.
If the LED does not stop blinking amber, see LED is blinking amber slowly,
continuously on page 255.

•

Blinking amber, green, and blue: The node is being configured as a managed
device in the Insight Instant Mesh WiFi network.
If the LED does not stop blinking amber, green, and blue, see LED does not stop
blinking amber, green, and blue on page 257.

When the configuration is complete, the LED lights as follows:•

Solid blue: The configuration is complete and the node is ready for operation.
The node functions in the Insight Instant Mesh WiFi network and is connected to
the Insight cloud.

4. Disconnect the node and move it to the location where you intend to use it.
5. At the new location, repeat Step 2 and Step 3.
6. Wait for the node to resync with the root.
When the node’s LED lights solid blue, the node and root synced successfully.
If the node and root did not sync, move the node closer to the root and try again.
The node must be within the root’s WiFi coverage area to establish a good or fair
WiFi connection.

Troubleshoot WiFi connectivity fora WiFi client
If a WiFi client cannot connect to the AP or the WiFi connectivity is not normal, try toisolate the problem:
Diagnostics andTroubleshooting

258

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710•

Make sure that the WiFi settings in the WiFi client and AP match exactly.
The WiFi network name (SSID) and WiFi security settings of the AP and WiFi device
must match exactly. Make sure that the WiFi client uses the correct passphrase for
the WiFi network.
For information about accessing the AP for initial configuration over a WiFi
connection, see Connect to the AP for initial configuration on page 23.

•

Does the WiFi client support the authentication and encryption that you configured
for the WiFi network?
For more information, see Change the authentication and encryption for a WiFi
network on page 69.
NOTE: If the AP’s WiFi authentication and encryption is set to WPA3 Personal
and the WiFi client does support WPA3, make sure that the WiFi adapter
device driver is updated to the latest version on the WiFi client.

•

Make sure that the WiFi radios are not off. For more information about the WiFi
radios, see Turn a radio on or off on page 86.

•

If you disabled the AP’s SSID broadcast for the WiFi network, the WiFi network is
hidden and does not display in the WiFi device’s network scanning list. (By default,
SSID broadcast is enabled.) For more information about the SSID broadcast, see
Hide or broadcast the SSID for a WiFi network on page 67.
NOTE: If you want to change the settings of a WiFi network on the AP, use awired LAN connection to avoid being disconnected when the new WiFi settings
take effect.

If the WiFi client finds the WiFi network but the signal strength is weak, check these
conditions:•

Is the WiFi client too far from the AP, or too close?
Place the WiFi client near the AP, but at least 6 feet (1.8 meters) away, and see
whether the signal strength improves.

•

Are objects between the WiFi client and the AP blocking the WiFi signal?

Troubleshoot Internet browsing
If a WiFi device is connected to the AP but unable to load any web pages from theInternet, it might be for one of the following reasons:•

The WiFi device might not recognize any DNS server addresses.

Diagnostics andTroubleshooting

259

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If you manually entered a DNS address when you set up the AP (that is, the AP uses
static IP address settings), restart the WiFi device and verify the DNS address.
•

The WiFi device might not use the correct TCP/IP settings.
If the WiFi device obtains its information by DHCP, reboot the WiFi device and verify
the address of the switch or Internet modem to which the AP is connected.
For information about TCP/IP problems, see Troubleshoot your network using theping utility on page 261.

You cannot log in to the AP over a
LAN connection
If you are unable to log in to the AP from a computer on your LAN and use the AP’s
device UI, check the following:•

Make sure that you are using the correct login information. The user name is admin
and the password is the one that you specified. The user name and password arecase-sensitive.
If you previously added the AP to a NETGEAR Insight network location and managed
the AP through the Insight Cloud Portal or Insight app, enter the Insight network
password for that location. For more information, see Connect over WiFi using the
NETGEAR Insight app on page 26.

•

Make sure that the IP address of your computer is in the same subnet as the AP.
If you disabled the AP’s DHCP client and configured a fixed (static) IP address when
you connected the AP to your network (see Disable the DHCP client and set a fixed
IP address on page 152), change the IP address and subnet mask on your computer
to so that the IP addresses of your computer and the AP are in the same IP subnet.

•

Try quitting the browser and launching it again.

•

If you are using on older type of browser, make sure that Java, JavaScript, or ActiveX
is enabled in your browser. For example, if you are using Internet Explorer, click theRefresh button to be sure that the Java applet is loaded.

•

If your AP’s IP address was changed (for example, the DHCP server in your network
issued an IP address to the AP) and you do not know the current IP address, use an
IP scanner application to detect the IP address.
NOTE: You can also use the NETGEAR Insight app to discover the IP addressthat is assigned to the AP. For more information, see Connect over WiFi using
the NETGEAR Insight app on page 26.

Diagnostics andTroubleshooting

260

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If you still cannot find the IP address, reset the AP’s configuration to factory defaults.
This sets the AP’s IP address to 192.168.0.100 and enables the DHCP client. For
more information, see Use the Reset button to reset the AP on page 186.

Changes are not saved
If you are logged in to the AP’s device UI and the AP does not save the changes thatyou make on a page, do the following:•

When entering configuration settings, always click the Apply button before moving
to another page or tab or your changes are lost.

•

Click the Refresh or Reload button in the web browser. It is possible that the changes
occurred but that the old settings remain in the web browser’s cache.

You enter the wrong password andcan no longer log in to the AP
If you enter the wrong admin password five times, access to the AP’s device UI is blocked
for five minutes.
After five minutes, the counter for failed login attempts is reset, and you can attempt tolog in again.
In addition, the following rules apply to the number of failed login attempts:•

The last access attempt determines whether the counter for failed login attempts isincreased.

•

If you restart the AP, the counter for failed login attempts is reset.

Troubleshoot your network using
the ping utility
Most network devices and routers contain a ping utility that sends an echo request
packet to the designated device. The device then responds with an echo reply. You caneasily troubleshoot a network using the ping utility in your computer or workstation.

Diagnostics andTroubleshooting

261

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Test the LAN path to your AP
You can ping the AP from your computer to verify that the LAN path to your AP is set
up correctly.
To ping the AP from a Windows-based computer:
1. From the Windows taskbar, click the Start button and find and select Run.
2. In the field provided, enter ping followed by the IP address of the AP, as in thisexample:ping 192.168.0.100
3. Click the OK button.
A message such as the following one displays:
Pinging <IP address> with 32 bytes of data
If the path is working, you see this message:
Reply from < IP address >: bytes=32 time=NN ms TTL=xxx
If the path is not working, you see this message:
Request timed out
If the path is not functioning correctly, one of the following problems might be occurring:•Wrong physical connections
Check that the appropriate LEDs are on for your network devices. If your AP andcomputer are connected to a separate Ethernet switch, make sure that the link LEDs
are lit for the switch ports that are connected to your computer and AP.

•

Wrong network configuration
Verify that the IP addresses for your computer and the AP are correct and that theaddresses are in the same subnet.

Test the path from your computer to aremote device
After you verify that the LAN path works correctly, test the path from your computer toa remote device.
To test the path from your computer to a remote device:
1. From the Windows taskbar, click the Start button and find and select Run.
2. In the field provided, enter ping -n 10 IP address.
IP address is the IP address of a remote device such as a remote DNS server.
Diagnostics andTroubleshooting

262

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

If the path is functioning correctly, replies as described in Test the LAN path to your AP
on page 262 display. If you do not receive replies, do the following:•

Check to see that your computer lists the IP address of the router to which the AP isconnected as the default router. If the IP configuration of your computer is assigned
by DHCP, this information is not visible in your computer’s Network Control Panel.

•

Check to see that the network address of your computer (the portion of the IP address
specified by the netmask) is different from the network address of the remote device.

Diagnostics andTroubleshooting

263

User Manual

A
Factory Default Settings andTechnical Specifications
This appendix includes the following sections:•

Factory default settings•

Technical specifications264

BE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Factory default settings
You can reset the AP to the factory default settings, which are shown in the following
table.
For more information about resetting the AP to its factory settings, see Return the AP
to its factory default settings on page 186.
Table 2. Factory default settings
FeatureDefault Setting

Management and login settings
Management mode

NETGEAR Insight (Cloud/Remote)Note: To access the device UI, you must select Web-browser (Local) as the
management mode.

User login URL

192.168.0.100, if not connected to a network.
Note: If connected to a network, the AP receives an IP address from a DHCP serveror router in the network.

User nameadmin, nonconfigurable

AP login password

password, case-sensitive, configurable
Note: The first time that you log in to the device UI, you must change the AP login
password. If you previously added the AP to a NETGEAR Insight network locationand managed the AP through the Insight Cloud Portal or Insight app, enter the Insight
network password for that location. For more information, see Connect over theInternet using the NETGEAR Insight Cloud Portal on page 23 or Connect over WiFi
using the NETGEAR Insight app on page 26.

WiFi network settings for initial setup and WiFi login
Initial SSID name

The SSID for initial setup is NETGEARxxxxxx-SETUP, where xxxxxx is the last six
hexadecimal digits of the AP’s MAC address.
Note: The first time that you log in to the device UI, you must change the SSID. If you
previously added the AP to a NETGEAR Insight network location and managed theAP through the Insight Cloud Portal or Insight app, this requirement might not apply.

Initial WiFi security

WPA3/WPA2 Personal (which is WPA3-PSK/WPA2-PSK)
WiFi password (network key): sharedsecretNote: The first time that you log in to the device UI, you must change the WiFi
password. If you previously added the AP to a NETGEAR Insight network locationand managed the AP through the Insight Cloud Portal or Insight app, this requirement
might not apply.

RF channels

Automatically selected (Auto) for all radios.
Note: The available and supported channels depend on the country and region thatyou select for the AP.

General system settings

Factory Default Settings andTechnical Specifications

265

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Table 2. Factory default settings (Continued)
FeatureDefault Setting

Operating mode

AP mode

DHCP client

Enabled so that the AP receives an IP address from a DHCP server or router in the
network.

NTP client

EnabledSpanning Tree Protocol

Disabled

Network integrity check

Disabled

IGMP snooping

Disabled

Hardware Assisted
Datapath

Enabled802.1Q VLAN

Untagged VLAN with VLAN ID 1

Management VLAN

VLAN ID 1

SyslogDisabled

Ethernet LLDP

EnabledUPnP

Enabled

LED

EnabledEnergy Efficiency Mode

Disabled

Multicast DNS gateway

Disabled

WLAN settings for an individual WiFi network (SSID or VAP)
Broadcast SSID

EnabledVLAN ID (for WiFi clients)

1

Network authentication

WPA3/WPA2 Personal (which is WPA3-PSK/WPA2-PSK)
The nonconfigurable data encryption for WPA3 is SAE
The nonconfigurable data encryption for WPA2 is AES

802.11w (PMF)

Optional

Multi PSKDisabled
Multi PSK is available only when the authentication is WPA2 Personal or WPA2/WPA
Personal.

Multi-link operation

Disabled

Broadcast schedule

Always on

Radio bands

2.4 GHz and 5 GHz enabled but 6 GHz disabled

Factory Default Settings andTechnical Specifications

266

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Table 2. Factory default settings (Continued)
FeatureDefault SettingBand steering

Disabled
Automatic band steering includes automatic 802.11k RRM and automatic 802.11v
WiFi network management.

Addressing and Traffic

Bridge

WiFi client isolation

Disabled

URL tracking

Disabled

MAC ACL for WiFi client
accessNone assigned

MAC ACL for broadband
and multicast traffic from
WiFi clients

None assigned

MAC/IP Traffic Filter group

None assigned

Captive portal

None

MAC ACL

None assigned

Rate limit

None

Advanced rate selection

Fixed multicast rate: 11 Mbps for the 2.4 GHz radio and 24 Mbps for the 5 GHz radio
Rate control: Disabled
Density level: 0

Basic radio settings that apply to all WiFi networks (SSIDs or VAPs)
Radio broadcast

2.4 GHz radio: Enabled
5 GHz radio: Enabled
6 GHz radio: Enabled

WiFi mode

2.4 GHz radio: 11be mode, which also supports 11ax, 11b, 11bg, and 11na
5 GHz radio: 11be mode, which also support 11a, 11na, 11ac, and 11ax
6 GHz radio: 11be mode, which also supports 11ax

Channel width

2.4 GHz radio: 20 MHz
5 GHz radio: 40 MHz
6 GHz radio: 80 MHz

Guard interval

2.4 GHz radio: Long-800 ns
5 GHz radio: Long-800 ns
6 GHz radio: Long-800 ns

Factory Default Settings andTechnical Specifications

267

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Table 2. Factory default settings (Continued)
FeatureDefault Setting

Output power

2.4 GHz radio: Maximum (100%)
5 GHz radio: Maximum (100%)
6 GHz radio: Maximum (100%)

Channel

2.4 GHz radio: Auto
5 GHz radio: Auto
6 GHz radio: Auto

Wi-Fi Multimedia (WMM)

2.4 GHz radio: Enabled
5 GHz radio: Enabled
6 GHz radio: Enabled

WMM Powersave

2.4 GHz radio: Enabled
5 GHz radio: Enabled
6 GHz radio: Enabled

Advanced radio settings that apply to all WiFi networks (SSIDs or VAPs)
Number of WiFi clients

2.4 GHz radio: 200 default (also the maximum number)
5 GHz radio: 200 default (also the maximum number)
6 GHz radio: 200 default (also the maximum number)

RTS threshold

2.4 GHz radio: Enabled at 2346
5 GHz radio: Enabled at 2346
6 GHz radio: Enabled at 2346

Beacon interval

2.4 GHz radio: 100 millisec.
5 GHz radio: 100 millisec.
6 GHz radio: 100 millisec.

802.11n 256 QAM

2.4 GHz radio: Enabled (applies in 11ng WiFi mode only)
5 GHz radio: Nonconfigurable
6 GHz radio: Nonconfigurable

MU-MIMO

2.4 GHz radio: Enabled
5 GHz radio: Enabled
6 GHz radio: Enabled

DTIM interval

2.4 GHz radio: 3
5 GHz radio: 3
6 GHz radio: 3

Factory Default Settings andTechnical Specifications

268

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Table 2. Factory default settings (Continued)
FeatureDefault Setting

Broadcast and multicast
rate limiting

2.4 GHz radio: Enabled with a limit of 50 pps
5 GHz radio: Enabled with a limit of 50 pps
6 GHz radio: Enabled with a limit of 50 pps

802.11h

2.4 GHz radio: Not applicable
5 GHz radio: Enabled
6 GHz radio: Enabled

Load balancing between
radiosDisabled

Force sticky clients todisassociate

Disabled

ARP proxy

EnabledHostname override

None

Wireless bridge

None configured

Security
RADIUS servers

None configured

Neighbor AP detection

2.4 GHz radio: Disabled
5 GHz radio: Disabled
6 GHz radio: Disabled

Global MAC ACLs forbroadcast and multicast
traffic from the wired LAN

None configured

Wireless Noise Filter

Eight default traffic policies, all of which are disabled

Global Traffic Filter

No traffic policies configured

MAC ACLs for WiFi client
accessEight default ACLs but none configured with MAC addresses

MAC ACLs for broadcast
and multicast traffic from
WiFi clients

Eight default ACLs but none configured with MAC addresses

MAC/IP Traffic Filters for
WiFi networks

Eight default groups but none configured with traffic policies

L2 security

Disabled

Remote management
SNMP

Disabled

Factory Default Settings andTechnical Specifications

269

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Table 2. Factory default settings (Continued)
FeatureDefault Setting

Other
Hostname override

None configured

Technical specifications
The following table shows the technical specifications.
Table 3. Technical specifications
FeatureDescription

WiFi modes

2.4 GHz radio: 802.11be, 802.11ax, 802.11ng, 801.11bg, and 802.11b
5 GHz radio: 802.11be, 802.11ax, 802.11ac, 802.11na, and 802.11a
6 GHz radio: 802.11be and 802.11ax
The AP supports concurrent operation in the 2.4 GHz, 5 GHz, and 6 GHz radio bands.

Maximum theoreticalthroughput

About 9.4 Gbps simultaneous throughput (688 Mbps in the 2.4 GHz band, 2882 Mbps
in the 5 GHz band, and 5765 Mbps in the 6 GHz band).
Note: Throughput can vary. Network conditions and environmental factors, including
volume of network traffic, building materials and construction, and network overhead,affect the data throughput rate.

Maximum number of
supported clients

2.4 GHz radio: 200
5 GHz radio: 200
6 GHz radio: 200

802.11 security

WPA3 Personal, WPA3 Enterprise, WPA3/WPA2 Personal, WPA2 Personal, WPA2Enterprise, WPA2/WPA Personal, Open Enhanced, and Open

WiFi standards

WiFi Multimedia Prioritization (WMM)
Wireless distribution system (WDS)

WiFi streams

2.4 GHz radio: 2 streams (2x2 antenna)
5 GHz radio: 2 streams (2x2 antenna)
6 GHz radio: 2 streams (2x2 antenna)

Operating frequency
ranges

2.4 GHz band: 2.412–2.462 GHz
5 GHz band: 5.18–5.825 GHz
6 GHz band: 5.925–7.125 GHz

Factory Default Settings andTechnical Specifications

270

User ManualBE9400 Tri-Band PoE 2.5G Insight Managed WiFi 7 Access Point Model WBE710

Table 3. Technical specifications (Continued)
FeatureDescription

Power over Ethernet

If you do not use a power adapter, the LAN/PoE port requires 802.3at (PoE+) power.
Note: PoE might be considered a network environment 0 per IEC TR 62101, andthus the interconnected ITE circuits might be considered safety extra low voltage(SELV).

PoE power consumption

25W

Power adapter

12 VDC, 2.5A
The plug is localized to the country of sale.

Hardware interfaces

One RJ-45 LAN/PoE Ethernet port that supports 2.5 Gbps, 1 Gbps, and 100 Mbps.
The port also supports Auto Uplink (Auto MDI-X).
Note: Without a power adapter, the LAN/PoE port requires 802.3at (PoE+).

Dimensions (W x D x H)

6.18 x 6.18 x 1.57 in(157 x 157 x 40 mm)

Weight1.52 lb (0.69 kg)

Operating temperature

32º to 104ºF (0° to 40°C)

Operating humidity

5 to 95% maximum relative humidity, noncondensing

Storage temperature–22° to 158°F (–30º to 70ºC)

Storage humidity

5 to 95% maximum relative humidity, noncondensing

EMI certification

FCC Part 15 Report (EMI) SubPart B
CE EMC Report, EN 55032/24/35 Report
EN 301 489-17 EMC Report

Regulatory compliance US

FCC Grant
FCC Spectrum Report, Part 15, SubPart C (15.247)
FCC Spectrum Report, Part 15, SubPart E (15.407)
FCC DFS Report
FCC Standard Absorption Rate Report (MPE)

Regulatory compliance
EuropeEN 300 328 Radio Spectrum Report
EN 301 893 Radio Spectrum Report
EN 301 893 DFS Report
EN 303 687 Report
EN RF Exposure (MPE)

Safety and energy
compliance

IEC 62368-1 Certificate and Test Report, CE IEC 62368-1

Factory Default Settings andTechnical Specifications

271

User Manual