ecCLOUD Controller

Use r Man u alwww.edge-core.com

Us er Ma nua lecCLOUD Controller
Cloud-Based Wired and Wireless Device Network Controller

E082023-CS-R05

How to Use This Guide

This guide includes detailed information on the Edgecore ecCLOUD Controller,
including how to create Clouds and Sites, and how to manage your APs and otherdevices. To manage your network devices effectively and ensure trouble-free
operation, you should first read the relevant sections in this guide so that you arefamiliar with all features.

Who Should Read This guide is for network administrators who are responsible for operating andThis Guide? maintaining network equipment. The guide assumes a basic working knowledge ofLANs (Local Area Networks), the Internet Protocol (IP), and Simple Network
Management Protocol (SNMP).

How This Guide The organization of this guide is based on the ecCLOUD Controller web
is Organized management interface. An introduction and initial configuration information is also
provided.

The guide includes these sections:

Section I “Getting Started” — Includes an introduction to the ecCLOUD
Controller and initial access steps.

Section II “Cloud Configuration” — Includes all management options available
through the ecCLOUD Controller web site.

Conventions The following conventions are used throughout this guide to show information:
Note: Emphasizes important information or calls your attention to related features
or instructions.

Caution: Alerts you to a potential hazard that could cause loss of data, or
damage the system or equipment.

Warning: Alerts you to a potential hazard that could cause personal injury.

– 3 –How to Use This Guide

Revision History This section summarizes the changes in each revision of this guide.
August 2023 RevisionThis is the fifth revision of this guide. It includes the following changes:


Added OpenRoaming, see “Adding an SSID” on page 142 and“OpenRoaming” on page 183

Added RF Isolation, see “Radio Settings” on page 152Modified Broadcast Rate, see “Radio Settings” on page 152

Added Site Grouping, see “Site Grouping” on page 58

Added “Always Follow Cloud Configuration” on page 60

March 2023 RevisionThis is the fourth revision of this guide. It includes the following changes:


Added Airtime Fairness, see “Global Settings” on page 153



Added 802.11v, see “Adding an SSID” on page 142

Added BLE Tx Power, see “iBeacon” on page 182

Added BLE Scan, see “iBeacon” on page 209Updated Channel Bandwidth, see “Physical Radio Settings” on page 153 and“Physical Radio Settings” on page 205Updated BSS Coloring, see “Physical Radio Settings” on page 153 and“Physical Radio Settings” on page 205Updated Minimum Allowed Signal, see “Adding an SSID” on page 99 and“Adding an SSID” on page 142

Added Terragraph device configuration, see “Terragraph Device Configuration”
on page 227Added Site Terragraph VLAN settings, see “VLAN Settings” on page 190

November 2022 RevisionThis is the third revision of this guide. It includes the following changes:


Added batch upload information, see “Creating Your First Cloud” on page 25
and “Add Devices” on page 80Updated Cloud menu, see “Managing Your Devices” on page 50– 4 –How to Use This GuideUpdated WiFi 5/WiFi 6 configuration, see “WiFi Configuration” on page 83

Renamed chapter “Site WiFi 5 Configuration” on page 97

Added Multicast/Broadcast Rate, see “Adding an SSID” on page 99

Added OSEN, see “Adding an SSID” on page 99

Added AuthPort External RADIUS, see “Radio Settings” on page 107Added Disabled W52 Channel, see “Radio Settings” on page 107Added IPv6 settings, see “Internet Settings” on page 111



Added Uplink 802.1P, see “VLAN Settings” on page 114

Added Enable RSTP, see “Local Network Settings” on page 117Added DNS Entries, see “Local Network Settings” on page 117Added ARP Inspection, see “ARP Inspection” on page 121Added DHCP Snooping, see “DHCP Snooping” on page 122Added AuthPort Remote Splash Page with External RADIUS, see “Hotspot
Settings” on page 122Added DNS Entries and DNS Mapping, see “Hotspot Settings” on page 122Added Generate NAS ID, see “RADIUS Server” on page 126

Added HTTPS Login, see “Captive Portal” on page 127Modified Cloud and Radio LEDs, see “System Settings” on page 129

Added MSP Mode, see “System Settings” on page 129

Added SNMP IPv6 Write Community and SNMP Location, see “SNMP” onpage 134

Added IGMP Snooping, see “IGMP Snooping” on page 137

Added LLDP, see “LLDP” on page 138

Added iBeacon, see “iBeacon” on page 138

Added SNMPv3 User, see “SNMPv3 User” on page 139

Added chapter “Site WiFi 6 Configuration” on page 140– 5 –How to Use This GuideAdded chapter “Site Terragraph Configuration” on page 186

Renamed chapter “WiFi 5 Device Configuration” on page 191

Added chapter “WiFi 6 Device Configuration” on page 200

May 2021 RevisionThis is the second revision of this guide. It includes the following changes:


Added support for EAP101 and EAP102.



Added section “QR Code Onboarding” on page 31.

December 2020 RevisionThis is the first revision of this guide.

– 6 –Contents

Section I

How to Use This Guide

3

Contents

7

Figures13

Getting Started

21

1 Introduction

Section II

22

ecCLOUD Controller Login

23

Creating Your First Cloud25

QR Code Onboarding

31

Understanding Configuration Inheritance

33

Understanding Device Registration

35

Device Configuration Changes

37

Configuration Errors and Failures

38

Configuration Suspended Error

38

Cloud Configuration40

2 Cloud Management

41

Managing Your Clouds

41

Create a New Cloud (from an existing account)

42

Editing Cloud Information

44

Changing the Cloud Properties

45

Deleting a Cloud46

Displaying the Cloud Dashboard

47

Creating a Custom Cloud Dashboard

48

Managing Your Devices

50

Filtering the Device List
– 7 –

50

Contents

3

Configuring Inheritance Policy

51

Viewing Device Information

52

Adding Devices

52

Upgrading Device Firmware

52

Displaying System Activity

54

Manage Your Sites

55

User Management

56

Site Grouping

58

Always Follow Cloud Configuration

60

Managing Licenses and Billing64

Add-Ons

65

Using the AuthPort Add-On

66

Service Plans

67

Accounts

69

AuthPort Certificate

71

Captive Portal

72

SSID Configuration

73

General Site Configuration

75

Overview of Sites

76

Creating a Site

77

Site Configuration

79

Add Devices

80

Place Devices on a Google Map

81

Set Floor Maps

82

WiFi Configuration

83

Displaying the Site Dashboard

84

Creating a Custom Site Dashboard

85

Monitoring Wireless APs and Clients

88

Schedule Maintenance Tasks

92

Upgrade Firmware

92

Bulk Reboot

93

Site Notifications

93

4 Site WiFi 5 Configuration
– 8 –

97

Contents

Wireless SSID Configuration

98

Adding an SSID

99

Setting Wireless Schedules

106

Radio Settings

107

General Networking Settings

110

Internet Settings

111

Ethernet Settings

113

VLAN Settings

114

Local Network Settings

117

Firewall Settings

119

Port Forwarding120

ARP Inspection

121

DHCP Snooping

122

Hotspot Settings

122

General Settings

122

Network Settings

124

DHCP Server

125

RADIUS Server

126

Captive Portal

127

Authentication Exceptions

129

System Settings

129

General Settings

129

SSH

131

Discovery Tool

131

Telnet132

Web Server

132

Network Time

133

SNMP

134

Remote Syslog

135

Ping Watchdog

136

BLE Settings

136

Multicast DNS

137

IGMP Snooping

137

LLDP

138

iBeacon138– 9 –Contents

SNMPv3 User

139

5 Site WiFi 6 Configuration

140

Wireless SSID Configuration

141

Adding an SSID

142

Setting Wireless Schedules

150

Radio Settings

152

General Networking Settings

156

Internet Settings

157

Ethernet Settings

160

VLAN Settings

161

Local Network Settings

163

Firewall Settings

165

Port Forwarding

166

ARP Inspection

167

DHCP Snooping

168

Hotspot Settings

168

General Settings

168

Network Settings

170

DHCP Server

171

RADIUS Server

171

Captive Portal

173

Authentication Exceptions

174

System Settings

175

General Settings

175

SSH

176

Discovery Tool

177

Network Time

177

SNMP

178

Telnet179

Web Server

179

Remote Syslog

180

Multicast DNS

181

LLDP

181

iBeacon182– 10 –

Contents

OpenRoaming

183

6 Site Terragraph Configuration

186

Metrolinq Terragraph Configuration

187

VLAN Settings

190

7 WiFi 5 Device Configuration

191

Accessing Device-Level Configuration

192

Device Radio Settings

194

8 WiFi 6 Device Configuration

200

Accessing Device-Level Configuration

201

Device Radio Settings

202

System Settings

209

iBeacon209

9 MetroLinq Device Configuration

211

MetroLinq Configuration

212

Wireless SSID

212

Radio Settings

213

Global Settings

213

Wireless 5 GHz

214

Wireless 2.4 GHz

216

Wireless 60 GHz

218

General Radio Settings

218

QoS Settings

222

Traffic Control

223

Using the LinqPath Tool

224

RSSI vs. Distance Graph

226

10 Terragraph Device Configuration

227

Terragraph Configuration

228

General Networking Settings

229

Radio Settings

231

System Settings

233

11 Switch Device Configuration
Switch Configuration

237
238

– 11 –

Contents

Port Configuration

239

Trunk Configuration

239

LACP Trunks

240

VLAN Configuration

241

Adding VLAN Port Members

241

Configuring Name Servers

243

Configuring Static IP Routes

243

Configuring Port Rate Limiting (QoS)244

STP Configuration

245

Port Security Configuration

245

Configuring 802.1X Port Authentication

246

ACL Configuration

248

Binding Ports to an ACL

249

Configuring Switch Services

250

Configuring Port Mirroring251

Configuring Local Logins

252

Configuring System Settings

252

Configuring Login Authentication253– 12 –

Figures

Figure 1: ecCLOUD Controller Login23

Figure 2: New User Registration

24

Figure 3: Creating a Cloud on First Login25

Figure 4: Create Your First Cloud

25

Figure 5: Defining Your First Site

26

Figure 6: Saving the Site Configuration

27

Figure 7: Add Devices Prompt

27

Figure 8: Device Management View

27

Figure 9: Adding Devices

28

Figure 10: Adding Devices Warning Message

29

Figure 11: Adding Devices Successful Message

29

Figure 12: Firmware Upgrade Button

30

Figure 13: Filtering the Device View

30

Figure 14: Placing a Device on a Map

31

Figure 15: Scanning the AP QR Code31

Figure 16: ecCLOUD Login Page

32

Figure 17: ecCLOUD Device Registration

33

Figure 18: Registering New Devices

35

Figure 19: Device Configuration Overrides

37

Figure 20: Reverting Device-Level Overrides

37

Figure 21: Cloud Menu

41

Figure 22: Displaying Cloud Membership

42

Figure 23: Adding Cloud Information

43

Figure 24: Showing Cloud Actions

44

Figure 25: Changing Cloud Properties

45

Figure 26: Delete Cloud Confirmation

46

Figure 27: The Cloud Dashboard

47

Figure 28: Adding a Custom Cloud Dashboard

48

Figure 29: Naming a Custom Cloud Dashboard

48– 13 –

Figures

Figure 30: Adding a Widget to a Custom Cloud Dashboard

49

Figure 31: Selecting a Widget for a Custom Cloud Dashboard

49

Figure 32: Customized Widgets Added to a Custom Cloud Dashboard

49

Figure 33: Cloud Menu Devices

50

Figure 34: Manage Your Devices

50

Figure 35: Configuration Inheritance Policy Indication

51

Figure 36: Manage Your Devices Actions Menu

51

Figure 37: Accessing Device Details

52

Figure 38: Adding Devices to Your Cloud

52

Figure 39: Firmware Upgrade Indication

52

Figure 40: Device Firmware Upgrade

53

Figure 41: Showing All System Activity

54

Figure 42: Filtering by Activity Category

54

Figure 43: Site Management Page

55

Figure 44: Site Dashboard

55

Figure 45: Manage Users

56

Figure 46: Invite a New User

57

Figure 47: Accessing Site Grouping

58

Figure 48: Site Grouping Page

58

Figure 49: Creating a Site Group

59

Figure 50: Managing Site Groups

59

Figure 51: Viewing Site Group Information

60

Figure 52: Resetting Site Grouping

60

Figure 53: Enabling Always Follow Cloud Configuration During Device Registration

61

Figure 54: Enabling Always Follow Cloud Configuration on the Devices Page

62

Figure 55: Managing Follow Cloud Configuration

62

Figure 56: Using Force Configuration Push

63

Figure 57: Using Auto Follow Cloud Config

63

Figure 58: Managing Licenses and Billing

64

Figure 59: Add-ons Menu

65

Figure 60: AuthPort Add-on

66

Figure 61: The AuthPort Menu

67

Figure 62: Adding a Service Plan

67

Figure 63: Service Plans Overview

68– 14 –

Figures

Figure 64: Creating a Single Account69

Figure 65: Creating Accounts in a Batch

69

Figure 66: Account List

70

Figure 67: Account Details

70

Figure 68: AuthPort Certificate

71

Figure 69: AuthPort Captive Portal Themes

72

Figure 70: AuthPort Captive Portal Editor

73

Figure 71: AuthPort SSID Configuration

73

Figure 72: Default Site Dashboard

76

Figure 73: Creating a New Site

77

Figure 74: Entering Basic Site Properties

78

Figure 75: Setting the Regulatory Country

79

Figure 76: Setting Local Logins

79

Figure 77: Add Devices Prompt

80

Figure 78: Registering New Devices

80

Figure 79: Adding Devices Warning Message

81

Figure 80: Adding Devices Successful Message

81

Figure 81: Placing a Device on a Map

82

Figure 82: Adding a Floor Map

82

Figure 83: Configuring a Floor Map

82

Figure 84: Placing Devices on Floor Maps

83

Figure 85: WiFi5 Configuration

83

Figure 86: Site Dashboard

84

Figure 87: Adding a Custom Site Dashboard

85

Figure 88: Naming a Custom Site Dashboard

86

Figure 89: Adding a Widget to a Custom Site Dashboard

86

Figure 90: Selecting a Widget for a Custom Site Dashboard

86

Figure 91: Customizing a New Site Dashboard Widget

87

Figure 92: Customized Site Dashboard

87

Figure 93: Wireless Clients Page

88

Figure 94: Wireless AP Information

89

Figure 95: Wireless AP Live Status

90

Figure 96: Wireless AP Active Clients

90

Figure 97: Client Information Page

91

Figure 98: Renaming a Wireless Client91– 15 –

Figures

Figure 99: Maintenance Tasks Page

92

Figure 100: New Firmware Upgrade Task Page

92

Figure 101: Manage Bulk-Reboot Page

93

Figure 102: Site Notification Settings

94

Figure 103: Site WiFi5 Configuration

98

Figure 104: Radio Settings (New SSID)

99

Figure 105: Bridge to Internet

101

Figure 106: Route to Internet

101

Figure 107: Adding a Wireless Schedule106

Figure 108: WiFi 5 Radio Settings

107

Figure 109: 5 GHz Radio Channels

108

Figure 110: 2.4 GHz Radio Channels

109

Figure 111: General Networking Settings

110

Figure 112: Internet Settings

111

Figure 113: Management VLAN Settings

112

Figure 114: IPv6 Settings

112

Figure 115: Ethernet Settings

113

Figure 116: VLAN Settings

115

Figure 117: Adding a VLAN

115

Figure 118: Local Network Settings

117

Figure 119: Firewall Settings

119

Figure 120: Port Forwarding

120

Figure 121: ARP Inspection

121

Figure 122: DHCP Snooping

122

Figure 123: Hotspot General Settings

123

Figure 124: Hotspot Network Settings

124

Figure 125: Hotspot DHCP Server Settings

125

Figure 126: Hotspot RADIUS Server Settings

126

Figure 127: Hotspot Captive Portal Settings

127

Figure 128: Hotspot Authentication Exceptions

129

Figure 129: General System Settings

130

Figure 130: SSH Server Settings

131

Figure 131: Discovery Tool Settings

131

Figure 132: Telnet Server Settings132– 16 –

Figures

Figure 133: Web Server Settings

133

Figure 134: NTP Settings

133

Figure 135: SNMP Settings

134

Figure 136: Remote Log Settings

135

Figure 137: Ping Watchdog Settings

136

Figure 138: BLE Settings

136

Figure 139: Multicast DNS Settings

137

Figure 140: IGMP Snooping Settings

137

Figure 141: LLDP Settings

138

Figure 142: iBeacon Settings

138

Figure 143: SNMPv3 User Settings

139

Figure 144: Site WiFi6 Configuration

141

Figure 145: Radio Settings (New SSID)

142

Figure 146: Bridge to Internet

148

Figure 147: Route to Internet

149

Figure 148: Adding a Wireless Schedule

150

Figure 149: WiFi 6 Radio Settings

152

Figure 150: 5 GHz Radio Channels

154

Figure 151: 2.4 GHz Radio Channels

154

Figure 152: General Networking Settings

156

Figure 153: Internet Settings

157

Figure 154: Management VLAN Settings

158

Figure 155: DHCP Relay

159

Figure 156: IPv6 Settings

159

Figure 157: Ethernet Settings

160

Figure 158: VLAN Settings

161

Figure 159: Adding a VLAN

162

Figure 160: Local Network Settings

163

Figure 161: Firewall Settings

165

Figure 162: Port Forwarding

166

Figure 163: ARP Inspection

167

Figure 164: DHCP Snooping

168

Figure 165: Hotspot General Settings

169

Figure 166: Hotspot Network Settings

170

Figure 167: Hotspot DHCP Server Settings171– 17 –

Figures

Figure 168: Hotspot RADIUS Server Settings

171

Figure 169: Hotspot Captive Portal Settings

173

Figure 170: Hotspot Authentication Exceptions

174

Figure 171: General System Settings

175

Figure 172: SSH Server Settings

176

Figure 173: Discovery Tool Settings

177

Figure 174: NTP Settings

177

Figure 175: SNMP Settings

178

Figure 176: Telnet Server Settings

179

Figure 177: Web Server Settings

180

Figure 178: Remote Log Settings

180

Figure 179: Multicast DNS Settings

181

Figure 180: LLDP Settings

181

Figure 181: iBeacon Settings

182

Figure 182: OpenRoaming Profile

183

Figure 183: Site Terragraph Configuration

187

Figure 184: Add Terragraph Node

188

Figure 185: Delete Terragraph Node

188

Figure 186: Add Terragraph Link

189

Figure 187: Delete Terragraph Link

189

Figure 188: Site Terragraph VLAN Settings

190

Figure 189: Accessing Device-Level Configuration

192

Figure 190: Device-Level Dashboard

193

Figure 191: Device Configuration

193

Figure 192: Device Global Radio Settings

194

Figure 193: Device General Radio Settings

194

Figure 194: Device Advanced Radio Settings

195

Figure 195: Device Physical Radio Settings

196

Figure 196: 5 GHz Radio Channels

197

Figure 197: 2.4 GHz Radio Channels

197

Figure 198: Accessing Device-Level Configuration

201

Figure 199: Device-Level Dashboard

201

Figure 200: Device Configuration

202

Figure 201: Device Global Radio Settings

202– 18 –

Figures

Figure 202: Device Mesh Settings

203

Figure 203: Device General Radio Settings

204

Figure 204: Device Advanced Radio Settings

205

Figure 205: Device Physical Radio Settings

205

Figure 206: 5 GHz Radio Channels

206

Figure 207: 2.4 GHz Radio Channels

207

Figure 208: Device iBeacon Settings

209

Figure 209: MetroLinq Device Dashboard

212

Figure 210: MetroLinq Device Dashboard

213

Figure 211: MetroLinq Device 5 GHz Radio Settings

213

Figure 212: 5 GHz Radio Channels

215

Figure 213: MetroLinq Device 2.4 GHz Radio Settings

216

Figure 214: 2.4 GHz Radio Channels

217

Figure 215: MetroLinq Device 60 GHz Radio Settings

218

Figure 216: 60 GHz Radio Channels

220

Figure 217: MetroLinq Radio Beamwidth

221

Figure 218: MetroLinq QoS Settings

222

Figure 219: MetroLinq Traffic Control Settings

223

Figure 220: MetroLinq LinqPath Settings

224

Figure 221: MetroLinq LinqBudget Results

225

Figure 222: MetroLinq LinqPath Expected RSSI Graph

226

Figure 223: Terragraph Device Dashboard

228

Figure 224: Terragraph Device General Networking

229

Figure 225: Terragraph Device Radio Settings

231

Figure 226: Terragraph Device System Settings

233

Figure 227: Switch Device Dashboard

238

Figure 228: Switch Ports

239

Figure 229: Configuring a Trunk240

Figure 230: Configuring Trunk Ports

240

Figure 231: Configuring LACP Trunks

241

Figure 232: Configuring VLANs

241

Figure 233: Configuring VLAN Port Members

242

Figure 234: Configuring VLAN Port Settings

243

Figure 235: Configuring Name Servers

243

Figure 236: Configuring IP Routes

244– 19 –

Figures

Figure 237: Configuring Port Rate Limiting

244

Figure 238: Configuring STP

245

Figure 239: Configuring Port Security

246

Figure 240: Configuring Port Authentication

247

Figure 241: Configuring Port Authentication

247

Figure 242: Configuring ACLs

248

Figure 243: Adding a New ACL

249

Figure 244: Port ACL Bindings

249

Figure 245: Binding Ports to ACLs

249

Figure 246: Switch Services

251

Figure 247: Port Mirroring

251

Figure 248: Local Login Configuration

252

Figure 249: System Settings

253

Figure 250: Login Authentication

253

Figure 251: Adding Authentication Servers

254– 20 –

Section I
Getting Started
This section provides an overview of the ecCLOUD Controller software anddescribes the initial steps required to start using the service.
This section includes these chapters:“Introduction” on page 22– 21 –

1

Introduction

This chapter includes the following sections:“ecCLOUD Controller Login” on page 23“Creating Your First Cloud” on page 25

“QR Code Onboarding” on page 31“Understanding Configuration Inheritance” on page 33“Understanding Device Registration” on page 35

“Device Configuration Changes” on page 37

“Configuration Errors and Failures” on page 38– 22 –

Chapter 1 | Introduction

ecCLOUD Controller Login

The Edgecore ecCLOUD Controller is a cloud-based network service available
from anywhere through a web-browser interface.
The ecCLOUD Controller software is highly scalable and able to manage anunlimited number of networks and devices. Combining both network management
and wireless controller features, it enables Edgecore access points (APs) andswitches to automatically connect and be managed as one network.
The following devices are supported by ecCLOUD:

Edgecore APs: EAP101, EAP102, ECW5211-L, ECWO5211-L, OAP100,
ECW5410-LEdgecore Switches: ECS2100-10P, ECS2100-10T, ECS2100-28P, ECS210028T, ECS2100-28PP, ECS2100-52T, ECS4100-12T, ECS4100-12PH,
ECS4100-28P, ECS4100-28T, ECS4100-52P, ECS4120-28Fv2, ECS412028Fv2-I, ECS4120-28T, ECS4120-52T



IgniteNet APs & MetroLinqs: SP-W2-AC1200(L), SP-W2M-AC1200, SPW2M-AC1200-POE, SS-W2-AC2600, SS-N300, GW-AC1200, SP-AC750,
ML1-60, ML2.5-60, ML2.5-60-BF, ML-60-LW, ML-5-LW, ML-60-10G-360



IgniteNet Switches: FusionSwitch PoE 10-Port, FusionSwitch PoE 24-Port,
FusionSwitch Fiber, MeshLinq

ecCLOUD Controller Login
From a web browser, go to cloud.ignitenet.com to register an account and startcreating your own cloud networks and sites.
Figure 1: ecCLOUD Controller Login– 23 –

Chapter 1 | Introduction
ecCLOUD Controller Login

Click “I want to register” to create a new account.
Figure 2: New User Registration

Enter your email address and specify a first and last name. Set a password toprotect access to your account, click “I am not a robot,” and then click REGISTER.
Note: You must have a valid email address in order to create your user profile.
The ecCLOUD Controller sends a verification email to the account email address.
When you receive the email, click on the provided link to activate your account.

– 24 –

Chapter 1 | Introduction
Creating Your First Cloud

Creating Your First Cloud
The ecCLOUD Controller uses a cloud-like account – it houses a group of sites,
which are logical groupings of your managed devices. Each cloud will have its own
set of users and configuration settings. As an end-user, you can join as many clouds
as you want, with different roles on each cloud.
Once you are registered as a user on the ecCLOUD Controller, you are given theoption to create a cloud when you first log in.
Figure 3: Creating a Cloud on First Login

After entering a name for your first cloud, click CREATE to display the Cloud
Dashboard.
Figure 4: Create Your First Cloud– 25 –

Chapter 1 | Introduction
Creating Your First Cloud

Click ADD SITE and enter information for your first site.
Figure 5: Defining Your First Site

Set the following properties for devices at your site:Enable Configuration: This setting has the following options:

ON: Enables you to remotely configure your devices. (default)

OFF: Your devices need to be configured locally. However, you can still
remotely monitor your devices and you will still receive alerts when a device
goes offline.

Upgrade At Registration: Enable this setting if you want your devices to be
automatically upgraded to the latest firmware after registration. It is
recommended that you keep this setting on.

Allow auto re-registration: When this setting is enabled, your devices willautomatically re-register when they are reset to defaults. If this setting is
disabled, a user must log in to the cloud and manually chose the action to takewhen a device attempts to re-register.

After configuring all the site information, click CREATE to create the site.

– 26 –

Chapter 1 | Introduction
Creating Your First Cloud

After setting the regulatory country and local logins, click “Save” to save yourconfiguration.
Figure 6: Saving the Site Configuration

When you first save the site configuration, you are prompted to add devices(wireless, switches, MeshLinqs, GLinqs) to your new site. Click “ADD DEVICES” tocontinue.
Figure 7: Add Devices Prompt

Alternatively, you can click Devices-Wireless or Switches on the main menu toaccess the device management view.
You are now ready to start adding Edgecore APs or switches to your cloud network.
Figure 8: Device Management View

Click on ADD DEVICE to access the “Register new Devices” page.
Fill in the serial number, MAC address and name, and then click SAVE.
Alternatively, you can use the QR code on a device (see “QR Code Onboarding”– 27 –

Chapter 1 | Introduction
Creating Your First Cloudon page 31), or use a barcode scanner. Or, you can upload information for abatch of devices in a file.
Turn “Enable barcode scanning mode” ON to quickly scan barcodes and enter theserial number and MAC addresses of your devices. Once entered, turn off thebarcode scanning mode and enter the names of the devices manually. Click the
SAVE button when you are ready to add your new devices to the site.
Turn on the “Always follow cloud configuration” feature to ignore any local
configuration changes received from a device. For more information, see “Always
Follow Cloud Configuration” on page 60.
For a batch upload, prepare a list of devices in a CSV (comma-separated values)
file. A CSV file is a plain text file in which information is separated by commas. For
each device, the serial number, MAC address and name should be entered on one
line, as in the following format.
<Serial Number 1>,<MAC 1>,<Device Name 1><Serial Number 2>,<MAC 2>,<Device Name 2>

Click the UPLOAD button to upload your CSV file.
For more information on registration, see “Understanding Device Registration” onpage 35.
Figure 9: Adding Devices– 28 –

Chapter 1 | Introduction
Creating Your First Cloud

When the controller adds a device, the following pop-up window is displayed
warning you that the device will inherit settings from the ecCLOUD controller site
configuration. For more information on inheritance, see “Understanding
Configuration Inheritance” on page 33.
Figure 10: Adding Devices Warning Message

Further, at the top of the “Register new devices” page a message appears indicatingthat devices have been successfully added. Click on the blue link “Map Manager”
in the message to place your device on a map. See “Placing a Device on a Map”
on page 31.
Figure 11: Adding Devices Successful Message– 29 –

Chapter 1 | Introduction
Creating Your First Cloud

Additionally, with the first device added to the site the “Upgrade Firmware” button
appears above the device list. Refer to “Schedule Maintenance Tasks” on page 92.
Figure 12: Firmware Upgrade Button

Clicking the filter (funnel shape) button in the upper left of the device manager view
enables devices in the list to be filtered based on various properties. Chose theproperties from the selection lists under Status, Health, Registration, Blocked,
Disabled, Configuration Status, and Configuration Inheritance Policy.
Click the “Clear” button to reset all the filters.
Figure 13: Filtering the Device View

– 30 –

Chapter 1 | Introduction

QR Code Onboarding

Placing a Device on a Map
Clicking on the Map Manager link in the adding-devices successful message
displays the map view page. Use the mouse to click-drag devices to installation
locations on the map.
Figure 14: Placing a Device on a Map

QR Code Onboarding
For quick set up and registration of your AP with the ecCLOUD controller, you canscan the QR code on the AP using a phone.
Follow these steps:

1. Power on the AP.
2. Connect the AP to the Internet. Connect your network or Internet access device
to the AP’s RJ-45 Uplink port.

3. Use the camera (iPhone) or a barcode app (Android) on your phone to scan
the AP’s QR code. The QR code is printed on a label on the AP.

Figure 15: Scanning the AP QR Code– 31 –

Chapter 1 | Introduction
QR Code Onboarding

4. When a message pops up, tap “yes” to join the Wi-Fi network. (iPhone requires
you to go to Settings > Wi-Fi for the message to pop up.)

The web browser should open and redirect to the Setup Wizard page.
Note: If the phone cannot connect to the Wi-Fi network, type the SSID (networkname) and password manually. The SSID name is the AP serial number (forexample, EC0123456789), and the password is the AP MAC address (forexample, 903CB3BC1234).

5. Select to manage the AP using the ecCLOUD controller, or to manage the AP instand-alone mode.

a. Stand-Alone Mode: Use the default wireless network setting or customize
the network name and password. Tap “Done” to finish the setup wizard.

Wait about two minutes for the AP configuration to update, and thenconnect to the wireless network name configured in the Setup Wizard. The
browser is then redirected to the login page of the AP.

b. Cloud-Managed Mode: Tap “Done” to finish the Setup Wizard and thebrowser is redirected to the ecCLOUD login page.

Figure 16: ecCLOUD Login Page

If you already have an ecCLOUD account, log in and select a site for the
AP. The AP is automatically registered for cloud management. After you tap“Save,” wait about two minutes for the cloud controller to configure the AP.

– 32 –

Chapter 1 | Introduction
Understanding Configuration Inheritance
Figure 17: ecCLOUD Device Registration

If you do not have an ecCLOUD account, tap “I want to register” and set
up an account. Create a cloud and site before confirming the regulatory
country. After tapping “Next,” the AP is then automatically registered forcloud management.
After you tap “Save,” wait about two minutes for the cloud controller toconfigure the AP.

Understanding Configuration Inheritance
When a new device is added to the Cloud, the device’s “Site-level configuration
inheritance” behavior must also be selected. This “Inheritance Policy” determines
how the Cloud configures a device. Cloud Configuration is very flexible, it allows
Device-level configuration overrides to be setup when there is a need to inherit only
a subset of site-level settings.
The Site-level Inheritance Policy is set when you first register a device, but this canalso be changed later at any time.
There are two Inheritance Policy options for devices:

Inherit site-level settings — Select this Inheritance Policy if you want tomanage devices at a site like a single unit with a common configuration. This isnormally the best way to configure Wi-Fi access devices. You would typicallychoose this Inheritance Policy for a hotel, business, or other similar application
where enterprise Wi-Fi is deployed.
Even though devices inherit most of their settings from the Site-level, you canalways override any Site-level settings at the Device-level by making changes
on the Device-level configuration pages.

Don’t inherit site-level settings — Select this Inheritance Policy if you do notwant a device to inherit any settings from the Site level.
– 33 –

Chapter 1 | Introduction
Understanding Configuration Inheritance

You would normally choose this Inheritance Policy if a device is used forinfrastructure, backhaul, or needs to be configured independently from theother devices at a site. This is the typical choice for MetroLinq point-to-pointlinks.
When Site-level inheritance is enabled for a device, the device’s final configuration
will include the following:

Settings inherited from the Site-level device configuration.

Settings initially inherited from the Site-level configuration that have been since
been modified as a Device-level “override.”

Settings unique to the Device-level configuration. That is, device-specificsettings that are not configurable at the Site level.

Note: Device-level overrides can be reset to the Site-level configuration by clicking
the “Use Site Settings” button on the page where a setting has been changed.
Note that some Device-level override settings, specifically those for SSIDs, local
logins, and VLANs, cause all other settings for that entity to be overridden. For
example, changing one setting for a Site-level configured SSID at the Device level
results in all settings for that SSID being treated as an override. That is, any futurechanges to the SSID at the Site level will not be reflected in the Device-level
configuration.

– 34 –

Chapter 1 | Introduction
Understanding Device Registration

Understanding Device Registration
New devices can easily be added to a site by entering (or scanning) the serial
numbers and MAC addresses of the devices into the “Add device” form on the
Cloud.
Figure 18: Registering New Devices

Note: A device’s serial number and MAC address can be found on its productbox, or on the main dashboard page of the local web configuration UI.
This is the typical process that occurs after a device is registered:

1. Once a device is added to a site, it goes into the “Pending Registration” state.
At this point, the Cloud is waiting for the device to call in for the first time tofetch the credentials it will use for future communication with the Cloud.

2. After the device makes its initial connection to the Cloud and completes

registration, the Cloud checks to see if the device’s site has the “auto firmware
upgrade” setting enabled. If so, it checks the device’s firmware to see if it needs
to be upgraded, and if so, it creates an auto firmware upgrade task for thedevice.

3. After the device is upgraded (or if firmware upgrade is skipped), the device will
send up its current configuration to the Cloud. This generates a “Received– 35 –

Chapter 1 | Introduction
Understanding Device Registration

Config” task, the details of which can be viewed on the device’s Activity page.
The Cloud must collect the device’s initial configuration, as well as firmware
version, before it can push any new configurations down to the device.

4. Next, the cloud will merge any Site-level configuration settings (assuming

inheritance is enabled) with the device’s configuration, and create a “Change
Config” task to push the new settings down to the device. If Site-inheritance isenabled, the device’s running configuration will be completely replaced withthe configuration seen on the device’s Configuration page on the Cloud. Any
configuration settings changed through the local UI prior to registration(excluding certain wireless client settings) will be wiped once the cloud sends
down the device’s new configuration.

After the initial configuration task is completed, the device is finished with all
registration-related activities and will commence normal operation. A device’s“Activity” page can be used at any time to see the point at which the device is in theinitial registration and/or configuration process.
In summary, there are four possible registration states for a device:

Unregistered: There is no record of the device in the Cloud database when adevice is unregistered.



Pending Registration: The Cloud user has added the device record to a site
by serial number and MAC, and the Cloud is waiting for the device to make an
initial connection. At this point, the device has not yet made any contact with
the Cloud. If you see a device in this state for a long time, check its Internet
connection or your upstream firewall settings.

Registered: The device has made initial contact with the Cloud, completed theregistration process, and received its credentials which it will use in any further
communication with the Cloud. The “registered” state is the normal operatingstate of a device on the cloud.



Re-registration: This means the device was previously registered, but is
attempting to register again. The system creates an alert for this situation as it
requires the user to login to their Cloud account and choose which actions theywant to take - such as to allow the device to connect again, and what to dowith the device's new configuration.

Note: You can enable “auto” re-registration from the site properties page so thatno manual intervention is required to resolve re-registration alerts.

– 36 –

Chapter 1 | Introduction
Device Configuration Changes

Device Configuration Changes
Any time a device’s Device-level or Site-level configuration is changed, the Cloudmust determine which settings should actually be changed and pushed down to a
device.
When “Site-level configuration inheritance” is enabled for a device, the final
configuration will be made of merging two different sets of configurations:

The common Site-level configuration settings for that product type, andThe device’s individual configuration, which includes settings not configurable
at the site level, such as advanced radio settings, features unique to a single
product, and more importantly, any Device-level configuration overrides.

Figure 19: Device Configuration Overrides

Device-level configuration setting overrides can be created by changing a setting at
the Device-level configuration that’s currently being inherited from the site level.
These overrides can always be reverted at any time by clicking the purple arrow
button next to the setting, or by clicking the “Use Site Settings” button.
Figure 20: Reverting Device-Level Overrides– 37 –

Chapter 1 | Introduction
Configuration Errors and Failures

After a user changes the configuration for a device, the following will happen:

1. A “Change Config” task will be created detailing exactly which settings arebeing changed on the device. This task can be tracked on the device’s Activity
page.

2. The Cloud will push the new configuration down to the device and wait for a

configuration ACK from the device to acknowledge that the new configuration
was successful.

3. If the ACK is received, the task is marked as complete. If the device loses

connectivity after applying the new set of configuration settings, the device willrevert to the previous configuration, and send a failure notification to the
Cloud. This will result in an “out of sync” error.

Configuration Errors and Failures
There are two major errors that may be encountered during the configuration
process:Configuration out of sync error: This error occurs when the device reverts aconfiguration pushed down from the Cloud because it cannot connect to the
Cloud again after the change. This is what “out of sync” means; the device’s
running configuration does not match the configuration on the Cloud.



Resolution: This error can be resolved by changing any incorrect settings inyour device’s configuration on the Cloud, and clicking the “Resync” button tosend them back down. For example, a device is currently operating in Clientmode, but is configured to use AP mode from the device’s Configuration pageon the Cloud. After a configuration push, the device will no longer be able toaccess the Internet or Cloud. The device’s operating mode must be changed to
Client from the Cloud configuration.

Configuration Device configuration suspension means that no configurations will be pushed to
Suspended Error the device from the Cloud, and no configurations received by the device will beprocessed by the Cloud.

A device’s configuration may become suspended in two cases:Device was downgraded: As of 2/1/2019, if you downgraded your Cloudconnected device to an older firmware without resetting to defaults, yourdevice’s configuration will automatically be suspended. The reason for this isthat the device’s configuration may contain keys or other values that are notsupported, or are incompatible with the older firmware version. This situation
could lead to system errors and undefined behavior.

– 38 –

Chapter 1 | Introduction
Configuration Errors and Failures
Resolution: Reset your device to defaults and allow it to connect to the Cloudagain through re-registration.


A system error has occurred: Sometimes (very rarely), a system error will
occur when the Cloud does not understand how to process one or more keys in
the configuration sent to it by the device.
Resolution: Most times, the system error can be cleared out by resetting thedevice to defaults, and choosing the “Use the device’s running config” at reregistration.

Note: This will clear out any “bad” cloud-level configuration keys, but will also
clear out any device-level overrides you may have created.
If that does not work, wait for support and development teams to investigate thecause of the system error. Once resolved, an email will be sent out to all Cloudaccount owners and admins notifying them that the device’s configuration has
been unsuspended.

– 39 –

Section II
Cloud Configuration
This section provides details on creating and managing clouds and sites, as well as
configuring access point settings.
This section includes these chapters:“Cloud Management” on page 41

“General Site Configuration” on page 75“Site WiFi 5 Configuration” on page 97

“Site WiFi 6 Configuration” on page 140“Site Terragraph Configuration” on page 186

“WiFi 5 Device Configuration” on page 191

“WiFi 6 Device Configuration” on page 200“MetroLinq Device Configuration” on page 211– 40 –

2

Cloud Management

This chapter includes the following sections:“Managing Your Clouds” on page 41

“Displaying the Cloud Dashboard” on page 47

“Creating a Custom Cloud Dashboard” on page 48

“Managing Your Devices” on page 50“Manage Your Sites” on page 55

“User Management” on page 56“Site Grouping” on page 58

“Always Follow Cloud Configuration” on page 60

“Managing Licenses and Billing” on page 64

“Add-Ons” on page 65

“Using the AuthPort Add-On” on page 66

Managing Your Clouds
Select “Manage Clouds” from the Cloud pull-down menu in the upper right of thescreen to get to the cloud management page.
Figure 21: Cloud Menu

– 41 –

Chapter 2 | Cloud Management
Managing Your Clouds

Create a New Cloud To add a new cloud to an existing account, follow these steps:(from an existingaccount) 1. Select Manage Clouds in the upper right of the screen (once logged in) to open
the Cloud Memberships page.

2. Click Add Cloud.
Figure 22: Displaying Cloud Membership

3. Fill in the cloud name and other descriptive information.
4. Click Save.

– 42 –

Chapter 2 | Cloud Management
Managing Your Clouds

Figure 23: Adding Cloud Information– 43 –

Chapter 2 | Cloud Management
Managing Your Clouds

Editing Cloud Click on the expand icon to show the DELETE and EDIT buttons.
Information
Figure 24: Showing Cloud Actions– 44 –

Chapter 2 | Cloud Management
Managing Your Clouds

Changing the Cloud In the cloud management list with the selected cloud expanded, click on the EDIT
Properties button in the lower right of the list to display the cloud information properties. Make
your changes to the cloud properties and then click the SAVE button.

Figure 25: Changing Cloud Properties– 45 –

Chapter 2 | Cloud Management
Managing Your Clouds

Deleting a Cloud In the cloud management list with the selected cloud expanded, click on the

DELETE button in the lower right of the list to delete the cloud. Click OK in theconfirmation window to complete deleting the cloud.

Figure 26: Delete Cloud Confirmation

Caution: Deleting a cloud is a permanent action and will result in the deletion of
all related records, such as APs, clients, sites, system activity logs, and device
configurations stored for that cloud.

– 46 –

Chapter 2 | Cloud Management
Displaying the Cloud Dashboard

Displaying the Cloud Dashboard
The cloud dashboard provides an overview of system status for configured devices,
recent activity information, a cloud status map, and a site status overview.
Figure 27: The Cloud Dashboard

The following items are displayed on the cloud dashboard:System Status — The four circles represent (from left to right): the number ofsites, the number of devices (with online/offline counts), the number of devices
with synced configurations, and the number of devices registered.

Note: Placing the mouse cursor over the four circles shows additional information.

– 47 –

Chapter 2 | Cloud Management

Creating a Custom Cloud Dashboard



Activity — Provides a short summary of the most recent device, network andsystem alerts, and maintenance notifications such as the device being
unreachable or rebooted. Clicking on each entry provides further details.



Cloud Map — Displays the geographical location of the cloud sites and thedevices located at each site. Hovering over a device displays a pop up withfurther device details.

Enabled Add-Ons Overview — A summary of the currently enabled Addons. Clicking in the box opens the Site Add-ons management view.



Site Status Overview — Lists a summary of site statistics, including the day’s
traffic, the number of clients, and the number of online devices.



Feedback Dialog — Enables you to send your comments and suggestions
directly to Edgecore.

Beta Features — Enables new cloud controller features that are in beta
release stage.

Creating a Custom Cloud Dashboard
In the default cloud dashboard, click the plus sign next to the default tab at the top
to create a custom dashboard suitable for your requirements.
Figure 28: Adding a Custom Cloud Dashboard

Enter a name for the new custom dashboard and click SUBMIT.
Figure 29: Naming a Custom Cloud Dashboard– 48 –

Chapter 2 | Cloud Management
Creating a Custom Cloud Dashboard
A new tab will appear next to the default dashboard tab with the custom
dashboard’s name. Click on one of the “+ Add Widget” buttons to add the desired
item for the new dashboard.
Figure 30: Adding a Widget to a Custom Cloud Dashboard

Once a widget is selected click the “ADD” button.
Figure 31: Selecting a Widget for a Custom Cloud Dashboard

Afterwards the widget will appear on the new custom dashboard. The widget size
can be adjusted by dragging the edges of the widget box. Further, it can berenamed or removed by clicking the three dot icon in the upper right of the box.
Click the “Add Widget” button again to add additional widgets to the custom
dashboard.
Figure 32: Customized Widgets Added to a Custom Cloud Dashboard– 49 –

Chapter 2 | Cloud Management
Managing Your Devices

Managing Your Devices
Clicking the Devices section on the Cloud menu displays all the cloud devices forall sites.
Figure 33: Cloud Menu Devices

Filtering the Device Click the filter (funnel) icon button in the upper left of the window to open the
List filtering options for the device list (Status, Health, State, Blocked, Disabled,

Configuration Status, Configuration Inheritance Policy, or Product Type). The
displayed devices can also be sorted by clicking on the ascending or descending
arrows at the top of each column.

Figure 34: Manage Your Devices– 50 –

Chapter 2 | Cloud Management
Managing Your Devices

Configuring The Site-level Inheritance Policy is set when you first register a device, but this canInheritance Policy also be changed later at any time. For more information, see “Understanding
Configuration Inheritance” on page 33.

In the Cloud Devices list, the column with the gear icon indicates the devices thathave the Configuration Inheritance Policy enabled. The Configuration Inheritance
Policy field can be filtered and the policy for devices changed from the “Actions”
list.
Figure 35: Configuration Inheritance Policy Indication

Select devices by clicking the checkmark square in the first column. The “Actions”
button becomes available in the column header. Click the Actions button to display
a menu of actions that can be applied to the selected devices.
Figure 36: Manage Your Devices Actions Menu

The following items are displayed on the Actions menu:Change Inheritance Policy — The selected devices will change theirinheritance policy, either to “Do not inherit site-level configuration,” or to“Inherit site-level configuration,” depending on the current setting.

Move to Site — Moves the selected devices to another site. The devices will
inherit site-level configuration from the selected site.



Block — Blocks the selected devices from communicating with the cloud.



Disable — Blocks (prevents communication with the cloud) and hides thedevices from all dashboards. The devices are no longer available, but thedevice history is preserved.

Delete — Permanently removes the selected devices from the cloud.

– 51 –

Chapter 2 | Cloud Management
Managing Your Devices

Viewing Device Click a device name link in the Name column to access the detailed device
Information information.
Figure 37: Accessing Device Details

Adding Devices Click the Add Devices button to display the “Register new devices” page and add
new devices to the cloud.

Figure 38: Adding Devices to Your Cloud

Upgrading Device Click the upgrade icon in the FW column when new firmware is available for a
Firmware device. The automated firmware upgrade page opens.
Figure 39: Firmware Upgrade Indication– 52 –

Chapter 2 | Cloud Management
Managing Your Devices

Follow the selections for the firmware type and upgrade schedules, and then click
the Create button to initiate the upgrade.
Figure 40: Device Firmware Upgrade– 53 –

Chapter 2 | Cloud Management
Displaying System Activity

Displaying System Activity
Click Activity on the Cloud menu to display all logged system alerts, maintenancetasks, and logged events. Click the filtering button on the left to specify a date
range selection. The displayed messages can also be sorted by clicking on theascending or descending arrows at the top of the Date column.
Figure 41: Showing All System Activity

Use the buttons at the top of the page to filter by the available categories: Alerts,
Maintenance, or System logs.
Figure 42: Filtering by Activity Category– 54 –

Chapter 2 | Cloud Management
Manage Your Sites

Manage Your Sites
From a Cloud menu, click on the Site Management.
Figure 43: Site Management Page

In the Manage Sites window a list of all created sites is shown with each site name,creation date, user list, and location. Click the edit button to edit a site’s properties,
or the delete button to delete a site once all devices are removed from it. Click theAdd Site button to open the site creation page.
Clicking on a site name opens the site’s dashboard.
Figure 44: Site Dashboard

See “General Site Configuration” on page 75 for further detailed site management
and configuration information.

– 55 –

Chapter 2 | Cloud Management
User Management

User Management
The user who originally creates a cloud is the cloud's owner. The owner can theninvite any number of users to have Owner, Administrator, or Regular User access tothe cloud and its sites.
Note the following access rights for users:

Owner — Cloud Owners have full write permissions and access to all sites
and devices within the clouds they administer.

Administrator — Cloud Administrators have nearly full write permissions andaccess to all sites and devices within the clouds they administer. They, however,cannot manage billing and licensing settings by default only the cloud owner
can do this. The cloud owner can grant this permission to an Administrator if
required.

Regular User — Site-level users that are bound to the sites that the ownerspecifies. They can further be classified as Managers (with full write access), or
Guests (with read-only access) within their specified sites.

From the Cloud menu, click “User management.”
Figure 45: Manage Users

The Manage Users page allows you to invite new users, remove users, or edit auser’s access permissions.
Click INVITE USER to open the invitation page. Fill in the user’s email address andselect the role for the user; Owner, Administrator, or a Regular User. For
administrators, two additional permissions can be selected. Click INVITE to send an
email message request to the new user to join the site.

– 56 –

Chapter 2 | Cloud Management

User Management

Figure 46: Invite a New User

The “Additional permissions” field is optional and contains the following items:Manage licenses and billing — Provides full access to Licenses & Billing
pages for the cloud.

Manage VPC settings — Allows access to Virtual Private Cloud (VPC) settings
used for custom clouds. Custom clouds remove the Edgecore branding from acloud and allow all the pages to have a custom name, logo, etc.

– 57 –

Chapter 2 | Cloud Management
Site Grouping

Site Grouping
When you need to manage multiple sites within the same cloud, you can use Site
Grouping to aggregate information from various sites on one page, avoiding theneed to constantly switch between sites.Site Grouping essentially enables you tocreate a logical collection of related sites.
Note that only Cloud Owners and Cloud Administrators have permission to use
Site Grouping.
To create a site group, go to the Site Management page and click “Manage Site
Grouping.”
Figure 47: Accessing Site Grouping

On the Site Grouping page, click “Add Site Grouping.”
Figure 48: Site Grouping Page

Enter a name and description for the site group. Click “Add Site” to add available
sites to the group from a list. Click Save to create the group.

– 58 –

Chapter 2 | Cloud Management
Site Grouping

Figure 49: Creating a Site Group

From the Manage Site Grouping page you can edit or delete groups, and switch
quickly between groups using the “Choose a Group” menu at the top-left of thepage.
Figure 50: Managing Site Groups

Selecting a Site Group refreshes the page and you can see aggregated informationfrom sites in the group.

– 59 –

Chapter 2 | Cloud Management
Always Follow Cloud Configuration

Figure 51: Viewing Site Group Information

To reset Site Grouping to the global view, click "Reset Site Grouping" on the Site
Grouping drop down list.
Figure 52: Resetting Site Grouping

Always Follow Cloud Configuration
In addition to site inheritance and device-level changes, ecCLOUD supports twoway synchronization of cloud and device configuration. When a user modifies a
device configuration locally through its web interface, the changes are pushed backto the ecCLOUD configuration.
To prevent the ecCLOUD configuration from being modified by local devicechanges, ecCLOUD provides an “Always follow cloud configuration” feature that
ignores any local configuration changes received from a device. This feature iscompletely independent of the type of device or its firmware version.
Note: You cannot initiate a firmware upgrade on a device with “Always follow
cloud configuration” enabled. First disable this feature before performing afirmware upgrade.

– 60 –

Chapter 2 | Cloud Management
Always Follow Cloud Configuration

When there is a mismatched configuration between the cloud and the device,
ecCLOUD notifies the cloud administrator with the message “The configuration
between cloud and device is not matched” and the “Configuration status” ismarked as “Configuration is not matched.”
The cloud administrator then has the option to manually push the ecCLOUD
configuration to the device, or to enable “Auto follow cloud config” toautomatically resolve the mismatched configuration.
When registering new devices you can enable “Always follow cloud configuration.”
Note: “Always follow cloud configuration” is automatically disabled when a device
is added by QR code onboarding.
Figure 53: Enabling Always Follow Cloud Configuration During Device Registration

You can also enable or disable “Always follow cloud configuration” for multiple
devices from the Site-level Devices page.

– 61 –

Chapter 2 | Cloud Management
Always Follow Cloud Configuration

Figure 54: Enabling Always Follow Cloud Configuration on the Devices Page

You can check the status of “Always follow cloud configuration” for devices from theSite-level Devices page, as well as enable/disable the feature using the “MANAGE
FOLLOW CLOUD CONFIGURATION” button.
Figure 55: Managing Follow Cloud Configuration

Once “Always follow cloud configuration” is enabled, ecCLOUD will still receive
configuration changes from devices, but it does not update the configuration in thecloud. In this situation, ecCLOUD marks the configuration state as “Configuration
is not matched.”
To synchronize cloud and device configurations, you can click “SYNC NOW” in thedevice-level configuration, or push the configuration from the Site-level Devices
page.
– 62 –

Chapter 2 | Cloud Management
Always Follow Cloud Configuration

Figure 56: Using Force Configuration Push

Alternatively, you can enable “Auto follow cloud config” on the Site Properties page
to push a configuration to devices automatically.
Figure 57: Using Auto Follow Cloud Config

Note: Do not enable MSP Mode and “Always follow cloud configuration” at thesame time. This will cause the device configuration not to be updated to ecCLOUD
properly.

– 63 –

Chapter 2 | Cloud Management
Managing Licenses and BillingManaging Licenses and Billing
From the Cloud menu, click Licenses & Billing to manage your ecCLOUD payment
plan.
Figure 58: Managing Licenses and Billing

From the Licensing and Billing page you can:

Apply voucher codes to add credit to your existing cloud plan renewal and
Add-on invoices.



Upgrade the your cloud plan from a Trial Plan to a Core Cloud plan or a
Virtual Private Cloud plan. Upgrades are enabled through credit card billing
either a single manual payment or with automatic renewal payments. You canalso apply Edgecore vouchers as payment for the upgrade.



View Enabled Add-ons and Invoice History records.

– 64 –

Chapter 2 | Cloud Management
Add-Ons

Add-Ons
This chapter describes add-ons that can be used for the following categories:Enhanced Guest Wi-Fi & External Captive Portal Services



Security and Family Services

ecCLOUD Extensions

Additional Hardware Support

Using Add-ons
From the Add-ons Menu, click on selection icon, click on “Learn More,” and thenclick on the “Activate” button to use the selected service:
Figure 59: Add-ons Menu

– 65 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

Using the AuthPort Add-On
The AuthPort Add-on enables the built-in authentication server of ecCLOUD,
supporting authentication, authorization, and accounting (AAA) functions for
wireless clients. With AuthPort enabled, you can create accounts based on different
service plans, which defines the time and data quota for each account. When thewireless client associates to the network, the client can login with the createdaccount to obtain Internet access.
Note: Currently, AuthPort is only supported on the following models: ECW5211-L,
ECWO5211-L, OAP100, ECW5410-L, SP-W2-AC1200 (L), SS-W2-AC2600,
EAP101, EAP102, EAP104.
You can purchase this add-on by navigating to the “Add-ons” menu item fromeither the Cloud or Site-level menus, and pressing the “BUY ADD-ON” button on
the AuthPort add-on.
Figure 60: AuthPort Add-on

After enabling the AuthPort add-on, the AuthPort configuration menu will appear
on the Cloud menu. You can configure a Service Plan, Accounts, Certificate, andCaptive Portals respectively.

– 66 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

Figure 61: The AuthPort Menu

Service Plans A service plan defines the usage limitations for an account. Before creating an
account, you must define the service plan first.

Figure 62: Adding a Service Plan

The following list shows the configurable items for a service plan.
Name — The name of the service plan.

– 67 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

Valid time period — The account is available only in the defined valid time
period. The time period is defined by the activation and expiration times.

Activation time — The client must log in to the account before the activation
time. If not, the account will expire and cannot be used.



Expiration time — The account will expire and cannot be used after the
expiration time.

Traffic quota — The quota limitation for the account. If the client uses more
traffic than the quota limitation, the account will be “out of quota” and cannot
be used for login.

Note — Any additional information for the plan.

Quota renewal — Configure the time for the account to renew the traffic
quota. The quota can be renewed daily, weekly, or monthly.



Number of devices per account — The number of devices that can use thesame account to login at the same time.

On the Service Plans page, you can see a list of overviews for all existing plans. You
can also add new plans, edit existing plans, or delete plans from this page.
Figure 63: Service Plans Overview– 68 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

Accounts Accounts for wireless clients can be generated based on the service plans. Accounts
can be created one by one or in a batch. When creating a single account, theusername and the password of the account are configured manually. Whencreating accounts in a batch, the usernames and passwords are randomly
generated.

Figure 64: Creating a Single AccountFigure 65: Creating Accounts in a Batch– 69 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

Both methods of creating accounts have a “multiplier” that can be configured toallow the account to include several units of the quota based on the service plan.
For example, if an account is created based on a service plan with a 10 GB quota,
you can set it to be three times the basic quota, making it have a 30 GB quota.
Figure 66: Account List

Once created, the accounts appear in the accounts list. In the accounts list, you
can check the account status, corresponding plan, expiration time, and traffic
quota information. Also, information of recent client device logins with the accountcan be examined here.
Figure 67: Account Details

For each created account, the administrator can also edit its properties, including
the password, corresponding service plan, and the multiplier for the total quota. In
addition, the administrator can export selected accounts to a CSV format file anddistribute the accounts to the wireless clients.

– 70 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

AuthPort Certificate When AuthPort authentication is enabled, clients will see a captive portal page afterconnecting to the SSID. The administrator can upload a security certificate andconfigure the domain name for the captive portal page.

Figure 68: AuthPort Certificate

If a certificate is not configured, wireless clients will be redirected to the captive
portal with an unencrypted HTTP connection. For security concerns, it is strongly
recommended to prepare a valid certificate and upload it so that the captive portal
will be under HTTPS protection. Note that the certificate and private key should bein PEM format. Just copy and paste the content of the certificate file and the private
key file to the corresponding fields.
As for the DNS (domain name service), the administrator can configure a domainname that wireless clients will see for the captive portal page. If the DNS is notconfigured, clients will see the IP address of the AP in the URL of the captive portal
page.
To prevent a security warning in the web browser, make sure the certificate is signed
by a trusted authority. Also, make sure the configured domain name is the same as
the “common name” (CN) field defined in the certificate.

– 71 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

Captive Portal AuthPort provides an editor for captive portal page customization. You can define
multiple captive portal templates and apply a different template to different
AuthPort-enabled SSIDs.

When you create a captive portal and access the editor for the first time, you will be
asked to select a theme for your portal. You can select a theme that is appropriate
for your service and start editing the page content.
Figure 69: AuthPort Captive Portal Themes

After selecting a template, you will enter the captive portal editor. The editor layout
consists of three main parts; a tool bar, an options/attributes panel, and a preview
frame. The tool bar is at the top of the editor. On the right-hand side is where theoptions or attributes can be configured. The preview frame allows you to drag-anddrop page objects and check your portal design in real-time.

– 72 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

Figure 70: AuthPort Captive Portal Editor

SSID Configuration AuthPort supports per-SSID configuration for enabling authentication. For example,
if you have two SSIDs where one is for staff and the other is for customers, you canenable AuthPort authentication only on the customer SSID. When staff members
associate to the staff SSID, they can immediately obtain Internet access. Whencustomers associate to the customer SSID, they are brought to the captive portal
page where login credentials are requested.
Figure 71: AuthPort SSID Configuration– 73 –

Chapter 2 | Cloud Management
Using the AuthPort Add-On

AuthPort authentication not only works with a captive portal, but it also can be
integrated with EAP authentication. When the security method is Open, WPA-PSK,
or WPA2-PSK, and if AuthPort Enable is “on” for the SSID, wireless clients are
redirected to the captive portal page after association. Clients can use the AuthPortcreated account to login and obtain Internet access.
When the security method is WPA-EAP or WPA2-EAP, and if AuthPort Enable is “on”
for the SSID, the cloud will become the RADIUS server for the EAP authentication.
Wireless clients can use the AuthPort-created accounts as the credentials for
wireless connection and complete the transparent login.

– 74 –

3

General Site Configuration

This chapter describes site configuration, including parameters that apply to all site
devices or to the overall site.
“Overview of Sites” on page 76“Creating a Site” on page 77

“Displaying the Site Dashboard” on page 84“Creating a Custom Site Dashboard” on page 85

“Monitoring Wireless APs and Clients” on page 88

“Schedule Maintenance Tasks” on page 92

“Site Notifications” on page 93– 75 –

Chapter 3 | General Site Configuration
Overview of Sites

Overview of Sites
A site is a logical grouping of devices that may or may not share common
configuration settings. It is customary to group devices located at the same site.
For example, if you are installing 50 APs for a hotel chain, each hotel location
would be represented by a different site on the ecCLOUD controller. Each site canhave a geographical location associated with it, a set of floor maps, and evenpreferred language and time zone settings.
Note: The number of devices in a site is limited to under 500.
The number of sites you can add to a cloud is dependent on your cloud plan; for aCore Cloud plan the limit is 500, for a Virtual Private Cloud plan the limit is 5000.
Figure 72: Default Site Dashboard– 76 –

Chapter 3 | General Site Configuration
Creating a Site

Creating a Site
When creating your first cloud, you are also prompted to create your first site andadd devices. See “Creating Your First Cloud” on page 25 for details.
To create additional sites from the Site menu, click on the pull-down list of sites at
the top of the menu. At the bottom of the list, click “Create a New Site.”
Figure 73: Creating a New Site

After opening the “Create a Site” page, fill in the properties for your new site andselect the geographic location using the map.
Note: Items marked with an asterisk are mandatory.

– 77 –

Chapter 3 | General Site Configuration
Creating a Site

Figure 74: Entering Basic Site Properties

General Settings

Site Name – The name of your site. You should choose something short but
meaningful. For example, use “ParkSide Atlanta” for a site that represents the
Atlanta installment of a fictional ParkSide hotel chain.

Description – Add any notes about your site here.

Enable Configuration: This setting has the following options:

ON: Enables you to remotely configure your devices. (default)

OFF: Your devices need to be configured locally. However, you can still
remotely monitor your devices and you will still receive alerts when a device
goes offline.

Upgrade At Registration: Enable this setting if you want your devices to be
automatically upgraded to the latest firmware after registration. It is
recommended that you keep this setting on.

– 78 –

Chapter 3 | General Site Configuration
Creating a Site

Allow auto re-registration: When this setting is enabled, your devices willautomatically re-register when they are reset to defaults. If this setting is
disabled, a user must log in to the cloud and manually chose the action to takewhen a device attempts to re-register.

Locations and Maps
Location – The location set here will determine which map is displayed on yoursite’s dashboard by default, as well as which regulatory country will be used for
wireless configuration purposes.

Site Configuration After configuring all the site information, click CREATE to create the site. You arethen prompted to configure the new site’s general settings, including the regulatory
country and local logins.
Figure 75: Setting the Regulatory Country

The Regulatory Country setting is typically pre-configured from the site’s Locationand Maps setting. The Local Logins also have one account configured by default
using a randomly-generated password. You can modify the password andconfigure additional local accounts as needed.
Note: The Local Logins default account from the ecCLOUD Site-level
configuration will overwrite the default account previously configured on the local
user interface of a device. Once the Site-level configuration has been pushed todevices, you must use Local Login accounts configured in the ecCLOUD Site-level
configuration.
Figure 76: Setting Local Logins

After setting the regulatory country and local logins, click “Save” to save yourconfiguration.
– 79 –

Chapter 3 | General Site Configuration
Creating a Site

Add Devices When you first save the site configuration, you are prompted to add devices(wireless, switches, MeshLinqs, GLinqs) to your new site. Click “ADD DEVICES” tocontinue.
Figure 77: Add Devices Prompt

On the “Register new Devices” page, fill in the serial number, MAC address andname, and then click SAVE. Alternatively, you can use a barcode scanner by
toggling the “Enable barcode scanning mode” to ON. You can then quickly enter
the serial number and MAC addresses of your devices. Once entered, turn off thebarcode scanning mode and enter the names of the devices manually. Click the
SAVE button when you are ready to add your new devices to the site.
You also have the option of a batch upload. First, prepare a list of devices in a CSV(comma-separated values) file. A CSV file is a plain text file in which information isseparated by commas. For each device, the serial number, MAC address and nameshould be entered on one line, as in the following format.
<Serial Number 1>,<MAC 1>,<Device Name 1><Serial Number 2>,<MAC 2>,<Device Name 2>

Click the UPLOAD button to upload your CSV file.
Figure 78: Registering New Devices– 80 –

Chapter 3 | General Site Configuration
Creating a Site

When the controller adds a device the following pop-up window is displayed
warning you that the device will inherit settings from the ecCLOUD site
configuration. Click OK.
Figure 79: Adding Devices Warning Message

When devices have been successfully added, a message appears at the top of the“Register new devices” page. Click on the blue link “Map Manager” in themessage to place your device on a map.
Figure 80: Adding Devices Successful Message

Place Devices on a On the Google Map page, use the mouse to click-drag devices to installation
Google Map locations on the map.

– 81 –

Chapter 3 | General Site Configuration
Creating a Site

Figure 81: Placing a Device on a Map

Set Floor Maps Floor maps provide a graphic view of your site, indicating the location andcoverage area for each AP. Floor maps help you visualize where the APs and clientsare in relationship to the building.

You can upload one or more custom images to create a background for the floor
plan by clicking “Add New Map.”
Figure 82: Adding a Floor Map

Use the “Place devices” feature from the Action icons or pull-down menu to set thelocation of wireless devices on the floor map image.
Figure 83: Configuring a Floor Map

Place devices by dragging an AP from the list on the right side of the page, whichcontains unplaced devices, to its location on the image. Position the cursor over a– 82 –

Chapter 3 | General Site Configuration
Creating a Sitedevice to display information about the device. Click “Show Coverage” to display
the area covered by the placed devices.
Figure 84: Placing Devices on Floor Maps

WiFi Configuration From the Site menu, select “Configuration” and then “WiFi5” or “WiFi6” toconfigure wireless settings that are inherited by all the site’s AP devices and any new
devices that are added to the site.

Note: The WiFi5 or WiFi6 configuration does not apply to devices that have theirinheritance policy set to “Do not inherit site-level configuration.”
Refer to “Site WiFi 5 Configuration” on page 97 for more detailed descriptions ofwireless device configuration.
Figure 85: WiFi5 Configuration– 83 –

Chapter 3 | General Site Configuration
Displaying the Site Dashboard

Displaying the Site Dashboard
The site dashboard provides status information for configured devices, client
activity, most active clients, most active clients and application, gateway interface,site maps, and site activity.
Figure 86: Site Dashboard

The following items are displayed on the site dashboard:System Status — The four circles represent (from left to right): the number ofdevices (with online/offline counts), the number of devices with synced
configurations, and the number of devices registered, and the day’s client
traffic.

Note: Placing the mouse cursor over the four circles shows additional information.

– 84 –

Chapter 3 | General Site Configuration

Creating a Custom Site Dashboard



Activity — Provides a short summary of the most recent device, network andsystem alerts, and maintenance notifications such as the device being
unreachable or rebooted. Clicking on each entry provides further details.



Status Map — Displays the geographical location of this site and the site’s
devices. Placing the mouse cursor over a device displays a pop up with further
device detail.

Enabled Add-Ons Overview — A summary of the currently enabled Addons. Clicking in the box opens the Site Add-ons management view.



Most Active APs by Unique Clients — This area shows the APs with single
clients showing the most network activity i.e. download and upload traffictransferred. Click on one the APs to go to the APs detailed Dashboard view.
Click on the buttons at the bottom to change the measurement window toeither 10 minutes, 1 hour, 1 day, or 1 week.



Most Active Clients by Traffic Transferred — This area shows the clients withthe most network activity i.e. download and upload traffic transferred in the last
10 minutes. Click on one the clients to go to the clients detailed information
view.



Most Active APs by Traffic Transferred — This graph shows the APs with themost network activity i.e. download and upload traffic transferred. Click on the
buttons at the bottom to change the measurement window to either 1 hour, 1day, 1 week or 1 month.

Total Wireless Client Count— This graph shows total clients attached to thecloud within the measurement window. Click on the buttons at the bottom tochange the measurement window to either 1 day, 1 week or 1 month.

Creating a Custom Site Dashboard
In the default site dashboard, click the plus sign next to the default tab at the top to
create a custom dashboard suitable for your requirements.
Figure 87: Adding a Custom Site Dashboard

Enter a name for the new custom dashboard and click SUBMIT.

– 85 –

Chapter 3 | General Site Configuration
Creating a Custom Site Dashboard

Figure 88: Naming a Custom Site Dashboard

A new tab will appear next to the default dashboard tab with the custom
dashboard’s name. Click on one of the “+ Add Widget” buttons to add the desired
item for the new dashboard.
Figure 89: Adding a Widget to a Custom Site Dashboard

Once a widget is selected click the “ADD” button.
Figure 90: Selecting a Widget for a Custom Site Dashboard– 86 –

Chapter 3 | General Site Configuration

Creating a Custom Site Dashboard

For some widgets, custom setup controls are available and these are presented in a
new window. Select the desired settings for the widget and then click the “Save”
button.
Figure 91: Customizing a New Site Dashboard Widget

Once selected and configured, the widget appears on the new custom dashboard.
The widget size can be adjusted by dragging the edges of the widget box.
Additionally, widgets can be renamed or removed by clicking the three dot icon in
the upper right of the box and the widget settings can be adjusted by clicking thegear icon.
Click the “Add Widget” button again to add additional widgets to the custom
dashboard.
Figure 92: Customized Site Dashboard– 87 –

Chapter 3 | General Site Configuration
Monitoring Wireless APs and Clients

Monitoring Wireless APs and Clients
The Wireless Clients page displays a list of wireless clients including their individual
client information, associated AP, and network activity. Network activity is shown as
combined throughput, most active clients, and sessions logs.
Wireless client data on the page can be filtered by band selection (2.4 GHz, 5
GHz, and 60 GHz) and the data traffic can be viewed based on traffic direction(download or upload) or time range (day, week, month, or by date).
Figure 93: Wireless Clients Page

The following items are displayed on the Wireless Clients page:

Filter by frequency range — Shows or hides data on the page for the 2.4
GHz, 5 GHz, or 60 GHz frequency bands.



Download/Upload/Combined — Selects the traffic throughput to display inthe chart; downloaded, uploaded, or both (combined).



Day/Week/Month — Selects the time range for the traffic throughput chart.



Most Active Clients — Shows the most active clients (combined rate) over thelast five minutes. To show more detailed information, click on a specific client in
the pie chart to open the Client Information page.

– 88 –

Chapter 3 | General Site Configuration
Monitoring Wireless APs and Clients

Date Range — Sets the date range to display for wireless client data in thesession logs.



Export — Exports the wireless client information to a CSV excel sheet available
from the Activity menu under maintenance.

Online clients only — Restricts the displayed session logs to wireless clientsthat are currently online.

Session Logs
To sort the session logs, click on the ascending or descending arrows for eachcolumn heading.
Click on any name in the Device column to open the Device information page fordetails on a specific AP. The first section of the Device information page includes
details about the AP, including a location map.
Figure 94: Wireless AP Information

The second section of the Device information page shows throughput andutilization data for radio and Ethernet interfaces on the AP.

– 89 –

Chapter 3 | General Site Configuration
Monitoring Wireless APs and Clients

Figure 95: Wireless AP Live Status

The third section of the Device information page shows details on wireless clientsassociated to the AP.
Figure 96: Wireless AP Active Clients– 90 –

Chapter 3 | General Site Configuration
Monitoring Wireless APs and Clients

From the wireless client session logs or AP’s active client list, click on any of theclients in the Name field to open the Client Information page for details on a
specific client.
The client information page shows detailed information on the client, signal
strength and throughput data, and a list of the client’s connection history.
Figure 97: Client Information Page

To rename a client, on the client’s information page click on the three-dot icon next
to the client name at the top of the page.
Figure 98: Renaming a Wireless Client

To reset a client to its original name, enter a blank in the rename dialog box andclick the Submit button.

– 91 –

Chapter 3 | General Site Configuration
Schedule Maintenance Tasks

Schedule Maintenance Tasks
From the Site menu, click on Devices and then Wireless (or other device type). The“Manage your devices” page will display. Use this page to manage a bulk reboot
or upgrade firmware.
Figure 99: Maintenance Tasks Page

Upgrade Firmware Click the Upgrade Firmware button to access New Firmware Upgrade Task page.
Select the product line, model number, or leave as “All” to upgrade all devices. You
have the option to schedule when upgrades start and which devices will be
upgraded. When configuration is complete, give the task a name and click Create.
Figure 100: New Firmware Upgrade Task Page

– 92 –

Chapter 3 | General Site Configuration
Site Notifications

Bulk Reboot Click the Manage Bulk-Reboot button to access Bulk-Reboot page. This pageenables you to reboot all devices at a site, either at the same time or in a rollingmanner. You can also specify a bulk-reboot to repeat at certain times and dates.

The Rolling Reboots option means that devices are rebooted one after the otherrather than all at the same time. In the case that a reboot times out for a device, allother reboots after will be canceled.
Figure 101: Manage Bulk-Reboot Page

Site Notifications
Click “Notifications” on the Site menu to access the notification settings for theselected site. The settings are used for any email or Slack notifications sent for thissite.
Note: If the Slack Add-on is not enabled for a site, you will not receive any
notifications to your Slack account, even if you have the “Notify Slack” setting
enabled. Select ”Add-ons” from the Cloud or Site menu to install the Slack Add-on.
See “Add-Ons” on page 65 for more information.
You can disable the creation of individual alerts using the toggle switches on the
Notification Settings page. No notifications will be sent for disabled alerts
regardless of the “Send email” and “Notify Slack” settings.

– 93 –

Chapter 3 | General Site Configuration
Site Notifications

Figure 102: Site Notification Settings

The following items are displayed on the Notification Settings page:Language — The language used for the alert emails.

Email Contacts — This is the list of email addresses that will receive alerts
when your devices go offline or require action. Separate multiple email
addresses with spaces.
Note that if you leave the “Email contacts” blank, no email notifications will besent regardless of the Alert “Send email” settings.

Timezone — Sets the time zone that will be used when sending alert-related
emails.

Alerts

Devices Unreachable — This alert is created when one or more of yourdevices cannot be reached.

Processing delay — An alert for unreachable (offline) devices is created whenat least one of your site's devices does not contact the cloud in the given time
period. For site-wide outages, this delay allows the system to create a single
alert email for a group of offline/unreachable devices. (Default: 8 minutes)



Device Configuration Failed — This alert is created when an attempt to
update configuration on one of your devices fails.
– 94 –

Chapter 3 | General Site Configuration
Site Notifications

Device Requires Action — This alert is created when devices have registration
issues that require your attention.



Device Re-registered — This alert is created when devices automatically reregisters with cloud controller.



Device Rebooted — This alert is created when one or more of your devices
reboots.



MetroLinq 60 GHz Link is Down — This alert is created when the 60 GHz
link goes down on a MetroLinq (and the 5 GHz failover link is activated if
enabled).

Time not in sync. — This alert is created when the time on device not in sync
with the cloud.



Channel Changed — This alert is created when a radio on one of yourdevices switches to a different channel (as a result of a DFS event or otherwise).

Streaming Failure — This alert is created when an attempt to start playing an
audio stream on one of your devices fails.



Maintenance Task Failure — This alert is created when a scheduled
maintenance task fails on one of your devices.



File Sync Error — This alert is created when an attempt to sync files (e.g.
custom Hotspot terms and logo) on one of your devices fails.



Firmware Downgraded — This indicates either manual firmware downgrade
or bootbank failure.



Firmware Upgraded — Notifies only about upgrades via device UI. Cloud
upgrades are registered as tasks.

Maintenance Tasks


Change Config — Receive notifications when the Cloud pushes configuration
to one or more of your devices.



Received Config — Receive notifications when a device pushes its config to
the Cloud.



Upgrade Firmware — Receive notifications when the Cloud upgrades
firmware on one or more of your devices.



Auto Firmware Upgrade — Receive notifications when the Cloud performs
automatic firmware upgrades on your devices.



Rolling Firmware Upgrade — Receive notifications when the Cloud performs
rolling firmware upgrades on your devices.
– 95 –

Chapter 3 | General Site Configuration
Site Notifications

Troubleshooting — Receive notifications when Troubleshooting files requestedby the Cloud from your devices become available.



Packet Capture — Receive notifications when packet capture files requestedby the Cloud from your devices become available.



Report — Receive notifications when reports requested by the Cloud from yourdevices become available.



Reboot — Receive notifications when the Cloud reboots one or more of yourdevices.

– 96 –

4

Site WiFi 5 Configuration

This chapter describes configuration settings for WiFi 5 access point devices. It
includes the following sections:“Wireless SSID Configuration” on page 98

“Radio Settings” on page 107

“General Networking Settings” on page 110

“Local Network Settings” on page 117“Firewall Settings” on page 119“Hotspot Settings” on page 122“System Settings” on page 129– 97 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configuration

Wireless SSID Configuration
From the Site menu, open “Configuration” and then “WiFi5” to display theconfiguration options that apply to all Edgecore Wi-Fi 5 access points in the samesite.
The Edgecore Wi-Fi 5 access points can operate in several radio modes, 802.11a/
a+n/ac+a+n (5 GHz) or 802.11b+g/b+g+n (2.4 GHz). Supported modes
depend on the access point model. Note that the dual-band access points canoperate at 2.4 GHz and 5 GHz at the same time.
Each radio supports eight Service Set Identification (SSID) or virtual access point(VAP) interfaces. Each VAP functions as a separate access point, and can be
configured with its own SSID and security settings. However, most radio signal
parameters apply to all VAP interfaces. Traffic to specific VAPs can be segregatedbased on user groups or application traffic. Wireless clients associate with each
VAP in the same way as they would with separate physical access points. Edgecore
AP devices support up to a total of 128 wireless clients across all SSID interfaces
per radio.
Figure 103: Site WiFi5 Configuration

The Wireless SSID tab on the WiFi5 configuration page includes these items:Global Settings — Configuration that applies to all SSID interfaces.
Auto Disable Broadcast — Automatically disables SSID broadcasts whena Wi-Fi device cannot connect to the cloud. (Default: Disabled)

SSID List — The list of configured SSID interfaces for the Wi-Fi devices in thissite. Note that each SSID applies to both the 2.4 GHz and 5 GHz radios unless– 98 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configuration

otherwise configured. You can configure a maximum of eight SSIDs. Click the“Add SSID” button to create an SSID interface.
Wireless Scheduling — A list of configured schedules for turning AP radios on
and off at specified times. The scheduling rules apply to all 2.4 GHz and
5 GHz interfaces on all site APs. Click the “Add Schedule” button to create awireless schedule.

Adding an SSID Click the Add SSID button on the WiFi Access configuration page and enter SSID,
network, and security settings as displayed below.
Figure 104: Radio Settings (New SSID)

The following items are displayed on the Add SSID page:
General SettingsEnable SSID — Enables or disables the SSID interface.
– 99 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configuration



SSID — The name of the basic service set provided by the VAP interface.
Clients that want to connect to the network through the access point must set
their SSID to the same as that of the access point’s VAP interface. (Range: 1-32
characters)

Broadcast SSID — The SSID can be broadcast at regular intervals so thatwireless stations searching for a network connection can discover it. This allows
wireless clients to dynamically discover and roam between WLANs. This feature
also makes it easier for hackers to break into your home network. Because
SSIDs are not encrypted, it is easy to scan WLANs looking for SSID broadcast
messages coming from an AP. (Default: On)

Client Isolation — When enabled, wireless clients can talk to the LAN, andreach the Internet if such connection is available, but they cannot communicate
with one another. (Default Off)

Block Multicast Forwarding — Stops multicast traffic from being forwarded towireless clients connected to the SSID. (Default Off)Minimum allowed Signal — Only allows clients to associate to this SSID if
their signal strength (RSSI) is equal or greater than the specified value. Setting
the value to -100 disables this feature. Clients already connected are checked
periodically.
This forces clients to associate with an AP that has a better signal strength (alsocalled assisted roaming). Suggested value is -70 to -80 depending on accesspoint density and coverage.
Enter an RSSI (Received Signal Strength Indicator) in decibels from -1 to-100db. Note that the closer it is to zero, the stronger the signal. (Default: -70)

Max Client Count — Sets the maximum number of wireless clients that can beconnected to this SSID at the same time. (Default: 127; Range: 0 to 127)

Multicast/Broadcast Rate — Allows a limit to be placed on the wirelessbandwidth consumed by multicast and broadcast packets.

Radio 5 Ghz — Options: 6M, 9M, 12M, 18M, 24M, 36M, 48M, 54M;
Default: 6M

Radio 2.4 Ghz — Options: 5.5M, 6M, 9M, 11M, 12M, 18M, 24M, 36M,
48M, 54M; Default: 5.5M

Activate on radio — Selects the radios on which this SSID should be created.
If an SSID is activated on both radios for a device (meaning that the SSID will
be mirrored), you can edit its record from either configuration tab, and thechanges will be made on both the 2.4 GHz and 5 GHz SSID records. (Default:
5GHz and 2.4GHz enabled)

Network Settings– 100 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configuration



Network Behavior — One of the following connection methods must be
specified. (Default: Route to Internet)
Bridge to Internet (AP Bridge Mode) — Configures an interface asattached to the WAN (that is, the Internet).
In the following figure, Ethernet port 0 and Ethernet port 1 are both
attached to the WAN. Traffic from these interfaces is directly bridged into
the Internet. Any of the Ethernet or radio interfaces can be configured thisway.

Figure 105: Bridge to InternetRoute to Internet (AP Router Mode) — Configures an interface as amember of the LAN.
In the following figure, Ethernet port 1, Wireless LAN 0 (5 GHz radio), andWireless LAN 1 (2.4 GHz radio) are all included in the LAN. Traffic fromthese interfaces is routed across the access point through Ethernet port 0 to
the Internet.

Figure 106: Route to InternetRoute through — The network to be routed. The default is “Default
local network” as displayed under LAN Settings – Local Network.

– 101 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configuration



Add to Guest Network — This interface can only support the guest
network.



Hotspot Controlled — This interface can only support hotspot services.
Walled garden — Enter a list of domains and/or IP addresses in CIDR
notation that the hotspot user can access before being authenticated by
the captive portal. Wildcard domains can be specified in the format of
domain.com (allow domain and all of its subdomains), or .domain.com(only allow subdomains).

VLAN Tag Traffic — Tags any packets passing from this SSID interface tothe associated Ethernet port as configured under “VLAN Settings” onpage 114. When enabled, select a configured VLAN ID from the list.

Note: ecCLOUD supports VLAN synchronization between APs and switches. When
VLAN tagging is enabled for an SSID, the configured VLAN ID is automatically"pushed" by ecCLOUD to the attached switch port. This enables the VLAN-tagged
traffic from the AP to be accepted by the switch port and avoids any loss ofconnectivity.


Limit upload rate — Enables rate limiting of traffic from the SSID interface as
it is passed to the wired network. You can set a maximum rate in Kbytes per
second. (Range: 256-10048576 Kbytes per second; Default: OFF)

Limit download rate — Enables rate limiting of traffic from the wired network
as it is passed to the SSID interface. You can set a maximum rate in Kbytes per
second. (Range: 256-10048576 Kbytes per second; Default: OFF)

Security Settings


OSEN — Enable this option for OSU Server-Only Authenticated L2 Encryption
Network.



Method — Sets the wireless security method for each SSID, including
association mode, encryption, and authentication. (Default: Open)Open — The SSID interface broadcasts a beacon signal including theconfigured SSID. Wireless clients with an SSID setting of “any” can read the
SSID from the beacon and automatically set their SSID to allow immediateconnection.



WPA-PSK — For enterprise deployment, WPA requires a RADIUS
authentication server to be configured on the wired network. However, forsmall office networks that may not have the resources to configure andmaintain a RADIUS server, WPA provides a simple operating mode thatuses just a pre-shared password for network access. The Pre-Shared Key
mode uses a common password for user authentication that is manually– 102 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configurationentered on the access point and all wireless clients. The PSK mode uses thesame TKIP packet encryption and key management as WPA in theenterprise, providing a robust and manageable alternative for small
networks.


Encryption — Data encryption uses one of the following methods:

AES — AES-CCMP is used as the multicast encryption cipher. AESCCMP is the standard encryption cipher required for WPA2. (This is
the default setting.)



TKIP + AES — The encryption method used by the client is
discovered by the access point.

Key — WPA is used to encrypt data transmitted between wireless clientsand the SSID interface. WPA uses static shared keys (fixed-length
hexadecimal or alphanumeric strings) that are manually distributed to
all clients that want to use the network.
String length must be 8 to 63 ASCII characters (letters and numbers).
No special characters are allowed.



WPA2-PSK — Clients using WPA2 with a Pre-shared Key are accepted forauthentication.
WPA was introduced as an interim solution for the vulnerability of WEP
pending the ratification of the IEEE 802.11i wireless security standard. In
effect, the WPA security features are a subset of the 802.11i standard.
WPA2 includes the now ratified 802.11i standard, but also offers backward
compatibility with WPA. Therefore, WPA2 includes the same 802.1X andPSK modes of operation and support for TKIP encryption.
Refer to WPA-PSK for a description of encryption methods and the key.

WPA-EAP — WPA employs a combination of several technologies toprovide an enhanced security solution for 802.11 wireless networks. A
RADIUS server is used for authentication, and can also be used foraccounting.
Refer to WPA-PSK for a description of encryption methods.
RADIUS Settings
A RADIUS server must be specified for the access point to implement IEEE
802.1X network access control and Wi-Fi Protected Access (WPA) wirelesssecurity.
In addition, you can configure a RADIUS Accounting server to receive usersession accounting information from the access point. RADIUS Accounting
can be used to provide valuable information on user activity in the network.

Note: This guide assumes that you have already configured RADIUS servers) to
support the access point. Configuration of RADIUS server software is beyond the– 103 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configuration

scope of this guide, refer to the documentation provided with the RADIUS server
software.



802.11r — Enables 802.11r fast roaming on the SSID interface. Thisfeature is only supported on AC Wave 2 devices (Sunspot Wave2,
Spark Wave2) running 2.2.0+ firmware. (Default: Disabled)Mobility Domain — The ID number that identifies the 802.11r
domain in which the AP operates. (Range: 1-65535)



Encryption Key — The pre-shared key for fast roaming. This key must
be exactly 16 characters long and only contain characters A-Z, a-z, 09, space, and ~!@$%^*()_+-=[]{}|:;<>?,./

Transition over the DS — Enables support for fast transitions over awireless distribution system (WDS) network.



MAC NASID list — Enter one MAC address and NAS ID per line.
Example: 00:12:34:56:78:9a a00123456789

Radius MAC Auth — Use RADIUS authentication. When this setting isenabled, the AP will send the MAC address of the client device to thespecified RADIUS server for authentication. The server verifies the MAC
is a valid user, and then replies to the AP with the dynamic VLAN ID (ifconfigured) and other resources for the client device.
Note: On your RADIUS server, both the user ID and password will need
to be set to the WiFi MAC of the client device and must be formatted
without punctuation.
This feature is supported with “Open Security” in v1.1.1 firmware, andall other security methods (besides WEP) in v1.1.2 firmware.



Use RADIUS Auth — For WPA-EAP and WPA2-EAP security, a RADIUS
server must be specified.



RADIUS Auth Server — Specifies the IP address or host name of the
RADIUS authentication server.



RADIUS Auth Port — The UDP port number used by the RADIUS
server for authentication messages. (Range: 1024-65535;
Default: 1812)

RADIUS Auth Secret — A shared text string used to encrypt messages
between the access point and the RADIUS server. Be sure that the same

– 104 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configurationtext string is specified on the RADIUS authentication server. Do not use
blank spaces in the string. (Maximum length: 255 characters)NAS ID — The RADIUS NAS identifier for the SSID interface. A NAS ID
can be used instead of an IP address to identify a client to a server.

Backup RADIUS Auth — Configures a secondary RADIUS server toact as a backup should the primary server become unavailable.



Use RADIUS Accounting — Use RADIUS accounting to enableaccounting of requested services for billing or security purposes.



RADIUS Acct Server — Specifies the IP address or host name of the
RADIUS accounting server.

Radius Acct Port — The UDP port number used by the RADIUS server
for accounting messages. (Range: 1024-65535; Default: 1813)

RADIUS Acct Secret — A shared text string used to encrypt messages
between the access point and the RADIUS server. Be sure that the sametext string is specified on the RADIUS accounting server. Do not use
blank spaces in the string. (Maximum length: 255 characters)

WPA2-EAP — WPA was introduced as an interim solution for thevulnerability of WEP pending the ratification of the IEEE 802.11i wirelesssecurity standard. In effect, the WPA security features are a subset of the802.11i standard. WPA2 includes the now ratified 802.11i standard, butalso offers backward compatibility with WPA. Therefore, WPA2 includes thesame 802.1X and PSK modes of operation and support for TKIP
encryption.
A RADIUS server is used for authentication, and can also be used toaccounting.
Refer to WPA-PSK for a description of encryption methods.
Refer to WPA-EAP for information on configuring the RADIUS server.



Access Control List — Wireless clients can be authenticated for network
access by checking their MAC address against the local database configuredon the access point. (Default: OFF)

Dynamic Authorization — The Dynamic Authorization Extensions (DAE) to
RADIUS enable a server to disconnect or change the authorization of clientsthat are already connected to the network.


DAE Port — The UDP port number to use for DAE messages.
(Default: 3799)



DAE Client — The IPv4 address of the RADIUS server.

– 105 –

Chapter 4 | Site WiFi 5 Configuration
Wireless SSID Configuration

DAE Secret — The shared text string used to encrypt DAE messages
between the access point and the RADIUS server.

Setting Wireless Configuring wireless schedules enables the AP radios to be turned on and off at
Schedules specified times. The scheduling rules apply to all 2.4 GHz and 5 GHz interfaces on
all site APs. Click the “Add Schedule” button to create a wireless schedule.
Figure 107: Adding a Wireless Schedule

The following items are displayed on the Add schedule page:Enabled — Makes the defined schedule active. (Default: Enabled)Name — A text string to identify the schedule.

Start time — The time that you want the radios to be turned on.

End Time — The time that you want the radios to be turned off.

Days — The selected days of the week on which to apply the schedule.

– 106 –

Chapter 4 | Site WiFi 5 Configuration

Radio Settings

Radio Settings
On the “WiFi Access” page, click the “Radio Settings” tab to configure 5 GHz and
2.4 GHz radio settings. Note that settings apply to all configured SSID interfaces.
Figure 108: WiFi 5 Radio Settings

The following items are displayed on the Radio Settings tab. Note that
configuration options apply to both the 5 GHz and 2.4 GHz radios unlessotherwise indicated.

Global SettingsBand Steering — When enabled, clients that support 2.4 GHz and 5 GHz are
first connected to the 5 GHz radio. This feature helps balance the client load
over the two radio bands. Note that both radios must have configured SSIDs
that match for this feature to fully operate. (Default: Disabled)External Radius Enabled — This is an AuthPort add-on feature (see “Using
the AuthPort Add-On” on page 66). When using the AuthPort add-on, you canconfigure settings for an external RADIUS server.

– 107 –

Chapter 4 | Site WiFi 5 Configuration

Radio Settings

Physical Radio Settings

Channel Bandwidth — The basic Wi-Fi channel bandwidth is 20 MHz, but bybonding channels together to create 40 MHz or 80 MHz channels, higher datatransmission rate can be achieved. However, selecting larger channel
bandwidths reduces the number a radio channels available.


5 GHz Radio — Options include 20, 40, and 80 MHz. (Default: 80 MHz)



2.4 GHz Radio — Options include 20 and 40 MHz. (Default: 40 MHz)

Channel — The radio channel that the access point uses to communicate withwireless clients. The available channels are dependent on the radio, Channel
Bandwidth, and Regulatory Country settings. You can also click the “Edit
Channel List” button to select specific available channels to use for each radio
interface.
Selecting Auto enables the access point to automatically select an unoccupied
radio channel. (Default: Auto)

Figure 109: 5 GHz Radio Channels– 108 –

Chapter 4 | Site WiFi 5 Configuration

Radio Settings

Figure 110: 2.4 GHz Radio Channels

Disabled W52 Channel — Applies only to the 5 GHz radio. This feature isdesigned for Spark AC Wave2 Mini APs with software version v2.3.1 or newer.
When enabled, this feature disables channels 36-48 automatically.



Max Tx Power — Adjusts the maximum power of the radio signals transmitted
from the access point. The higher the transmission power, the farther thetransmission range. Power selection is not just a trade-off between coveragearea and maximum supported clients. You also have to ensure that high-powersignals do not interfere with the operation of other radio devices in the service
area. (The range of power settings and defaults are dependent on the APmodel and the Regulatory Country setting.)

Beacon Interval — The rate at which beacon signals are transmitted from theaccess point. The beacon signals allow wireless clients to maintain contact withthe access point. They also carry power-management and other information.
(Range: 100-1024 TUs; Default: 100 TUs)



20/40MHz Coexist — Applies only to the 2.4 GHz radio. This option allows
802.11n 20 MHz and 40 MHz channel bandwidths to operate together in thesame network. (Default: On)

Advanced Radio Settings
Max Client Count — Sets the max number of clients that are allowed toconnect to this radio. To disable this feature, set the value to 0. (Range: 0-64;
Default: 0)Probe Req. Data Push — Enable Client Probe Request Data Push for thisradio. When enabled, the radio will push client probe request data in JSON
format to your specified URL.

– 109 –

Chapter 4 | Site WiFi 5 Configuration
General Networking Settings

General Networking Settings
On the “WiFi Access” page, click the “General Networking” tab to configure
Internet, Ethernet ports, and VLAN settings for all devices in a site. Some items on
this page only display the current setting, they cannot be configured. These settings
can only be overridden at the device-level configuration.
Figure 111: General Networking Settings– 110 –

Chapter 4 | Site WiFi 5 Configuration

General Networking Settings

Internet Settings Note that only the Internet IP Address Mode and Management VLAN settings canbe changed on this page. These rest of these settings can only be overridden on a
per-device basis at device-level configuration.

Figure 112: Internet Settings

The following items are displayed on this page section:

General SettingsInternet Source — The interface on devices used to access the Internet.



VLAN tag traffic — Enable to activate tagging on this interface and choose atagging ID value between 2 and 4094, inclusive.



IP Address Mode — The method used to provide an IP address for the Internet
access port. (Options: DHCP, Use Device’s Settings; Default: DHCP)

DHCP — Enables DHCP on the Internet Source interface.

Use Device’s Settings — Select this option if you plan on assigning static
IPs to your devices prior to registration. Also choose this option if you aremixing static IP and DHCP-based modes. By default, all devices will use
DHCP unless configured otherwise.



MTU Size — Sets the size of the maximum transmission unit (MTU) for packets
sent on this network.



Fallback IP — This IP address is used if you cannot connect to the device IP
address.



Fallback Netmask — The network mask associated with the fallback IP
address.

– 111 –

Chapter 4 | Site WiFi 5 Configuration
General Networking Settings

MGMT VLAN Settings
Figure 113: Management VLAN SettingsMgmt VLAN — Select this option to enable a management VLAN on site
devices. Once you enable this option, you will no longer be able to accessdevices on any of the built-in the local networks (like 192.168.2.1 forexample). You will only be able to access devices from the specified VLAN
network. If a device’s IP mode is set to DHCP, it will also request a new IP
address in the subnet range assigned to the VLAN network.

Mgmt VLAN ID— Specifies the ID of the management VLAN.

IP Address Mode — The method used to provide an IP address for a device
over the Management VLAN. (Options: DHCP, Static IP; Default: DHCP)

DHCP — Enables DHCP on the management VLAN.



Static IP — Sets a static IP to access site devices over the management
VLAN. Configure an IP address, subnet mask, and default gateway address.



Fallback IP — The IP address to use to connect to a device over the
management VLAN if the DHCP-assigned address cannot be reached.

Fallback Netmask — The network mask associated with the fallback IP
address.

IPV6 Settings
Figure 114: IPv6 Settings

The following items are displayed on this section of the page:– 112 –

Chapter 4 | Site WiFi 5 Configuration

General Networking Settings



IP Address Mode — The method used to provide an IPv6 address for theInternet access port. (Default: DHCP; Options: DHCP, Static IP)

DHCP — If you configure DHCP, the Client Id must be specified.


Client Id — Manually enter the client ID for the DHCP client.

Static IP — To configure a static IPv6 address for the Internet access port,
the following items must be specified.


IP Address — Specifies an IPv6 address for the access point. An IPv6
address must be configured according to RFC 2373 using 8 colon
separated 16-bit hexadecimal values. One double colon may be usedin the address to indicate the appropriate number of zeros required tofill the undefined fields.

Default Gateway — The IPv6 address of the default gateway, which isused if the requested destination address is not on the local subnet.



DNS — The IPv6 address of Domain Name Servers on the network. A
DNS maps numerical IPv6 addresses to domain names and can beused to identify network hosts by familiar names instead of the IPv6
addresses. If you have a DNS server located on the local network, typethe IPv6 address in the text field provided.

Ethernet Settings This page section shows basic Ethernet settings for site APs. These settings can only
be overridden on a per-device basis at device-level configuration.

Figure 115: Ethernet Settings

The following items are displayed on this page section:

Ethernet Settings for WAN Port
By default, the WAN port interface is set as the Internet source and the following
message is displayed: “This port is the Internet source for devices in this site.”
If more than one interface is connected to the Internet, only the last configured
interface is used.


Auto-negotiation — Enables or disables auto-negotiation for the WAN portinterface.
– 113 –

Chapter 4 | Site WiFi 5 Configuration
General Networking Settings

Ethernet Settings for LAN Port(s)Network Behavior — Shows the network connection method (that is, themanner in which the LAN ports are used).



Auto-negotiation — Enables or disables auto-negotiation for a given portinterface.
1000BASE-T does not support forced mode. Auto-negotiation should always
be used to establish a connection over any 1000BASE-T port.
When auto-negotiation is enabled, the access point will negotiate the best
settings for a link based on advertised capabilities.

VLAN Settings The access point can employ VLAN tagging to control access to network resources
and increase security. VLANs separate traffic passing between the access point,
associated clients, and the wired network. You can create up to 12 VLAN tagged
networks.

VLANs (virtual local area networks) are turned off by default. If turned on they willautomatically tag any packets passed to Ethernet ports from the relevant VAP(virtual access point). Note also that specific VAPs can enable or disable VLAN
tagging (see “Adding an SSID” on page 99).
Note the following points about the access point’s VLAN support:

If an Ethernet LAN port on the access point is assigned a VLAN ID, any traffic
entering that port must be also tagged with the same VLAN ID.

Wireless clients associated to the access point can be assigned to a VLAN.
Wireless clients are assigned to the VLAN for the VAP interface with which they
are associated. The access point only allows traffic tagged with correct VLAN
IDs to be forwarded to associated clients on each VAP interface.

When VLAN support is enabled on the access point, traffic passed to the wired
network is tagged with the appropriate VLAN ID. When an Ethernet port on theaccess point is configured as a VLAN member, traffic received from the wired
network must also be tagged with the same VLAN ID. Received traffic that has
an unknown VLAN ID or no VLAN tag is dropped.

When VLAN support is disabled, the access point does not tag traffic passed to
the wired network and ignores the VLAN tags on any received frames.

Note: Before enabling VLAN tagging on the access point, be sure to configure theattached network switch port to support tagged VLAN frames for the VLAN IDs
configured on the access point. Otherwise, connectivity to the access point will belost when you enable the VLAN feature.

– 114 –

Chapter 4 | Site WiFi 5 Configuration

General Networking Settings

Figure 116: VLAN Settings

The following items are displayed on this page section:


VLAN ID — The identifier assigned to the VLAN. (Range: 2-4094)



Tagged Ports — The Ethernet ports assigned to the VLAN. Options include
WAN port or LAN port(s).

PPPoE Profile — Indicates if PPPoE is enabled or disabled for the VLAN.



Uplink 802.1P — Indicates the IEEE 802.1p priority setting for traffic on this
VLAN.



Untagged Interfaces — Click the “Configure SSIDs” link to open the Wireless
SSID tab. Then edit or create an SSID interface to be a member of the specified
VLAN (see “Adding an SSID” on page 99).

Actions — Click and select to edit or delete a configured VLAN.

Adding a VLAN
Click the “Add New VLAN” button to create a VLAN.
Figure 117: Adding a VLAN

The following items are displayed on this page section:


VLAN ID — The VLAN identifier to be assigned. (Range: 2-4094)– 115 –

Chapter 4 | Site WiFi 5 Configuration
General Networking Settings

Ports — The Ethernet ports assigned to the VLAN. Options include WAN port
or LAN port(s).

PPPoE Profile — The Point-to-Point Protocol over Ethernet (PPPoE) is acommon WAN protocol that provides a secure “tunnel” connection between aservice provider and the local network.



User Name — The name to use for the service provider connection.

Password — The password to use for the service provider connection.



IP Address — The IP address to use for the service provider connection.

Uplink 802.1P — Sets the IEEE 802.1p priority for traffic on this VLAN.
Priorities range from “Best Effort” (lowest) to “Network Control” (highest).

– 116 –

Chapter 4 | Site WiFi 5 Configuration
Local Network Settings

Local Network Settings
The Local Network tab configures settings for the default LAN network, guest
network, and other custom networks.
Figure 118: Local Network Settings

The following items are displayed on this page:

Add Custom LAN — Click this button to create a additional networks with
their own custom settings. You can create up to 10 custom LANs.



IP Address — Specifies the IP address for the local network or guest network.
Valid IP addresses consist of four decimal numbers, 0 to 255, separated byperiods. (Default: 192.168.2.1)

Subnet Mask — Indicates the local subnet mask. (Default: 255.255.255.0)



MTU Size — Sets the size of the maximum transmission unit (MTU) for packets
sent on this network. (Default: 1500)



Enable STP — Enables or disables processing of Spanning Tree Protocol
messages. (Default: Disabled)– 117 –

Chapter 4 | Site WiFi 5 Configuration
Local Network SettingsEnable UPnP — Enables or disables Universal Plug-and-Play broadcast
messages. (Default: Disabled)Enable RSTP — Enables or disables processing of Rapid Spanning Tree
Protocol messages. (Default: Disabled)Smart Isolation — Enables network traffic to be restricted to the specified
network:

Disable (full access) — There is no traffic isolation. Clients can access theInternet and other devices on the local LAN. This is the option to choose if
you trust the clients that will be connecting to your network.

Internet access only — Traffic from this network can only be routed to andfrom the Internet. This is the option to choose for hotspot users or users
connecting to a guest network.

LAN access only — Traffic from this network is restricted to local LAN
devices only.

Internet-only (strict) — This is the same as "Internet access only," but withthe additional restriction that users cannot access resources or devices onany private network (192.168.0.0, 172.16.0.0, 10.0.0.0, etc.). This isuseful if an AP is “double NAT’ed” and the network upstream from yourAP’s gateway is another private network.

Interface Members — The interfaces attached to the local area network.



DHCP Server — Enables/disables DHCP on this network. (Default: Enabled)

DHCP Start — First address in the address pool. (Range: 1-256;
Default: x.x.x.100)



DHCP Limit — Maximum number of addresses in the address pool.
(Range: 1-254; Default: 150)



Lease Time — The time period for which assigned IP addresses are valid.



DNS Servers — List up to three DNS server IP addresses, one per line.

DNS Entries — Only applicable for Spark AC Wave2 Mini APs.Allows clientsto access the web interface through the specified domain from a local network.

– 118 –

Chapter 4 | Site WiFi 5 Configuration
Firewall Settings

Firewall Settings
Firewall filtering restricts connection parameters to limit the risk of intrusion. The
firewall settings allow you to define a sequential list of rules that filter traffic basedon source and destination IP addresses and ports. Ingress packets are tested
against the filter rules one by one. As soon as a packet matches a rule, theconfigured action is implemented.
One rule, “Allow-Ping,” is pre-configured to allow Ping packets from the Internet.
You can enable or disable this rule, but it cannot be modified or deleted. Click the“Add Rule” button to add a new firewall rule.
Figure 119: Firewall Settings

The following items are displayed on this page:Enabled — Enables the configured firewall rule.

Name — User defined name for the filtering rule. (Range: 1-30 characters)

Source IP — An IPv4 address in CIDR notation. Includes an IP address
followed by a slash (/) and a decimal number to define the network mask.



Source Port — The source protocol port. (Range: 1-65535)



Destination IP — The destination IPv4 address.

Destination Port — The destination protocol port. (Range: 1-65535)



Target — The action to take when the configured rule matches a packet.
(Options: Accept, Reject, Drop, Mark, NoTrack)

Family — Specifies IPv4 or IPv6 traffic, or both. (Options: IPv4, IPv6, Any)

– 119 –

Chapter 4 | Site WiFi 5 Configuration
Firewall Settings

Source — The source interface. (Options: Any, Default Local Network,
Internet, Guest Network, Hotspot Network)Protocol — Defines the protocol type of packets. (Options: Any, TCP+UDP,
TCP, UDP, ICMP)Destination — The destination interface. (Options: Any, Default Local
Network, Internet, Guest Network, Hotspot Network)

Port Forwarding Port Forwarding can be used to map an inbound protocol type (TCP/UDP) and port
to an “internal” IP address and port. The internal (local) IP addresses are the IP
addresses assigned to local devices at the edge of a network, and the external IP
address is the IP address assigned to the AP interface. This allows remote users toaccess different servers on your local network using your single public IP address.

Remote users accessing services such as web or FTP at your local site through yourpublic IP address, are redirected (mapped) to other local server IP addresses and
TCP/UDP port numbers. For example, if you set Protocol/External Port to TCP/80(HTTP or web) and the Destination IP/Destination Port to 192.168.3.9/80, then all
HTTP requests from outside users are forwarded to 192.168.3.9 on port 80.
Therefore, by just using your external IP address provided by your ISP, Internet users
can access the services they need at the local addresses to which you redirect them.
The more common TCP service port numbers include: HTTP: 80, FTP: 21, Telnet:
23, and POP3: 110.
Figure 120: Port Forwarding

The following items are displayed on this page:Enabled — Enables port forwarding.

Name — User-defined name. (Range: 1-30 characters)Protocol — Set the protocol type to which port forwarding is applied. (Options:
TCP, UDP, TCP+UDP)

External Port — The Internet traffic TCP/UDP port number. (Range: 1-65535)



Destination IP — The destination IP address on the local network.

Destination Port — The destination protocol port. (Range: 1-65535)– 120 –

Chapter 4 | Site WiFi 5 Configuration
Firewall Settings

ARP Inspection ARP Inspection is a security feature that validates the MAC Address bindings for

Address Resolution Protocol packets. It provides protection against ARP traffic withinvalid MAC-to-IP address bindings, which forms the basis for certain “man-in-themiddle” attacks. This is accomplished by intercepting all ARP requests andresponses and verifying each of these packets before the local ARP cache is
updated or the packet is forwarded to the appropriate destination. Invalid ARP
packets are dropped.

Figure 121: ARP Inspection

The following items are displayed on this page:

ARP Inspection — When enabled, ARP packets are validated against ARP
spoofing.

Force DHCP — Allows an AP to only learn MAC/IP pair information through
DHCP packets. Since devices configured with static IP address do not send
DHCP traffic, any clients with static IP addresses will be blocked by APs unlesstheir MAC/IP pair is listed and enabled in the Static Trust List.



Trust List Broadcast — Lets other APs learn the trusted MAC/IP pairs to issue
ARP requests.



Static Trust List — Adds the MAC or MAC/IP pairs of devices that are trusted
to issue ARP requests. Other network nodes can still send their ARP requests,
but if their IP appears in the static list with a different MAC, their ARP requests
will be dropped.

– 121 –

Chapter 4 | Site WiFi 5 Configuration
Hotspot Settings

DHCP Snooping DHCP snooping is used to validate and filter DHCP messages received by APs.

When DHCP snooping is enabled, DHCP messages received from a device notlisted in the DHCP snooping table are dropped.

You can add known and trusted DHCP servers to the table by specifying their MAC
and IP addresses.
Figure 122: DHCP Snooping

The following items are displayed on this page:Enable — Enables DHCP Snooping.

Trust DHCP Server MAC — The MAC address of a known and trusted DHCP
server.



Trust DHCP Server IP — The IP address of a known and trusted DHCP server.



Remark — A comment relating to the DHCP server configured.

Hotspot Settings
The Hotspot settings page can configure Internet access for the general public inplaces such as coffee shops, libraries, and hospitals. Specific access rights may
also be defined through a RADIUS server.
When setting up a hotspot service, you must also navigate to the wireless SSID
configuration page and select “Hotspot-Controlled” as the network behavior on an
SSID interface. (See “Wireless SSID Configuration” on page 98.)

General Settings The General Settings section on the Hotspot page configures the basic hotspot
mode.

– 122 –

Chapter 4 | Site WiFi 5 Configuration
Hotspot Settings

Figure 123: Hotspot General Settings

The following items are displayed on this page section:


Hotspot Enabled — Enables or disables the hotspot service.
Select the hotspot mode below. (Hotspot Mode will be statically set to “External
Portal” for all firmware greater than 1.1.4. Please upgrade to firmware greaterthan 1.1.4 in order to take advantage of this setting.)External Captive Portal Service — This option will show the hotspot guest
an externally hosted captive portal splash page and may prompt them tologin, depending on how you have configured your service settings.
Choose this option if you have signed up with a third-party captive portal
service provider, such as Cloud4Wi or HotSpotSystem.

No Authentication — This option shows the hotspot guest yourcustomized, locally hosted captive portal splash page, and will not require
the guest to login before accessing the Internet. If you fill out the (optional)
terms of service text, the guest will be required to accept these before they
can access the Internet.

Simple Password-only Splash Page — This option will show the hotspot
guest your customized, locally hosted captive portal splash page, and will
require them to enter a simple password to login and access the Internet. If
you fill out the (optional) terms of service text, the guest will be required toaccept these before they can access the Internet.



Local Splash Page with External RADIUS — This option shows the
hotspot guest your customized, locally hosted captive portal splash page,
and will require them to enter a valid RADIUS user name and password tologin and access the Internet. If you fill out the (optional) terms of service
text, the guest will be required to accept these before they can access theInternet.



Remote Splash Page with External RADIUS — This is an AuthPort addon feature (see “Using the AuthPort Add-On” on page 66). The hotspot will
be redirected to an external splash page and authenticate with an external
RADIUS server.

– 123 –

Chapter 4 | Site WiFi 5 Configuration
Hotspot Settings

Smart Isolation — Enables network traffic to be restricted to the specified
network:

Disable (full access) — There is no traffic isolation. Clients can access theInternet and other devices on the local LAN. This is the option to choose if
you trust the clients that will be connecting to your network.

Internet access only — Traffic from this network can only be routed to andfrom the Internet. This is the option to choose for hotspot users or users
connecting to a guest network.

LAN access only — Traffic from this network is restricted to local LAN
devices only.

Internet-only (strict) — This is the same as “Internet access only,” but withthe additional restriction that users cannot access resources or devices onany private network (192.168.0.0, 172.16.0.0, 10.0.0.0, etc.). This isuseful if an AP is “double NAT’ed” and the network upstream from yourAP's gateway is another private network.

Network Settings The Network Settings section on the Hotspot page configures local network settings
for the hotspot service.

Figure 124: Hotspot Network Settings

The following items are displayed on this page section:

IP Address — Specifies the IP address for the hotspot. Valid IPv4 addresses
consist of four decimal numbers, 0 to 255, separated by periods.
(Default: 192.168.182.1)

Netmask — Network mask for the associated IP subnet. This mask identifies
the host address bits used for routing to specific subnets.



DHCP Gateway — The gateway used to access the DHCP server.
– 124 –

Chapter 4 | Site WiFi 5 Configuration
Hotspot Settings



DHCP Gateway Port — The UDP/TCP port used to access the DHCP server.



DNS 1 — The IP address of the primary Domain Name Server on the network.
A DNS maps numerical IP addresses to domain names and can be used to
identify network hosts by familiar names instead of the IP addresses.



DNS 2 — The secondary DNS server available to DHCP clients.



DNS Domain Name — The domain name used to resolve incomplete hostnames via the Domain Name System. (Range: 1-32 characters)



DNS Entries — Only applicable for Spark AC Wave2 Mini APs.Allows clientsto access the web interface through the specified domain from a local network.



DNS Mapping — Configures DNS mapping for user-specified IP and domain
name.

DHCP Server The DHCP Server section on the Hotspot page configures DHCP address poolsettings for the hotspot service.

Figure 125: Hotspot DHCP Server Settings

The following items are displayed on this page section:
Start — Starting number of (last numeric field) in address pool. (Range: 1-254;
Default: 10)

Limit — Ending number of (last numeric field) in address pool.
(Range: 1-245; Default: 245)

Lease Time — The duration that an IP address is assigned to a DHCP client.
(Range: 600-43200 seconds; Default: 3600 seconds)– 125 –

Chapter 4 | Site WiFi 5 Configuration
Hotspot Settings

RADIUS Server The RADIUS Server section on the Hotspot page configures RADIUS server settings
for the hotspot service.

Figure 126: Hotspot RADIUS Server Settings

The following items are displayed on this page section:
Enable RADIUS Auth — Enables RADIUS authentication for clients attempting
to access the captive portal.



RADIUS Server Address — IP address or host name of the primary RADIUS
server.



Backup RADIUS server address — IP address or host name of the secondary
RADIUS server.



RADIUS server shared secret — A shared text string used to encrypt
messages between the access point and the RADIUS server. Be sure that thesame text string is specified on the RADIUS server. Do not use blank spaces inthe string. (Range: 1-255 characters).



RADIUS server auth port — RADIUS server UDP port used for authentication
messages. (Range: 1-65535, Default: 1812)

RADIUS server acct port — RADIUS server UDP port used for accounting
messages. (Range: 1-65535, Default: 1813)



Enable RadSec — An authentication and authorization protocol fortransporting RADIUS datagrams over TCP and TLS. RadSec replaces UDP usedin the initial RADIUS design, providing a reliable transport protocol and more
extensive security for the packet payload.

Auth method — Selects the encryption method to use for messages between
the AP and the RADIUS server; CHAP, PAP, or MS-CHAPv2. The encryption
method must match that used by the RADIUS server. (Default: CHAP)

Local ID — Local RADIUS server identifier.

– 126 –

Chapter 4 | Site WiFi 5 Configuration
Hotspot Settings

Local Name — Local RADIUS server name

Generate NAS ID — This option will generate a unique NAS ID for eachdevice in this site.

NAS ID — Local RADIUS server operation identifier.

Captive Portal The Captive Portal section on the Hotspot page configures portal details for the
hotspot service.

A captive portal forces a hotspot client to access a welcome web page before
gaining further access to the Internet. The welcome page may requireauthentication and/or payment.
Figure 127: Hotspot Captive Portal Settings

Depending on the hotspot mode selected, the following items are displayed on thispage section:
Common to all Modes

Landing URL — Indicates the URL to which the user is directed after logging into the captive portal.

Idle Timeout — The maximum a connection can remain inactive before it isclosed. (Range: 0-86400 seconds)

Session Timeout — The maximum time a client can stay logged in to thehotspot. (Range: 0-86400 seconds)– 127 –

Chapter 4 | Site WiFi 5 Configuration
Hotspot Settings

Common to all Modes Except External Captive Portal Service and Remote Splash
Page with External RADIUSHTTPS Login — Enables HTTPS for the captive portal.

Common to all Modes Except External Captive Portal ServiceCustomize Splash Page — When enabled, fill in the information that is used
to create the local captive portal welcome page.


Title — Enter the text you want to display as the title on the page.

Background Color — Click the button to select a color for the page
background.



Logo Image — Click the “Upload” button to send an image file. Files arelimited to a size of 1MB and the image must have a maximum height andwidth of 1000 pixels.

Terms and Conditions — Enter text in the window that define the captive
portal terms and conditions, and then use the controls to format the text.
Alternatively, click the “Use Default Terms and Conditions” button to importa generic text that you can then edit.

External Captive Portal Service Mode

Captive portal URL — Host name of Internet service portal for the hotspot.

Captive portal secret — The password used for logging into the hotspot.

Swap Octets — Swap the values of the reported “input octets” and “output
octets.”Simple Password-only Splash Page Mode

Splash Page Password — The password required for users to log in andaccess the Internet.

– 128 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

Authentication The Auth Exceptions section on the Hotspot page configures a “walled garden” andExceptions white list for the hotspot service.
Figure 128: Hotspot Authentication Exceptions

The following items are displayed on this page section:Walled garden — Enter a list of domains or IP addresses in CIDR notation that
hotspot users can access before being authenticated by the captive portal.
Wildcard domains can be specified in the format of domain.com (allow domain
and all sub-domains), or .domain.com (only allow sub-domains).



Auth white list — A list of MAC addresses that are allowed to bypass thecaptive portal to access the Internet.

System Settings
The System Settings page allows you to control remote management access to APs
and configure NTP time servers, Telnet, Web, and SNMP management interfaces
are enabled and open to access from the Internet. To provide more security,
specific services can be disabled and management access prevented from theInternet.

General Settings The General Settings section on the System Settings page can be used to configure
the cloud status LED, reset button, and time zone.

– 129 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

Figure 129: General System Settings

The following items are displayed on this page:Enable cloud status LED — For some devices (SkyFire, SunSpot, Spark, andSpark Wave 2 Mini), the LED is green when the AP is successfully connected to
ecCLOUD and is operating normally.

Enable radio LEDs — Only supported on ECW5211, ECWO5211, OAP100,
and Spark Wave 2/SunSpot Wave 2 running 3.0.0+ firmware. The LEDs areon when a radio is enabled and operating normally.

Enable reset button — Enables or disables the hardware reset button. Notethat the reset button cannot be disabled at the site level.

Timezone — To display a time corresponding to your local time, choose oneof the predefined time zones from the pull-down list.



Number of boot retries — The maximum number of bootup retries before
switching to the next boot bank. (Range: 1-254; Default: 3)Enable prelogin PPPoE form — Turn this setting on in order to show a PPPoE
username/password input form before the local web UI login form whenever
the Internet does not appear to be accessible. This will allow end users to enter
their PPPoE credentials without having to log in to the device UI.

MSP Mode — Enables the Managed Service Provider (MSP) mode thatprevents end-users from accessing and modifying most device settings fromuser-defined user accounts. Management access from “root” and “admin”
accounts still provide full access to all device settings. (Default: Disabled)
With MSP mode enabled, service providers have the option of making specificwireless SSID settings available for user configuration by enabling the “Local
Configurable” setting.

– 130 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

Note: Do not enable MSP Mode and “Always follow cloud configuration”(page 60) at the same time. This will cause the device configuration not to be
updated to ecCLOUD properly.

SSH The Secure Shell (SSH) acts as a secure replacement for Telnet. The SSH protocol

uses generated public keys to encrypt all data transfers passing between the accesspoint and SSH-enabled management station clients and ensures that data travelingover the network arrives unaltered. Clients can then securely use the local username and password for access authentication.

Note that SSH client software needs to be installed on the management station toaccess the access point for management via the SSH protocol.
Figure 130: SSH Server Settings

The following items are displayed on this page:

SSH Server — Enables or disables SSH access to the access point.
(Default: Enabled)

SSH Port — Sets the TCP port number for the SSH server on the access point.
(Range: 1-65535; Default: 22)Allow SSH from WAN — Allows SSH management access from the WAN.

Discovery Tool The Edgecore Discovery agent allows the AP to be discovered by other devices on
the local network or over the Internet.

Figure 131: Discovery Tool Settings– 131 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

The following items are displayed on this page:

Discovery Tool — Enables or disables the discovery tool. (Default: Enabled)Allow over WAN — Allows discovery tool access from the WAN.

Telnet Telnet is a remote management tool that can be used to configure the access pointfrom anywhere in the network. However, note that Telnet is not secure from hostileattacks. Telnet provides access to a Linux-based interface which is used for device
analysis and debugging.
Figure 132: Telnet Server Settings

The following items are displayed on this page:Telnet Server — Enables or disables Telnet access to the access point.
(Default: Enabled)Telnet Port — Sets the TCP port number for the Telnet server on the accesspoint. (Range: 1-65535; Default: 23)Allow Telnet from WAN — Allows Telnet management access from the WAN.

Web Server A Web browser provides the primary method of managing the access point. BothHTTP and HTTPS service can be accessed independently. If you enable HTTPS, youmust indicate this in the URL: https://device:port_number]

When you start HTTPS, the connection is established in this way:

The client authenticates the server using the server’s digital certificate.

The client and server negotiate a set of security protocols to use for theconnection.



The client and server generate session keys for encrypting and decrypting data.

The client and server establish a secure encrypted connection.



A padlock icon should appear in the status bar for most browsers.

– 132 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

Figure 133: Web Server Settings

The following items are displayed on this page:

HTTP Port — The TCP port to be used by the HTTP Web browser interface.
(Range: 1-65535; Default: 80)Allow HTTP from WAN — Allows HTTP management access from the WAN.

HTTPS Port — The TCP port to be used by the HTTPS Web browser interface.
(Range: 1-65535; Default: 443)

Allow HTTPS from WAN — Allows HTTPS management access from the
WAN.

Network Time Network Time Protocol (NTP) allows the access point to set its internal clock basedon periodic updates from a time server (SNTP or NTP). Maintaining an accurate
time on the access point enables the system log to record meaningful dates andtimes for event entries. If the clock is not set, the access point will only record thetime from the factory default set at the last bootup.

The access point acts as an NTP client, periodically sending time synchronization
requests to specified time servers. The access point will attempt to poll each serverin the configured sequence to receive a time update.
Figure 134: NTP Settings– 133 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

The following items are displayed on this page:

NTP Service — Enables or disables sending of requests for time updates.
(Default: Enabled)NTP Servers — Sets the host names for time servers. The switch attempts to
update the time from the first server, if this fails it attempts an update from thenext server in the sequence. To configure additional servers, type in an entry inthe blank field at the bottom of the list.

SNMP Simple Network Management Protocol (SNMP) is a communication protocol

designed specifically for managing devices on a network. It is typically used toconfigure these devices for proper operation in a network environment, as well as
to monitor them to evaluate performance or detect potential problems.

Figure 135: SNMP Settings

The following items are displayed on this page:

SNMP Server — Enables or disables SNMP on the access point.
(Default: Enabled)Contact — Administrator responsible for the access point.

Community String — A community string that acts like a password andpermits access to the SNMP protocol. (Range: 1-32 characters, case sensitive;
Default: public)
The default string “public” provides read-only access to the access point’sManagement Information (MIB) database.



IPv6 Write Community — A community string for IPv6 access to the accesspoint’s Management Information (MIB) database. (Range: 1-32 characters,case sensitive; Default: private6)– 134 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

Location — Sets the SNMP system location string. (Maximum length: 255
characters)Allow SNMP from WAN — Allows SNMP management access from the WAN.

Remote Syslog Use this feature to send log messages to a Syslog server.
Figure 136: Remote Log Settings

The following items are displayed on this page:

Remote Syslog — Enables/disables the logging of debug or error messages tothe remote logging process. (Default: Disabled)Server IP — Specifies the IP address of a remote server which will be sent
syslog messages.

Server Port — Specifies the UDP port number used by the remote server.
(Range: 1-65535)

Log Prefix — Sets the prefix for the log file sent to the specified server. The filesuffix “log” is used.



Track connections — Sends wireless client connection log messages to the
Syslog server.

– 135 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

Ping Watchdog Use this feature to send ping probe packets to a defined IP address to confirm
connectivity.

Figure 137: Ping Watchdog Settings

The following items are displayed on this page:Ping Watchdog — Enable the sending of ping probe packets to a defined IP
address to confirm connectivity. (Default: Disabled)IP Address — The primary IP address to ping.

Failover IP Address — The (optional) failover IP address to ping if a pingprobe to the primary IP fails. Note that if the failover IP can successfully be
pinged, the fail counter will reset to zero again.

Interval (min) — How often, in minutes, a ping check should be made.



Failure count — The number of consecutive pings that must fail before thedevice is rebooted.

BLE Settings Use this feature to enable devices to push records of Bluetooth Low Energy (BLE)
probe requests to a specified URL.

BLE settings are available only on devices with BLE support.
Figure 138: BLE Settings– 136 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

The following items are displayed on this page:

BLE Probe Req. Data Push — Enable BLE Probe Request Data Push for site
APs. When enabled, APs will push BLE probe request data in JSON format tothe specified URL.



Push URL — The URL to which to send data.

Multicast DNS Use this feature to enable Multicast DNS support on APs. Multicast DNS can beused on small networks that do not have a DNS server to resolve host names tomulticast IP addresses.

Multicast DNS settings are available only on devices with mDNS support.
Figure 139: Multicast DNS Settings

The following items are displayed on this page:

MDNS — Enables or disables multicast DNS support. (Default: Enabled)

IGMP Snooping APs can use IGMP (Internet Group Management Protocol) to check for any clientsthat want to receive a specific multicast service. APs can then propagate service
requests up to any neighboring multicast switch/router to ensure that clients willcontinue to receive the multicast service.
Figure 140: IGMP Snooping Settings

The following items are displayed on this page:Enable — Enables the IGMP Snooping service. (Default: Disabled)– 137 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

LLDP Link Layer Discovery Protocol (LLDP) is used to discover basic information aboutneighboring devices in a network. LLDP is a Layer 2 protocol that uses periodic
broadcasts to advertise information about the sending device.

Figure 141: LLDP Settings

The following items are displayed on this page:Enable — Enables the sending of LLDP advertisements about the AP toneighboring devices in the network. (Default: Disabled)Tx Interval (seconds) — Sets the periodic transmit interval for LLDP
advertisements. (Range: 5-32768 seconds; Default: 30 seconds)Tx Hold (number of time(s)) — Configures a time-to-live (TTL) value sent in
the LLDP advertisements as shown in the formula below. (Range: 2-10;
Default: 4)
The time-to-live tells the receiving LLDP agent how long to retain all information
pertaining to the sending device if it does not transmit updates in a timely
manner.
The TTL in seconds is based on the following rule:
minimum value ((Tx Interval * Tx Hold), or 65535)
Therefore, the default TTL is 4*30 = 120 seconds.

iBeacon The AP supports the iBeacon standard based on Bluetooth Low Energy (BLE).

Devices with BLE Beacons can provide location-based services to BLE clients, suchas phones, that can recognize the beacon advertisements, extract the provided
information, and then take actions based on the content.

Figure 142: iBeacon Settings– 138 –

Chapter 4 | Site WiFi 5 Configuration
System Settings

The following items are displayed on this page:Enable — Enables iBeacon support on the AP. (Default: Enabled)

UUID — The iBeacon Universally Unique Identifier that advertises the beacon
service. The UUID contains 32 hexadecimal digits in five groups, separated byhyphens.



Major — The iBeacon value that is used to identify a beacon group.
(Range: 0-65535)



Minor — The iBeacon value that is used to identify individual beacons within agroup. (Range: 0-65535)

SNMPv3 User SNMP protocol version 3 provides secure access by account authentication anddata encryption. An SNMP v3 user can be defined by clicking the Add button.

Figure 143: SNMPv3 User Settings

The following items are displayed on this page:Name — The user name used to access the SNMP service.



Access Auth — Select the access permission as “Read Only” or “Write.”

Auth Type — Select the hash algorithm for authentication.



Auth Pwd — Configure the password for authentication.

Encryption Type — Select the encryption algorithm for data packets.

Encryption Pwd — Configure the password for data encryption.

– 139 –

5

Site WiFi 6 Configuration

This chapter describes configuration settings for WiFi 6 access point devices. It
includes the following sections:“Wireless SSID Configuration” on page 141“Radio Settings” on page 152

“General Networking Settings” on page 156

“Local Network Settings” on page 163

“Firewall Settings” on page 165

“Hotspot Settings” on page 168

“System Settings” on page 175

“OpenRoaming” on page 183– 140 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration

Wireless SSID Configuration
From the Site menu, open “Configuration” and then “WiFi6” to display theconfiguration options that apply to all Edgecore Wi-Fi 6 access points in the samesite.
The Edgecore Wi-Fi 6 access points can operate in several radio modes, 802.11a/
a+n/ac+a+n/ax (5 GHz) or 802.11b+g+n/ax (2.4 GHz). Supported modes
depend on the access point model. Note that the dual-band access points canoperate at 2.4 GHz and 5 GHz at the same time.
Each radio supports eight Service Set Identification (SSID) or virtual access point(VAP) interfaces. Each VAP functions as a separate access point, and can be
configured with its own SSID and security settings. However, most radio signal
parameters apply to all VAP interfaces. Traffic to specific VAPs can be segregatedbased on user groups or application traffic. Wireless clients associate with each
VAP in the same way as they would with separate physical access points. Edgecore
AP devices support up to a total of 128 wireless clients across all SSID interfaces
per radio.
Figure 144: Site WiFi6 Configuration

The Wireless SSID tab on the WiFi6 configuration page includes these items:
SSID List — The list of configured SSID interfaces for the Wi-Fi devices in thissite. Note that each SSID applies to both the 2.4 GHz and 5 GHz radios unlessotherwise configured. You can configure a maximum of eight SSIDs. Click the“Add SSID” button to create an SSID interface.

Wireless Scheduling — A list of configured schedules for turning AP radios on
and off at specified times. The scheduling rules apply to all 2.4 GHz and
5 GHz interfaces on all site APs. Click the “Add Schedule” button to create awireless schedule.

– 141 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration

Adding an SSID Click the Add SSID button on the WiFi6 Access configuration page and enter SSID,
network, and security settings as displayed below.
Figure 145: Radio Settings (New SSID)

The following items are displayed on the Add SSID page:
General SettingsEnable SSID — Enables or disables the SSID interface.



SSID — The name of the basic service set provided by the VAP interface.
Clients that want to connect to the network through the access point must set
their SSID to the same as that of the access point’s VAP interface. (Range: 1-32
characters)– 142 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration



Broadcast SSID — The SSID can be broadcast at regular intervals so thatwireless stations searching for a network connection can discover it. This allows
wireless clients to dynamically discover and roam between WLANs. This feature
also makes it easier for hackers to break into your home network. Because
SSIDs are not encrypted, it is easy to scan WLANs looking for SSID broadcast
messages coming from an AP. (Default: On)

Client Isolation — When enabled, wireless clients can talk to the LAN, andreach the Internet if such connection is available, but they cannot communicate
with one another. (Default Off)

Multicast-to-Unicast Conversion — When enabled, the AP forwards
multicast traffic only to those clients that request multicast traffic, instead ofbroadcasting traffic to all clients. This feature is automatically enabled whenclient isolation is disabled, and disabled when client isolation is enabled. The
feature cannot be configured manually. (Default On)

Max Client Count — Sets the maximum number of wireless clients that can beconnected to this SSID at the same time. (Default: 127; Range: 0 to 127)



Minimum allowed Signal — Only allows clients to associate to this SSID if
their signal strength (RSSI) is equal or greater than the specified value. Setting
the value to -100 disables this feature. Clients already connected are checked
periodically.
This forces clients to associate with an AP that has a better signal strength (alsocalled assisted roaming). Suggested value is -70 to -80 depending on accesspoint density and coverage.
Enter an RSSI (Received Signal Strength Indicator) in decibels from -1 to-100db. Note that the closer it is to zero, the stronger the signal. (Default: -70)

Activate on radio — Selects the radios on which this SSID should be created.
If an SSID is activated on both radios for a device (meaning that the SSID will
be mirrored), you can edit its record from either configuration tab, and thechanges will be made on both the 2.4 GHz and 5 GHz SSID records. (Default:
5GHz and 2.4GHz enabled)

Security Settings

Method — Sets the wireless security method for each SSID, including
association mode, encryption, and authentication. (Default: Open)Open — The SSID interface broadcasts a beacon signal including theconfigured SSID. Wireless clients with an SSID setting of “any” can read the
SSID from the beacon and automatically set their SSID to allow immediateconnection.



WPA-PSK — For enterprise deployment, WPA requires a RADIUS
authentication server to be configured on the wired network. However, for– 143 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration

small office networks that may not have the resources to configure andmaintain a RADIUS server, WPA provides a simple operating mode thatuses just a pre-shared password for network access. The Pre-Shared Key
mode uses a common password for user authentication that is manuallyentered on the access point and all wireless clients. The PSK mode uses thesame TKIP packet encryption and key management as WPA in theenterprise, providing a robust and manageable alternative for small
networks.


Encryption — Data encryption uses one of the following methods:

AES — AES-CCMP is used as the multicast encryption cipher. AESCCMP is the standard encryption cipher required for WPA2. (This is
the default setting.)



TKIP + AES — The encryption method used by the client is
discovered by the access point.

Key — WPA is used to encrypt data transmitted between wireless clientsand the SSID interface. WPA uses static shared keys (fixed-length
hexadecimal or alphanumeric strings) that are manually distributed to
all clients that want to use the network.
String length must be 8 to 63 ASCII characters (letters and numbers).
No special characters are allowed.

Multiple Keys — Enables the entry of multiple keys, one per line.
Entering a key with a specific MAC address limits the key for use by asingle client. Entering a key without a MAC address enables the key tobe used by all clients.
Multiple keys are supported for WPA-PSK, WPA2-PSK, and WPA3
Personal Transition security.



WPA2-PSK — Clients using WPA2 with a Pre-shared Key are accepted forauthentication.
WPA was introduced as an interim solution for the vulnerability of WEP
pending the ratification of the IEEE 802.11i wireless security standard. In
effect, the WPA security features are a subset of the 802.11i standard.
WPA2 includes the now ratified 802.11i standard, but also offers backward
compatibility with WPA. Therefore, WPA2 includes the same 802.1X andPSK modes of operation and support for TKIP encryption.
Refer to WPA-PSK for a description of encryption methods and the key.

WPA-EAP — WPA employs a combination of several technologies toprovide an enhanced security solution for 802.11 wireless networks. A
RADIUS server is used for authentication, and can also be used foraccounting.
Refer to WPA-PSK for a description of encryption methods.
– 144 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration

RADIUS Settings
A RADIUS server must be specified for the access point to implement IEEE
802.1X network access control and Wi-Fi Protected Access (WPA) wirelesssecurity.
In addition, you can configure a RADIUS Accounting server to receive usersession accounting information from the access point. RADIUS Accounting
can be used to provide valuable information on user activity in the network.
Note: This guide assumes that you have already configured RADIUS servers) to
support the access point. Configuration of RADIUS server software is beyond thescope of this guide, refer to the documentation provided with the RADIUS server
software.



Radius MAC Auth — Use RADIUS authentication. When this setting isenabled, the AP will send the MAC address of the client device to thespecified RADIUS server for authentication. The server verifies the MAC
is a valid user, and then replies to the AP with the dynamic VLAN ID (ifconfigured) and other resources for the client device.
Note: On your RADIUS server, both the user ID and password will need
to be set to the WiFi MAC of the client device and must be formatted
without punctuation.
This feature is supported with “Open Security” in v1.1.1 firmware, andall other security methods (besides WEP) in v1.1.2 firmware.



Use RADIUS Auth — For WPA-EAP and WPA2-EAP security, a RADIUS
server must be specified.



RADIUS Auth Server — Specifies the IP address or host name of the
RADIUS authentication server.



RADIUS Auth Port — The UDP port number used by the RADIUS
server for authentication messages. (Range: 1024-65535;
Default: 1812)

RADIUS Auth Secret — A shared text string used to encrypt messages
between the access point and the RADIUS server. Be sure that the same

– 145 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configurationtext string is specified on the RADIUS authentication server. Do not use
blank spaces in the string. (Maximum length: 255 characters)

Backup RADIUS Auth — Configures a secondary RADIUS server toact as a backup should the primary server become unavailable.



Use RADIUS Accounting — Use RADIUS accounting to enableaccounting of requested services for billing or security purposes.



RADIUS Acct Server — Specifies the IP address or host name of the
RADIUS accounting server.

Radius Acct Port — The UDP port number used by the RADIUS server
for accounting messages. (Range: 1024-65535; Default: 1813)

RADIUS Acct Secret — A shared text string used to encrypt messages
between the access point and the RADIUS server. Be sure that the sametext string is specified on the RADIUS accounting server. Do not use
blank spaces in the string. (Maximum length: 255 characters)

WPA2-EAP — WPA was introduced as an interim solution for thevulnerability of WEP pending the ratification of the IEEE 802.11i wirelesssecurity standard. In effect, the WPA security features are a subset of the802.11i standard. WPA2 includes the now ratified 802.11i standard, butalso offers backward compatibility with WPA. Therefore, WPA2 includes thesame 802.1X and PSK modes of operation and support for TKIP
encryption.
A RADIUS server is used for authentication, and can also be used toaccounting.
Refer to WPA-PSK for a description of encryption methods.
Refer to WPA-EAP for information on configuring the RADIUS server.



WPA3 Personal — Clients using WPA3 with Simultaneous Authenticationof Equals (SAE) are accepted for authentication.
WPA3 provides more robust password-based authentication called
Simultaneous Authentication of Equals (SAE), which replaces Pre-Share Key(PSK) in WPA2-Personal. This technology prevents offline dictionary attacks
so that data traffic can be transmitted securely.



WPA3 Personal Transition — Clients using WPA3 with SAE or clientsusing WPA2 with PSK are accepted for authentication. The AP negotiates
the supported authentication and encryption with each client before
allowing access to the network.



WPA3 Enterprise — An enhanced version of WPA2-EAP security that uses
more robust encryption. Clients must support one of the stronger WPA3
encryption options and use Protected Management Frames (PMF) to be– 146 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration

able to access the network. The use of IEEE 802.1X network access control
and a RADIUS server is required.
Refer to RADIUS Settings above for information on RADIUS configuration.


WPA3 Enterprise Transition — Allows WPA3 and WPA2 clients to accessthe network. Encryption options and the use of Protected Management
Frames (PMF) are negotiated with each client before allowing access to the
network.
Refer to RADIUS Settings above for information on RADIUS configuration.



WPA3 Enterprise 192-bit — WPA3 Enterprise security uses a standard
128-bit encryption. For a network handling more sensitive data, there is an
option to use 192-bit encryption for additional protection.
Refer to RADIUS Settings above for information on RADIUS configuration.



PMF — Protected Management Frames (PMF) provide WPA2/WPA3 security forunicast and multicast management frames between the AP and clients. The“Optional” setting allows clients that do not support PMF to access the network.
The “Mandatory” setting allows only clients that support PMF to access the
network. (Default: Optional)

802.11k — Provides clients with information on neighbor APs when roaming.
As a client is about to roam from an AP, it sends a request for a “Neighbor
Report” that includes a list of available APs and associated information. The
client can then quickly identify the best AP to which it can roam without having
to scan all channels. (Default: Disabled)

802.11v — Provides information to associated clients that facilitates theoverall improvement of the wireless network. Also helps clients to improvebattery life by setting the idle period. (Default: Disabled)

802.11r — Provides a method for fast transition roaming between APs. Before
clients roam to a new AP, the initial handshake and encryption calculations are
performed in advance, which results in a fast hand off without the need for reauthentication. (Default: Disabled)

OWE — Opportunistic Wireless Encryption (OWE) is the WPA3 open network
security that allows users of public Wi-Fi networks to gain secure access without
using a password. OWE provides individual encryption of data
communications between the AP and each client, but does not provide
authentication of user identities.



Access Control List — Wireless clients can be authenticated for network
access by checking their MAC address against the local database configuredon the access point. (Default: OFF)– 147 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration



Policy — The MAC list can be configured to either allow or deny network
access to specified clients. (Default: Allow all MACs on list)Filtered MACs — List of client MAC addresses.

Dynamic Authorization — The Dynamic Authorization Extensions (DAE) to
RADIUS enable a server to disconnect or change the authorization of clientsthat are already connected to the network.


DAE Port — The UDP port number to use for DAE messages.
(Default: 3799)



DAE Client — The IPv4 address of the RADIUS server.



DAE Secret — The shared text string used to encrypt DAE messages
between the access point and the RADIUS server.

Network Settings

Network Behavior — One of the following connection methods must be
specified. (Default: Route to Internet)
Bridge to Internet (AP Bridge Mode) — Configures an interface asattached to the WAN (that is, the Internet).
In the following figure, Ethernet port 0 and Ethernet port 1 are both
attached to the WAN. Traffic from these interfaces is directly bridged into
the Internet. Any of the Ethernet or radio interfaces can be configured thisway.

Figure 146: Bridge to InternetRoute to Internet (AP Router Mode) — Configures an interface as amember of the LAN.
In the following figure, Ethernet port 1, Wireless LAN 0 (5 GHz radio), andWireless LAN 1 (2.4 GHz radio) are all included in the LAN. Traffic from– 148 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configurationthese interfaces is routed across the access point through Ethernet port 0 to
the Internet.
Figure 147: Route to InternetRoute through — The network to be routed. The default is “Default
local network” as displayed under LAN Settings – Local Network.



Add to Guest Network — This interface can only support the guest
network.



Hotspot Controlled — This interface can only support hotspot services.


Walled garden — Enter a list of domains and/or IP addresses in CIDR
notation that the hotspot user can access before being authenticated by
the captive portal. Wildcard domains can be specified in the format of
domain.com (allow domain and all of its subdomains), or .domain.com(only allow subdomains).



VLAN Tag Traffic — Tags any packets passing from this SSID interface tothe associated Ethernet port as configured under “VLAN Settings” onpage 161. When enabled, select a configured VLAN ID from the list.

Dynamic VLAN — The RADIUS server provides the access point with theuser VLAN information. The access point assigns the associated user to therelated VLAN.

Note: ecCLOUD supports VLAN synchronization between APs and switches. When
VLAN tagging is enabled for an SSID, the configured VLAN ID is automatically"pushed" by ecCLOUD to the attached switch port. This enables the VLAN-tagged
traffic from the AP to be accepted by the switch port and avoids any loss ofconnectivity.


Limit upload rate — Enables rate limiting of traffic from the SSID interface as
it is passed to the wired network. You can set a maximum rate in Kbytes per
second. (Range: 256-10048576 Kbytes per second; Default: OFF)– 149 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration



Limit download rate — Enables rate limiting of traffic from the wired network
as it is passed to the SSID interface. You can set a maximum rate in Kbytes per
second. (Range: 256-10048576 Kbytes per second; Default: OFF)OpenRoaming — Available when WPA2-EAP security is selected,
OpenRoaming (Hotspot 2.0) provides a standard for public-access Wi-Fi
networks to support seamless roaming between wireless networks. A
OpenRoaming AP advertises its public Wi-Fi capabilities and services so thatclients can decide if they want to connect to the network. (Default: Disabled)Choose Profile — Selects a configured profile to apply to the wirelessnetwork.



Configure OpenRoaming — Click to access the OpenRoaming profile
settings page. See “OpenRoaming” on page 183 for profile configuration.



AuthPort Enable — When this option is enabled, Wi-Fi users are asked toauthenticate against a configurable ecCLOUD hosted account database
before they are granted Internet access. The AuthPort add-on must be enabled
for this option to be activated (see “Using the AuthPort Add-On” on page 66).

Proxy ARP — When Proxy ARP is enabled, the AP maintains its own ARP lookup
table and replies to ARP requests on behalf of downstream stations, avoiding
network inefficiencies. This feature is automatically enabled when client
isolation is disabled, and disabled when client isolation is enabled. The featurecannot be configured manually. Proxy ARP is supported when the network
behavior is “Bridge to Internet” or “VLAN Tag Traffic.”

Setting Wireless Configuring wireless schedules enables the AP radios to be turned on and off at
Schedules specified times. The scheduling rules apply to all 2.4 GHz and 5 GHz interfaces on
all site APs. Click the “Add Schedule” button to create a wireless schedule.

Figure 148: Adding a Wireless Schedule– 150 –

Chapter 5 | Site WiFi 6 Configuration
Wireless SSID Configuration

The following items are displayed on the Add schedule page:Enabled — Makes the defined schedule active. (Default: Enabled)Name — A text string to identify the schedule.

Start time — The time that you want the radios to be turned on.

End Time — The time that you want the radios to be turned off.

Days — The selected days of the week on which to apply the schedule.

– 151 –

Chapter 5 | Site WiFi 6 Configuration

Radio Settings

Radio Settings
On the “WiFi Access” page, click the “Radio Settings” tab to configure 5 GHz and
2.4 GHz radio settings. Note that settings apply to all configured SSID interfaces.
Figure 149: WiFi 6 Radio Settings– 152 –

Chapter 5 | Site WiFi 6 Configuration

Radio Settings

The following items are displayed on the Radio Settings tab. Note that
configuration options apply to both the 5 GHz and 2.4 GHz radios unlessotherwise indicated.

Global SettingsBand Steering — When enabled, clients that support 2.4 GHz and 5 GHz are
first connected to the 5 GHz radio. This feature helps balance the client load
over the two radio bands. Note that both radios must have configured SSIDs
that match for this feature to fully operate. (Default: Disabled)Airtime Fairness — Enabling this feature improves the overall performance of
the wireless network. (Default: Disabled)RF Isolation — When enabled, clients are isolated between different radio
cards.

Physical Radio Settings

802.11 Mode — Defines the radio operation mode.
Radio 5 GHz — Default: 11ax; Options: 11a, 11a+n, 11ac+a+n, 11ax

Radio 2.4 GHz — Default: 11ax; Options: 11b+g+n/ax

Channel Bandwidth — The basic Wi-Fi channel bandwidth is 20 MHz, but bybonding channels together to create 40 MHz, 80 MHz, or 160 MHz channels,
higher data transmission rate can be achieved. However, selecting larger
channel bandwidths reduces the number a radio channels available. The
available channel bandwidth is dependent on the 802.11 Mode.
(Default: 20 MHz on 2.4 GHz Radio, 80 MHz on 5 GHz Radio;
Options: 20 MHz, 40 MHz, 80MHz, 160MHz)

20MHz — For 802.11b+g+n and 802.11ax

40MHz — For 802.11b+g+n, 802.11a, 802.11a+n, 802.11ac+a+n
and 802.11ax

80MHz — For 802.11ac+a+n and 802.11ax

160MHz — (Supported on EAP104 5 GHz radio only) For
802.11ac+a+n and 802.11ax

Channel — The radio channel that the access point uses to communicate withwireless clients. The available channels are dependent on the radio, Channel
Bandwidth, and Regulatory Country settings. You can also click the “Edit
Channel List” button to select specific available channels to use for each radio
interface.

– 153 –

Chapter 5 | Site WiFi 6 Configuration

Radio Settings

Selecting Auto enables the access point to automatically select an unoccupied
radio channel. (Default: Auto)
Figure 150: 5 GHz Radio Channels

Figure 151: 2.4 GHz Radio Channels

Idle Timeout — The maximum a connection can remain inactive before it isclosed. (Default: 300 seconds)

Max Tx Power — Adjusts the maximum power of the radio signals transmitted
from the access point. The higher the transmission power, the farther thetransmission range. Power selection is not just a trade-off between coveragearea and maximum supported clients. You also have to ensure that high-powersignals do not interfere with the operation of other radio devices in the service
area. (The range of power settings and defaults are dependent on the APmodel and the Regulatory Country setting.)– 154 –

Chapter 5 | Site WiFi 6 Configuration

Radio Settings

Beacon Interval — The rate at which beacon signals are transmitted from theaccess point. The beacon signals allow wireless clients to maintain contact withthe access point. They also carry power-management and other information.
(Range: 100-1024 TUs; Default: 100 TUs)



BSS coloring — In 802.11ax (Wi-Fi 6) mode, BSS coloring allows nearby APs
operating at the same frequency to identify traffic belonging to their own Basic
Service Set (BSS). The BSS coloring enables Wi-Fi 6 networks to operate more
efficiently in high-density environments where neighboring AP and clienttransmissions overlap. Assign a color value (a number from 1 to 63) to identify
the radio BSS, or enter value 64 to allow the AP to randomly select a color
value. (Range: 1-63, 64 random, Default: 64)

Broadcast Rate — Allows a limit to be placed on the wireless bandwidthconsumed by broadcast packets.
Radio 5 Ghz — Options: 6M, 9M, 12M, 18M, 24M, 36M, 48M, 54M;
Default: 6M

Radio 2.4 Ghz — Options: 5.5M, 6M, 9M, 11M, 12M, 18M, 24M, 36M,
48M, 54M; Default: 5.5M

Target Wake Time — In 802.11ax (Wi-Fi 6) mode, the AP can allow clients torequest a specific Target-Wakeup Time (TWT) to transmit or receive frames,
rather than rely on periodic beacons. This feature enables client devices tohave much longer sleep states and results in significant power savings. In
addition, the AP can control and schedule client TWTs to both manage
contention in the network and accommodate delay-sensitive traffic. (Default:
Disabled)

OFDMA — The 802.11ax (Wi-Fi 6) mode supports Orthogonal Frequency
Division Multiple Access (OFDMA) and this cannot be disabled.

Advanced Radio Settings

Probe Req. Data Push — Enable Client Probe Request Data Push for thisradio. When enabled, the radio will push client probe request data in JSON
format to your specified URL.

– 155 –

Chapter 5 | Site WiFi 6 Configuration
General Networking Settings

General Networking Settings
On the “WiFi Access” page, click the “General Networking” tab to configure
Internet, Ethernet ports, and VLAN settings for all devices in a site. Some items on
this page only display the current setting, they cannot be configured. These settings
can only be overridden at the device-level configuration.
Figure 152: General Networking Settings– 156 –

Chapter 5 | Site WiFi 6 Configuration

General Networking Settings

Internet Settings Note that only the Internet IP Address Mode and Management VLAN settings canbe changed on this page. These rest of these settings can only be overridden on a
per-device basis at device-level configuration.

Figure 153: Internet Settings

The following items are displayed on this page section:

General SettingsInternet Source — The interface on devices used to access the Internet.



VLAN tag traffic — Enable to activate tagging on this interface and choose atagging ID value between 2 and 4094, inclusive.



IP Address Mode — The method used to provide an IP address for the Internet
access port. (Options: DHCP, Use Device’s Settings; Default: DHCP)

DHCP — Enables DHCP on the Internet Source interface.

Use Device’s Settings — Select this option if you plan on assigning static
IPs to your devices prior to registration. Also choose this option if you aremixing static IP and DHCP-based modes. By default, all devices will use
DHCP unless configured otherwise.

MTU Size — Sets the size of the maximum transmission unit (MTU) for packets
sent on this network.

– 157 –

Chapter 5 | Site WiFi 6 Configuration
General Networking Settings



Fallback IP — This IP address is used if you cannot connect to the device IP
address.



Fallback Netmask — The network mask associated with the fallback IP
address.

MGMT VLAN Settings
Figure 154: Management VLAN SettingsMgmt VLAN — Select this option to enable a management VLAN on site
devices. Once you enable this option, you will no longer be able to accessdevices on any of the built-in the local networks (like 192.168.2.1 forexample). You will only be able to access devices from the specified VLAN
network. If a device’s IP mode is set to DHCP, it will also request a new IP
address in the subnet range assigned to the VLAN network.

Mgmt VLAN ID— Specifies the ID of the management VLAN.

IP Address Mode — The method used to provide an IP address for a device
over the Management VLAN. (Options: DHCP, Static IP; Default: DHCP)

DHCP — Enables DHCP on the management VLAN.



Static IP — Sets a static IP to access site devices over the management
VLAN. Configure an IP address, subnet mask, and default gateway address.



Fallback IP — The IP address to use to connect to a device over the
management VLAN if the DHCP-assigned address cannot be reached.

Fallback Netmask — The network mask associated with the fallback IP
address.

– 158 –

Chapter 5 | Site WiFi 6 Configuration

General Networking Settings

DHCP Relay Settings
When DHCP relay is enabled, APs act as an agent for all clients and sends all
broadcast DHCP requests directly to a specified DHCP server. The DHCP server IP
address and port must be configured, and optionally a backup server.
Figure 155: DHCP Relay

The following items are displayed on this page:

DHCP Relay — Enables the DHCP relay feature on the AP.



DHCP Relay Server — Specifies the IP address of the DHCP server.



DHCP Relay Port — Specifies the port of the DHCP server.

Backup DHCP Relay — Optionally specifies a backup DHCP server IP address
and port to use if there is no response from the primary server.



Remote ID — Use the hostname as the remote ID, or manually configure a text
string as the remote ID.

IPV6 Settings
Figure 156: IPv6 Settings

The following items are displayed on this section of the page:

IP Address Mode — The method used to provide an IPv6 address for theInternet access port. (Default: DHCP; Options: DHCP, Static IP)

DHCP — If you configure DHCP, the Client ID must be specified.


Client ID — Manually enter the client ID for the DHCP client.

– 159 –

Chapter 5 | Site WiFi 6 Configuration
General Networking Settings

Static IP — To configure a static IPv6 address for the Internet access port,
the following items must be specified.


IP Address — Specifies an IPv6 address for the access point. An IPv6
address must be configured according to RFC 2373 using 8 colon
separated 16-bit hexadecimal values. One double colon may be usedin the address to indicate the appropriate number of zeros required tofill the undefined fields.

Default Gateway — The IPv6 address of the default gateway, which isused if the requested destination address is not on the local subnet.



DNS — The IPv6 address of Domain Name Servers on the network. A
DNS maps numerical IPv6 addresses to domain names and can beused to identify network hosts by familiar names instead of the IPv6
addresses. If you have a DNS server located on the local network, typethe IPv6 address in the text field provided.

Ethernet Settings This page section shows basic Ethernet settings for site APs. These settings can only
be overridden on a per-device basis at device-level configuration.

Figure 157: Ethernet Settings

The following items are displayed on this page section:

Ethernet Settings for WAN Port
By default, the WAN port interface is set as the Internet source and the following
message is displayed: “This port is the Internet source for devices in this site.”
If more than one interface is connected to the Internet, only the last configured
interface is used.

Ethernet Settings for LAN Port(s)Network Behavior — Shows the network connection method (that is, themanner in which the LAN ports are used).

– 160 –

Chapter 5 | Site WiFi 6 Configuration

General Networking Settings

Advanced Ethernet Settings


PoE Out — Enables the PoE Out feature when the PoE source is detected as
802.3at, otherwise the PoE Out feature is disabled. When set to “Off,” PoE Out
is always disabled.

VLAN Settings The access point can employ VLAN tagging to control access to network resources
and increase security. VLANs separate traffic passing between the access point,
associated clients, and the wired network. You can create up to 12 VLAN tagged
networks.

VLANs (virtual local area networks) are turned off by default. If turned on they willautomatically tag any packets passed to Ethernet ports from the relevant VAP(virtual access point). Note also that specific VAPs can enable or disable VLAN
tagging (see “Adding an SSID” on page 142).
Note the following points about the access point’s VLAN support:

If an Ethernet LAN port on the access point is assigned a VLAN ID, any traffic
entering that port must be also tagged with the same VLAN ID.

Wireless clients associated to the access point can be assigned to a VLAN.
Wireless clients are assigned to the VLAN for the VAP interface with which they
are associated. The access point only allows traffic tagged with correct VLAN
IDs to be forwarded to associated clients on each VAP interface.

When VLAN support is enabled on the access point, traffic passed to the wired
network is tagged with the appropriate VLAN ID. When an Ethernet port on theaccess point is configured as a VLAN member, traffic received from the wired
network must also be tagged with the same VLAN ID. Received traffic that has
an unknown VLAN ID or no VLAN tag is dropped.

When VLAN support is disabled, the access point does not tag traffic passed to
the wired network and ignores the VLAN tags on any received frames.

Note: Before enabling VLAN tagging on the access point, be sure to configure theattached network switch port to support tagged VLAN frames for the VLAN IDs
configured on the access point. Otherwise, connectivity to the access point will belost when you enable the VLAN feature.
Figure 158: VLAN Settings

The following items are displayed on this page section:


VLAN ID — The identifier assigned to the VLAN. (Range: 2-4094)– 161 –

Chapter 5 | Site WiFi 6 Configuration
General Networking Settings

Tagged Ports — The Ethernet ports assigned to the VLAN. Options include
WAN port or LAN port(s).

Untagged Interfaces — Click the “Configure SSIDs” link to open the Wireless
SSID tab. Then edit or create an SSID interface to be a member of the specified
VLAN (see “Adding an SSID” on page 142).

Actions — Click and select to edit or delete a configured VLAN.

Adding a VLAN
Click the “Add New VLAN” button to create a VLAN.
Figure 159: Adding a VLAN

The following items are displayed on this page section:


VLAN ID — The VLAN identifier to be assigned. (Range: 2-4094)

Ports — The Ethernet ports assigned to the VLAN. Options include WAN port
or LAN port(s).

– 162 –

Chapter 5 | Site WiFi 6 Configuration
Local Network Settings

Local Network Settings
The Local Network tab configures settings for the default LAN network, guest
network, and other custom networks.
Figure 160: Local Network Settings

The following items are displayed on this page:

Add Custom LAN — Click this button to create a additional networks with
their own custom settings. You can create up to 10 custom LANs.



IP Address — Specifies the IP address for the local network or guest network.
Valid IP addresses consist of four decimal numbers, 0 to 255, separated byperiods. (Default: 192.168.2.1)

Subnet Mask — Indicates the local subnet mask. (Default: 255.255.255.0)



MTU Size — Sets the size of the maximum transmission unit (MTU) for packets
sent on this network. (Default: 1500)



Enable STP — Enables or disables processing of Spanning Tree Protocol
messages. (Default: Disabled)– 163 –

Chapter 5 | Site WiFi 6 Configuration
Local Network SettingsEnable UPnP — Enables or disables Universal Plug-and-Play broadcast
messages. (Default: Disabled)Smart Isolation — Enables network traffic to be restricted to the specified
network:

Disable (full access) — There is no traffic isolation. Clients can access theInternet and other devices on the local LAN. This is the option to choose if
you trust the clients that will be connecting to your network.

Internet access only — Traffic from this network can only be routed to andfrom the Internet. This is the option to choose for hotspot users or users
connecting to a guest network.

LAN access only — Traffic from this network is restricted to local LAN
devices only.

Internet-only (strict) — This is the same as "Internet access only," but withthe additional restriction that users cannot access resources or devices onany private network (192.168.0.0, 172.16.0.0, 10.0.0.0, etc.). This isuseful if an AP is “double NAT’ed” and the network upstream from yourAP’s gateway is another private network.

Interface Members — The interfaces attached to the local area network.



DHCP Server — Enables/disables DHCP on this network. (Default: Enabled)


DHCP Start — First address in the address pool. (Range: 1-256;
Default: x.x.x.100)



DHCP Limit — Maximum number of addresses in the address pool.
(Range: 1-254; Default: 150)



Lease Time — The time period for which assigned IP addresses are valid.



DNS Servers — List up to three DNS server IP addresses, one per line.

– 164 –

Chapter 5 | Site WiFi 6 Configuration
Firewall Settings

Firewall Settings
Firewall filtering restricts connection parameters to limit the risk of intrusion. The
firewall settings allow you to define a sequential list of rules that filter traffic basedon source and destination IP addresses and ports. Ingress packets are tested
against the filter rules one by one. As soon as a packet matches a rule, theconfigured action is implemented.
One rule, “Allow-Ping,” is pre-configured to allow Ping packets from the Internet.
You can enable or disable this rule, but it cannot be modified or deleted. Click the“Add Rule” button to add a new firewall rule.
Figure 161: Firewall Settings

The following items are displayed on this page:Enabled — Enables the configured firewall rule.

Name — User defined name for the filtering rule. (Range: 1-30 characters)

Source IP — An IPv4 address in CIDR notation. Includes an IP address
followed by a slash (/) and a decimal number to define the network mask.



Source Port — The source protocol port. (Range: 1-65535)



Destination IP — The destination IPv4 address.

Destination Port — The destination protocol port. (Range: 1-65535)



Target — The action to take when the configured rule matches a packet.
(Options: Accept, Reject, Drop, Mark, NoTrack)

Family — Specifies IPv4 or IPv6 traffic, or both. (Options: IPv4, IPv6, Any)

– 165 –

Chapter 5 | Site WiFi 6 Configuration
Firewall Settings

Source — The source interface. (Options: Any, Default Local Network,
Internet, Guest Network, Hotspot Network)Protocol — Defines the protocol type of packets. (Options: Any, TCP+UDP,
TCP, UDP, ICMP)Destination — The destination interface. (Options: Any, Default Local
Network, Internet, Guest Network, Hotspot Network)

Port Forwarding Port Forwarding can be used to map an inbound protocol type (TCP/UDP) and port
to an “internal” IP address and port. The internal (local) IP addresses are the IP
addresses assigned to local devices at the edge of a network, and the external IP
address is the IP address assigned to the AP interface. This allows remote users toaccess different servers on your local network using your single public IP address.

Remote users accessing services such as web or FTP at your local site through yourpublic IP address, are redirected (mapped) to other local server IP addresses and
TCP/UDP port numbers. For example, if you set Protocol/External Port to TCP/80(HTTP or web) and the Destination IP/Destination Port to 192.168.3.9/80, then all
HTTP requests from outside users are forwarded to 192.168.3.9 on port 80.
Therefore, by just using your external IP address provided by your ISP, Internet users
can access the services they need at the local addresses to which you redirect them.
The more common TCP service port numbers include: HTTP: 80, FTP: 21, Telnet:
23, and POP3: 110.
Figure 162: Port Forwarding

The following items are displayed on this page:Enabled — Enables port forwarding.

Name — User-defined name. (Range: 1-30 characters)Protocol — Set the protocol type to which port forwarding is applied. (Options:
TCP, UDP, TCP+UDP)

External Port — The Internet traffic TCP/UDP port number. (Range: 1-65535)



Destination IP — The destination IP address on the local network.

Destination Port — The destination protocol port. (Range: 1-65535)– 166 –

Chapter 5 | Site WiFi 6 Configuration
Firewall Settings

ARP Inspection ARP Inspection is a security feature that validates the MAC Address bindings for

Address Resolution Protocol packets. It provides protection against ARP traffic withinvalid MAC-to-IP address bindings, which forms the basis for certain “man-in-themiddle” attacks. This is accomplished by intercepting all ARP requests andresponses and verifying each of these packets before the local ARP cache is
updated or the packet is forwarded to the appropriate destination. Invalid ARP
packets are dropped.

Figure 163: ARP Inspection

The following items are displayed on this page:

ARP Inspection — When enabled, ARP packets are validated against ARP
spoofing.

Force DHCP — Allows an AP to only learn MAC/IP pair information through
DHCP packets. Since devices configured with static IP address do not send
DHCP traffic, any clients with static IP addresses will be blocked by APs unlesstheir MAC/IP pair is listed and enabled in the Static Trust List.



Trust List Broadcast — Lets other APs learn the trusted MAC/IP pairs to issue
ARP requests.



Static Trust List — Adds the MAC or MAC/IP pairs of devices that are trusted
to issue ARP requests. Other network nodes can still send their ARP requests,
but if their IP appears in the static list with a different MAC, their ARP requests
will be dropped.

– 167 –

Chapter 5 | Site WiFi 6 Configuration
Hotspot Settings

DHCP Snooping DHCP snooping is used to validate and filter DHCP messages received by APs.

When DHCP snooping is enabled, DHCP messages received from a device notlisted in the DHCP snooping table are dropped.

You can add known and trusted DHCP servers to the table by specifying their MAC
and IP addresses.
Figure 164: DHCP Snooping

The following items are displayed on this page:Enable — Enables DHCP Snooping.

Trust DHCP Server MAC — The MAC address of a known and trusted DHCP
server.



Trust DHCP Server IP — The IP address of a known and trusted DHCP server.



Remark — A comment relating to the DHCP server configured.

Hotspot Settings
The Hotspot settings page can configure Internet access for the general public inplaces such as coffee shops, libraries, and hospitals. Specific access rights may
also be defined through a RADIUS server.
When setting up a hotspot service, you must also navigate to the wireless SSID
configuration page and select “Hotspot-Controlled” as the network behavior on an
SSID interface. (See “Wireless SSID Configuration” on page 141.)

General Settings The General Settings section on the Hotspot page configures the basic hotspot
mode.

– 168 –

Chapter 5 | Site WiFi 6 Configuration
Hotspot Settings

Figure 165: Hotspot General Settings

The following items are displayed on this page section:


Hotspot Enabled — Enables or disables the hotspot service.
Select the hotspot mode below. (Hotspot Mode will be statically set to “External
Portal” for all firmware greater than 1.1.4. Please upgrade to firmware greaterthan 1.1.4 in order to take advantage of this setting.)External Captive Portal Service — This option will show the hotspot guest
an externally hosted captive portal splash page and may prompt them tologin, depending on how you have configured your service settings.
Choose this option if you have signed up with a third-party captive portal
service provider, such as Cloud4Wi or HotSpotSystem.

No Authentication — This option shows the hotspot guest yourcustomized, locally hosted captive portal splash page, and will not require
the guest to login before accessing the Internet. If you fill out the (optional)
terms of service text, the guest will be required to accept these before they
can access the Internet.

Simple Password-only Splash Page — This option will show the hotspot
guest your customized, locally hosted captive portal splash page, and will
require them to enter a simple password to login and access the Internet. If
you fill out the (optional) terms of service text, the guest will be required toaccept these before they can access the Internet.



Local Splash Page with External RADIUS — This option shows the
hotspot guest your customized, locally hosted captive portal splash page,
and will require them to enter a valid RADIUS user name and password tologin and access the Internet. If you fill out the (optional) terms of service
text, the guest will be required to accept these before they can access theInternet.



Remote Splash Page with External RADIUS — This is an AuthPort addon feature (see “Using the AuthPort Add-On” on page 66). The hotspot will
be redirected to an external splash page and authenticate with an external
RADIUS server.

– 169 –

Chapter 5 | Site WiFi 6 Configuration
Hotspot Settings

Smart Isolation — Enables network traffic to be restricted to the specified
network:

Disable (full access) — There is no traffic isolation. Clients can access theInternet and other devices on the local LAN. This is the option to choose if
you trust the clients that will be connecting to your network.

Internet access only — Traffic from this network can only be routed to andfrom the Internet. This is the option to choose for hotspot users or users
connecting to a guest network.

LAN access only — Traffic from this network is restricted to local LAN
devices only.

Internet-only (strict) — This is the same as “Internet access only,” but withthe additional restriction that users cannot access resources or devices onany private network (192.168.0.0, 172.16.0.0, 10.0.0.0, etc.). This isuseful if an AP is “double NAT’ed” and the network upstream from yourAP's gateway is another private network.

Network Settings The Network Settings section on the Hotspot page configures local network settings
for the hotspot service.

Figure 166: Hotspot Network Settings

The following items are displayed on this page section:

IP Address — Specifies the IP address for the hotspot. Valid IPv4 addresses
consist of four decimal numbers, 0 to 255, separated by periods.
(Default: 192.168.182.1)

Netmask — Network mask for the associated IP subnet. This mask identifies
the host address bits used for routing to specific subnets.



DHCP Gateway — The gateway used to access the DHCP server.



DHCP Gateway Port — The UDP/TCP port used to access the DHCP server.



DNS 1 — The IP address of the primary Domain Name Server on the network.
A DNS maps numerical IP addresses to domain names and can be used to
identify network hosts by familiar names instead of the IP addresses.
– 170 –

Chapter 5 | Site WiFi 6 Configuration
Hotspot Settings



DNS 2 — The secondary DNS server available to DHCP clients.



DNS Domain Name — The domain name used to resolve incomplete hostnames via the Domain Name System. (Range: 1-32 characters)

DHCP Server The DHCP Server section on the Hotspot page configures DHCP address poolsettings for the hotspot service.

Figure 167: Hotspot DHCP Server Settings

The following items are displayed on this page section:


DHCP Start — Starting number of (last numeric field) in address pool.
(Range: 1-254; Default: 10)



DHCP Limit — Ending number of (last numeric field) in address pool.
(Range: 1-245; Default: 245)

Lease Time — The duration that an IP address is assigned to a DHCP client.
(Range: 600-43200 seconds; Default: 3600 seconds)

RADIUS Server The RADIUS Server section on the Hotspot page configures RADIUS server settings
for the hotspot service.

Figure 168: Hotspot RADIUS Server Settings– 171 –

Chapter 5 | Site WiFi 6 Configuration
Hotspot Settings

The following items are displayed on this page section:
Enable RADIUS Auth — Enables RADIUS authentication for clients attempting
to access the captive portal.



RADIUS Server Address — IP address or host name of the primary RADIUS
server.



Backup RADIUS server address — IP address or host name of the secondary
RADIUS server.



RADIUS server shared secret — A shared text string used to encrypt
messages between the access point and the RADIUS server. Be sure that thesame text string is specified on the RADIUS server. Do not use blank spaces inthe string. (Range: 1-255 characters).



RADIUS server auth port — RADIUS server UDP port used for authentication
messages. (Range: 1-65535, Default: 1812)

RADIUS server acct port — RADIUS server UDP port used for accounting
messages. (Range: 1-65535, Default: 1813)



Enable RadSec — An authentication and authorization protocol fortransporting RADIUS datagrams over TCP and TLS. RadSec replaces UDP usedin the initial RADIUS design, providing a reliable transport protocol and more
extensive security for the packet payload.

Auth method — Selects the encryption method to use for messages between
the AP and the RADIUS server; CHAP, PAP, or MS-CHAPv2. The encryption
method must match that used by the RADIUS server. (Default: CHAP)

Local ID — Local RADIUS server identifier.



Local Name — Local RADIUS server name

Generate NAS ID — This option will generate a unique NAS ID for eachdevice in this site.

NAS ID — Local RADIUS server operation identifier.

– 172 –

Chapter 5 | Site WiFi 6 Configuration
Hotspot Settings

Captive Portal The Captive Portal section on the Hotspot page configures portal details for the
hotspot service.

A captive portal forces a hotspot client to access a welcome web page before
gaining further access to the Internet. The welcome page may requireauthentication and/or payment.
Figure 169: Hotspot Captive Portal Settings

Depending on the hotspot mode selected, the following items are displayed on thispage section:
Common to all Modes

Landing URL — Indicates the URL to which the user is directed after logging into the captive portal.

Idle Timeout — The maximum a connection can remain inactive before it isclosed. (Range: 0-86400 seconds)

Session Timeout — The maximum time a client can stay logged in to thehotspot. (Range: 0-86400 seconds)

Common to all Modes Except External Captive Portal Service and Remote Splash
Page with External RADIUSHTTPS Login — Enables HTTPS for the captive portal.

– 173 –

Chapter 5 | Site WiFi 6 Configuration
Hotspot Settings

Common to all Modes Except External Captive Portal ServiceCustomize Splash Page — When enabled, fill in the information that is used
to create the local captive portal welcome page.


Title — Enter the text you want to display as the title on the page.

Background Color — Click the button to select a color for the page
background.



Logo Image — Click the “Upload” button to send an image file. Files arelimited to a size of 1MB and the image must have a maximum height andwidth of 1000 pixels.

Terms and Conditions — Enter text in the window that define the captive
portal terms and conditions, and then use the controls to format the text.
Alternatively, click the “Use Default Terms and Conditions” button to importa generic text that you can then edit.

External Captive Portal Service Mode

Captive portal URL — Host name of Internet service portal for the hotspot.

Captive portal secret — The password used for logging into the hotspot.

Swap Octets — Swap the values of the reported “input octets” and “output
octets.”Simple Password-only Splash Page Mode

Splash Page Password — The password required for users to log in andaccess the Internet.

Authentication The Auth Exceptions section on the Hotspot page configures a “walled garden” andExceptions white list for the hotspot service.
Figure 170: Hotspot Authentication Exceptions– 174 –

Chapter 5 | Site WiFi 6 Configuration
System Settings

The following items are displayed on this page section:Walled garden — Enter a list of domains or IP addresses in CIDR notation that
hotspot users can access before being authenticated by the captive portal.
Wildcard domains can be specified in the format of domain.com (allow domain
and all sub-domains), or .domain.com (only allow sub-domains).



Auth white list — A list of MAC addresses that are allowed to bypass thecaptive portal to access the Internet.

System Settings
The System Settings page allows you to control remote management access to APs
and configure NTP time servers, Telnet, Web, and SNMP management interfaces
are enabled and open to access from the Internet. To provide more security,
specific services can be disabled and management access prevented from theInternet.

General Settings The General Settings section on the System Settings page can be used to configure
the cloud status LED, reset button, and time zone.

Figure 171: General System Settings

The following items are displayed on this page:Enable LEDs — Only supported on ECW5211, ECWO5211, OAP100, andSpark Wave 2/SunSpot Wave 2 running 3.0.0+ firmware. The LEDs are onwhen a radio is enabled and operating normally.

Enable reset button — Enables or disables the hardware reset button. Notethat the reset button cannot be disabled at the site level.

Timezone — To display a time corresponding to your local time, choose oneof the predefined time zones from the pull-down list.



Number of boot retries — The maximum number of bootup retries before
switching to the next boot bank. (Range: 1-254; Default: 3)– 175 –

Chapter 5 | Site WiFi 6 Configuration
System Settings



MSP Mode — Enables the Managed Service Provider (MSP) mode thatprevents end-users from accessing and modifying most device settings fromuser-defined user accounts. Management access from “root” and “admin”
accounts still provide full access to all device settings. (Default: Disabled)
With MSP mode enabled, service providers have the option of making specificwireless SSID settings available for user configuration by enabling the “Local
Configurable” setting.

Note: Do not enable MSP Mode and “Always follow cloud configuration”(page 60) at the same time. This will cause the device configuration not to be
updated to ecCLOUD properly.

SSH The Secure Shell (SSH) acts as a secure replacement for Telnet. The SSH protocol

uses generated public keys to encrypt all data transfers passing between the accesspoint and SSH-enabled management station clients and ensures that data travelingover the network arrives unaltered. Clients can then securely use the local username and password for access authentication.

Note that SSH client software needs to be installed on the management station toaccess the access point for management via the SSH protocol.
Figure 172: SSH Server Settings

The following items are displayed on this page:

SSH Server — Enables or disables SSH access to the access point.
(Default: Enabled)

SSH Port — Sets the TCP port number for the SSH server on the access point.
(Range: 1-65535; Default: 22)Allow SSH from WAN — Allows SSH management access from the WAN.

– 176 –

Chapter 5 | Site WiFi 6 Configuration
System Settings

Discovery Tool The Edgecore Discovery agent allows the AP to be discovered by other devices on
the local network or over the Internet.

Figure 173: Discovery Tool Settings

The following items are displayed on this page:

Discovery Tool — Enables or disables the discovery tool. (Default: Enabled)Allow over WAN — Allows discovery tool access from the WAN.

Network Time Network Time Protocol (NTP) allows the access point to set its internal clock basedon periodic updates from a time server (SNTP or NTP). Maintaining an accurate
time on the access point enables the system log to record meaningful dates andtimes for event entries. If the clock is not set, the access point will only record thetime from the factory default set at the last bootup.

The access point acts as an NTP client, periodically sending time synchronization
requests to specified time servers. The access point will attempt to poll each serverin the configured sequence to receive a time update.
Figure 174: NTP Settings

The following items are displayed on this page:

NTP Service — Enables or disables sending of requests for time updates.
(Default: Enabled)NTP Servers — Sets the host names for time servers. The switch attempts to
update the time from the first server, if this fails it attempts an update from the– 177 –

Chapter 5 | Site WiFi 6 Configuration
System Settings

next server in the sequence. To configure additional servers, type in an entry inthe blank field at the bottom of the list.

SNMP Simple Network Management Protocol (SNMP) is a communication protocol

designed specifically for managing devices on a network. It is typically used toconfigure these devices for proper operation in a network environment, as well as
to monitor them to evaluate performance or detect potential problems.
Figure 175: SNMP Settings

The following items are displayed on this page:

SNMP Server — Enables or disables SNMP on the access point.
(Default: Enabled)Write Community — A community string that acts like a password andpermits access to the SNMP protocol. (Range: 1-32 characters, case sensitive;
Default: public)
The default string “public” provides read-only access to the access point’sManagement Information (MIB) database.



IPv6 Write Community — A community string for IPv6 access to the accesspoint’s Management Information (MIB) database. (Range: 1-32 characters,case sensitive; Default: private6)



Read Community — A community string for read-only access to the accesspoint’s Management Information (MIB) database. (Range: 1-32 characters,case sensitive; Default: public)

IPv6 Read Community — A community string for IPv6 read-only access to theaccess point’s Management Information (MIB) database. (Range: 1-32
characters, case sensitive; Default: public6)– 178 –

Chapter 5 | Site WiFi 6 Configuration
System Settings

Telnet Telnet is a remote management tool that can be used to configure the access pointfrom anywhere in the network. However, note that Telnet is not secure from hostileattacks. Telnet provides access to a Linux-based interface which is used for device
analysis and debugging.
Figure 176: Telnet Server Settings

The following items are displayed on this page:Telnet Server — Enables or disables Telnet access to the access point.
(Default: Enabled)Telnet Port — Sets the TCP port number for the Telnet server on the accesspoint. (Range: 1-65535; Default: 23)Allow Telnet from WAN — Allows Telnet management access from the WAN.

Web Server A Web browser provides the primary method of managing the access point. BothHTTP and HTTPS service can be accessed independently. If you enable HTTPS, youmust indicate this in the URL: https://device:port_number]

When you start HTTPS, the connection is established in this way:

The client authenticates the server using the server’s digital certificate.

The client and server negotiate a set of security protocols to use for theconnection.



The client and server generate session keys for encrypting and decrypting data.

The client and server establish a secure encrypted connection.



A padlock icon should appear in the status bar for most browsers.

– 179 –

Chapter 5 | Site WiFi 6 Configuration
System Settings

Figure 177: Web Server Settings

The following items are displayed on this page:

HTTP Port — The TCP port to be used by the HTTP Web browser interface.
(Range: 1-65535; Default: 80)Allow HTTP from WAN — Allows HTTP management access from the WAN.

HTTPS Port — The TCP port to be used by the HTTPS Web browser interface.
(Range: 1-65535; Default: 443)

Allow HTTPS from WAN — Allows HTTPS management access from the
WAN.

Remote Syslog Use this feature to send log messages to a Syslog server.
Figure 178: Remote Log Settings

The following items are displayed on this page:

Remote Syslog — Enables/disables the logging of debug or error messages tothe remote logging process. (Default: Disabled)Server IP — Specifies the IP address of a remote server which will be sent
syslog messages.

– 180 –

Chapter 5 | Site WiFi 6 Configuration
System SettingsServer Port — Specifies the UDP port number used by the remote server.
(Range: 1-65535)

Log Prefix — Sets the prefix for the log file sent to the specified server. The filesuffix “log” is used.



Track connections — Sends wireless client connection log messages to the
Syslog server.

Multicast DNS Use this feature to enable Multicast DNS support on APs. Multicast DNS can beused on small networks that do not have a DNS server to resolve host names tomulticast IP addresses.

Multicast DNS settings are available only on devices with mDNS support.
Figure 179: Multicast DNS Settings

The following items are displayed on this page:

MDNS — Enables or disables multicast DNS support. (Default: Enabled)

LLDP Link Layer Discovery Protocol (LLDP) is used to discover basic information aboutneighboring devices in a network. LLDP is a Layer 2 protocol that uses periodic
broadcasts to advertise information about the sending device.

Figure 180: LLDP Settings

The following items are displayed on this page:Enable — Enables the sending of LLDP advertisements about the AP toneighboring devices in the network. (Default: Disabled)Tx Interval (seconds) — Sets the periodic transmit interval for LLDP
advertisements. (Range: 5-32768 seconds; Default: 30 seconds)– 181 –

Chapter 5 | Site WiFi 6 Configuration
System SettingsTx Hold (number of time(s)) — Configures a time-to-live (TTL) value sent in
the LLDP advertisements as shown in the formula below. (Range: 2-10;
Default: 4)
The time-to-live tells the receiving LLDP agent how long to retain all information
pertaining to the sending device if it does not transmit updates in a timely
manner.
The TTL in seconds is based on the following rule:
minimum value ((Tx Interval * Tx Hold), or 65535)
Therefore, the default TTL is 4*30 = 120 seconds.

iBeacon The AP supports the iBeacon standard based on Bluetooth Low Energy (BLE).

Devices with BLE Beacons can provide location-based services to BLE clients, suchas phones, that can recognize the beacon advertisements, extract the provided
information, and then take actions based on the content.

Figure 181: iBeacon Settings

The following items are displayed on this page:Enable — Enables iBeacon support on the AP. (Default: Enabled)

UUID — The iBeacon Universally Unique Identifier that advertises the beacon
service. The UUID contains 32 hexadecimal digits in five groups, separated byhyphens.



Major — The iBeacon value that is used to identify a beacon group.
(Range: 0-65535)



Minor — The iBeacon value that is used to identify individual beacons within agroup. (Range: 0-65535)

Tx Power — Sets the BLE radio transmit power (supported only on EAP101 andEAP104). (Range: 5 dBm to -20 dBm; Default: 5 dBm)

– 182 –

Chapter 5 | Site WiFi 6 Configuration

OpenRoaming

OpenRoaming
OpenRoaming provides a standard for public-access Wi-Fi networks to support
seamless roaming between wireless networks. An OpenRoaming network advertises
its public Wi-Fi capabilities and services so that clients can decide if they want toconnect to the network.
Up to 32 OpenRoaming profiles can be configured and applied to specific wirelessnetworks (see “OpenRoaming” under “Adding an SSID” on page 142). Click “Add
Custom Openroaming” to configure a profile.
Figure 182: OpenRoaming Profile

The following items are displayed on this page:Internet Access — Enable if this network provides access to the Internet.

– 183 –

Chapter 5 | Site WiFi 6 Configuration
OpenRoaming

Access Network Type — Select one from the predefined list.
Private network — Home and enterprise networks that unauthorized users
cannot access.



Private network with guest access — A private network that provides forguest access. A typical example would be an enterprise network that offers
guest access.



Chargeable public network — A network that is available to all users,
but requires a fee.

Free Public Network — A network that is available to all users without any
fees.



Personal device network — A network for peripheral connectivity in an
ad-hoc mode. For example, a camera that connects to a printer.

Emergency services only network — A network that is dedicated foraccess to emergency services only.



Test or experimental — A network for tests or experimental work.

Wildcard — When selected, the AP will reply to clients regardless of the
network type requested by the client query.



HESSID — The Homogenous Extended Service Set Identifier (HESSID) for the
OpenRoaming network. When configured, the HESSID (a MAC address)
uniquely identifies all APs belonging to the same network.

Venue Group — Identifies the general class of the venue. Select from thepredefined list.

Venue Type — Identifies the specific type of venue within each group.

Network Auth Type — Specifies the authentication required for the network.
Select an option from the predefined list. (Default: “Acceptance of terms andconditions”)

IPv4 Address Type — Specifies the IPv4 address type available from the
network.



IPv6 Address Type — Specifies the IPv6 address type available from the
network

Operating Class — A standard index (based on IEEE Std 802.11-2012 Annex
E) that specifies the AP supported operating channels.

– 184 –

Chapter 5 | Site WiFi 6 Configuration

OpenRoaming

Venue Name Information — Configures a list of up to 10 venue names.
Language — Select a language from the list. (Default: English)Name — The name of the network venue. Multiple names can be added
to the list.



URL — Specifies a URL that provides additional venue information to users.



NAI Realm List — (Optional) The network access identifier (NAI) realm list
identifies those service provider or other networks that are accessible throughthe AP. By discovering which authentication realms are supported by a network,a mobile device can selectively authenticate to its preferred network. Up to 10
identifiers can be configured.



Operator Friendly Name — The name of the network operator and thespecified language. Up to 10 names can be configured.

Cellular Network Information List (PLMN) — (Optional) Identifies the 3GPP
cellular networks available through the AP. Specifically, this field identifies the
Public Land Mobile Network (PLMN) ID, comprised of the Mobile Country Code
(MCC) and Mobile Network Code (MNC) of the mobile operator. Up to 10
PLMN IDs can be configured. Input the pair of MCC, MNC.
For example: 400, 00
MCC: Three decimal digits (000-999)
MNC: Two (00-99) or three decimal digits (000-999)

Domain Name List — Lists one or up to 10 domain names for the entity
operating the AP. This is critical for OpenRoaming network selection policy, as it
identifies the operator of the network. It indicates to the mobile device whether
they are at a home hotspot or a visited hotspot.

Roaming Consortium List — (Optional) A roaming consortium is a group ofservice providers (SP) with which a user’s credentials can be used forauthentication. Each roaming consortium is identified by an organization
identifier (OI) that is assigned by the IEEE. An OI is often 24 bits in length, but
can also be 36 bits. Up to 10 identifiers can be configured.

– 185 –

6

Site TerragraphConfiguration
This chapter describes configuration settings for Metrolinq Terragraph units at the
Site level. It includes the following sections:“Metrolinq Terragraph Configuration” on page 187

“VLAN Settings” on page 190– 186 –

Chapter 6 | Site Terragraph Configuration

Metrolinq Terragraph Configuration

Metrolinq Terragraph Configuration
The network connectivity and topology for Metrolinq Terragraph units can be
defined on the PoP node when the local controller is enabled. After defining the
topology, the PoP will find the nodes and set up links automatically.
Note: When configuring Metrolinq Terragraph units, be sure to follow thesepoints:1. After resetting a PoP node to defaults, you should delete all nodes and links, andthen re-add them to the Site Configuration page.
2. Be sure to delete all related links and nodes before you delete or move a device
to another site.
Figure 183: Site Terragraph Configuration

The Terragraph site configuration page includes these items:


Add Node — Fill in correspond type and Radio MAC to add Node.

– 187 –

Chapter 6 | Site Terragraph Configuration
Metrolinq Terragraph Configuration

Figure 184: Add Terragraph Node

Name — The name of the node. It is defined automatically based on thenode type, but can be modified afterward.



MAC — The system MAC address of the node. For a DN, the system MAC
address can be found on the device’s label or on the Dashboard tab. For a
CN, use the radio MAC as the node MAC.

Type — Set the node as Distribution Node (DN) or Client Node (CN).

Radio A/B/C/D — The MAC addresses of the radios.

Pop — Only one of the MLTG-360 devices can be the PoP node in a
topology.
Note that POP DN can only be named as “POP.”

Delete Node — Delete the node from the topology. You need to delete all
related links before deleting a node.

Figure 185: Delete Terragraph Node

Name — The name of the node.



MAC — The system MAC address of the node.

– 188 –

Chapter 6 | Site Terragraph Configuration

Metrolinq Terragraph Configuration



Add Link — Select two nodes and corresponding radio MACs to establish alink.

Figure 186: Add Terragraph Link



Node A — Selects the node A name.



MAC A — Selects the node A radio MAC address.



Node B — Selects the node B name.



MAC B — Selects the node B radio MAC address.



Channel — Select the working channel. Channels 1 to 4 are available.

Delete Link — Select a specific node pair to delete a link.

Figure 187: Delete Terragraph Link



Node A — Selects the node A name.



MAC A — Selects the node A radio MAC address.



Node B — Selects the node B name.



MAC B — Selects the node B radio MAC address.

– 189 –

Chapter 6 | Site Terragraph Configuration
VLAN Settings

VLAN Settings
QinQ tagging adds a second VLAN tag to the Ethernet frame, which then contains
the original VLAN tag and additional information, such as the service provider
VLAN. This allows network operators to extend VLANs across multiple switches andservice provider networks, creating a more scalable and flexible networkarchitecture.
After configuring the VLANs, data traffic from the LAN side of a CN device will be
encapsulated with configured S-VLAN and C-VLAN headers, and then be
forwarded to the uplink of the POP node.
This feature is available for MLTG devices with firmware 1.5.0 and above.
Figure 188: Site Terragraph VLAN Settings

The following items are displayed on this page:Name — A name that identifies the VLAN configuration.



S-VLAN ID — The Service VLAN, which is a VLAN that is used to differentiate
traffic from different customers or services in a service provider network.



C-VLAN ID — The Customer VLAN, which is a VLAN that is used todifferentiate traffic from different customers in a service provider network.

– 190 –

7

WiFi 5 Device Configuration

This chapter describes configuration settings for access points at the Device level. It
includes the following sections:“Accessing Device-Level Configuration” on page 192

“Device Radio Settings” on page 194– 191 –

Chapter 7 | WiFi 5 Device Configuration
Accessing Device-Level Configuration

Accessing Device-Level Configuration
When a device’s “Inheritance Policy” is enabled, the device is configured from theSite level. However, a device can be individually configured at the Device level andthe settings will override the Site-level configuration.
Note: Individual device overrides can be reset to the Site-level configuration byclicking the “Use Site Settings” button on the page where a setting has beenchanged.
In addition, wireless devices include settings not configurable at the Site level, suchas advanced radio settings and features unique to a specific product. These settings
can only be configured at the Device level.
To access configuration for a device, click on the device name from the Site-level
list of devices (also available from the Cloud-level list of devices).
Figure 189: Accessing Device-Level Configuration

From the Device dashboard, click on “Configuration” on the Device menu toaccess a device’s configuration.

– 192 –

Chapter 7 | WiFi 5 Device Configuration
Accessing Device-Level Configuration

Figure 190: Device-Level Dashboard

The Device Configuration page includes tabbed sections similar to the Site
Configuration page.
Figure 191: Device Configuration

Device-level configuration for SSIDs are indicated in the “Origin” column of the
SSID list; either “Site” or “Device” is displayed. Most other configuration items at
the Device level are identical to those at the Site level.
This chapter only covers the device configuration that is different from the Site-level
configuration, as documented in “Site WiFi 5 Configuration” on page 97.

– 193 –

Chapter 7 | WiFi 5 Device Configuration
Device Radio Settings

Device Radio Settings
Click the “Radio Settings” tab to configure 5 GHz and 2.4 GHz radio settings.
Note that settings apply to all configured SSID interfaces.
The following items are displayed on the Radio Settings tab. Configuration options
apply to both the 5 GHz and 2.4 GHz radios unless otherwise indicated.

Global Settings
Figure 192: Device Global Radio Settings

Regulatory Country — The wireless device regulatory setting. This setting isdisplayed but not configurable at the Device level.
The AP’s country code must be correctly set to be sure that the radios operateaccording to permitted local regulations. That is, setting the country code
restricts operation of the AP to the radio channels and transmit power levels
permitted for wireless networks in the specified country.

Band Steering — When enabled, clients that support 2.4 GHz and 5 GHz are
first connected to the 5 GHz radio. This feature helps balance the client load
over the two radio bands. Note that both radios must have configured SSIDs
that match for this feature to fully operate. (Default: Disabled)

General Radio Settings
Figure 193: Device General Radio SettingsEnable Radio — Enables or disables the wireless service on this interface.

– 194 –

Chapter 7 | WiFi 5 Device Configuration

Device Radio Settings



Operation Mode — Selects the mode in which the AP radio will function.


Access Point (Auto-WDS) — The AP operates as an access point in WDS
mode, which accepts connections from APs in Client WDS mode. (This is
the default setting.)
In this mode, the AP provides services to clients as a normal access point.
WDS is used to automatically search for and connect to other AP nodes
using the same SSID and security settings.

Client — The AP can provide a wireless connection to another AP. In thismode, it can pass information from or to locally wired hosts, but does notprovide services to any wireless clients.



Client WDS — The AP operates as a client station in WDS mode, which
can connect to other access points in Auto-WDS mode. Connection toanother AP can be made automatically by other access points operating in
Auto-WDS mode.

Site Survey — Click the button to scan for other Wi-Fi devices in the device
location.

Advanced Radio Settings
Figure 194: Device Advanced Radio Settings

Probe Req. Data Push — Enable Client Probe Request Data Push for thisradio. When enabled, the radio will push client probe request data in JSON
format to your specified URL.



Push URL — The web address where probe request data from this radio will bepushed.

– 195 –

Chapter 7 | WiFi 5 Device Configuration
Device Radio Settings

Physical Radio Settings
Figure 195: Device Physical Radio Settings







802.11 Mode — Defines the radio operation mode.


5 GHz Radio — Options: 802.11a, 802.11a+n, 11ac+a+n;
Default: 802.11ac+a+n



2.4 GHz Radio — Fixed: 802.11b+g+nChannel Bandwidth — The basic Wi-Fi channel bandwidth is 20 MHz, but bybonding channels together to create 40 MHz or 80 MHz channels, higher datatransmission rate can be achieved. However, selecting larger channel
bandwidths reduces the number a radio channels available.


5 GHz Radio — Options include 20, 40, and 80 MHz. (Default: 80 MHz)



2.4 GHz Radio — Options include 20 and 40 MHz. (Default: 40 MHz)

Channel — The radio channel that the access point uses to communicate withwireless clients. The available channels are dependent on the radio, Channel
Bandwidth, and Regulatory Country settings. You can also click the “Edit
Channel List” button to select specific available channels to use for each radio
interface.

– 196 –

Chapter 7 | WiFi 5 Device Configuration

Device Radio Settings

Selecting Auto enables the access point to automatically select an unoccupied
radio channel. (Default: Auto)
Figure 196: 5 GHz Radio Channels

Figure 197: 2.4 GHz Radio Channels

Tx Power — Adjusts the maximum power of the radio signals transmitted fromthe access point. The higher the transmission power, the farther thetransmission range. Power selection is not just a trade off between coveragearea and maximum supported clients. You also have to ensure that high-powersignals do not interfere with the operation of other radio devices in the service
area. (The range of power settings and defaults are dependent on the APmodel and the Regulatory Country setting.)

Fragmentation Thresh. — Sets the maximum frame size above which packets
are fragmented. This reduces the time required to transmit the frame, and– 197 –

Chapter 7 | WiFi 5 Device Configuration
Device Radio Settings

therefore reduces the probability that it will be corrupted (at the cost of moredata overhead). (Range: 256-2346 bytes; Default: 2346 bytes)


RTS Thresh. — Sets the packet size threshold at which a Request to Send (RTS)
frame must be sent to a receiving station prior to the sending station starting
communications. The access point sends CTS frames to a receiving station tonegotiate the sending of a data frame. After receiving an RTS frame, the accesspoint sends a CTS (clear to send) frame to notify the sending station that it canstart sending data.
If the RTS threshold is set to 1, the access point always sends RTS signals. If set
to 2347, the access point never sends RTS signals. If set to any other value, andthe packet size equals or exceeds the RTS threshold, the RTS/CTS (Request to
Send / Clear to Send) mechanism will be enabled.
The access points contending for the medium may not be aware of each other.
The RTS/CTS mechanism can solve this “Hidden Node Problem.” (Range: 12347 bytes: Default: 2347 bytes)



SGI — The 802.11n draft specifies two guard intervals: 400ns (short) and
800ns (long). Support of the 400ns Short Guard Interval is optional for transmit
and receive. The purpose of a guard interval is to introduce immunity to
propagation delays, echoes, and reflections to which digital data is normallyvery sensitive. Enabling the SGI sets it to 400ns. (Default: Enabled)STBC — Space-time Block Coding sends multiple copies of the same data overa number of antennas, using the various received versions to improve thereliability of data transfer. The transmitted signal may traverse a difficult
environment with scattering, reflection, and refraction which may then be
further corrupted by thermal noise in the receiver, so some of the received
copies will be better than others. This redundancy results in a higher chance ofbeing able to use one or more of the received copies to correctly decode thereceived signal. (Default: Disabled)

DFS — This field is available only if the selected radio mode operates in the
5 GHz frequency.
For radios in the 5 GHz band, When DFS support is on and the regulatory
domain requires radar detection on the channel, the Dynamic Frequency
Selection (DFS) and Transmit Power Control (TPC) features of 802.11h areactivated. The default is Off.
DFS is a mechanism that requires wireless devices to share spectrum and avoid
cochannel operation with radar systems in the 5 GHz band. DFS requirements
vary based on the regulatory domain, which is determined by the country code
setting of the AP. (Default: Enabled)

20/40MHz Coexist — Applies only to the 2.4 GHz radio. This option allows
802.11n 20 MHz and 40 MHz channel bandwidths to operate together in thesame network. (Default: On)– 198 –

Chapter 7 | WiFi 5 Device Configuration

Device Radio Settings– 199 –

8

WiFi 6 Device Configuration

This chapter describes configuration settings for WiFi 6 access points at the Device
level. It includes the following sections:“Accessing Device-Level Configuration” on page 201

“Device Radio Settings” on page 202

“System Settings” on page 209– 200 –

Chapter 8 | WiFi 6 Device Configuration
Accessing Device-Level Configuration

Accessing Device-Level Configuration
When a device’s “Inheritance Policy” is enabled, the device is configured from theSite level. However, a device can be individually configured at the Device level andthe settings will override the Site-level configuration.
Note: Individual device overrides can be reset to the Site-level configuration byclicking the “Use Site Settings” button on the page where a setting has beenchanged.
In addition, wireless devices include settings not configurable at the Site level, suchas advanced radio settings and features unique to a specific product. These settings
can only be configured at the Device level.
To access configuration for a device, click on the device name from the Site-level
list of devices (also available from the Cloud-level list of devices).
Figure 198: Accessing Device-Level Configuration

From the Device dashboard, click on “Configuration” on the Device menu toaccess a device’s configuration.
Figure 199: Device-Level Dashboard– 201 –

Chapter 8 | WiFi 6 Device Configuration
Device Radio Settings

The Device Configuration page includes tabbed sections similar to the Site
Configuration page.
Figure 200: Device Configuration

Device-level configuration for SSIDs are indicated in the “Origin” column of the
SSID list; either “Site” or “Device” is displayed. Most other configuration items at
the Device level are identical to those at the Site level.
This chapter only covers the device configuration that is different from the Site-level
configuration, as documented in “Site WiFi 6 Configuration” on page 140.

Device Radio Settings
Click the “Radio Settings” tab to configure 5 GHz and 2.4 GHz radio settings.
Note that settings apply to all configured SSID interfaces.
The following items are displayed on the Radio Settings tab. Configuration options
apply to both the 5 GHz and 2.4 GHz radios unless otherwise indicated.

Global Settings
Figure 201: Device Global Radio Settings

Regulatory Country — The wireless device regulatory setting. This setting isdisplayed but not configurable at the Device level.

– 202 –

Chapter 8 | WiFi 6 Device Configuration

Device Radio Settings

The AP’s country code must be correctly set to be sure that the radios operateaccording to permitted local regulations. That is, setting the country code
restricts operation of the AP to the radio channels and transmit power levels
permitted for wireless networks in the specified country.
Band Steering — When enabled, clients that support 2.4 GHz and 5 GHz are
first connected to the 5 GHz radio. This feature helps balance the client load
over the two radio bands. Note that both radios must have configured SSIDs
that match for this feature to fully operate. (Default: Disabled)

Mesh Settings
Open Mesh is a network of interconnected node APs, of which only one has awired connection to the network (and the Internet). The other AP nodes provide
wireless links to each other and some support connections to wireless clients. The
mesh network not only extends wireless connectivity over a greater distance, butalso provides backup links should one node in the network fail.
Figure 202: Device Mesh Settings

Open Mesh — Enables Open Mesh support on the SSID interface.

Mesh ID — Name of the mesh network.

Mesh Method — Security applied on Open Mesh links.

Open — None.



WPA3-Personal — Uses WPA3 with Simultaneous Authentication of
Equals (SAE) on mesh links to other APs.

Network Behavior — One of the following connection methods must be
specified. (Default: Route to Internet)
Bridge to Internet — Configures an interface as attached to the WAN.
Traffic from this interface is directly bridged into the Internet. (SeeFigure 146, “Bridge to Internet", on page 148.)



Route to Internet — Configures an interface as a member of the LAN.
Traffic from this interface is routed across the access point and out through– 203 –

Chapter 8 | WiFi 6 Device Configuration
Device Radio Settings

an interface which is bridged to the Internet. (See Figure 147, “Route toInternet", on page 149.)


Network Name — The network to be routed. The default is “Default
local network” as displayed under LAN Settings – Local Network.

Mesh Radio — When setting up an AP to be a node in a mesh network, selectone radio interface (2.4 GHz or 5 GHz) and configure it to operate on a
specific channel (do not select Auto). Set up other AP nodes to operate on thesame radio interface, channel, and with the same SSID.

General Radio Settings
Figure 203: Device General Radio SettingsEnable Radio — Enables or disables the wireless service on this interface.

Operation Mode — Selects the mode in which the AP radio will function.


Access Point (Auto-WDS) — The AP operates as an access point in WDS
mode, which accepts connections from APs in Client WDS mode. (This is
the default setting.)
In this mode, the AP provides services to clients as a normal access point.
WDS is used to automatically search for and connect to other AP nodes
using the same SSID and security settings.

Client — The AP can provide a wireless connection to another AP. In thismode, it can pass information from or to locally wired hosts, but does notprovide services to any wireless clients.

Site Survey — Click the button to scan for other Wi-Fi devices in the device
location.

– 204 –

Chapter 8 | WiFi 6 Device Configuration

Device Radio Settings

Advanced Radio Settings
Figure 204: Device Advanced Radio Settings

Probe Req. Data Push — Enable Client Probe Request Data Push for thisradio. When enabled, the radio will push client probe request data in JSON
format to your specified URL.



Push URL — The web address where probe request data from this radio will bepushed.

Physical Radio Settings
Figure 205: Device Physical Radio Settings



802.11 Mode — Defines the radio operation mode.


5 GHz Radio — Options: 802.11a, 802.11a+n, 802.11ac+a+n,
802.11ax; Default: 802.11ax



2.4 GHz Radio — Options: 802.11b+g+n, 802.11ax; Default:
802.11ax– 205 –

Chapter 8 | WiFi 6 Device Configuration
Device Radio Settings

Channel Bandwidth — The basic Wi-Fi channel bandwidth is 20 MHz, but bybonding channels together to create 40 MHz, 80 MHz, or 160 MHz channels,
higher data transmission rate can be achieved. However, selecting larger
channel bandwidths reduces the number a radio channels available. The
available channel bandwidth is dependent on the 802.11 Mode.
(Default: 20 MHz on 2.4 GHz Radio, 80 MHz on 5 GHz Radio;
Options: 20 MHz, 40 MHz, 80MHz, 160MHz)

20MHz — For 802.11b+g+n and 802.11ax

40MHz — For 802.11b+g+n, 802.11a, 802.11a+n, 802.11ac+a+n
and 802.11ax

80MHz — For 802.11ac+a+n and 802.11ax

160MHz — (Supported on EAP104 5 GHz radio only) For
802.11ac+a+n and 802.11ax

Channel — The radio channel that the access point uses to communicate withwireless clients. The available channels are dependent on the radio, Channel
Bandwidth, and Regulatory Country settings. You can also click the “Edit
Channel List” button to select specific available channels to use for each radio
interface.
Selecting Auto enables the access point to automatically select an unoccupied
radio channel. (Default: Auto)

Figure 206: 5 GHz Radio Channels– 206 –

Chapter 8 | WiFi 6 Device Configuration

Device Radio Settings

Figure 207: 2.4 GHz Radio Channels



WME Configuration — Wireless Multimedia Extensions (WME), also known as
Wi-Fi Multimedia (WMM), is a Wi-Fi Alliance interoperability certification,
based on the IEEE 802.11e standard. It provides basic Quality of service (QoS)features for IEEE 802.11 networks. Access priority can be configured for four“Access Category”(AC) types using the following parameters:

CW Min (Minimum Contention Window) – The initial upper limit of therandom backoff wait time before wireless medium access can beattempted. The initial wait time is a random value between zero and the
CWMin value. Specify the CWMin value in the range 0-15 microseconds.
Note that the CWMin value must be equal or less than the CWMax value.



CW Max (Maximum Contention Window) – The maximum upper limitof the random backoff wait time before wireless medium access can beattempted. The contention window is doubled after each detected collision
up to the CWMax value. Specify the CWMax value in the range 0-15
microseconds. Note that the CWMax value must be greater or equal to the
CWMin value.



AIFS (Arbitration Inter-Frame Space) – The minimum amount of wait
time before the next data transmission attempt. Specify the AIFS value in therange 0-15 microseconds.



TXOP Limit (Transmit Opportunity Limit) – The maximum time an ACtransmit queue has access to the wireless medium. When an AC queue isgranted a transmit opportunity, it can transmit data for a time up to the
TXOP Limit. This data bursting greatly improves the efficiency for high datarate traffic. Specify a value in the range 0-8192 microseconds.

– 207 –

Chapter 8 | WiFi 6 Device Configuration
Device Radio Settings

Idle Timeout (sec) — The AP disconnects a client when there is no activity forthe configured amount of time. (Default: 300 seconds; Range: 60-60000
seconds)



Beacon Interval — The rate at which beacon signals are transmitted from theaccess point. The beacon signals allow wireless clients to maintain contact withthe access point. They also carry power-management and other information.
(Range: 100-1024 TUs; Default: 100 TUs)



Target Wake Time — In 802.11ax (Wi-Fi 6) mode, the AP can allow clients torequest a specific Target-Wakeup Time (TWT) to transmit or receive frames,
rather than rely on periodic beacons. This feature enables client devices tohave much longer sleep states and results in significant power savings. In
addition, the AP can control and schedule client TWTs to both manage
contention in the network and accommodate delay-sensitive traffic. (Default:
Disabled)

BSS coloring — In 802.11ax (Wi-Fi 6) mode, BSS coloring allows nearby APs
operating at the same frequency to identify traffic belonging to their own Basic
Service Set (BSS). The BSS coloring enables Wi-Fi 6 networks to operate more
efficiently in high-density environments where neighboring AP and clienttransmissions overlap. Assign a color value (a number from 1 to 63) to identify
the radio BSS, or enter value 64 to allow the AP to randomly select a color
value. (Range: 1-63, 64 random, Default: 64)

Multicast/Broadcast Rate — Allows a limit to be placed on the wirelessbandwidth consumed by multicast and broadcast packets.
Radio 5 Ghz — Options: 6M, 9M, 12M, 18M, 24M, 36M, 48M, 54M;
Default: 6M

Radio 2.4 Ghz — Options: 5.5M, 6M, 9M, 11M, 12M, 18M, 24M, 36M,
48M, 54M; Default: 5.5M



Tx Power — Adjusts the maximum power of the radio signals transmitted fromthe access point. The higher the transmission power, the farther thetransmission range. Power selection is not just a trade off between coveragearea and maximum supported clients. You also have to ensure that high-powersignals do not interfere with the operation of other radio devices in the service
area. (The range of power settings and defaults are dependent on the APmodel and the Regulatory Country setting.)

OFDMA — The 802.11ax (Wi-Fi 6) mode supports Orthogonal Frequency
Division Multiple Access (OFDMA) and this cannot be disabled.



DFS — This field is available only if the selected radio mode operates in the
5 GHz frequency.
For radios in the 5 GHz band, When DFS support is on and the regulatory
domain requires radar detection on the channel, the Dynamic Frequency– 208 –

Chapter 8 | WiFi 6 Device Configuration
System Settings

Selection (DFS) and Transmit Power Control (TPC) features of 802.11h areactivated. The default is Off.
DFS is a mechanism that requires wireless devices to share spectrum and avoid
cochannel operation with radar systems in the 5 GHz band. DFS requirements
vary based on the regulatory domain, which is determined by the country code
setting of the AP. (Default: Enabled)

System Settings
Click the “System Settings” tab to configure Device-level features.

iBeacon The AP supports the iBeacon standard based on Bluetooth Low Energy (BLE).

Devices with BLE Beacons can provide location-based services to BLE clients, suchas phones, that can recognize the beacon advertisements, extract the provided
information, and then take actions based on the content.

Figure 208: Device iBeacon Settings

The following items are displayed on this page:Enable — Enables iBeacon support on the AP. (Default: Enabled)

BLE Scan — (EAP101 and EAP104 only) Scans for all BLE devices, includingthese four types: EddyStone-UID, EddyStone-URL, EddyStone-TLM, andibeacon.



UUID — The iBeacon Universally Unique Identifier that advertises the beacon
service. The UUID contains 32 hexadecimal digits in five groups, separated byhyphens.



Major — The iBeacon value that is used to identify a beacon group.
(Range: 0-65535)



Minor — The iBeacon value that is used to identify individual beacons within agroup. (Range: 0-65535)– 209 –

Chapter 8 | WiFi 6 Device Configuration
System Settings

Tx Power — Sets the BLE radio transmit power (supported only on EAP101 andEAP104). (Range: 5 dBm to -20 dBm; Default: 5 dBm)

– 210 –

9

MetroLinq Device
Configuration
This chapter describes configuration settings for MetroLinq units at the Device level.
It includes the following sections:“MetroLinq Configuration” on page 212“Wireless SSID” on page 212

“Radio Settings” on page 213

“QoS Settings” on page 222“Traffic Control” on page 223

“Using the LinqPath Tool” on page 224– 211 –

Chapter 9 | MetroLinq Device Configuration
MetroLinq Configuration

MetroLinq Configuration
MetroLinq devices that support 2.4 GHz and 5 GHz bands can inherit
configuration settings from the Site level for these radio interfaces. The 60 GHz
radio settings cannot be inherited from the Site level and must be configured at theDevice level.
This section covers Device-level configuration for MetroLinq devices, including
specific settings not available at the Site level. For general Device-level settings, see“WiFi 5 Device Configuration” on page 191.
Figure 209: MetroLinq Device Dashboard

Wireless SSID
The MetroLinq devices support a 60 GHz radio, and often include 5 GHz and
2.4 GHz radios. SSIDs can only be configured for the 5 GHz and 2.4 GHz radiosfrom the Wireless SSID page. The 60 GHz radio supports only one SSID and it must
be configured on the Radio Settings page.
In cases where the 5 GHz radio is configured as a backup to the 60 GHz radio, theSSID must also be configured on the Radio Settings page.

– 212 –

Chapter 9 | MetroLinq Device Configuration

Radio Settings

For details on configuring Wi-Fi access SSIDs, see “Wireless SSID Configuration”
on page 98.
Figure 210: MetroLinq Device Dashboard

Radio Settings
Click the “Radio Settings” tab to configure 60 GHz, 5 GHz, and 2.4 GHz radio
settings.
Figure 211: MetroLinq Device 5 GHz Radio Settings

Global Settings The following items are displayed on this page section:
Country — The MetroLinq device regulatory setting.

– 213 –

Chapter 9 | MetroLinq Device Configuration
Radio Settings

The MetroLinq’s country code must be correctly set to be sure that the radios
operate according to permitted local regulations. That is, setting the countrycode restricts operation of the MetroLinq to the radio channels and transmit
power levels permitted for wireless networks in the specified country.

Wireless 5 GHz General Radio SettingsEnable Radio — Enables or disables the wireless service on the 5 GHz
interface. Note that the 5 GHz radio can be configured to operate as a backup
link for the 60 GHz radio.



Operation Mode — Selects the mode in which the 5 GHz radio will function.


Access Point (Auto-WDS) — The 5 GHz radio operates as an accesspoint in WDS mode, which accepts connections from APs in Client WDS
mode. (This is the default setting.)
In this mode, the 5 GHz radio provides services to clients as a normal
access point. WDS is used to automatically search for and connect to otherAP nodes using the same SSID and security settings.

Client WDS — Sets the 5 GHz radio to only operate as the backup
wireless bridge client in a point-to-point wireless link between two
MetroLinq units.

Site Survey — Click the button to scan for other Wi-Fi devices at the device
location.

Client Mode Settings (when Client WDS mode selected)


SSID —Input a unique name for the service set identifier of the 5 GHz
interface. MetroLinq units at each end of a point-to-point backup link must be
set to the same SSID. (Range: 1—32 characters)

Lock to BSSID — Enter the MAC address of the Master unit in the link to lockthe Client radio to only that unit.



Encryption — Sets the wireless security method for the 5 GHz interface. Whendisabled, there is no security on the wireless link. When enabled, MetroLinq
units in the point-to-point backup link use WPA2 security with a pre-shared key
for authentication and encryption. (Default: Disabled)

Encryption Cipher — Sets the encryption cipher to use for the WPA2 preshared key.


CCMP (AES) — AES-CCMP is the standard encryption cipher required
for WPA2. (This is the default setting.)

Auto: TKIP + CCMP (AES) — The encryption method used is
discovered during association with the link partner.
– 214 –

Chapter 9 | MetroLinq Device Configuration

Radio SettingsKey — Sets the WPA2 pre-shared key to use for encryption.

Physical Radio Settings

Channel Bandwidth — The basic Wi-Fi channel bandwidth is 20 MHz, but bybonding channels together to create 40 MHz or 80 MHz channels, higher datatransmission rate can be achieved. However, selecting larger channel
bandwidths reduces the number a radio channels available. (Options: 20, 40,
and 80 MHz; Default: 80 MHz)

Channel — The radio channel that the access point uses to communicate withwireless clients. The available channels are dependent on the radio, Channel
Bandwidth, and Regulatory Country settings. You can also click the “Edit
Channel List” button to select specific available channels to use.
Selecting Auto enables the access point to automatically select an unoccupied
radio channel. (Default: Auto)

Figure 212: 5 GHz Radio Channels

Tx Power — Adjusts the maximum power of the radio signals transmitted fromthe access point. The higher the transmission power, the farther thetransmission range. Power selection is not just a trade off between coveragearea and maximum supported clients. You also have to ensure that high-powersignals do not interfere with the operation of other radio devices in the service
area. (The range of power settings and defaults are dependent on the APmodel and the Regulatory Country setting.)

Multicast Enhancement — This feature translates multicast packets to unicast
packets before forwarding to clients, which results in more stable and fastertransmissions. If poor multicast streaming is experienced by wireless clients,
enable this feature to improve performance. (Not available when the 5 GHz
radio is set to Client WDS mode.)– 215 –

Chapter 9 | MetroLinq Device Configuration
Radio Settings

Wireless 2.4 GHz Figure 213: MetroLinq Device 2.4 GHz Radio Settings

The following items are displayed on this page section:
Enable Radio — Enables or disables the wireless service on the 2.4 GHz
interface.

Site Survey — Click the button to scan for other Wi-Fi devices at the device
location.



Channel Bandwidth — The basic Wi-Fi channel bandwidth is 20 MHz, but bybonding channels together to create 40 MHz or 80 MHz channels, higher datatransmission rate can be achieved. However, selecting larger channel
bandwidths reduces the number a radio channels available. (Options: 20 and
40 MHz; Default: 20 MHz)

Channel — The radio channel that the access point uses to communicate withwireless clients. The available channels are dependent on the radio, Channel
Bandwidth, and Regulatory Country settings. You can also click the “Edit
Channel List” button to select specific available channels to use.

– 216 –

Chapter 9 | MetroLinq Device Configuration

Radio Settings

Selecting Auto enables the access point to automatically select an unoccupied
radio channel. (Default: Auto)
Figure 214: 2.4 GHz Radio Channels

Tx Power — Adjusts the maximum power of the radio signals transmitted fromthe access point. The higher the transmission power, the farther thetransmission range. Power selection is not just a trade off between coveragearea and maximum supported clients. You also have to ensure that high-powersignals do not interfere with the operation of other radio devices in the service
area. (The range of power settings and defaults are dependent on the APmodel and the Regulatory Country setting.)

Multicast Enhancement — This feature translates multicast packets to unicast
packets before forwarding to clients, which results in more stable and fastertransmissions. If poor multicast streaming is experienced by wireless clients,
enable this feature to improve performance.

– 217 –

Chapter 9 | MetroLinq Device Configuration
Radio Settings

Wireless 60 GHz Figure 215: MetroLinq Device 60 GHz Radio Settings

General Radio The following items are displayed on this page section:
Settings
Enable Radio — Enables the wireless service on the 60 GHz interface.

Operation Mode — Selects the mode in which the 60 GHz interface willfunction.



Master — Sets the 60 GHz interface as the Master in a point-to-point orpoint-to-multi-point wireless link between two or more MetroLinq units.
MetroLinq wireless links require one unit set as Master and the other(s) set
to Client. Links to non-Edgecore devices are not supported.



Client — Sets the 60 GHz interface as a client in a point-to-point wirelesslink between two MetroLinq units.

5 GHz backup — Configures the 5 GHz interface to function as a backup to
the 60 GHz radio link. Should the 60 GHz link fail, the 5 GHz link is enabled– 218 –

Chapter 9 | MetroLinq Device Configuration

Radio Settings

to maintain connectivity. The 5 GHz backup can only be configured when the
60 GHz interface is set to Master mode. (Default: Disabled)

Wireless Networks (60 GHz radio set to Master mode)SSID —Input a unique name for the service set identifier of the 60 GHz
interface. MetroLinq units at each end of a point-to-point link must be set to thesame SSID. (Range: 1—32 characters)

Encryption — Sets the wireless security method for the 60 GHz interface.
When disabled, there is no security on the wireless link. When enabled,
MetroLinq units in the point-to-point link use WPA2 security with a pre-shared
key for authentication and encryption. (Default: Disabled)Key — Sets the WPA2 pre-shared key to use for encryption.

Client Mode Settings (60 GHz radio set to Client mode)SSID —Input a unique name for the service set identifier of the 60 GHz
interface. MetroLinq units at each end of a point-to-point link must be set to thesame SSID. (Range: 1—32 characters)

Lock to BSSID — Enter the MAC address of the Master unit in the link to lockthe Client radio to only that unit.



Encryption — Sets the wireless security method for the 60 GHz interface.
When disabled, there is no security on the wireless link. When enabled,
MetroLinq units in the point-to-point link use WPA2 security with a pre-shared
key for authentication and encryption. (Default: Disabled)Key — Sets the WPA2 pre-shared key to use for encryption.

Backup SSID (5 GHz)

SSID —Input a unique name for the service set identifier of the backup 5 GHz
interface. MetroLinq units at each end of a point-to-point link must be set to thesame 5 GHz backup SSID. (Range: 1—32 characters)

Broadcast SSID — Enables or disables sending the configured SSID in beacon
messages. (Default: Enabled)

Encryption — Sets the wireless security method for the 60 GHz interface.
When disabled, there is no security on the wireless link. When enabled,
MetroLinq units in the point-to-point link use WPA2 security with a pre-shared
key for authentication and encryption. (Default: Disabled)

Encryption Cipher — Sets the encryption cipher to use for the WPA2 preshared key.


CCMP (AES) — AES-CCMP is the standard encryption cipher required
for WPA2. (This is the default setting.)– 219 –

Chapter 9 | MetroLinq Device Configuration
Radio Settings

Auto: TKIP + CCMP (AES) — The encryption method used is
discovered during association with the link partner.

Key — Sets the WPA2 pre-shared key to use for encryption.

Physical Radio Settings

MCS Rate — The modulation and coding scheme used to set the data rate at
which the MetroLinq transmits packets on the 60 GHz interface. A setting of“Auto” sets the rate depending on the signal strength.

Channel Bandwidth — For the 60 GHz radio, a channel bandwidth of
2160 MHz or 1080 MHz can be selected. (Default: 2160 MHz)

Channel — The radio channel that the MetroLinq uses to communicate on the
60 GHz interface. The available channels are dependent on the radio,
Channel Bandwidth, and Regulatory Country settings.

Figure 216: 60 GHz Radio Channels

Tx Power — Adjusts the maximum power of the radio signals transmitted on
the 60 GHz interface. The higher the transmission power, the farther thetransmission range and higher the data rate. (The range of power settings anddefaults are dependent on the AP model and the Regulatory Country setting.)

AMPDU — Enables or disables the use of Aggregated MAC Protocol Data
Units. Physical layer (PHY) data rate improvements do not increase realthroughput beyond a point because of 802.11 protocol overheads. The main
media access control feature that provides a performance improvement isaggregation. Aggregation of MAC protocol data units (MPDUs) is referred to as
MPDU aggregation or (A-MPDU). (Default: Enabled)Client Isolation — When enabled, wireless clients can talk to the LAN, andreach the Internet if such connection is available, but they cannot communicate
with one another. (Default Off)IGMP Snooping — Enables IGMP snooping to manage and filter multicast
streams over the 60 GHz interface.
– 220 –

Chapter 9 | MetroLinq Device Configuration

Radio Settings



RSSI based failover —When enabled and the Received Signal Strength
Indicator (RSSI) of the 60 GHz link falls below the “RSSI failover limit,” the link
will failover to the 5 GHz backup link. (Default:-65, Range: -95 to -25)

Settings for MetroLinq 60 LW, 2.5-60-18-BF, 10G Tri-Band Omni
Figure 217: MetroLinq Radio BeamwidthRadio beamwidth — Sets the sector antenna beamwidth for the MetroLinq 60
LW, 2.5-60-18-BF, and 10G Tri-Band Omni. The narrower the beamwidth, themore directional the signal, and higher the antenna gain. (Options: 10, 30,
60, 90, 120 degrees; Default: 120 degrees)

DBSC — Enable Directional Beam Scan and Connect (DBSC) to address thelimitation where phased array antennas only use a quasi-omni single
directional beam to perform a wide area scanning. The lower gain of a quasiomni beam limits the maximum distance at which connections can beestablished and traffic maintained. Enabling DBSC resolves the lower gain
issue by using directed beams when scanning. (Default: Disabled)– 221 –

Chapter 9 | MetroLinq Device Configuration
QoS Settings

QoS Settings
The QoS (Quality of Service) Settings tab enables specific VLANs to be assigned ashigh priority traffic, where the data packets are tagged as high priority and aretransmitted before other packets.
The MetroLinq interfaces have three priority queues; one for control messages, one
for high priority traffic, and one for all other traffic. Packets tagged with anIEEE 802.1p priority of 4 to 7, or IP/TOS priority of 4 to 7, are classified as highpriority and placed into the high priority queue by default.
On the QoS Settings page, you can also configure up to five VLANs as high priority
traffic. That is, any data frame with one of the VLAN IDs will be classified as highpriority and put in the high priority queue.
Figure 218: MetroLinq QoS Settings

The following items are displayed on this page:

VLAN id #1-#5 — Configures a VLAN ID as high priority traffic. All five
VLANs have the same equal priority. (Range: 1-4094, 0 means disabled)

IPTV Video Stream — When enabled, causes all multicast frames to beclassified as high priority, improving performance for IPTV streams.
(Default: Disabled)– 222 –

Chapter 9 | MetroLinq Device Configuration

Traffic Control

Traffic Control
Use the Traffic Control settings to limit the uplink and downlink bandwidth for
specified devices. First create Traffic Profiles that specify the uplink and downlink
bandwidth limits, and then bind the profiles to specific device MAC addresses.
Click the “Add Profile” button to add a new profile. Give the profile a name andspecify the bandwidth limits.
To bind a profile to a MAC address, click the “Add Control” button, enter a device
MAC address, and then select the profile name form the pull-down list.
Figure 219: MetroLinq Traffic Control Settings

The following items are displayed on this page:

Traffic Control Enable — Enables the configured traffic control settings.
(Default: Disabled)Traffic Profile — Configure the required profiles.


Profile — Specify a name that describes the profile.



Download (Mbps) — Sets the maximum downlink rate to a value between
0 and 1000 Mbps. (Default: 0)Upload (Mbps) — Sets the maximum uplink rate to a value between 0 and1000 Mbps. (Default: 0)– 223 –

Chapter 9 | MetroLinq Device Configuration
Using the LinqPath ToolTraffic Control — Binds the Traffic Profiles to MAC addresses.


MAC — Device MAC address.

Profile — Configured profile name.

Using the LinqPath Tool
The Edgecore LinqPath™ tool can be used to estimate the maximum distance andsignal levels you can expect on a MetroLinq connection given the specified
parameters. Statistical rain fade calculations are included using the ITU rain model.
The LinqPath™ tool is available with a free ecCLOUD account. You can access
LinqPath by clicking the icon in the top navigation menu.
Specify the planned link details in the LinqBudget section, and then view the results
and RSSI graph to be sure it meets your required link performance.
You can save your LinqPath calculations using the “Save Results” button. Up to 10
link results can be saved in your LinqPath history.
Figure 220: MetroLinq LinqPath Settings

The following items are displayed on this page section:

Master — The MetroLinq model that will be used as the PTP or PTMP master.



Client — The MetroLinq model that will be used as the PTP or PTMP client.

– 224 –

Chapter 9 | MetroLinq Device Configuration

Using the LinqPath Tool

Target Distance — The intended distance of the link.



Channel — The radio channel that the link will operate on.

Channel Width — The configured radio channel width.



Tx Power — The transmit power that will be configured for the MetroLinq
60 GHz radio.



ITU Rain Zone — The ITU rain zone in which the link will operate. A map
highlighting the various rain regions are provided by the LinqPath tool.

Rain Rate — The predicted ITU rain rate (mm per hour) for the specified zone.

Figure 221: MetroLinq LinqBudget Results

The following items are displayed on this page section:

Expected RSSI — Shows the expected RSSI of the link based on the distanceprovided in the Target Distance input box.



Expected RSSI with rain — Shows the expected RSSI of the link when it israining based on the distance provided in the Target Distance input box.



Expected Distance Limit — Shows the expected maximum distance at which alink with the selected MetroLinq models can achieve 3 Gbps, 2 Gbps, and
1 Gbps throughput. The “With Rain” values include the statistical rain fadeconsiderations calculated using the ITU Rain Zone and Rain Rate settings.

– 225 –

Chapter 9 | MetroLinq Device Configuration
Using the LinqPath ToolRSSI vs. Distance LinqPath also produces a graph of the Expected RSSI versus distance. The purple
Graph “No Rain” line indicates the expected RSSI without rain. The blue “With Rain” line
indicates the expected RSSI that should be exceeded by the percentage of time
selected in the “60 GHz Rain Reliability” drop-down menu. The 1 Gbps, 2 Gbps,
and 3 Gbps lines show the RSSI levels at which each data rate can be achieved.

Figure 222: MetroLinq LinqPath Expected RSSI Graph– 226 –

10

Terragraph Device
Configuration
This chapter describes configuration settings for Terragraph MLTG-CN units at theDevice level. It includes the following sections:“Terragraph Configuration” on page 228

“General Networking Settings” on page 229

“Radio Settings” on page 231

“System Settings” on page 233– 227 –

Chapter 10 | Terragraph Device Configuration
Terragraph Configuration

Terragraph Configuration
This section covers Device-level configuration for Terragraph MLTG-CN devices,
including specific settings not available at the Site level.
Figure 223: Terragraph Device Dashboard– 228 –

Chapter 10 | Terragraph Device Configuration

General Networking Settings

General Networking Settings
Click the “General Networking” tab to configure management port and LAN portsettings.
Figure 224: Terragraph Device General Networking

The following items are displayed on this page:
PoE Port


POE Port Role — Selects the function of the Uplink Port (PoE port). This portfunctions as a dedicated management port by default. The role can bechanged to “Bridged with LAN port” so that the port functions as a LAN port.

Management Port Settings


IP Address Mode — Sets the method used to provide an IP address for theInternet access port. (Default: DHCP; Options: DHCP, static IP)Fallback IP — The IPv4 address used when a DHCP server is unavailable.
(Default: 192.168.1.20)



Fallback Netmask — The subnet mask used for the Fallback IP address.
(Default: 255.255.255.0)– 229 –

Chapter 10 | Terragraph Device Configuration
General Networking Settings

LAN Port Settings


IP Address Mode — Configures the LAN interface to be in static IP mode or
DHCP mode. In DHCP mode, a DCHP request is broadcast to the Layer 2
network when the network behavior is set to Layer 2 Bridge. When the network
behavior is set to VXLAN, a DHCP request is sent to the core network via the
VXLAN tunnel.



IP Address — The static IP address when the IP Address Mode is “Static IP.”

Subnet Mask — The subnet mask when the IP Address Mode is “Static IP.”

Default Gateway — The IPv4 address of the default gateway, which is used if
the requested destination address is not on the local subnet.



DNS Entries — Allows clients to access the web interface through the specified
domain from a local network.

Mgmt VLAN — Select this option to enable a management VLAN on site
devices. Once you enable this option, you will no longer be able to accessdevices on any of the built-in the local networks (for example, 192.168.2.1).
You will only be able to access devices from the specified VLAN network. If adevice’s IP mode is set to DHCP, it will also request a new IP address in thesubnet range assigned to the VLAN network.

– 230 –

Chapter 10 | Terragraph Device Configuration

Radio Settings

Radio Settings
Click the “Radio Settings” tab to configure the operation mode and security.
Figure 225: Terragraph Device Radio Settings

The following items are displayed on this page:
Operation ModeMode — For firmware versions before 1.4.2:
Client Mode (Terragraph Mode) — Allows a connection to a Terragraph
DN device. In this mode, the client passively waits for a DN device toconnect.

Client Mode (Point-to-point Mode) — Allows a connection to a Base
Station Mode CN device. In this mode, the client passively waits for a Base
Station Mode CN to connect.

Base Station Mode — Allows links to be created to client mode (Point-topoint Mode) CN devices. For MLTG-CN units, up to 15 links can becreated. For MLTG-CN LR units, only one link can be created.

Mode — For firmware versions after 1.5.0:
Client Mode — Allows connections to DN or Base Station Mode CN
devices. In this mode, the client passively waits for a connection.

– 231 –

Chapter 10 | Terragraph Device Configuration
Radio SettingsBase Station Mode — Allows links to be created to client mode (Point-topoint Mode) CN devices. For MLTG-CN units, up to 15 links can becreated. For MLTG-CN LR units, only one link can be created.

Channel

Channel — In Base Station Mode, you can select the working channel (1 to 4)
for a link.

Security

Security — The security method used for the link. In the current version, only
WPA2-PSK is supported.

PasswordPassword — Configures the password for WPA2-PSK.

Radio Configuration
In Base Station Mode, click “ADD RULE” and enter the 60GHz radio MAC addressof the another MLTG-CN device. Alternatively, click “SCAN” to find and selectMAC addresses of other MLTG-CN devices.

– 232 –

Chapter 10 | Terragraph Device Configuration
System Settings

System Settings
Click the “System Settings” tab to configure general settings, NTP, SNMP, andsyslog.
Figure 226: Terragraph Device System Settings

The following items are displayed on this page:
General Settings
 Timezone — To display a time corresponding to your local time, choose oneof the predefined time zones from the pull-down list.


Number of boot retires for switching bootbank — The maximum numberof bootup retries before switching to the next boot bank. (Range: 1-254;
Default: 5)Number of boot retires for factory reset — The maximum number ofbootup retries before reset device to default. (Range: 1-254; Default: 3)

Network Time (NTP)
Network Time Protocol (NTP) allows the device to set its internal clock based on
periodic updates from a time server. The device acts as an NTP client, periodicallysending time synchronization requests to specified time servers. The device willattempt to poll each server in the configured sequence to receive a time update.
NTP Servers — Enter IP addresses of NTP servers.

– 233 –

Chapter 10 | Terragraph Device Configuration
System Settings

SNMP
The Simple Network Management Protocol (SNMP) is designed specifically for
managing devices on a network. It is typically used to configure devices for proper
operation in a network environment, as well as to monitor them to evaluate
performance or detect potential problems.


SNMP Server — Enables or disables SNMP.



Write Community — A text string that acts like a password and permits accessthrough SNMP protocol version 2. This community string verifies the access of
IPv4 users.



IPv6 Write Community — A text string that acts like a password and permits
access through SNMP protocol version 2. This community string verifies theaccess of IPv6 users.

Remote Syslog
The device allows you to control the logging of error messages, including the typeof events that are recorded and configure logging to a remote System Log (syslog)
server or other management stations.


Server Size — Specifies the available memory used for logging of error
messages. (Default: 64 KiB)

Server IP — Specifies the IPv4 or IPv6 address of a remote server which will besent syslog messages.

Server Port — Specifies the UDP port number used by the remote server.
(Range: 1-65535; Default: 514)

Log Level — Use the menu to select the severity of the logs to print to theconsole. Logs with the severity level you select and all logs of greater severity
print. For example, if you select Error, the logged messages include Error,
Critical, Alert, and Emergency. The default severity level is Debug(7). The
severity can be one of the following levels:

Table 1: Logging Levels
Level

Severity Name

Description

7

Debug

Debugging messages

6

Informational

Informational messages only

5

NoticeNormal but significant condition, such as cold start4

Warning

Warning conditions (e.g., return false, unexpected
return)3

Error

Error conditions (e.g., invalid input, default used)* There are only Level 2, 5 and 6 error messages for the current firmware release.

– 234 –

Chapter 10 | Terragraph Device Configuration
System Settings

Table 1: Logging Levels (Continued)
Level

Severity Name

Description

2

CriticalCritical conditions (e.g., memory allocation, or freememory error - resource exhausted)

1

Alert

Immediate action needed0

Emergency

System unusable* There are only Level 2, 5 and 6 error messages for the current firmware release.

SNMP V3 User
SNMP protocol version 3 provides secure access by account authentication anddata encryption. The SNMP v3 user list can be defined with the following items.
Name — The user name used to access the SNMP service.



Access Auth. — Select the access permission as “Read Only” or “Write.”

Auth. Type — Select the hash algorithm for authentication.

Auth. Pwd. — Configure the password for authentication.

Encryption Type — Select the encryption algorithm for data packets.

Encryption Pwd — Configure the password for data encryption.

– 235 –

Chapter 10 | Terragraph Device Configuration
System Settings– 236 –

11

Switch Device Configuration

This chapter describes configuration settings for switches at the Device level. It
includes the following sections:“Switch Configuration” on page 238

“Port Configuration” on page 239

“VLAN Configuration” on page 241

“Configuring Name Servers” on page 243

“Configuring Static IP Routes” on page 243

“Configuring Port Rate Limiting (QoS)” on page 244

“STP Configuration” on page 245

“Port Security Configuration” on page 245

“Configuring 802.1X Port Authentication” on page 246

“ACL Configuration” on page 248

“Configuring Switch Services” on page 250

“Configuring Port Mirroring” on page 251“Configuring Local Logins” on page 252

“Configuring System Settings” on page 252

“Configuring Login Authentication” on page 253– 237 –

Chapter 11 | Switch Device Configuration
Switch Configuration

Switch Configuration
Edgecore switch devices can only inherit Site Port Security settings from the Sitelevel. Other settings must be configured at the Device level.
This section covers Device-level configuration for switch devices. ecCLOUD
supports switch management for the following Edgecore models.
ECS2100-10P, ECS2100-10T, ECS2100-28P, ECS2100-28T, ECS2100-28PP,
ECS2100-52T
ECS4100-12T, ECS4100-12PH, ECS4100-28P, ECS4100-28T, ECS4100-52P
ECS4120-28Fv2, ECS4120-28Fv2-I, ECS4120-28T, ECS4120-52T
Note: This chapter provides an example of switch configuration available fromecCLOUD. For complete feature support and configuration, refer to the Web
Management Guide and CLI Reference Guide for the specific switch model, which
can be obtained from www.edgecore.com.
Figure 227: Switch Device Dashboard– 238 –

Chapter 11 | Switch Device Configuration

Port Configuration

Port Configuration
The switch configuration Ports tab provides access to basic port settings.
Click the EDIT button to enable/disable a port interface, set auto-negotiation andthe interface capabilities to advertise, or manually fix the speed, duplex mode, andflow control.
Figure 228: Switch Ports

Trunk Configuration Trunks are multiple links between devices that work as one virtual, aggregate link. A
port trunk offers a dramatic increase in bandwidth for network segments where
bottlenecks exist, as well as providing a fault-tolerant link between two devices.

When setting up a static trunk between switches, take note of the following points:


Finish configuring trunks before you connect the corresponding network cables
between switches to avoid creating a loop.

The ports at both ends of a connection must be configured as trunk ports.

When configuring static trunks on switches of different types, they must becompatible with the Cisco EtherChannel standard.

– 239 –

Chapter 11 | Switch Device Configuration
Port Configuration



The ports at both ends of a trunk must be configured in an identical manner,
including speed, duplex mode, flow control, VLAN assignments, and CoS
settings.

Click the Trunk tab and then the ADD NEW TRUNK button to create a trunk
identifier.
Figure 229: Configuring a Trunk

Click the Port Trunk tab to add member ports to a static trunk. Click the EDIT button
to assign a trunk ID to a port.
Figure 230: Configuring Trunk Ports

LACP Trunks The Link Aggregation Control Protocol (LACP) enables dynamic trunks to becreated between two switches. LACP-configured ports automatically negotiate atrunked link with LACP-configured ports on another device. You can configure any
number of ports on a switch as LACP, as long as they are not already configured aspart of a static trunk. If ports on another device are also configured as LACP, theswitch and the other device will negotiate a trunk link between them.
When setting up LACP trunks, take note of the following points:

To avoid creating a loop in the network, be sure you enable LACP before
connecting the ports, and also disconnect the ports before disabling LACP.



If the target switch has also enabled LACP on the connected ports, the trunk will
be activated automatically.
– 240 –

Chapter 11 | Switch Device Configuration

VLAN Configuration

A trunk formed with another switch using LACP will automatically be assigned
the next available trunk ID.

If more than the maximum number of ports attached to the same target switch
have LACP enabled, the additional ports are placed in standby mode, and will
only be enabled if one of the active links fails.

All ports on both ends of an LACP trunk must be configured for full duplex, andauto-negotiation.

Figure 231: Configuring LACP Trunks

VLAN Configuration
Click the VLAN tab to create or remove VLAN groups, or set the administrative
status. To propagate information about VLAN groups used on this switch to external
network devices, you must specify a VLAN ID for each of these groups.
Click the ADD NEW VLAN button to create a new VLAN ID. You can also define a
VLAN as an Layer 3 interface, which must be configured before you can assign an
IP address to a VLAN.
Figure 232: Configuring VLANs

Adding VLAN Port When creating and enabling VLANs for a switch, you must assign each port to theMembers VLAN group(s) in which it will participate. By default, all ports are assigned to

VLAN 1 as untagged ports. Add a port as a tagged port if you want it to carry traffic
for one or more VLANs, and any intermediate network devices or the host at theother end of the connection supports VLANs. Then assign ports on the other VLANaware network devices along the path that will carry this traffic to the same VLAN(s).
However, if you want a port on this switch to participate in one or more VLANs, but– 241 –

Chapter 11 | Switch Device Configuration
VLAN Configuration

none of the intermediate network devices nor the host at the other end of theconnection supports VLANs, then you should add this port to the VLAN as an
untagged port.
Note: ecCLOUD supports VLAN synchronization between APs and switches. When
VLAN tagging is enabled for an SSID, the configured VLAN ID is automatically"pushed" by ecCLOUD to the attached switch port. This enables the VLAN-tagged
traffic from the AP to be accepted by the switch port and avoids any loss ofconnectivity.
Click the Port VLAN tab to show port VLAN membership.
Figure 233: Configuring VLAN Port Members

Click the EDIT button to configure the VLAN behavior for a specific port, including
the mode of operation (Hybrid or 1Q Trunk), the default VLAN identifier (PVID),
accepted frame types, and ingress filtering. Assign ports as tagged if they areconnected to 802.1Q VLAN compliant devices, or untagged they are notconnected to any VLAN-aware devices. Or, configure a port as forbidden toprevent the switch from adding it to a VLAN.

– 242 –

Chapter 11 | Switch Device Configuration
Configuring Name Servers

Figure 234: Configuring VLAN Port Settings

Configuring Name Servers
Click the Name Servers tab to configure a list of name servers to be used for
dynamic DNS lookup. When more than one name server is specified, the servers
are queried in the specified sequence until a response is received, or the end of thelist is reached with no response.
Click the ADD NAME SERVER button and specify the IPv4 or IPv6 address of adomain name server to use for name-to-address resolution.
Figure 235: Configuring Name Servers

Configuring Static IP Routes
Edgecore switches support IP routing and routing path management via static
routing definitions. When IP routing is functioning, a switch acts as a wire-speed
router, passing traffic between VLANs with different IP interfaces, and routing traffic
to external IP networks. However, when a switch is first booted, default routing can– 243 –

Chapter 11 | Switch Device Configuration
Configuring Port Rate Limiting (QoS)

only forward traffic between local IP interfaces. As with all traditional routers, static
routing needs to be manually configured.
Static routes may be required to force the use of a specific route to a subnet. Static
routes do not automatically change in response to changes in network topology, so
you should only configure a small number of stable routes to ensure network
accessibility.
To enter static routes in the routing table, click the IP Routes tab and then the ADD
IP ROUTE button. Specify the destination IP Address and net mask, and the IP
address of the next router hop used for the route.
Figure 236: Configuring IP Routes

Configuring Port Rate Limiting (QoS)
Click the QoS tab to apply rate limiting to ingress or egress ports. This function
allows a network manager to control the maximum rate for traffic received ortransmitted on a port interface. Rate limiting is configured on interfaces at the edgeof a network to limit traffic into or out of the network.
Rate limiting can be applied to individual ports or trunks. When an interface isconfigured with this feature, the traffic rate will be monitored by the switch
hardware to verify conformity. Non-conforming traffic is dropped, conforming
traffic is forwarded without any changes.
Click the EDIT button for a port interface to enable input or output rate limiting andset the required rate limit.
Figure 237: Configuring Port Rate Limiting– 244 –

Chapter 11 | Switch Device Configuration

STP Configuration

STP Configuration
The Spanning Tree Protocol (STP) can be used to detect and disable network loops,
and to provide backup links between switches, bridges or routers. This allows theswitch to interact with other bridging devices (that is, an STP-compliant switch,bridge or router) in your network to ensure that only one route exists between any
two stations on the network, and provide backup links which automatically takeover when a primary link goes down.
Edgecore switches support three types of spanning tree protocol:

STP — Spanning Tree Protocol (IEEE 802.1D). (When this option is selected,
the switch will use RSTP set to STP forced-compatibility mode.)

RSTP — Rapid Spanning Tree (IEEE 802.1w).



MSTP — Multiple Spanning Tree (IEEE 802.1s).

Click the STP tab and enable STP. Select the protocol and configure the bridge
priority, which is used in selecting the spanning tree root device (the network device
with the highest priority becomes the STP root device).
Note: For more information on STP configuration, refer to the Web Management
Guide and CLI Reference Guide for the specific switch model, which can beobtained from www.edgecore.com.
Figure 238: Configuring STP

Port Security Configuration
You can use Port Security to configure the maximum number of device MAC
addresses that can be learned by a switch port, stored in the address table, andauthorized to access the network.
When port security is enabled on a port, the switch stops learning new MAC
addresses on the specified port when it has reached a configured maximum– 245 –

Chapter 11 | Switch Device Configuration
Configuring 802.1X Port Authentication

number. Only incoming traffic with source addresses already stored in the addresstable will be authorized to access the network through that port. If a device with anunauthorized MAC address attempts to use the switch port, the intrusion will be
detected and the switch can automatically take action by disabling the port andsending a trap message.
Click the Port Security tab and then the EDIT button for ports you want to configure.
Enable security for the port, set the action to take when an invalid address is
detected on a port, and set the maximum number of MAC addresses allowed on
the port.
Figure 239: Configuring Port Security

Configuring 802.1X Port Authentication
The IEEE 802.1X (802.1X or dot1X) standard defines a port-based access control
procedure that prevents unauthorized access to a network by requiring users to firstsubmit credentials for authentication. Access to all switch ports in a network can becentrally controlled from a server, which means that authorized users can use thesame credentials for authentication from any point within the network.
Click the Port Auth tab to configure 802.1X port settings for the switch as the local
authenticator. When 802.1X is enabled, you need to configure the parameters forthe authentication process that runs between the client and the switch (that is, theauthenticator), as well as the client identity lookup process that runs between theswitch and authentication server.
For information on authentication server configuration, see “Configuring Login
Authentication” on page 253.
Click the EDIT button for a port to configure the port authentication details.

– 246 –

Chapter 11 | Switch Device Configuration

Configuring 802.1X Port Authentication

Figure 240: Configuring Port Authentication

When the switch functions as a local authenticator between supplicant devices
attached to a switch port and the authentication server, you need to configure theparameters for the exchange of EAP messages between the authenticator andclients on the Authenticator configuration page.
On the port authentication details page, set the port Control Mode to “Auto” toenable authentication.
Figure 241: Configuring Port Authentication

Note: For more information on port authentication configuration, refer to the Web
Management Guide and CLI Reference Guide for the specific switch model, which
can be obtained from www.edgecore.com.

– 247 –

Chapter 11 | Switch Device Configuration
ACL Configuration

ACL Configuration
Access Control Lists (ACL) provide ingress packet filtering for IPv4/IPv6 frames(based on address, protocol, Layer 4 protocol port number or TCP control code),
IPv6 frames (based on address, DSCP traffic class), or any frames (based on MAC
address or Ethernet type). To filter incoming packets, first create an access list, add
the required rules, and then bind the list to a specific port.
An ACL is a sequential list of permit or deny conditions that apply to IP addresses,
MAC addresses, or other more specific criteria. The switch tests ingress packets
against the conditions in an ACL one by one. A packet will be accepted as soon as
it matches a permit rule, or dropped as soon as it matches a deny rule. If no rules
match, the packet is accepted.
To configure an ACL, click the ACL tab and then the ADD NEW ACL button. Selectthe type of ACL you want to configure:IPv4 Standard — Configures an ACL based on source IPv4 addresses.

IPv4 Extended — Configures an ACL based on source and destination IPv4
addresses, TCP/UDP port number, protocol type, and TCP control code.

IPv6 Standard — Configures an ACL based on source IPv6 addresses.

IPv6 Extended — Configures an ACL based on source and destination IPv6
addresses, DSCP traffic class, or next header type.



MAC — Configures an ACL based on hardware addresses, packet format, andEthernet type.



ARP — Configures an ACL based on ARP messages addresses.

Figure 242: Configuring ACLs

On the Add New ACL page, give the ACL a name and then click the “+” button toconfigure rules to add to the ACL.

– 248 –

Chapter 11 | Switch Device Configuration
ACL Configuration

Figure 243: Adding a New ACL

Binding Ports to an After configuring ACLs, click the Port ACL tab to bind the ports that need to filter
ACL ingress traffic to the appropriate ACLs.
Click the EDIT button to configure an ACL for a port.
Figure 244: Port ACL Bindings

On the Port ACL edit page, select the configured ACL name, enable the ACL, andoptionally enable counters to collect ACL statistics.
Figure 245: Binding Ports to ACLs

– 249 –

Chapter 11 | Switch Device Configuration
Configuring Switch Services

Note: For more information on ACL configuration, refer to the Web Management
Guide and CLI Reference Guide for the specific switch model, which can beobtained from www.edgecore.com.

Configuring Switch Services
Click the Services tab to configure Telnet and web server access to the switch, andto configure network time.
Enable the Telnet server for accessing the switch CLI over a Telnet connection.
Enable the HTTP web server for access to switch management using a web browser
interface.
You can also enable HTTPS over the Secure Socket Layer (SSL), providing secureaccess (an encrypted connection) to the switch’s web interface.
Both the HTTP and HTTPS service can be enabled independently on the switch.
However, you cannot configure both services to use the same TCP port.
The Network Time Protocol (NTP) allows a switch to set its internal clock based on
periodic updates from a time server. Maintaining an accurate time on a switch
enables the system log to record meaningful dates and times for event entries.
To configure NTP, enter the IPv4 address for up to three time servers and thenenable the NTP service. The switch will poll all the time servers configured, theresponses received are filtered and compared to determine the most reliable andaccurate time update for the switch.

– 250 –

Chapter 11 | Switch Device Configuration

Configuring Port Mirroring

Figure 246: Switch Services

Configuring Port Mirroring
Use the Mirror tab to mirror traffic from any source port to a target port for realtime analysis. You can then attach a logic analyzer or RMON probe to the target
port and study the traffic crossing the source port in a completely unobtrusive
manner.
Enable mirroring, select the source and destination ports, and the type of traffic tomirror; received, transmitted, or both.
Figure 247: Port Mirroring– 251 –

Chapter 11 | Switch Device Configuration
Configuring Local Logins

Configuring Local Logins
Use the Local Logins tab to control management access to the switch based on
manually configured user names and passwords.
The Local Logins have one account configured by default using a randomlygenerated password. You can modify the password and configure additional local
accounts as needed.
Note: The Local Logins default account is from the ecCLOUD Site-level
configuration and it will overwrite the default account previously configured on thelocal user interface of a device. Once the Site-level configuration has been pushed
to devices, you must use Local Login accounts configured at the ecCLOUD Devicelevel configuration.
Figure 248: Local Login Configuration

Configuring System Settings
Use the System Settings tab to identify the system by displaying information such as
the device location and contact information. You can also enable jumbo frames
and configure the local timezone.
Edgecore switches include support for layer 2 jumbo frames. A switch provides
more efficient throughput for large sequential data transfers by supporting jumbo
frames up to 10240 bytes for Gigabit Ethernet and 10 Gigabit Ethernet ports ortrunks. Compared to standard Ethernet frames that run only up to 1.5 KB, using
jumbo frames significantly reduces the per-packet overhead required to process
protocol encapsulation fields.
You should also set the time zone of your switch location. NTP uses Coordinated
Universal Time (or UTC, formerly Greenwich Mean Time, or GMT) based on thetime at the Earth’s prime meridian, zero degrees longitude, which passes throughGreenwich, England. To display a time corresponding to your local time, you must
indicate the number of hours and minutes your time zone is east (before) or west
(after) of UTC. You can choose one of the predefined time zone definitions.

– 252 –

Chapter 11 | Switch Device Configuration

Configuring Login Authentication

Figure 249: System Settings

Configuring Login Authentication
Use the Authentication tab to specify local or remote authentication. Local andremote login authentication control management access via the console port, webbrowser, or Telnet.
Local authentication restricts management access based on user names andpasswords. Remote authentication uses a remote access authentication server
based on RADIUS or TACACS+ protocols to verify management access.
By default, management access is always checked against the local authentication
database. If a remote authentication server is used, you must specify theauthentication sequence. Then specify the corresponding parameters for the
remote authentication servers.
You can specify up to three authentication methods for any user to indicate theauthentication sequence. For example, if you select (1) RADIUS, (2) TACACS and(3) Local, the user name and password on the RADIUS server is verified first. If the
RADIUS server is not available, then authentication is attempted using the
TACACS+ server, and finally the local user name and password is checked.
Figure 250: Login Authentication– 253 –

Chapter 11 | Switch Device Configuration
Configuring Login Authentication

To add authentication servers, click the ADD NEW RADIUS SERVER button andconfigure the IP address and other server details.
Figure 251: Adding Authentication Servers– 254 –