Configure a Wi-Fi access point with personal security

The WPA and WPA2 personal security modes allow a Wi-Fi access point to authenticate clients by using a preshared key that the client enters when connecting to the access point.

Note When Primary Responder mode is enabled, the WPA1 personal security mode is not available. For more information about Primary Responder mode, see Differences between standard firmware operation and Primary Responder mode.

By default, the EX15W device comes with one preconfigured access point, Digi AP. You cannot delete default access points, but you can modify them or you can create your own access points.

Required configuration items

Enable the Wi-Fi access point
The Service Set Identifier (SSID) for the access point.
Configure security for the access point to use personal security.
The password (preshared key) that clients will used to connect to the access point.
LAN/bridge assignment. Once you configure a Wi-Fi access point, you must assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.

Additional configuration items

Determine whether to broadcast the access point's SSID.
Determine whether to isolate clients connected to this access point, so that they cannot communicate with each other.
The amount of time to wait before changing the group key.

To configure a Wi-Fi access point to use personal security:

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click Network > WiFi > Access points.
Create a new access point or modify an existing access point:
- To create a new access point, for Add WiFi access point:, type a name for the access point and click .
- To modify an existing access point, click to expand the access point.
The Wi-Fi access point configuration window is displayed.
For SSID, type the SSID. Up to 32 characters are allowed.
Enable SSID broadcast to configure the radio to broadcast the SSID.
(Optional) Enable Isolate clients if it isn't already enabled to prevent clients that are connected to this access point from communicating with each other. This setting is enabled by default. See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.
For Encryption, select one of the following:
- WPA Personal (PSK): All Wi-Fi clients must support WPA to be able to authenticate.
  Note When Primary Responder mode is enabled, the WPA personal security mode is not available. For more information about Primary Responder mode, see Differences between standard firmware operation and Primary Responder mode.
- WPA/WPA2 Personal (PSK): Wi-Fi clients that support WPA and WPA2 are able to authenticate.
  Note When Primary Responder mode is enabled, the WPA personal security mode is not available. For more information about Primary Responder mode, see Differences between standard firmware operation and Primary Responder mode.
- WPA2 Personal (PSK): All Wi-Fi clients must support WPA2 to be able to authenticate.
- WPA2-PSK/WPA3-SAE mixed mode: Wi-Fi clients that support WPA2 and WPA3 are able to authenticate.
- WPA3 Personal (SAE): All Wi-Fi clients must support WPA3 to be able to authenticate.
  Note Only select WPA3 Personal (SAE) if you know that all Wi-Fi clients connecting to this device will have WPA3 capabilities.
For Pre-shared key, enter the password that clients will use when connecting to the access point.
Note If you need to configure a Wi-Fi passphrase with any non-printable ASCII characters, you can use the wpa_passphrase tool to generate the appropriate pre-shared key. The wpa_passphrase command is available in the shell console of a DAL OS Digi device. For details about the command, see the wpa_passphrase Linux command.
(Optional) For Group rekey interval, type the amount of time to wait before changing the group key.

The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.

Allowed values are any number of days, hours, minutes, or seconds, and take the format number{d|h|m|s}.

For example, to set Group rekey interval to ten minutes, enter 10m or 600s.

Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Click Apply to save the configuration and apply the change.

 Command line

Configure a new access point

Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Create a new access point:

(config)> add network wifi ap new_AP
(config network wifi ap new_AP)>

New access points are enabled by default.

Set the SSID for the Wi-Fi access point. Up to 32 characters are allowed.
```
(config network wifi ap new_AP)> ssid my_SSID
(config network wifi ap new_AP)>
```
SSID broadcasting is enabled by default for new access points.
Set the security for the access point to a personal security option:
```
(config network wifi ap new_AP)> encryption type value
(config network wifi ap new_AP)> 
```
where value is one of:
- psk: Uses WPA Personal (PSK). All Wi-Fi clients must support WPA to be able to authenticate.
  Note When Primary Responder mode is enabled, the WPA personal security mode is not available. For more information about Primary Responder mode, see Differences between standard firmware operation and Primary Responder mode.
  Note If you need to configure a Wi-Fi passphrase with any non-printable ASCII characters, you can use the wpa_passphrase tool to generate the appropriate pre-shared key. The wpa_passphrase command is available in the shell console of a DAL OS Digi device. For details about the command, see the wpa_passphrase Linux command.
- mixedpsk: Uses mixed WPA/WPA2 Personal (PSK) mode. Wi-Fi clients that support WPA and WPA2 are able to authenticate.
  Note When Primary Responder mode is enabled, the WPA personal security mode is not available. For more information about Primary Responder mode, see Differences between standard firmware operation and Primary Responder mode.
- psk2: Uses WPA2 Personal (PSK) mode. All Wi-Fi clients must support WPA2 to be able to authenticate.
- psk2sae: Uses WPA2-PSK/WPA3-AES mixed mode. Wi-Fi clients that support WPA2 and WPA3 are able to authenticate.
- sae: Uses WPA3 Personal mode. All Wi-Fi clients must support WPA3 to be able to authenticate.
```
(config network wifi ap new_AP)> encryption type psk2sae
(config network wifi ap new_AP)> 
```
(Optional) Determine whether to prevent clients that are connected to this access point from communicating with each other:
```
(config)> network wifi ap digi_ap isolate_clients true
(config)> 
```
See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.
Set the password that clients will use when connecting to the access point:
```
(config network wifi ap new_AP)> encryption key_type password
(config network wifi ap new_AP)> 
```
where key_type varies depending on the selection for encryption type, above:
- If type is set to psk, key_type is key_psk.
- If type is set to mixedpsk, key_type is key_mixedpsk.
- If type is set to psk2, key_type is key_psk2.
- If type is set to psk2sae, key_type is key_psk2sae.
- If type is set to sae, key_type is key_sae.
For example, if type is set to psk2sae, set key_psk2sae to the appropriate password:
```
(config network wifi ap new_AP)> encryption type psk2sae
(config network wifi ap new_AP)> encryption key_psk2sae abcd1234
(config network wifi ap new_AP)> 
```
Note The encryption key type must correspond to the configured encryption type. If you set an encyrption key type that does not correspond to the configured encryption type, you will not be able to save the configuration.
(Optional) Set the amount of time to wait before changing the group key.
The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.
```
(config network wifi ap new_AP)> encryption group_rekey value
(config network wifi ap new_AP)> 
```
where value is any number of days, hours, minutes, or seconds, and takes the format number{d|h|m|s}.

For example, to set group rekey interval to ten minutes, enter either 10m or 600s:
```
(config network wireless ap new_AP)> encryption group_rekey 600s
(config network wireless ap new_AP)> 
```
Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.

Edit an existing Access point

Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Show available access points:

(config)> network wifi ap ?

 Additional Configuration
 -------------------------------------------------------------------------------
 digi_ap                  Digi AP

(config)>

Set the SSID for the appropriate access point:

(config)> network wifi ap digi_ap ssid my_SSID
(config)>

SSID broadcasting is enabled by default for the preconfigured access points. If SSID broadcasting is disabled:
```
(config)> network wifi ap digi_ap ssid_broadcast true
(config)>
```
Set the security for the access point to a personal security option:
```
(config network wifi ap new_AP)> encryption type value
(config network wifi ap new_AP)> 
```
where value is one of:
- psk: Uses WPA Personal (PSK). All Wi-Fi clients must support WPA to be able to authenticate.
  Note When Primary Responder mode is enabled, the WPA personal security mode is not available. For more information about Primary Responder mode, see Differences between standard firmware operation and Primary Responder mode.
  Note If you need to configure a Wi-Fi passphrase with any non-printable ASCII characters, you can use the wpa_passphrase tool to generate the appropriate pre-shared key. The wpa_passphrase command is available in the shell console of a DAL OS Digi device. For details about the command, see the wpa_passphrase Linux command.
- mixedpsk: Uses mixed WPA/WPA2 Personal (PSK) mode. Wi-Fi clients that support WPA and WPA2 are able to authenticate.
  Note When Primary Responder mode is enabled, the WPA personal security mode is not available. For more information about Primary Responder mode, see Differences between standard firmware operation and Primary Responder mode.
- psk2: Uses WPA2 Personal (PSK) mode. All Wi-Fi clients must support WPA2 to be able to authenticate.
- psk2sae: Uses WPA2-PSK/WPA3-AES mixed mode. Wi-Fi clients that support WPA2 and WPA3 are able to authenticate.
- sae: Uses WPA3 Personal mode. All Wi-Fi clients must support WPA3 to be able to authenticate.
```
(config network wifi ap new_AP)> encryption type psk2sae
(config network wifi ap new_AP)> 
```
(Optional) Determine whether to prevent clients that are connected to this access point from communicating with each other:
```
(config)> network wifi ap digi_ap isolate_client true
(config)> 
```
See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.

Set the password that clients will use when connecting to the access point:

(config)> network wifi ap digi_ap encryption key_psk2 password
(config)>

(Optional) Set the amount of time to wait before changing the group key.
The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.
```
(config)> network wifi ap digi_ap encryption group_rekey value
(config)> 
```
where value is any number of days, hours, minutes, or seconds, and takes the format number{d|h|m|s}.

For example, to set group rekey interval to ten minutes, enter either 10m or 600s:
```
(config)> network wireless ap digi_ap encryption group_rekey 600s
(config)> 
```
Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.