Configure a Wi-Fi access point with enterprise security

The WPA2 enterprise security mode allows a Wi-Fi access point to authenticate clients by using one or more RADIUS servers. When the Wi-Fi access point receives a connection request from a client, it authenticates the client with the RADIUS server before allowing the client to connect.

Using enterprise security modes allows each client to have different usernames and passwords configured in the RADIUS server, rather than using preshared key on the AnywhereUSB Plus device.

By default, the AnywhereUSB PlusW device comes with one preconfigured access point, Digi AP. You cannot delete default access points, but you can modify them or you can create your own access points.

Required configuration items

Enable the Wi-Fi access point
The Service Set Identifier (SSID) for the access point.
Configure security for the access point to WPA2 enterprise.
The IP address for one or more RADIUS servers.
The secret key for one or more RADIUS servers.
LAN/bridge assignment. Once you configure a Wi-Fi access point, you must assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.

Additional configuration items

Determine whether to broadcast the access point's SSID.
Determine whether to isolate clients connected to this access point, so that they cannot communicate with each other.
The server port for one or more RADIUS server.
The amount of time to wait before changing the group key.

To configure a Wi-Fi access point with WPA2 enterprise security:

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click Network > WiFi > Access points.
Create a new access point or modify an existing access point:
- To create a new access point, for Add WiFi access point:, type a name for the access point and click .
- To modify an existing access point, click to expand the access point.
The Wi-Fi access point configuration window is displayed.
For SSID, type the SSID. Up to 32 characters are allowed.
Enable SSID broadcast to configure the radio to broadcast the SSID.
(Optional) Enable Isolate clients to prevent clients that are connected to this access point from communicating with each other. See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.
For Encryption, select WPA2 Enterprise.
Configure one or more RADIUS servers:
1. Click to expand RADIUS server list.
2. Click to expand RADIUS server.
3. For RADIUS IP/hostname, type the IP address or hostname of the RADIUS server.
4. (Optional) Change the RADIUS port. The default port is 1812.
5. For RADIUS secret key, type the secret key as configured on the RADIUS server.
6. To add additional RADIUS servers, click 
(Optional) For Group rekey interval, type the amount of time to wait before changing the group key.

The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.

Allowed values are any number of days, hours, minutes, or seconds, and take the format number{d|h|m|s}.

For example, to set Group rekey interval to ten minutes, enter 10m or 600s.

Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Click Apply to save the configuration and apply the change.

 Command line

Configure a new access point

Select the device in Remote Manager and click Actions > Open Console, or log into the AnywhereUSB Plus local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Create a new access point:

(config)> add network wifi ap new_AP
(config network wifi ap new_AP)>

New access points are enabled by default.

Set the SSID for the Wi-Fi access point. Up to 32 characters are allowed.
```
(config network wifi ap new_AP)> ssid my_SSID
(config network wifi ap new_AP)>
```
SSID broadcasting is enabled by default for new access points.

Set the security for the access point to wpa2:

(config network wifi ap new_AP)> encryption type wpa2
(config network wifi ap new_AP)>

(Optional) Determine whether to prevent clients that are connected to this access point from communicating with each other:
```
(config)> network wifi ap digi_ap isolate_clients true
(config)> 
```
See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.

Configure one or more RADIUS servers:

Set the IP address of the RADIUS server:

(config network wifi ap new_AP)> encryption radius_servers 0 host IP_address
(config network wifi ap new_AP)>

Set the secret key as configured on the RADIUS server:

(config network wifi ap new_AP)> encryption radius_servers 0 key secret_key
(config network wifi ap new_AP)>

(Optional) Set the RADIUS server's port. The default is 1812.

(config network wifi ap new_AP)> encryption radius_servers 0 port port
(config network wifi ap new_AP)>

(Optional) Set the amount of time to wait before changing the group key.
The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.
```
(config network wifi ap new_AP)> encryption group_rekey value
(config network wifi ap new_AP)> 
```
where value is any number of days, hours, minutes, or seconds, and takes the format number{d|h|m|s}.

For example, to set group rekey interval to ten minutes, enter either 10m or 600s:
```
(config network wireless ap new_AP)> encryption group_rekey 600s
(config network wireless ap new_AP)> 
```
Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Save the configuration and apply the change
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.

Edit an existing Access point

Select the device in Remote Manager and click Actions > Open Console, or log into the AnywhereUSB Plus local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Show available access points:

(config)> network wifi ap ?

 Additional Configuration
 -------------------------------------------------------------------------------
 digi_ap                  Digi AP

(config)>

Set the SSID for the appropriate access point:

(config)> network wifi ap digi_ap ssid my_SSID
(config)>

SSID broadcasting is enabled by default for the preconfigured access points. If SSID broadcasting is disabled:
```
(config)> network wifi ap digi_ap ssid_broadcast true
(config)>
```

Set the security for the access point to wpa2:

(config network wifi ap new_AP)> encryption type wpa2
(config network wifi ap new_AP)>

(Optional) Determine whether to prevent clients that are connected to this access point from communicating with each other:
```
(config)> network wifi ap digi_ap isolate_client true
(config)> 
```
See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.

Set the IP address or hostname of the RADIUS server:

(config)> network wifi ap digi_ap encryption host_wpa2 hostname
(config)>

Set the secret key as configured on the RADIUS server:

(config)> network wifi ap digi_ap encryption key_wpa2 secret_key
(config)>

(Optional) Set the RADIUS server's port. The default is 1812.

(config)> network wifi ap digi_ap encryption port_wpa2 port
(config)>

(Optional) Set the amount of time to wait before changing the group key.
The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.
```
(config)> network wifi ap digi_ap encryption group_rekey value
(config)> 
```
where value is any number of days, hours, minutes, or seconds, and takes the format number{d|h|m|s}.

For example, to set group rekey interval to ten minutes, enter either 10m or 600s:
```
(config)> network wireless ap digi_ap encryption group_rekey 600s
(config)> 
```
Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Save the configuration and apply the change
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.