Configure a Wi-Fi access point with enterprise security

The WPA2 and WPA3 enterprise security modes allows a Wi-Fi access point to authenticate clients by using one or more RADIUS servers. When the Wi-Fi access point receives a connection request from a client, it authenticates the client with the RADIUS server before allowing the client to connect.

Using enterprise security modes allows each client to have different usernames and passwords configured in the RADIUS server, rather than using preshared key on the TX64 device.

By default, the TX64 device comes with two preconfigured access points, Digi AP (Wi-Fi1) and Digi AP (Wi-Fi2). You cannot delete default access points, but you can modify them or you can create your own access points.

Required configuration items

Additional configuration items

To configure a Wi-Fi access point with WPA2 enterprise or WPA3 enterprise security:

 

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Network > WiFi > Access points.
  4. Create a new access point or modify an existing access point:
    • To create a new access point, for Add WiFi access point:, type a name for the access point and click .

    • To modify an existing access point, click to expand the access point.

    The Wi-Fi access point configuration window is displayed.

  5. For SSID, type the SSID. Up to 32 characters are allowed.
  6. Enable SSID broadcast to configure the radio to broadcast the SSID.
  7. (Optional) Enable Isolate clients if it isn't already enabled to prevent clients that are connected to this access point from communicating with each other. This setting is enabled by default. See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.
  8. For Encryption, select either:

    • WPA2 Enterprise: Uses WPA2 enterprise security mode.

    • WPA3 Enterprise: Uses WPA3 enterprise security mode. If WPA3 Enterprise is selected, you must select Wi-Fi2 radio for Radio, above.

      Note Only select WPA3 Enterprise if you know that all Wi-Fi clients connecting to this device will have WPA3 capabilities.

      Note The DAL OS 25.11.10.42 release adds support for WPA3 Enterprise 192-bit mode and updates the default behavior for WPA3 Enterprise security settings.

  9. Configure one or more RADIUS servers:
    1. Click to expand RADIUS server list.
    2. Click to expand RADIUS server.
    3. For RADIUS IP/hostname, type the IP address or hostname of the RADIUS server.
    4. (Optional) Change the RADIUS port. The default port is 1812.
    5. For RADIUS secret key, type the secret key as configured on the RADIUS server.

    6. To add additional RADIUS servers, click

  10. The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.

    Allowed values are any number of days, hours, minutes, or seconds, and take the format number{d|h|m|s}.

    For example, to set Group rekey interval to ten minutes, enter 10m or 600s.

    Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.

  11. Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.

    The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.

  12. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the TX64 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Create a new access point:
    (config)> add network wifi ap new_AP
(config network wifi ap new_AP)>

    New access points are enabled by default.

  4. Set the Wi-Fi radio for the new access point:
    1. Show available radios:
      (config network wifi ap new_AP)> radio ?

Radio: The Wi-Fi radio to run this access point on.
Format:
  wifi1
  wifi2
Current value:

(config network wifi ap new_AP)>
    2. Set the appropriate radio:
      (config network wifi ap new_AP)> radio wifi1
(config network wifi ap new_AP)>

    5. Note If WPA3 enterprise mode will be used for the encryption technology, you must set the radio to wifi2.

  5. Set the SSID for the Wi-Fi access point. Up to 32 characters are allowed.
    (config network wifi ap new_AP)> ssid my_SSID
(config network wifi ap new_AP)>

    SSID broadcasting is enabled by default for new access points.

  6. Set the security for the access point to an enterprise security option:
    (config network wifi ap new_AP)> encryption type value
(config network wifi ap new_AP)>

    where value is either:

    • wpa2: Uses WPA2 enterprise security mode.

    • wpa3: Uses WPA3 enterprise security mode. If wpa3 is selected, you must select wifi2 for the radio, above.

      Note Only select wpa3 if you know that all Wi-Fi clients connecting to this device will have WPA3 capabilities.

      Note The DAL OS 25.11.10.42 release adds support for WPA3 Enterprise 192-bit mode and updates the default behavior for WPA3 Enterprise security settings. To configure, navigate to the

  7. (Optional) Determine whether to prevent clients that are connected to this access point from communicating with each other:
    (config)> network wifi ap digi_ap1 isolate_clients true
(config)>

    See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.

  8. Configure one or more RADIUS servers:
    1. Set the IP address of the RADIUS server:
      (config network wifi ap new_AP)> encryption radius_servers 0 host IP_address
(config network wifi ap new_AP)>
    2. Set the secret key as configured on the RADIUS server:
      (config network wifi ap new_AP)> encryption radius_servers 0 key secret_key
(config network wifi ap new_AP)>
    3. (Optional) Set the RADIUS server's port. The default is 1812.
      (config network wifi ap new_AP)> encryption radius_servers 0 port port
(config network wifi ap new_AP)>

      1. Add a server:

        (config network wifi ap new_AP)> add encryption radius_servers end
(config network wifi ap new_AP encryption radius_servers 1)>

      2. Configure the new server as described above. For example, set the server IP address:

        (config network wifi ap new_AP encryption radius_servers 1)> host IP_address
(config network wifi ap new_AP encryption radius_servers 1)>
      3. Repeat for additional radius servers.

  9. The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.

    (config network wifi ap new_AP)> encryption group_rekey value
(config network wifi ap new_AP)>

    where value is any number of days, hours, minutes, or seconds, and takes the format number{d|h|m|s}.

    For example, to set group rekey interval to ten minutes, enter either 10m or 600s:

    (config network wireless ap new_AP)> encryption group_rekey 600s
(config network wireless ap new_AP)>

    Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.

  10. Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.

    The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.

  11. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  12. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.

  1. Select the device in Remote Manager and click Actions > Open Console, or log into the TX64 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Show available access points:
    (config)> network wifi ap ?

 Additional Configuration
 -------------------------------------------------------------------------------
 digi_ap1                  Digi AP (Wi-Fi1)
 digi_ap2                  Digi AP (Wi-Fi2)

(config)>
  4. Set the SSID for the appropriate access point:
    (config)> network wifi ap digi_ap1 ssid my_SSID
(config)>
  5. SSID broadcasting is enabled by default for the preconfigured access points. If SSID broadcasting is disabled:
    (config)> network wifi ap digi_ap1 ssid_broadcast true
(config)>
  6. Set the security for the access point to an enterprise security option:
    (config network wifi ap new_AP)> encryption type value
(config network wifi ap new_AP)>

    where value is either:

    • wpa2: Uses WPA2 enterprise security mode.

    • wpa3: Uses WPA3 enterprise security mode. If wpa3 is selected, you must select wifi2 for the radio, above.

      Note Only select wpa3 if you know that all Wi-Fi clients connecting to this device will have WPA3 capabilities.

      Note The DAL OS 25.11.10.42 release adds support for WPA3 Enterprise 192-bit mode and updates the default behavior for WPA3 Enterprise security settings. To configure, navigate to the

  7. (Optional) Determine whether to prevent clients that are connected to this access point from communicating with each other:
    (config)> network wifi ap digi_ap1 isolate_client true
(config)>

    See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.

  8. Set the IP address or hostname of the RADIUS server:
    (config)> network wifi ap digi_ap1 encryption host_wpa2 hostname
(config)>
  9. Set the secret key as configured on the RADIUS server:
    (config)> network wifi ap digi_ap1 encryption key_wpa2 secret_key
(config)>
  10. (Optional) Set the RADIUS server's port. The default is 1812.
    (config)> network wifi ap digi_ap1 encryption port_wpa2 port
(config)>
  11. :
    1. Show available radios:
      (config)> network wifi radio ?

 Additional Configuration
 -------------------------------------------------------------------------------
 wifi1                     Wi-Fi1 radio
 wifi2                     Wi-Fi2 radio

(config)>
    2. Set the appropriate radio:
      (config)> network wifi ap digi_ap1 radio wifi1
(config)>

  12. The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.

    (config)> network wifi ap digi_ap1 encryption group_rekey value
(config)>

    where value is any number of days, hours, minutes, or seconds, and takes the format number{d|h|m|s}.

    For example, to set group rekey interval to ten minutes, enter either 10m or 600s:

    (config)> network wireless ap digi_ap1 encryption group_rekey 600s
(config)>

    Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.

  13. Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.

    The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.

  14. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  15. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.