Configure an open Wi-Fi access point

This procedure configures a Wi-Fi access point that does not require a password for client connections.

By default, the TX64 device comes with two preconfigured access points, Digi AP (Wi-Fi1) and Digi AP (Wi-Fi2). You cannot delete default access points, but you can modify them or you can create your own access points.

Required configuration items

Enable the Wi-Fi access point
Select a Wi-Fi radio for the access point.
The Service Set Identifier (SSID) for the access point.
Configure open security for the access point.
Wi-Fi access point assignment: Once you configure a Wi-Fi access point, you must assign the Wi-Fi access point.
- LAN interface: See Configure a Local Area Network (LAN).
- Bridge: See Configure a bridge.

Additional configuration items

Determine whether to broadcast the access point's SSID.
Determine whether to isolate clients connected to this access point, so that they cannot communicate with each other.
The amount of time to wait before changing the group key.

To configure a Wi-Fi access point with no security:

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click Network > WiFi > Access points.
Create a new access point or modify an existing access point:
- To create a new access point, for Add WiFi access point:, type a name for the access point and click .
- To modify an existing access point, click to expand the access point.
The Wi-Fi access point configuration window is displayed.
For SSID, type the SSID. Up to 32 characters are allowed.
Enable SSID broadcast to configure the radio to broadcast the SSID.
(Optional) Enable Isolate clients if it isn't already enabled to prevent clients that are connected to this access point from communicating with each other. This setting is enabled by default. See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.
For Encryption, select one of the following:
- Open (Unencrypted) No encryption is used.
- WPA3 Enhanced Open (OWE) Uses Opportunistic Wireless Encryption (OWE) technology to provide encryption for Wi-Fi networks that do not use password protection.
  Note Only select WPA3 Enhanced Open (OWE) if you know that all Wi-Fi clients connecting to this device will have WPA3 capabilities.
(Optional) For Group rekey interval, type the amount of time to wait before changing the group key.

The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.

Allowed values are any number of days, hours, minutes, or seconds, and take the format number{d|h|m|s}.

For example, to set Group rekey interval to ten minutes, enter 10m or 600s.

Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Click Apply to save the configuration and apply the change.

 Command line

Configure a new access point

Select the device in Remote Manager and click Actions > Open Console, or log into the TX64 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Create a new access point:

(config)> add network wifi ap new_AP
(config network wifi ap new_AP)>

New access points are enabled by default.

Set the Wi-Fi radio for the new access point:

Show available radios:

(config network wifi ap new_AP)> radio ?

Radio: The Wi-Fi radio to run this access point on.
Format:
  wifi1
  wifi2
Current value:

(config network wifi ap new_AP)>

Set the appropriate radio:

(config network wifi ap new_AP)> radio wifi1
(config network wifi ap new_AP)>

Note If WPA3 enterprise mode will be used for the encryption technology, you must set the radio to wifi2.

Set the SSID for the Wi-Fi access point. Up to 32 characters are allowed.
```
(config network wifi ap new_AP)> ssid my_SSID
(config network wifi ap new_AP)>
```
SSID broadcasting is enabled by default for new access points.
Set the security for the access point to an open security method:
```
(config network wifi ap new_AP)> encryption type value
(config network wifi ap new_AP)> 
```
where value is either:
- none: No encryption is used.
- owe: Uses WPA3 Enhanced Open, which uses Opportunistic Wireless Encryption (OWE) technology to provide encryption for Wi-Fi networks that do not use password protection.
  Note Only select owe if you know that all Wi-Fi clients connecting to this device will have WPA3 capabilities.
(Optional) Determine whether to prevent clients that are connected to this access point from communicating with each other:
```
(config)> network wifi ap digi_ap1 isolate_clients true
(config)> 
```
See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.
(Optional) Set the amount of time to wait before changing the group key.
The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.
```
(config network wifi ap new_AP)> encryption group_rekey value
(config network wifi ap new_AP)> 
```
where value is any number of days, hours, minutes, or seconds, and takes the format number{d|h|m|s}.

For example, to set group rekey interval to ten minutes, enter either 10m or 600s:
```
(config network wireless ap new_AP)> encryption group_rekey 600s
(config network wireless ap new_AP)> 
```
Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.

Edit an existing Access point

Select the device in Remote Manager and click Actions > Open Console, or log into the TX64 local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```

Show available access points:

(config)> network wifi ap ?

 Additional Configuration
 -------------------------------------------------------------------------------
 digi_ap1                  Digi AP (Wi-Fi1)
 digi_ap2                  Digi AP (Wi-Fi2)

(config)>

Set the SSID for the appropriate access point:

(config)> network wifi ap digi_ap1 ssid my_SSID
(config)>

SSID broadcasting is enabled by default for the preconfigured access points. If SSID broadcasting is disabled:
```
(config)> network wifi ap digi_ap1 ssid_broadcast true
(config)>
```
Set the security for the access point to an open security method:
```
(config network wifi ap new_AP)> encryption type value
(config network wifi ap new_AP)> 
```
where value is either:
- none: No encryption is used.
- owe: Uses WPA3 Enhanced Open, which uses Opportunistic Wireless Encryption (OWE) technology to provide encryption for Wi-Fi networks that do not use password protection.
  Note Only select owe if you know that all Wi-Fi clients connecting to this device will have WPA3 capabilities.
(Optional) Determine whether to prevent clients that are connected to this access point from communicating with each other:
```
(config)> network wifi ap digi_ap1 isolate_client true
(config)> 
```
See Isolate Wi-Fi clients for information about how to prevent clients connected to different access points from communicating with each other.

(Optional) Set the amount of time to wait before changing the group key.
The group key is shared by all in clients of the access point, and after a client has disconnected, it will be able to use the group key to decrypt broadcast packets until the key is changed.
```
(config)> network wifi ap digi_ap1 encryption group_rekey value
(config)> 
```
where value is any number of days, hours, minutes, or seconds, and takes the format number{d|h|m|s}.

For example, to set group rekey interval to ten minutes, enter either 10m or 600s:
```
(config)> network wireless ap digi_ap1 encryption group_rekey 600s
(config)> 
```
Increasing the time between rekeys can improve connectivity issues in noisy environments. To disable group rekeys, set to 0. This will allow any client that has previously connected to see all broadcast traffic on the wireless network until the Wi-Fi radio is restarted. The default is 10 minutes.
Assign the Wi-Fi access point to a LAN interface or to a bridge. See Configure a Local Area Network (LAN) and Configure a bridge for more information.
The access point must be assigned to an active LAN, or a bridge that is assigned to an active LAN.
Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.