This document provides information about the features available and bug fixes of EnGeniusCloud Solution. To get started, click an item on the left side and browse the contents.

v1.8.85

[New Features]

• Increased MyPSK entry to 5,000 to support larger MDU/Domitory environment.

• Supports sub-option codes within DHCP Option 43, enabling EnGenius APs to identify the correct Access Controller (AC) in mixed environments with multiple AP and AC brands.

• Support client traffic logs when SSID is set is set to NAT mode, providing more information for trouble shooting.

• Supports Configuration Rollback function, allowing the device to automatically rollback to the last stable configuration if a misconfiguration causes a loss of Cloud connection.

• Increase 802.11 RTS/CTS disable option to reduce signaling overhead and latency. This improves data transmission efficiency in environments with strong signals and minimal interference, such as those using directional antennas.

v1.8.84

[Issues Fixed]

1. Resolved mDNS loop issue. When there are multiple AP in a network with multiple SSID and mDNS Forwarding enabled, power cycle one of the AP may causes network unstable.

v1.8.83

[Issues Fixed]

1. Enhance the gateway detection mechanism in Bridge Mode to solve the problem that captive portal clients could not correctly redirect to gateway.

2. Solve the issue that LSP can still access when Local Web Pages was disabled.

3. Fix the problem that AP goes offline when the third octet of gateway (GW) subnet mask is less than 255(e.g., GW IP 192.168.1.1, mask 255.255.254.0).

4. Fix the issue that TX Bytes and RX Bytes statistics in the disconnection log always show 0.

5. Fix AP cannot send 802.11v post-association packets properly when band steering is enabled.

v1.8.82

• Support EnGenius fast-handover algorithm 2.0

• Remove dropbear chacha20-poly1305@openssh.com encryption due to security concern.

• Fix the issue that clients may get disconnected after editing ACL rules.

• Add country code for Japan.

v1.8.81

• Add support for SAMLv2 (Security Assertion Markup Language version 2) in Captive portal with Azure-AD.

• Support HTTPS-Only for local device page.

• Support WPA2-PSK[AES] + WPA-PSK[TKIP] encryption mode.

• Speed up the LED turn-off time when the user disables the LED Light function.

Appendix for v1.x.81

1. Add support for SAMLv2 in Captive portal with Azure-AD

A captive portal is a web page that users must interact with to gain network access, often seen in public Wi-Fi networks. This update introduces support for SAMLv2 (Security Assertion Markup Language version 2), a prominent protocol used for exchanging authentication and authorization data between identity providers and service providers.

(a) What is SAMLv2?

SAMLv2 is an XML-based open standard for secure exchange of authentication and authorization data. It enables Single Sign-On (SSO), allowing users to authenticate once and gain access to multiple applications without re-entering credentials. In the context of Azure AD, SAMLv2 facilitates secure communication between Azure AD (the identity provider) and various services (service providers) users want to access.

(b) Implications of This Update

• Enhanced Authentication: Users can now authenticate through Azure AD when accessing a network via a captive portal. This means that organizations leveraging Azure AD for identity management can extend its use to captive portals, ensuring a consistent and secure authentication process.

• Single Sign-On (SSO): With SAMLv2, users benefit from SSO capabilities. They log in once with their Azure AD credentials and gain seamless access to multiple services and applications without the need to re-authenticate, improving user experience and productivity.

• Increased Security: SAMLv2 enhances security by enabling strong authentication and reducing password fatigue. It ensures that authentication tokens are securely transmitted and managed, protecting user credentials from potential attacks.

(c) Practical Applications

Organizations can now implement SAMLv2-based captive portals, allowing users to connect to networks using their Azure AD credentials. This integration streamlines access management and bolsters security, making it especially beneficial for enterprises with a high reliance on Azure AD for identity services.

In summary, the support for SAMLv2 in Azure-AD captive portals facilitates a more secure, efficient, and user-friendly authentication process, aligning with modern enterprise needs for robust identity and access management.

1. Support HTTPS-Only for local device page

To address security concerns, we have introduced an HTTPS-only switch that allows users to control access to the Local Service Page (LSP). This feature is essential for enhancing the security of local device management by ensuring that all communications are encrypted.

(a) Importance of HTTPS for Security

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP and is widely used to secure data transmission over the internet. When enabled, HTTPS ensures that all data exchanged between the user's browser and the local device page is encrypted. This encryption is crucial for several reasons:

• Data Privacy: HTTPS uses TLS (Transport Layer Security) to encrypt the data, making it unreadable to any third party that might intercept the communication. This protects sensitive information such as login credentials and configuration settings from being exposed.

• Data Integrity: Encryption also ensures that the data transferred has not been altered during transmission. It prevents tampering and ensures that the information received by the user is exactly what the server sent.

• Authentication: HTTPS verifies the identity of the local device page, ensuring that users are connecting to the correct page and not a malicious site impersonating it. This helps prevent man-in-the-middle attacks where an attacker might intercept and alter communications between the user and the device.

• User Trust: Users are more likely to trust and engage with local device pages that employ HTTPS, as indicated by the padlock icon in the browser's address bar. This visual assurance helps build confidence in the security of the connection.

(b) Implementation and Control

By introducing an HTTPS-only switch, we empower users to enforce this level of security. Users can easily enable this switch to ensure that all access to the Local Service Page is through HTTPS. This change mitigates risks associated with unencrypted HTTP connections, such as eavesdropping and data breaches.

In summary, the HTTPS-only feature significantly enhances the security of local device pages by ensuring encrypted, authentic, and tamper-proof communication, thereby protecting user data and fostering trust.

v1.8.75

• This f/w version is for the first release.

v1.8.85

[New Features]

• Increased MyPSK entry to 5,000 to support larger MDU/Domitory environment.

• Supports sub-option codes within DHCP Option 43, enabling EnGenius APs to identify the correct Access Controller (AC) in mixed environments with multiple AP and AC brands.

• Support client traffic logs when SSID is set is set to NAT mode, providing more information for trouble shooting.

• Supports Configuration Rollback function, allowing the device to automatically rollback to the last stable configuration if a misconfiguration causes a loss of Cloud connection.

• Increase 802.11 RTS/CTS disable option to reduce signaling overhead and latency. This improves data transmission efficiency in environments with strong signals and minimal interference, such as those using directional antennas.

v1.8.84

[Issues Fixed]

Support concurrent tri-band connection for MLO clients.

v1.7.84

[Issues Fixed]

1. Resolved mDNS loop issue. When there are multiple AP in a network with multiple SSID and mDNS Forwarding enabled, power cycle one of the AP may causes network unstable.

2. Resolve the compatibility issue between the AP and iPhone 16 during MLO operation, which may lead to device crashes. Note. During MLO operation, ONLY dual bands are supported.

v1.7.83

[Issues Fixed]

1. Enhance the gateway detection mechanism in Bridge Mode to solve the problem that captive portal clients could not correctly redirect to gateway.

2. Solve the issue that LSP can still access when Local Web Pages was disabled.

3. Fix the problem that AP goes offline when the third octet of gateway (GW) subnet mask is less than 255 (e.g., GW IP 192.168.1.1, mask 255.255.254.0).

4. Fix the issue that TX Bytes and RX Bytes statistics in the disconnection log always show 0.

5. Fix AP cannot send 802.11v post-association packets properly when band steering is enabled.

v1.7.82

• Support EnGenius fast-handover algorithm 2.0

• Remove dropbear chacha20-poly1305@openssh.com encryption due to security concern.

• Fix the issue that clients may get disconnected after editing ACL rules.

• Add country code for Japan.

v1.7.81

• Add support for SAMLv2 (Security Assertion Markup Language version 2) in Captive portal with Azure-AD.

• Support HTTPS-Only for local device page.

• Support WPA2-PSK[AES] + WPA-PSK[TKIP] encryption mode.

• Speed up the LED turn-off time when the user disables the LED Light function.

Appendix for v1.x.81

1. Add support for SAMLv2 in Captive portal with Azure-AD

A captive portal is a web page that users must interact with to gain network access, often seen in public Wi-Fi networks. This update introduces support for SAMLv2 (Security Assertion Markup Language version 2), a prominent protocol used for exchanging authentication and authorization data between identity providers and service providers.

(a) What is SAMLv2?

SAMLv2 is an XML-based open standard for secure exchange of authentication and authorization data. It enables Single Sign-On (SSO), allowing users to authenticate once and gain access to multiple applications without re-entering credentials. In the context of Azure AD, SAMLv2 facilitates secure communication between Azure AD (the identity provider) and various services (service providers) users want to access.

(b) Implications of This Update

• Enhanced Authentication: Users can now authenticate through Azure AD when accessing a network via a captive portal. This means that organizations leveraging Azure AD for identity management can extend its use to captive portals, ensuring a consistent and secure authentication process.

• Single Sign-On (SSO): With SAMLv2, users benefit from SSO capabilities. They log in once with their Azure AD credentials and gain seamless access to multiple services and applications without the need to re-authenticate, improving user experience and productivity.

• Increased Security: SAMLv2 enhances security by enabling strong authentication and reducing password fatigue. It ensures that authentication tokens are securely transmitted and managed, protecting user credentials from potential attacks.

(c) Practical Applications

Organizations can now implement SAMLv2-based captive portals, allowing users to connect to networks using their Azure AD credentials. This integration streamlines access management and bolsters security, making it especially beneficial for enterprises with a high reliance on Azure AD for identity services.

In summary, the support for SAMLv2 in Azure-AD captive portals facilitates a more secure, efficient, and user-friendly authentication process, aligning with modern enterprise needs for robust identity and access management.

1. Support HTTPS-Only for local device page

To address security concerns, we have introduced an HTTPS-only switch that allows users to control access to the Local Service Page (LSP). This feature is essential for enhancing the security of local device management by ensuring that all communications are encrypted.

(a) Importance of HTTPS for Security

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP and is widely used to secure data transmission over the internet. When enabled, HTTPS ensures that all data exchanged between the user's browser and the local device page is encrypted. This encryption is crucial for several reasons:

• Data Privacy: HTTPS uses TLS (Transport Layer Security) to encrypt the data, making it unreadable to any third party that might intercept the communication. This protects sensitive information such as login credentials and configuration settings from being exposed.

• Data Integrity: Encryption also ensures that the data transferred has not been altered during transmission. It prevents tampering and ensures that the information received by the user is exactly what the server sent.

• Authentication: HTTPS verifies the identity of the local device page, ensuring that users are connecting to the correct page and not a malicious site impersonating it. This helps prevent man-in-the-middle attacks where an attacker might intercept and alter communications between the user and the device.

• User Trust: Users are more likely to trust and engage with local device pages that employ HTTPS, as indicated by the padlock icon in the browser's address bar. This visual assurance helps build confidence in the security of the connection.

(b) Implementation and Control

By introducing an HTTPS-only switch, we empower users to enforce this level of security. Users can easily enable this switch to ensure that all access to the Local Service Page is through HTTPS. This change mitigates risks associated with unencrypted HTTP connections, such as eavesdropping and data breaches.

In summary, the HTTPS-only feature significantly enhances the security of local device pages by ensuring encrypted, authentic, and tamper-proof communication, thereby protecting user data and fostering trust.

v1.7.74

• Fix the issue that AP sometimes goes offline even when the network is functioning normally.

v1.7.73

• Fix the device online status issue where certificates may sometimes disappear after device firmware update.

• Fix AP sometimes getting offline upon device firmware updates, requiring a reboot to get AP online.

• Fix AP offline issue caused by UTF-8 device name.

• Resolve the issue of a full system reload occurring when adding/deleting MyPSK Users.

v1.7.71

• Add multi-language support for System Name in LSP--You can modify the name of your AP from the cloud page where multiple languages are supported. Any changes made will synchronize to the LSP page “Device Overview” -> “System Name” field

• Update LSP web GUI style--We've revamped the LSP web GUI with a sleek and modern design, enhancing visual appeal without compromising any of the existing LSP functionality. Enjoy an updated interface that not only looks stylish but also aligns with contemporary design standards, providing a more visually pleasing and user-friendly experience.

• Support shaping policies or block schemes on a per-application basis--Elevate network management with our SSID traffic throttling feature, now upgraded to customize bandwidth limits for specific applications such as YouTube, Apple iCloud, Facebook, Netflix, Apple App Store, and Line, etc. Facilitate enterprise clients to efficiently allocate limited bandwidth, ensuring optimal service delivery for a larger clientele.

• If mDNS forwarding is enabled, BCMC suppression will not block mDNS packets.

1. mDNS (Multicast DNS) Overview:

   mDNS, or Multicast DNS, is a protocol that allows devices on a local network to discover and connect to each other without the need for a centralized DNS (Domain Name System) server. It enables automatic assignment of domain names to devices, making it easier for users to access services on the network without manual configuration.

   In practical terms, mDNS simplifies the process of identifying and connecting to devices such as printers, smart home devices, and other networked services within a local environment. Instead of relying on traditional DNS, which typically involves a central server, mDNS uses multicast packets to resolve domain names to IP addresses directly on the local network.

2. BCMC (Broadcast/Multicast Control) suppression Functionality:

   On the other hand, BCMC, or Broadcast/Multicast Control, is a feature designed to manage and control the impact of broadcast and multicast traffic on a network. Broadcasting and multicasting can lead to increased network congestion and reduced efficiency, especially in large-scale deployments.

   BCMC helps address these challenges by suppressing or controlling unnecessary broadcast and multicast traffic. By doing so, it ensures that the network operates more efficiently, reducing the risk of bandwidth saturation and enhancing overall performance.

3. Interplay between mDNS and BCMC:

   In certain network scenarios, there may be a potential conflict between mDNS and BCMC functionalities. By allowing mDNS packets to pass through when mDNS forwarding is enabled, the network ensures that devices can continue to discover and communicate with each other seamlessly using the mDNS protocol. This synergy between mDNS and BCMC functionality aims to strike a balance between efficient network management and the need for smooth, decentralized device discovery and connectivity in local environments.

• Client List supports more OS types - Meta VR devices, Honeywell IoT device…etc--Clients List feature now includes expanded compatibility with various operating systems such as Meta VR devices, Honeywell IoT devices, and more. To ensure ongoing accuracy and relevance, we regularly update our fingerprint identification system. This proactive approach allows us to seamlessly integrate newly released devices into the Cloud Clients List page, ensuring that you have precise and up-to-date information about connected clients.

• SSID on LAN : support AD and LDAP captive portal authentication.

• Disable 6GHz radio if selected Wi-Fi encryption is not supported on the 6GHz band.

• Support 6GHz all-channel-utilization scan in diag tool.

v1.7.60

• This f/w version is for the first release.

v1.8.85

[New Features]

• Increased MyPSK entry to 5,000 to support larger MDU/Domitory environment.

• Supports sub-option codes within DHCP Option 43, enabling EnGenius APs to identify the correct Access Controller (AC) in mixed environments with multiple AP and AC brands.

• Support client traffic logs when SSID is set is set to NAT mode, providing more information for trouble shooting.

• Supports Configuration Rollback function, allowing the device to automatically rollback to the last stable configuration if a misconfiguration causes a loss of Cloud connection.

• Increase 802.11 RTS/CTS disable option to reduce signaling overhead and latency. This improves data transmission efficiency in environments with strong signals and minimal interference, such as those using directional antennas.

v1.8.84

[Issues Fixed]

1. Resolved mDNS loop issue. When there are multiple AP in a network with multiple SSID and mDNS Forwarding enabled, power cycle one of the AP may causes network unstable.

v1.8.83

[Issues Fixed]

1. Enhance the gateway detection mechanism in Bridge Mode to solve the problem that captive portal clients could not correctly redirect to gateway.

2. Solve the issue that LSP can still access when Local Web Pages was disabled.

3. Fix the problem that AP goes offline when the third octet of gateway (GW) subnet mask is less than 255 (e.g., GW IP 192.168.1.1, mask 255.255.254.0).

4. Fix the issue that TX Bytes and RX Bytes statistics in the disconnection log always show 0.

5. Fix AP cannot send 802.11v post-association packets properly when band steering is enabled.

v1.8.82

• Support EnGenius fast-handover algorithm 2.0

• Remove dropbear chacha20-poly1305@openssh.com encryption due to security concern.

• Fix the issue that clients may get disconnected after editing ACL rules.

• Add country code for Japan.

v1.6.81

• Add support for SAMLv2 (Security Assertion Markup Language version 2) in Captive portal with Azure-AD.

• Support HTTPS-Only for local device page.

• Support WPA2-PSK[AES] + WPA-PSK[TKIP] encryption mode.

• Speed up the LED turn-off time when the user disables the LED Light function.

Appendix for v1.x.81

1. Add support for SAMLv2 in Captive portal with Azure-AD

A captive portal is a web page that users must interact with to gain network access, often seen in public Wi-Fi networks. This update introduces support for SAMLv2 (Security Assertion Markup Language version 2), a prominent protocol used for exchanging authentication and authorization data between identity providers and service providers.

(a) What is SAMLv2?

SAMLv2 is an XML-based open standard for secure exchange of authentication and authorization data. It enables Single Sign-On (SSO), allowing users to authenticate once and gain access to multiple applications without re-entering credentials. In the context of Azure AD, SAMLv2 facilitates secure communication between Azure AD (the identity provider) and various services (service providers) users want to access.

(b) Implications of This Update

• Enhanced Authentication: Users can now authenticate through Azure AD when accessing a network via a captive portal. This means that organizations leveraging Azure AD for identity management can extend its use to captive portals, ensuring a consistent and secure authentication process.

• Single Sign-On (SSO): With SAMLv2, users benefit from SSO capabilities. They log in once with their Azure AD credentials and gain seamless access to multiple services and applications without the need to re-authenticate, improving user experience and productivity.

• Increased Security: SAMLv2 enhances security by enabling strong authentication and reducing password fatigue. It ensures that authentication tokens are securely transmitted and managed, protecting user credentials from potential attacks.

(c) Practical Applications

Organizations can now implement SAMLv2-based captive portals, allowing users to connect to networks using their Azure AD credentials. This integration streamlines access management and bolsters security, making it especially beneficial for enterprises with a high reliance on Azure AD for identity services.

In summary, the support for SAMLv2 in Azure-AD captive portals facilitates a more secure, efficient, and user-friendly authentication process, aligning with modern enterprise needs for robust identity and access management.

1. Support HTTPS-Only for local device page

To address security concerns, we have introduced an HTTPS-only switch that allows users to control access to the Local Service Page (LSP). This feature is essential for enhancing the security of local device management by ensuring that all communications are encrypted.

(a) Importance of HTTPS for Security

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP and is widely used to secure data transmission over the internet. When enabled, HTTPS ensures that all data exchanged between the user's browser and the local device page is encrypted. This encryption is crucial for several reasons:

• Data Privacy: HTTPS uses TLS (Transport Layer Security) to encrypt the data, making it unreadable to any third party that might intercept the communication. This protects sensitive information such as login credentials and configuration settings from being exposed.

• Data Integrity: Encryption also ensures that the data transferred has not been altered during transmission. It prevents tampering and ensures that the information received by the user is exactly what the server sent.

• Authentication: HTTPS verifies the identity of the local device page, ensuring that users are connecting to the correct page and not a malicious site impersonating it. This helps prevent man-in-the-middle attacks where an attacker might intercept and alter communications between the user and the device.

• User Trust: Users are more likely to trust and engage with local device pages that employ HTTPS, as indicated by the padlock icon in the browser's address bar. This visual assurance helps build confidence in the security of the connection.

(b) Implementation and Control

By introducing an HTTPS-only switch, we empower users to enforce this level of security. Users can easily enable this switch to ensure that all access to the Local Service Page is through HTTPS. This change mitigates risks associated with unencrypted HTTP connections, such as eavesdropping and data breaches.

In summary, the HTTPS-only feature significantly enhances the security of local device pages by ensuring encrypted, authentic, and tamper-proof communication, thereby protecting user data and fostering trust.

v1.6.80

• Support wireless client MAC-based WMM.

• Support application DSCP tagging.

• Enhance Traffic Log to support additional NAT information to syslog server.

• Support Radsec to provide TLS encryption for Radius connection initiated from AP.

• Enhance MyPSK Radius requests for external Radius server to contain both RoamingIQ attribute and mac authentication attribute.

• Support additional dolphin action to run Radius server existence test.

• Support group of multiple AD configuration for single SSID.

• Use dolphin subscribe actions for all channel utilization scan in diag tools.

• Support malware URL Blocking.

• Support website filtering.

• Support hotspot2.0 and openRoaming.

• Support client-balancing 2.0

• Fix mesh topology that may sometimes display failed.

• Enhance Multicast to Unicast function for legacy clients.

Appendix for v1.x.80

1. Support wireless client MAC-based WMM

(a) Wi-Fi Multimedia (WMM) Overview:

Wi-Fi Multimedia (WMM) is a QoS (Quality of Service) standard that is an integral part of modern Wi-Fi technology, based on the IEEE 802.11e standard. WMM is essential in environments where different types of data compete for bandwidth because it ensures that time-sensitive applications like voice and video conferencing perform well even in congested network conditions. This protocol prioritizes traffic according to four access categories:

• Voice: Highest priority, dedicated to voice-over-IP (VoIP) services.

• Video: High priority, allocated for streaming video.

• Best Effort: Standard priority for general data traffic such as web browsing.

• Background: Lowest priority, intended for data that is not time-sensitive, like backups or bulk data transfers.

(b) What Does "MAC-Based WMM Support" Mean?

The feature "Support wireless client mac-based WMM" refers to the capability of the wireless access point (AP) to apply WMM rules based on the MAC address of each connecting client device. A MAC address is a unique identifier assigned to network interfaces for communications on the physical network segment. Implementing MAC-based WMM allows network administrators to assign different data priorities to devices according to their MAC addresses. This functionality is particularly useful in diverse operational environments where devices have varying bandwidth and latency requirements.

(c) Practical Applications of Mac-Based WMM

Here are several scenarios where mac-based WMM can significantly enhance network management and performance:

Tailored Experience: Enterprises can customize network performance based on the roles or departments within the organization. For example, devices belonging to the executive team or those used in critical operations might be assigned higher data priorities.

Enhanced Security: By controlling which devices have priority access, administrators can better manage network security protocols and reduce the risk of unauthorized data access.

Optimized Network Utilization: Mac-based WMM enables the network to adapt dynamically to changing conditions and user demands, prioritizing critical applications automatically.

Improved Scalability: As more devices join the network, administrators can manage traffic effectively without manual reconfiguration, ensuring consistent performance across all connected devices.

1. Support application DSCP tagging

(a) What is DSCP?

DSCP stands for Differentiated Services Code Point. It is a field in the IP header used to enable Quality of Service (QoS) on networks. DSCP replaces the older system of IP precedence with a more flexible and granular approach to traffic classification and prioritization. The DSCP field consists of six bits, allowing for 64 different traffic classes that can be defined and used to manage packet forwarding policies.

DSCP plays a crucial role in network traffic management by providing a mechanism for marking packets to receive different levels of service based on their assigned class. This capability is essential for managing congestion and ensuring that high-priority traffic, such as real-time voice or video, receives the necessary bandwidth and minimal latency.

(b) How Does DSCP Work?

When a packet is sent from a source, the DSCP value is set in its IP header, indicating the level of priority it should receive across the network. Network routers and switches read this DSCP value and make decisions about the packet's forwarding priority and queue placement. By doing so, networks can differentiate between various types of traffic, prioritizing them according to organizational policies and network requirements.

(c) Benefits of DSCP Tagging

1. Improved Network Performance: By prioritizing critical applications, DSCP helps in managing network resources efficiently, thus enhancing overall performance. Traffic like VoIP and video conferencing can operate smoothly even under heavy network load.

2. Enhanced Quality of Service: DSCP enables more granular control over packet forwarding decisions, allowing network administrators to fine-tune QoS policies. This leads to better service quality, especially for latency-sensitive applications.

3. Scalability: DSCP scales well with the size of the network, providing a consistent approach to QoS even as the network grows and traffic volume increases.

4. Flexibility: The ability to define multiple levels of service makes DSCP highly flexible. Organizations can customize their traffic management strategies to align with specific business needs.

(d) Applications of DSCP Tagging in Enterprise Networks

• Voice and Video Prioritization: DSCP is extensively used to ensure that voice and video traffic is given priority over other types of data, reducing delays and improving communication quality.

• Data Center Traffic Management: In data centers, DSCP can help manage the flow of traffic between servers, storage systems, and external networks, optimizing response times and service delivery.

• Remote Work Solutions: With the rise of remote work, DSCP can play a pivotal role in prioritizing VPN traffic to ensure that business-critical applications have the bandwidth they need.

1. Support hotspot2.0 and openRoaming

(a) What is Hotspot 2.0?

Hotspot 2.0, also known as Wi-Fi Certified Passpoint, is a standard created by the Wi-Fi Alliance to streamline and secure the process of connecting to Wi-Fi hotspots. It allows mobile devices to automatically discover and connect to Wi-Fi networks without user intervention, using a seamless, secure authentication process based on the credentials issued by the service provider, much like cellular networks.

(b) Key Features of Hotspot 2.0

• Seamless Connectivity: Hotspot 2.0 enables devices to automatically connect to Wi-Fi networks with robust security protocols, without requiring users to manually search for and select networks.

• Enhanced Security: It supports advanced security protocols, such as WPA2-Enterprise and WPA3-Enterprise, providing end-to-end encryption and preventing unauthorized access.

• Simplified User Experience: By automating the discovery and connection process, Hotspot 2.0 eliminates the need for users to repeatedly enter login credentials.

• Interoperability: Designed to work across different wireless service providers and geographies, facilitating easier roaming and connectivity.

(c) What is OpenRoaming?

OpenRoaming is a federation service that allows users to seamlessly roam between Wi-Fi and cellular networks, removing the need to manually connect to different Wi-Fi networks. It is a collaboration spearheaded by the Wireless Broadband Alliance (WBA) that brings together a consortium of companies aiming to create a globally interconnected network.

(d) Benefits of OpenRoaming

• Effortless Network Transition: With OpenRoaming, devices can automatically switch between Wi-Fi and cellular networks without user interaction, depending on the best available network.

• Universal Coverage: It aims to combine the benefits of both private and public Wi-Fi networks with cellular service, expanding network coverage dramatically.

• Secure Connectivity: OpenRoaming ensures that security standards such as WPA3 are met, keeping the user's data protected during transmission across different networks.

• Enhanced User Experience: Provides a smooth, uninterrupted service as users move between different network environments, ideal for travelling users and mobile professionals.

(e) Applications and Implications of Hotspot 2.0 and OpenRoaming

1. Travel and Hospitality: For travelers, Hotspot 2.0 and OpenRoaming can significantly enhance connectivity in airports, hotels, and public spaces, offering seamless access to high-quality Wi-Fi.

2. Urban Mobility: In smart cities, these technologies can facilitate uninterrupted internet access across different urban spaces, improving navigation, streaming, and communication services.

3. Enterprise Connectivity: Businesses can provide secure, seamless Wi-Fi access to employees and visitors, improving productivity and user satisfaction.

4. Telecommunications: For telecom operators, integrating Hotspot 2.0 and OpenRoaming can reduce the load on cellular networks and provide a better balance of traffic across networks.

The inclusion of "Support for Hotspot 2.0 and OpenRoaming" in our firmware underlines our commitment to enhancing connectivity and user experience. These features enable devices to leverage advanced network technologies to automatically connect to the best available network, securely and effortlessly. By adopting these standards, we are setting a new benchmark for seamless and secure mobile connectivity, catering to the needs of modern users who require reliable and effortless internet access wherever they go.

v1.6.74

• Fix the issue that AP sometimes goes offline even when the network is functioning normally.

v1.6.73

• Fix the device online status issue where certificates may sometimes disappear after device firmware update.

• Fix AP sometimes getting offline upon device firmware updates, requiring a reboot to get AP online.

• Fix AP offline issue caused by UTF-8 device name.

• Resolve the issue of a full system reload occurring when adding/deleting MyPSK Users.

v1.6.71

• Add multi-language support for System Name in LSP--You can modify the name of your AP from the cloud page where multiple languages are supported. Any changes made will synchronize to the LSP page “Device Overview” -> “System Name” field

• Update LSP web GUI style--We've revamped the LSP web GUI with a sleek and modern design, enhancing visual appeal without compromising any of the existing LSP functionality. Enjoy an updated interface that not only looks stylish but also aligns with contemporary design standards, providing a more visually pleasing and user-friendly experience.

• Support shaping policies or block schemes on a per-application basis--Elevate network management with our SSID traffic throttling feature, now upgraded to customize bandwidth limits for specific applications such as YouTube, Apple iCloud, Facebook, Netflix, Apple App Store, and Line, etc. Facilitate enterprise clients to efficiently allocate limited bandwidth, ensuring optimal service delivery for a larger clientele.

• If mDNS forwarding is enabled, BCMC suppression will not block mDNS packets.

1. mDNS (Multicast DNS) Overview:

   mDNS, or Multicast DNS, is a protocol that allows devices on a local network to discover and connect to each other without the need for a centralized DNS (Domain Name System) server. It enables automatic assignment of domain names to devices, making it easier for users to access services on the network without manual configuration.

   In practical terms, mDNS simplifies the process of identifying and connecting to devices such as printers, smart home devices, and other networked services within a local environment. Instead of relying on traditional DNS, which typically involves a central server, mDNS uses multicast packets to resolve domain names to IP addresses directly on the local network.

2. BCMC (Broadcast/Multicast Control) suppression Functionality:

   On the other hand, BCMC, or Broadcast/Multicast Control, is a feature designed to manage and control the impact of broadcast and multicast traffic on a network. Broadcasting and multicasting can lead to increased network congestion and reduced efficiency, especially in large-scale deployments.

   BCMC helps address these challenges by suppressing or controlling unnecessary broadcast and multicast traffic. By doing so, it ensures that the network operates more efficiently, reducing the risk of bandwidth saturation and enhancing overall performance.

3. Interplay between mDNS and BCMC:

   In certain network scenarios, there may be a potential conflict between mDNS and BCMC functionalities. By allowing mDNS packets to pass through when mDNS forwarding is enabled, the network ensures that devices can continue to discover and communicate with each other seamlessly using the mDNS protocol. This synergy between mDNS and BCMC functionality aims to strike a balance between efficient network management and the need for smooth, decentralized device discovery and connectivity in local environments.

• Client List supports more OS types - Meta VR devices, Honeywell IoT device…etc--Clients List feature now includes expanded compatibility with various operating systems such as Meta VR devices, Honeywell IoT devices, and more. To ensure ongoing accuracy and relevance, we regularly update our fingerprint identification system. This proactive approach allows us to seamlessly integrate newly released devices into the Cloud Clients List page, ensuring that you have precise and up-to-date information about connected clients.

• SSID on LAN : support AD and LDAP captive portal authentication.

• Disable 6GHz radio if selected Wi-Fi encryption is not supported on the 6GHz band.

• Support 6GHz all-channel-utilization scan in diag tool.

v1.6.67

• Fixed the issue for encountering failure when selecting specific country: Liechtenstein, Montenegro, or Angola.

v1.6.66

• Support WPA3-Enterprise on 6GHz band.

• Update openssl version (from 1.1.1n to 3.0.9) to support TLS1.2

• Optimize captive portal re-authentication with backup cache.

• Improve client balance background scan algorithm: optimize the algorithm flow by reducing unnecessary actions in client balance background scan algorithm to increase the efficiency.

• Set BCMC suppression enabled by default. Enabling BCMC suppression may eliminate unnecessary broadcast and multicast packets from Ethernet to wireless interface and result in less wireless interference.

• Set min. bitrate value as 12Mbps for each radio interface. Higher minimum bitrate value can help reduce the client connections with lower signal strength and result in faster roaming to other AP to avoid AP sticky connection issue.

v1.6.61

• Fixed traffic log for wrong format issue.

• Fixed abnormal banned message displaying when message length is more than one line.

• Don't force disabling accounting server in voucher service.

• Fixed Wi-Fi crash issue in v1.x.60 FW which caused system reboot.

• Adjust DHCP Discover-packet sending scheme when both L2 isolation and portal are enabled.

v1.6.56

• Fixed vulnerability issue (CVE-2022-38546).

v1.6.55

• Support SNMPv3 with multiple user accounts.

• Support application blocking feature.

• Support 802.11r in more security types:

(a) WPA3 Personal (SAE)

(b) WPA3-Personal/WPA2-PSK mixed

(c) WPA3 Enterprise with suite-b disabled

• Support packet capture functions.

• WPA3-Personal supports Dynamic Client VLAN Pooling.

• WPA3-Enterprise supports external Radius with VLAN assignment.

• Support DFS channel 144.

v1.6.50

• Update openssl to 1.1.1n

• Support AD server with multi-group feature.

• Optimize Wi-Fi reload time.

• Support Wi-Fi Calling QoS.

• Support 1000 myPSK rules per AP.

• Support SSID-based IPSec VPN tunneling (StrongSWAN).

• Support EnGenius auto VPN (mediator).

• Support SMBv2/v3 for AD authentication.

v1.6.48

• Adjust EAP-Enterprise rekey interval to avoid wireless IOT issues.

v1.6.47

• Fix hostapd daemon dead issue.

• Add protection for hostapd zombie symptom.

• Fix VLAN by RADIUS issue.

v1.6.46

• Enhance IOT client association compatibility.

v1.6.45

• Support RADIUS CoA disconnect-client requests (802.1x)

• Support SmartTV SSID

• LSP page encloses language support for Japanese language.

• Resolved Fragattack vulnerability issues.

• Support EoGRE tunnel and DHCP option 82.

• 6GHz supports HT160 bandwidth option.

v1.5.85

[New Features]

• Increased MyPSK entry to 5,000 to support larger MDU/Domitory environment.

• Supports sub-option codes within DHCP Option 43, enabling EnGenius APs to identify the correct Access Controller (AC) in mixed environments with multiple AP and AC brands.

• Support client traffic logs when SSID is set is set to NAT mode, providing more information for trouble shooting.

• Supports Configuration Rollback function, allowing the device to automatically rollback to the last stable configuration if a misconfiguration causes a loss of Cloud connection.

• Increase 802.11 RTS/CTS disable option to reduce signaling overhead and latency. This improves data transmission efficiency in environments with strong signals and minimal interference, such as those using directional antennas.

v1.5.84

[Issues Fixed]

1. Resolved mDNS loop issue. When there are multiple AP in a network with multiple SSID and mDNS Forwarding enabled, power cycle one of the AP may causes network unstable.

v1.5.83

[Issues Fixed]

1. Enhance the gateway detection mechanism in Bridge Mode to solve the problem that captive portal clients could not correctly redirect to gateway.

2. Solve the issue that LSP can still access when Local Web Pages was disabled.

3. Fix the problem that AP goes offline when the third octet of gateway (GW) subnet mask is less than 255 (e.g., GW IP 192.168.1.1, mask 255.255.254.0).

4. Fix the issue that TX Bytes and RX Bytes statistics in the disconnection log always show 0.

5. Fix AP cannot send 802.11v post-association packets properly when band steering is enabled.

v1.5.82

• Support EnGenius fast-handover algorithm 2.0

• Remove dropbear chacha20-poly1305@openssh.com encryption due to security concern.

• Fix the issue that clients may get disconnected after editing ACL rules.

• Add country code for Japan.

v1.5.81

• Add support for SAMLv2 (Security Assertion Markup Language version 2) in Captive portal with Azure-AD.

• Support HTTPS-Only for local device page.

• Support WPA2-PSK[AES] + WPA-PSK[TKIP] encryption mode.

• Speed up the LED turn-off time when the user disables the LED Light function.

Appendix for v1.x.81

1. Add support for SAMLv2 in Captive portal with Azure-AD

A captive portal is a web page that users must interact with to gain network access, often seen in public Wi-Fi networks. This update introduces support for SAMLv2 (Security Assertion Markup Language version 2), a prominent protocol used for exchanging authentication and authorization data between identity providers and service providers.

(a) What is SAMLv2?

SAMLv2 is an XML-based open standard for secure exchange of authentication and authorization data. It enables Single Sign-On (SSO), allowing users to authenticate once and gain access to multiple applications without re-entering credentials. In the context of Azure AD, SAMLv2 facilitates secure communication between Azure AD (the identity provider) and various services (service providers) users want to access.

(b) Implications of This Update

• Enhanced Authentication: Users can now authenticate through Azure AD when accessing a network via a captive portal. This means that organizations leveraging Azure AD for identity management can extend its use to captive portals, ensuring a consistent and secure authentication process.

• Single Sign-On (SSO): With SAMLv2, users benefit from SSO capabilities. They log in once with their Azure AD credentials and gain seamless access to multiple services and applications without the need to re-authenticate, improving user experience and productivity.

• Increased Security: SAMLv2 enhances security by enabling strong authentication and reducing password fatigue. It ensures that authentication tokens are securely transmitted and managed, protecting user credentials from potential attacks.

(c) Practical Applications

Organizations can now implement SAMLv2-based captive portals, allowing users to connect to networks using their Azure AD credentials. This integration streamlines access management and bolsters security, making it especially beneficial for enterprises with a high reliance on Azure AD for identity services.

In summary, the support for SAMLv2 in Azure-AD captive portals facilitates a more secure, efficient, and user-friendly authentication process, aligning with modern enterprise needs for robust identity and access management.

1. Support HTTPS-Only for local device page

To address security concerns, we have introduced an HTTPS-only switch that allows users to control access to the Local Service Page (LSP). This feature is essential for enhancing the security of local device management by ensuring that all communications are encrypted.

(a) Importance of HTTPS for Security

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP and is widely used to secure data transmission over the internet. When enabled, HTTPS ensures that all data exchanged between the user's browser and the local device page is encrypted. This encryption is crucial for several reasons:

• Data Privacy: HTTPS uses TLS (Transport Layer Security) to encrypt the data, making it unreadable to any third party that might intercept the communication. This protects sensitive information such as login credentials and configuration settings from being exposed.

• Data Integrity: Encryption also ensures that the data transferred has not been altered during transmission. It prevents tampering and ensures that the information received by the user is exactly what the server sent.

• Authentication: HTTPS verifies the identity of the local device page, ensuring that users are connecting to the correct page and not a malicious site impersonating it. This helps prevent man-in-the-middle attacks where an attacker might intercept and alter communications between the user and the device.

• User Trust: Users are more likely to trust and engage with local device pages that employ HTTPS, as indicated by the padlock icon in the browser's address bar. This visual assurance helps build confidence in the security of the connection.

(b) Implementation and Control

By introducing an HTTPS-only switch, we empower users to enforce this level of security. Users can easily enable this switch to ensure that all access to the Local Service Page is through HTTPS. This change mitigates risks associated with unencrypted HTTP connections, such as eavesdropping and data breaches.

In summary, the HTTPS-only feature significantly enhances the security of local device pages by ensuring encrypted, authentic, and tamper-proof communication, thereby protecting user data and fostering trust.

v1.5.80

• Support wireless client MAC-based WMM.

• Support application DSCP tagging.

• Enhance Traffic Log to support additional NAT information to syslog server.

• Support Radsec to provide TLS encryption for Radius connection initiated from AP.

• Enhance MyPSK Radius requests for external Radius server to contain both RoamingIQ attribute and mac authentication attribute.

• Support additional dolphin action to run Radius server existence test.

• Support group of multiple AD configuration for single SSID.

• Use dolphin subscribe actions for all channel utilization scan in diag tools.

• Support malware URL Blocking.

• Support website filtering.

• Support hotspot2.0 and openRoaming.

• Support client-balancing 2.0

• Fix mesh topology that may sometimes display failed.

• Enhance Multicast to Unicast function for legacy clients.

Appendix for v1.x.80

1. Support wireless client MAC-based WMM

(a) Wi-Fi Multimedia (WMM) Overview:

Wi-Fi Multimedia (WMM) is a QoS (Quality of Service) standard that is an integral part of modern Wi-Fi technology, based on the IEEE 802.11e standard. WMM is essential in environments where different types of data compete for bandwidth because it ensures that time-sensitive applications like voice and video conferencing perform well even in congested network conditions. This protocol prioritizes traffic according to four access categories:

• Voice: Highest priority, dedicated to voice-over-IP (VoIP) services.

• Video: High priority, allocated for streaming video.

• Best Effort: Standard priority for general data traffic such as web browsing.

• Background: Lowest priority, intended for data that is not time-sensitive, like backups or bulk data transfers.

(b) What Does "MAC-Based WMM Support" Mean?

The feature "Support wireless client mac-based WMM" refers to the capability of the wireless access point (AP) to apply WMM rules based on the MAC address of each connecting client device. A MAC address is a unique identifier assigned to network interfaces for communications on the physical network segment. Implementing MAC-based WMM allows network administrators to assign different data priorities to devices according to their MAC addresses. This functionality is particularly useful in diverse operational environments where devices have varying bandwidth and latency requirements.

(c) Practical Applications of Mac-Based WMM

Here are several scenarios where mac-based WMM can significantly enhance network management and performance:

Tailored Experience: Enterprises can customize network performance based on the roles or departments within the organization. For example, devices belonging to the executive team or those used in critical operations might be assigned higher data priorities.

Enhanced Security: By controlling which devices have priority access, administrators can better manage network security protocols and reduce the risk of unauthorized data access.

Optimized Network Utilization: Mac-based WMM enables the network to adapt dynamically to changing conditions and user demands, prioritizing critical applications automatically.

Improved Scalability: As more devices join the network, administrators can manage traffic effectively without manual reconfiguration, ensuring consistent performance across all connected devices.

1. Support application DSCP tagging

(a) What is DSCP?

DSCP stands for Differentiated Services Code Point. It is a field in the IP header used to enable Quality of Service (QoS) on networks. DSCP replaces the older system of IP precedence with a more flexible and granular approach to traffic classification and prioritization. The DSCP field consists of six bits, allowing for 64 different traffic classes that can be defined and used to manage packet forwarding policies.

DSCP plays a crucial role in network traffic management by providing a mechanism for marking packets to receive different levels of service based on their assigned class. This capability is essential for managing congestion and ensuring that high-priority traffic, such as real-time voice or video, receives the necessary bandwidth and minimal latency.

(b) How Does DSCP Work?

When a packet is sent from a source, the DSCP value is set in its IP header, indicating the level of priority it should receive across the network. Network routers and switches read this DSCP value and make decisions about the packet's forwarding priority and queue placement. By doing so, networks can differentiate between various types of traffic, prioritizing them according to organizational policies and network requirements.

(c) Benefits of DSCP Tagging

1. Improved Network Performance: By prioritizing critical applications, DSCP helps in managing network resources efficiently, thus enhancing overall performance. Traffic like VoIP and video conferencing can operate smoothly even under heavy network load.

2. Enhanced Quality of Service: DSCP enables more granular control over packet forwarding decisions, allowing network administrators to fine-tune QoS policies. This leads to better service quality, especially for latency-sensitive applications.

3. Scalability: DSCP scales well with the size of the network, providing a consistent approach to QoS even as the network grows and traffic volume increases.

4. Flexibility: The ability to define multiple levels of service makes DSCP highly flexible. Organizations can customize their traffic management strategies to align with specific business needs.

(d) Applications of DSCP Tagging in Enterprise Networks

• Voice and Video Prioritization: DSCP is extensively used to ensure that voice and video traffic is given priority over other types of data, reducing delays and improving communication quality.

• Data Center Traffic Management: In data centers, DSCP can help manage the flow of traffic between servers, storage systems, and external networks, optimizing response times and service delivery.

• Remote Work Solutions: With the rise of remote work, DSCP can play a pivotal role in prioritizing VPN traffic to ensure that business-critical applications have the bandwidth they need.

1. Support hotspot2.0 and openRoaming

(a) What is Hotspot 2.0?

Hotspot 2.0, also known as Wi-Fi Certified Passpoint, is a standard created by the Wi-Fi Alliance to streamline and secure the process of connecting to Wi-Fi hotspots. It allows mobile devices to automatically discover and connect to Wi-Fi networks without user intervention, using a seamless, secure authentication process based on the credentials issued by the service provider, much like cellular networks.

(b) Key Features of Hotspot 2.0

• Seamless Connectivity: Hotspot 2.0 enables devices to automatically connect to Wi-Fi networks with robust security protocols, without requiring users to manually search for and select networks.

• Enhanced Security: It supports advanced security protocols, such as WPA2-Enterprise and WPA3-Enterprise, providing end-to-end encryption and preventing unauthorized access.

• Simplified User Experience: By automating the discovery and connection process, Hotspot 2.0 eliminates the need for users to repeatedly enter login credentials.

• Interoperability: Designed to work across different wireless service providers and geographies, facilitating easier roaming and connectivity.

(c) What is OpenRoaming?

OpenRoaming is a federation service that allows users to seamlessly roam between Wi-Fi and cellular networks, removing the need to manually connect to different Wi-Fi networks. It is a collaboration spearheaded by the Wireless Broadband Alliance (WBA) that brings together a consortium of companies aiming to create a globally interconnected network.

(d) Benefits of OpenRoaming

• Effortless Network Transition: With OpenRoaming, devices can automatically switch between Wi-Fi and cellular networks without user interaction, depending on the best available network.

• Universal Coverage: It aims to combine the benefits of both private and public Wi-Fi networks with cellular service, expanding network coverage dramatically.

• Secure Connectivity: OpenRoaming ensures that security standards such as WPA3 are met, keeping the user's data protected during transmission across different networks.

• Enhanced User Experience: Provides a smooth, uninterrupted service as users move between different network environments, ideal for travelling users and mobile professionals.

(e) Applications and Implications of Hotspot 2.0 and OpenRoaming

1. Travel and Hospitality: For travelers, Hotspot 2.0 and OpenRoaming can significantly enhance connectivity in airports, hotels, and public spaces, offering seamless access to high-quality Wi-Fi.

2. Urban Mobility: In smart cities, these technologies can facilitate uninterrupted internet access across different urban spaces, improving navigation, streaming, and communication services.

3. Enterprise Connectivity: Businesses can provide secure, seamless Wi-Fi access to employees and visitors, improving productivity and user satisfaction.

4. Telecommunications: For telecom operators, integrating Hotspot 2.0 and OpenRoaming can reduce the load on cellular networks and provide a better balance of traffic across networks.

The inclusion of "Support for Hotspot 2.0 and OpenRoaming" in our firmware underlines our commitment to enhancing connectivity and user experience. These features enable devices to leverage advanced network technologies to automatically connect to the best available network, securely and effortlessly. By adopting these standards, we are setting a new benchmark for seamless and secure mobile connectivity, catering to the needs of modern users who require reliable and effortless internet access wherever they go.

v1.5.74

• Fix the issue that AP sometimes goes offline even when the network is functioning normally.

v1.5.73

• Fix the device online status issue where certificates may sometimes disappear after device firmware update.

• Fix AP sometimes getting offline upon device firmware updates, requiring a reboot to get AP online.

• Fix AP offline issue caused by UTF-8 device name.

• Resolve the issue of a full system reload occurring when adding/deleting MyPSK Users.

v1.5.70

• Add multi-language support for System Name in LSP--You can modify the name of your AP from the cloud page where multiple languages are supported. Any changes made will synchronize to the LSP page “Device Overview” -> “System Name” field

• Update LSP web GUI style--We've revamped the LSP web GUI with a sleek and modern design, enhancing visual appeal without compromising any of the existing LSP functionality. Enjoy an updated interface that not only looks stylish but also aligns with contemporary design standards, providing a more visually pleasing and user-friendly experience.

• Support shaping policies or block schemes on a per-application basis--Elevate network management with our SSID traffic throttling feature, now upgraded to customize bandwidth limits for specific applications such as YouTube, Apple iCloud, Facebook, Netflix, Apple App Store, and Line, etc. Facilitate enterprise clients to efficiently allocate limited bandwidth, ensuring optimal service delivery for a larger clientele.

• If mDNS forwarding is enabled, BCMC suppression will not block mDNS packets.

1. mDNS (Multicast DNS) Overview:

   mDNS, or Multicast DNS, is a protocol that allows devices on a local network to discover and connect to each other without the need for a centralized DNS (Domain Name System) server. It enables automatic assignment of domain names to devices, making it easier for users to access services on the network without manual configuration.

   In practical terms, mDNS simplifies the process of identifying and connecting to devices such as printers, smart home devices, and other networked services within a local environment. Instead of relying on traditional DNS, which typically involves a central server, mDNS uses multicast packets to resolve domain names to IP addresses directly on the local network.

2. BCMC (Broadcast/Multicast Control) suppression Functionality:

   On the other hand, BCMC, or Broadcast/Multicast Control, is a feature designed to manage and control the impact of broadcast and multicast traffic on a network. Broadcasting and multicasting can lead to increased network congestion and reduced efficiency, especially in large-scale deployments.

   BCMC helps address these challenges by suppressing or controlling unnecessary broadcast and multicast traffic. By doing so, it ensures that the network operates more efficiently, reducing the risk of bandwidth saturation and enhancing overall performance.

3. Interplay between mDNS and BCMC:

   In certain network scenarios, there may be a potential conflict between mDNS and BCMC functionalities. By allowing mDNS packets to pass through when mDNS forwarding is enabled, the network ensures that devices can continue to discover and communicate with each other seamlessly using the mDNS protocol. This synergy between mDNS and BCMC functionality aims to strike a balance between efficient network management and the need for smooth, decentralized device discovery and connectivity in local environments.

• Client List supports more OS types - Meta VR devices, Honeywell IoT device…etc--Clients List feature now includes expanded compatibility with various operating systems such as Meta VR devices, Honeywell IoT devices, and more. To ensure ongoing accuracy and relevance, we regularly update our fingerprint identification system. This proactive approach allows us to seamlessly integrate newly released devices into the Cloud Clients List page, ensuring that you have precise and up-to-date information about connected clients.

• SSID on LAN : support AD and LDAP captive portal authentication.

v1.5.67

• Fixed the issue for encountering failure when selecting specific country: Liechtenstein, Montenegro, or Angola.

v1.5.66

• Update openssl version (from 1.1.1n to 3.0.9) to support TLS1.2

• Optimize captive portal re-authentication with backup cache.

• Improve client balance background scan algorithm: optimize the algorithm flow by reducing unnecessary actions in client balance background scan algorithm to increase the efficiency.

• Set BCMC suppression enabled by default. Enabling BCMC suppression may eliminate unnecessary broadcast and multicast packets from Ethernet to wireless interface and result in less wireless interference.

• Set min. bitrate value as 12Mbps for each radio interface. Higher minimum bitrate value can help reduce the client connections with lower signal strength and result in faster roaming to other AP to avoid AP sticky connection issue.

v1.5.61

• Fixed traffic log for wrong format issue.

• Fixed abnormal banned message displaying when message length is more than one line.

• Don't force disabling accounting server in voucher service.

• Fixed Wi-Fi crash issue in v1.x.60 FW which caused system reboot.

• Adjust DHCP Discover-packet sending scheme when both L2 isolation and portal are enabled.

v1.5.60

• Update channel spec to v230404.

• Revise L2-Isolation to allow broadcast and multicast traffics to go through.

• Add a new function for channel candidate list.

• Enhance Application Analysis to support per-client statistics.

• Disable default open Management SSID.

• Enhance DCS mechanism to support CSA (Channel Switching Announcement).

v1.5.56

• Fixed vulnerability issue (CVE-2022-38546).

v1.5.55

• Support SNMPv3 with multiple user accounts.

• Support application blocking feature.

• Support 802.11r in more security types:

(a) WPA3 Personal (SAE)

(b) WPA3-Personal/WPA2-PSK mixed

(c) WPA3 Enterprise with suite-b disabled

• Support packet capture functions.

• WPA3-Personal supports Dynamic Client VLAN Pooling.

• WPA3-Enterprise supports external Radius with VLAN assignment.

• Support DFS channel 144.

v1.5.50

• Update openssl to 1.1.1n

• Support AD server with multi-group feature.

• Optimize Wi-Fi reload time.

• Support Wi-Fi Calling QoS.

• Support 1000 myPSK rules per AP.

• Support SSID-based IPSec VPN tunneling (StrongSWAN).

• Support EnGenius auto VPN (mediator).

• Support SMBv2/v3 for AD authentication.

2024/10/22

• Layer 7 policy-based route is supported, so you can set the rules to direct specific applications to different WAN interfaces without specifying IP addresses or port ranges. Configure > Gateway > Interface > Policy Route > Layer 7 > Add the rules

• Layer 7 firewall rules are supported, so you can block specific applications without specifying IP addresses or port ranges. Configure > Gateway > Firewall > Outbound Rules > Lay 7 > Set the rules

• Disable RTS /CTS is supported Configure > Access Points > Radio > Enable/Disable RTS/CTS on outdoor APS

2024/08/08

• Network template is supported , so you can easily copy the current network configuration as the template and then apply to multiple networks in the same organization at the same time. Organization > Backup & Restore > Configuration template > Add the network template > Click Apply then select the networks to be applied the network template configuration.

• Firmware freeze is supported . Configure > Firmware > Enable freeze firmware version > select the Beta/Stable version firmware to be frozen then click apply

• Enable / Disable Https only and access control on local web pages Configure > General settings> Network > Enable/Disable Https only and enable disable Local web pages.

2024/6/20

• AVXpress offers an end-to-end Quality of Service (QoS) solution specifically designed for crucial audio/video (AV) applications, including video conferencing, multi-media streaming, and gaming. It enables users to prioritize traffic based on its importance. Configure > SSID > Application control > Adjust the priority on audio/video (AV) applications

• RadSec support for the RADIUS server allows you to exchange RADIUS authentication, authorization, and accounting messages through a secure TLS tunnel between the RADIUS server and the AP. It requires AP firmware version 1.x.81 or higher and the addition of a RadSec certificate for functionality. Organization> Security > Certificates> Upload the certificate you get from the RADIUS server > Then go to Configure > AP > SSID > Wireless > WPA2/3 Enterprise/Captive portal > Custom RADIUS> Enable the RadSec on RADIUS Server.

2024/4/30

• Beta version of the new dashboard has been released, so you can check the PDU device numbers, and power status, which include the PDU outlet and Switch PoE status. Dashboard > click the view beta version on the top right corner > New dashboard is displayed with PDU devices numbers , Power status and clients.

• Hotspot 2.0 is a standard for Wi-Fi roaming between Wi-Fi and cellular networks with automatic authentication. It required AP firmware 1.x.75 or above. Configure >SSID > Hotspot2.0 > Enable Hotspot 2.0 .

2024/04/02

• Support Policy Route, you can route traffic over preferred network paths, prioritize certain types of traffic, or balance traffic across multiple links for load balancing and optimization purposes. Configure > Gateway > Interface > Policy Route > Add Policy Rule

2024/02/29

• Support PDU templates, so you can configure whole network PDUs at once with each PDU model template. Configure > PDU > Template

• When the outlet auto-reboots and the powered device is not powered successfully , we will notify users by default.

2024/01/31

• Auto Channel now allows you to pick the desired channel on Radio settings Configure > Radio > select auto > click Change ch. > pick the channel.

• Support allowlist on Client Access Control. Configure > Client Access Control > Enter the mac address on allowlist.

• Add MLO (Multi-Link Operation) options on each SSID. This allows Wi-fi 7 clients to create multiple links with different bands and transmit data concurrently. required AP firmware V1.x.70 or above on Wi-Fi 7 models. Configure > SSID > Wireless> Enable MLO.

• Add DDNS for gateway passthrough mode. Configure > Gateway > Interfaces > select passthrough mode > Choose DDNS providers you want and configure it.

2024/01/04

• Wired Client will display the clients that are directly connected to the downlink port on switches. ECS1xxx/2xxx requires switch firmware v1.2.85 or above. ECS5xxx requires switch firmware v2.2.15 or above.Manage > Client > Wired Client

• SSID on LAN is supported on ECW115 and ECW215AP on LAN3 . Configure > General settings > AP > select the SSID you want to bind on LAN3

• Gateway detail page support Log page. Manage > Gateway > Detail > Logs.

• PDU & EXT supports photo as other product's detail page.

2023/11/30

• The Network can be dragged and dropped to different HV in the same Organization. Click the menu icon on the left-top corner > drag the network and then move to different HV in the same organization.

• PD lifeguard and Autocam lifeguard are supported. PD lifeguard is a function that will automatically reboot PD devices when the PoE switch found it was not responding. Auto cam lifeguard is one of the options in PDLG auto mode. By enabling ACLG, the switch also considers Onvif discovery results to verify if the connected PD is a surveillance device or not. if yes, apply the ACLG reboot profile to the corresponding port automatically.Manage > Switch > Details > PoE > PD lifeguard > Select Ports to enable PD lifeguard > Select Auto Mode > enable Autocam lifeguard.

• Port Isolation Enhancement is supported, so you can configure the forward ports which can be separated into different groups where traffic between different group are blocked. Manage > Switch > Details > Ports > Select Ports to enable Isolation and set forward ports.

• MSP change log is supported. Click MSP icon > Teams > Change log

2023/10/19

• Topology view now can display PDU and Switch Extender. Manage > Topology > you can see the PDU/ Switch Extender icon displayed if you have the devices.

• MSP Single Sign-On (SSO) is now supported.

• BCMC is activated by default and available under the basic plan. Configure > SSID > Add SSID > Advanced settings> BCMC is enabled by default and no Pro license required

• 802.11r now can be enabled when select WPA3 Personal (SAE) or WPA3-Personal/WPA2-PSK mixed.

• Gateway WWAN offers a statistical chart Manage > Gateway Detail > Summary > WWAN statistics is displayed on Throughput/ Latency/Packet Loss.

• VLAN Trunking is available for both Switch and Switch Extender Manage > Switch/Switch EXT details> Ports> Select the port you want to enable VLAN Trunking and Apply.

2023/09/18

• The outlet schedule is able to set three enabled periods in one day on PDU firmware v1.0.5 or above. Manage > PDU > detail > Schedule > edit the outlet schedule > select time slider to be 3

• The outlet autoreboot is supported. Manage > PDU > detail > AutoReboot > Enable the AutoReboot on outlets and configure the hosts that you want to ping

• SNMP v1/v2 is supported on PDU firmware v1.0.5 or above. Configure > General settings > SNMP > change SNMP state to V1/V2c and set the community

• Switch Extender-related settings are now available to configure if your inventory has the extender registered in your organization.

• Gateway EnGenius DDNS is supported when you update the ESG firmware to v1.1.36 on ESG510 or 1.2.36 on ESG610/620. Configure > Interface > WAN > DDNS > select the DDNS provider to EnGenius DDNS > hostname is displayed and able to edited.

• Gateway PoE reset is supported Hover on port on the Gateway Panel on detail page > Reset PoE

2023/08/15

• PDU-related settings are now available to configure if your inventory has the PDU registered in your organization.

• MSP features include creating MSP teams, Inventory device management across Organizations, and cloning organizations.

• Support Failover Preference for adjusting the preferred secondary WAN interface.

• Support Per client application analysis Manage > Client > click the client name > Application Analysis

• Support bandwidth limit on Gateway LAN Interface. Configure > Gateway > Interface > LAN > adjust the download / Upload limit on Bandwidth limit tab.

2023/07/17

• Multiple Bridge is supported on the gateway, This allows you to create Multiple untagged subnet environments. Manage > Gateway > Interfaces > LAN > Change to Multiple bridge mode> Create other interfaces and set the interface type to Bridge

2023/07/07

• Export “Outbound firewall rules” and “Port Forwarding rules” in CSV format. Configure > Gateway > Firewall > Outbound Rules/Port forwarding > Click on the Export button

2023/05/05

• Multi-language is supported. Click on the account located in the upper-right corner of the GUI > Languages > select the language (Chinese, Japan, Indonesia, German, Italy, or Netherlands)

2023/04/28

• Containment could prevent clients to connect to rogue APs listed in the Rogue lists. Manage > AirGuard > Contain all rogue devices. This is available on AP 1.x.55 on "S" models.

• Contain selected APs only Manage >AirGuard > Rogue SSIDs > Expand the Rogue SSID to see all rogue AP’s detected > Choose the ones to be contained. This is available on AP 1.x.55 on "S" models.

• Mail notification option for firmware upgrades is supported. If enabled, users will receive email notifications if there will be firmware upgrade happened. Configure > Alert > enable notification of firmware upgrade

2023/01/31

• Support the option to disable NAT traversal in Site-To-Site VPN. Configure > Gateway > Site to Site VPN > Disable the NAT traversal

• Site-To-Site VPN can be enabled under WAN passthrough mode.

• Support the option to apply outbound firewall rules to all ESGs under the same Org. Configure > Gateway > Firewall > Click the " Apply to all ESG in the org > Click Apply

• Support real-time VPN status under the Gateway Pro feature plan. Manage > VPN Status > VPN nodes > EnGenius Peers or Non-EnGenius Peers > Last Update : Realtime

2022/12/26

• Azure AD supportedConfigure > SSID > Click on one SSID > Captive Portal > Authentication Type > Azure AD

  Configure > SSID > Click on one SSID > Wireless > WPA2/3 Enterprise > Azure AD

2022/12/19

• PoE Extended mode is supported Manage < Switches > Details > Ports > select the Ports > click Configure > find the speed/duplex settings > select Extended.

2022/12/7

• Support Import/Export VLAN with JSON file, so you can import VLAN settings at a time.Manage> Switches > Detail > VLAN > export the JSON file > adjust the VLAN settings> import the JSON file. Configure> Switches > Template > click one of the template > VLAN > export the JSON file > adjust the VLAN settings> import the JSON file.

2022/11/14

• Wi-Fi calling service allows cellular users to make or receive calls using a Wi-Fi network instead of using the cellular network of the carrier, This is available on AP 1.X.50 or later version. Configure > General Settings > AP > Enable WiFi calling.

2022/5/25

• We provide Base DN allows you to specify the LDAP domain and type the LDAP login attribute to use for authentication. Configure > SSID > Click on one SSID > Captive portal > My LDAP Server > Specify the baseDN (format: dc=example,dc=com) and the login attrubute.

2022/5/12

• We provide “Fail-over” when 1st Radius is not reachable, 2nd or 3rd Radius will be used. However, some conditions might need to have “Load balance” on the Radius servers due to a very large client list to do authentication. SSID > Captive Portal > Custom Radius > 3 Radius servers allowed > enable Radius Load balance

2022/4/29

• SmartCast SSID allows users to stream their subscribed media to the TV through Chromecast in their room. This feature requires AP firmware V1.x.37 for ac models and v1.x.45 for ax models Configure > SSID > Create a SmartCast SSID and enable mDNS forwarding for all other SSIDs >add Chromecast to the lists > Download the QR code of the Chromecast and then install it on the corresponding Chromecast device > Scan QR-code

• Support RADIUS VLAN override SSID > WPA2/3 enterprise > VLAN by RADIUS

• Support Hidden SSID detection Manage > AirGuard > Rogure SSID

2022/4/12

• Support Packet Capture with Switch firmware 1.2.61 or above. Manage > Switches > Detail > click Diag icon > Packet Capture Manage > Switches > Diag > Packet Capture

• Allow users to reset the authenticator’s certificate to default on Google LDAP. SSID > WPA2/3 enterprise > Google LDAP SSID > Captive Portal > Authentication Type > Google LDAP

• Support Advanced DCS settings. So you can schedule DCS by start time or time interval. Configure > Radio settings > DCS > Advanced settings

2022/3/31

Diag tool is supported on switch firmware 1.2.60 or above. So you can use it to troubleshoot errors. Manage > Switches > Diag

Manage > Switches > Detail> click Diag icon

2022/3/2

6G is supported by the country.

Configure > SSID > Click one SSID > Wireless > Enable 6G.

Configure > Radio Settings > Enable 6G

2022/1/18

DuraFon Roam management page is supported. Click the phone icon on the left panel.

2021/12/8

Diag tool is supported on AP firmware 1.x.35 or above. So you can use it to troubleshoot errors.

Manage > Access Ponts > Diag

Manage > Access Ponts > Detail>click Diag icon

Clear all logs on Organization is supported. Notification > click clear icon near the Organization

2021/12/1

Per device licensing added. We provide 1 year of free PRO licensing, so you can use PRO features. After 1 year, if you want to use the PRO feature, each device needs to assign a license.

Organization > Inventory & Licensing

2021/11/9

• Dynamic Channel Selection supported. This will automatically change channels to avoid interference Configure > Radio settings > DCS > Enable DCS

• Exclude DFS supported. This allows you to exclude DFS channels from Auto Channel on 5G Configure > Radio settings > Exclude DFS > Enable Exclude DCS

2021/10/19

• New Firmware Trial Zone Supported.

  Users can pick devices into New Firmware Trial Zone, so you can try the new Firmware on partial network devices and prevent the whole Network from going wrong.

  Configure > Firware Upgrade > New Firmware Trial Zone > Add devices into Trial Zone

2021/09/02

• AD/ LDAP supported (only 1 SSID can be enabled in a network)

  Configure > SSID > Click on one SSID > Captive Portal > Authentication Type > My LDAP Server or Active directory

  Configure > SSID > Click on one SSID > Wireless > WPA2 Enterprise > Security > My LDAP Server or Active directory

• Support Bandwidth limit by RADIUS and RADIUS MAC Auth

  Configure > SSID > Click on one SSID > Captive portal > Custom RADIUS

2021/08/24

• Support Virtual AP on floor plans. This allows users to plan the Wi-Fi environment even if physical AP hasn't been registered. Once users have physical APs in the network, users can drag the physical AP to Virtual AP ( model needs to be the same) then physical AP could use the Virtual AP configuration. Manage > Map & Floor Plans > click Virtual AP icon on the tool bar > add the virtual AP then drag on the floor plan > adjust the Virtual AP configuration

• Support to use polyline to draw an obstacle. Manage > Map & Floor Plans > Obstacle

2021/07/14

• Support Google LDAP. If users have used Google Suite, then the users are able to choose google LDAP as their service. If users import Google Certificates from the EnGenius cloud then users can return to the Google Suite to manage the LDAP service. SSID > WPA2/3 enterprise > Google LDAP SSID > Captive Portal > Authentication Type > Google LDAP

• Support System IP Range. Let users be aware of the EnGenius reserved IP range to prevent them from using it in their local LAN. and be able to change the System reserved range if they cannot change their local LAN IP address range. Configure > General settings > AP

• Support RADIUS CoA (Change of Authorization). This allows a RADIUS server to change the access authorization of an active client session. Configure > SSID > click on one SSID > Captive Portal > Custom Radius > CoA

2021/5/19

• Support switch template. This helps users to apply the same port configuration to all switches with the same models in the Network to save the time of configuration. Configure > Switch settings > Template

• Support WIFI usage in Client Timeline.

  Manage > Clients > then click on one client.

2021/4/12:

• Support exporting client list to CSV. Manage > Clients > Export > CSV

• Support SNMP in Configure > General settings > Network

• Support network configuration backup/restore. Organization > Backup & Restore > Add a Network Backup with device backup

2021/3/17

• Support Report Generation. Report > Task > New Task

• Support Facebook WiFi Configure > SSID > click on one SSID > Captive Portal > Facebook Wi-Fi

• Support WPA2-MyPSK Auth with External RADIUS SSID > WPA2-PSK> WP2-MyPSK > Auth with external RADIUS

2021/2/25

• On Manage > Switch> Detail page, add a LED Blinking button to trigger an AP to blink its LED for 10 seconds. This could help users quickly identify the AP.

• Support multicast and unicast General Settings > AP > Advanced Settings.

• Support Switch POE Scheduling Manage > Switches > Detail > PoE Sched.

2021/1/14

• Support WPA2-MyPSK. SSID > WPA2-PSK> WP2-MyPSK

• Support BCMC Suppression. SSID > Wireless > Advanced Settings

• Support Org License so you are able to try the Pro feature easily. Organization > Inventory & License > Click on Switch to Professional

2020/10/19

• Support mesh topology and show third-party devices. Manage > Topology

• Support NAS ID in custom RADIUS settings. SSID > click one SSID > Captive Portal > Custom RADIUS

2020/9/23

• Support VIP in ACL Settings. Configure > Access Control > VIP > Add VIP

2020-08-26

• Support the option to enable/disable switch local GUI in individual settings.

  • Go to Switch detail page > System Settings > Local GUI (enable / disable)

  • By default: Disabled, to prevent confusion on the settings from Cloud and Local GUI.

  • If the user wants to set some advanced settings which Cloud doesn’t support yet, then the user can enable the Local GUI

• Support both "Per Client" bandwidth limit and "Per SSID" bandwidth limit

  • SSID > Bandwidth Limit > Enable "Per Client" and or "Per SSID" bandwidth limit > Upload / Download limit

2020-07-09

• For Covid-19 infection control, Exposure Analysis, an extension of the Client Timeline, helps the Company to be able to identify who had been exposed to the infected in past days. Manage > Clients > click on one client to go to Client Timeline > Exposure Analysis (Exposure Analysis is by default disabled, go to below to enable: Organization > Privacy > Enable Exposure Analysis

2020-06-12

• Bulk voucher list can be exported to .csv file Go to Voucher portal > user credential > auto generation > generate guest pass * N > create bulk voucher > Export to csv

2020-06-01

• TFA (Two Factor Authentication) is enabled for Cloud users

• Enable TFA of your own: User profile > Two Factor Authentication > install Google Authentication on mobile phone > enter TFA (or 2FA) code on Google Authentication APP > Activate

• or to enforce TFA (2FA) for all users in Organization Organization > Security > Enable 2FA Enforcement

• Client's name can be renamed

2020-05-07

• Block function enables admin to block clients from access the networks, and the blocked-user will get blocked message. Manage > Clients > choose the clients to be blocked > Access Control > Block on SSID / Blocked on Network-wide

• Add DNS setting under NAT mode, so user can add, say, content filtering service to filter content access of NAT clients. Manage > SSID > choose one SSID > Network > Client IP mode > NAT mode enabled > DNS settings

2020-04-27

• Splash page editor is enhanced to "WYSWYG" style for user to define their own Logo and theme. Configure > SSID > click on one SSID > Splash Page > Local Splash Page

• Global credential setting is now available to assign single credential to all AP and Switch in the Network for local access. Configure > General Settings > Network > Local Credential

• "Mirror" and "Link Aggregation" function is enabled in Switch Manage > Switches > click on one Switch >under Switch Device Local Page > Mirror / Link Aggregation

2020-04-08

• Client Timeline is available to track how client access to the network for easy-to-debug Manage > Clients > then click on one client

• Dark mode supported

2020-03-10

• User can block clients in Client List.

• Support ACL Block List in SSID > Access Control

• Support WYSIWYG Splash Page editor.

• Add a “Clone From” button in SSID Setting page to speed up SSID manipulation by coping settings from other SSID.

• TX Power tuning options now start from 1 to 10 dBm.

• Support network-wide LED setting in General Settings > AP.

• Support LAN Port settings in General Settings > AP for wall-mounted Access Points.

• For 3rd party presence analytics or location-aware services, EnGenius Cloud now supports Presence Reporting settings inGeneral Settings > AP for integration in advance.

• Syslog Server settings have been moved to General Settings under AP and Switch Tab.

• Support Traffic Log to have AP sending more traffic info to syslog server. The feature is available in advanced settings of General Settings > AP.

• In Firmware Upgrade page, clicking “Upgrade Now” button now also displays a summary of upgraded device number.

• User can see logs of a Switch in Switch List > Detail > Logs.

• Topology now automatically displays the port numbers when mouse is hovering the device icon.

2020-01-09

• Support WPA3.

• Support 802.11w.

• In AP List > Detail page, add LED Blinking button to trigger an AP to blink its LED for 10 seconds. This could help user to quickly identify the AP.

• User now can create and print vouchers in batch.

• Client List now shows more details about client IP address and vendor info.

• New EMail Alert format. Instead of sending all details in one mail, mail body now mainly contains the summary of managed networks. User can follow the link in the mail to browse details in advance.

2019-12-05

• Add "Global Settings" in Toolbar menu to support more network-wide configurations.

• In "Global Settings", user can configure network-wide "Local Credential" to make all managed APs with the same username and password for local access.

• Support the option to turn on/off LEDs of all managed APs in Global Settings > AP.

• Add "VLAN Settings" in Toolbar menu to let user centrally manage all VLANs defined or used in the Network. If there is any VLAN binding with SSID or Voice VLAN defined in switch, all these VLANs would listed in the VLAN Settings page.

• In Switch List > Detail > Summary, user can view all VLANs applied on dedicated switch (including VoiceVLAN).

2019-11-05

• Support network-wide Switch Settings for spanning tree, LLDP, voice VLAN, QoS, IGMP snooping, and jumbo frames.

• Support network-wide VLAN Settings. You can have an overview of the VLANs used in your network including SSIDs or Voice VLANs.

• In the switch detail page, you can manually configure IP Address settings of the switch. Note that the settings only work for the firmware version after 1.1.16.

• In the switch detail page, VLAN can be directly manipulated here. Any newly created VLAN will be also shown in the network-wide VLAN Settings.

2019-10-03

New Features

• Client List now supports sophisticated search options.

• New Sign-In, Sign-Up pages is online.

• Have a dedicated button on the toolbar to manage team members intuitively.

• Add a Help icon button at top right corner of menu bar. User can access user manual and get support ticket over there.

• Support Delete My Account in the user setting menu.

• User can rename Skykey on the management page.

2019-09-25

New Features

• Network-wide Radio Settings now support Indoor and Outdoor profiles.

• Support an option "Disable 11ax in 2.4G" in the Radio Setting. Some legacy wireless clients are not compatible with 11ax. Enabling this option makes the 11ax APs like ECW220 or ECW230 can still serve legacy client well in 2.4G channel.

• Users can upload and display photos in AP Detail page of Web GUI now.

v1.5.85

[New Features]

• Increased MyPSK entry to 5,000 to support larger MDU/Domitory environment.

• Supports sub-option codes within DHCP Option 43, enabling EnGenius APs to identify the correct Access Controller (AC) in mixed environments with multiple AP and AC brands.

• Support client traffic logs when SSID is set is set to NAT mode, providing more information for trouble shooting.

• Supports Configuration Rollback function, allowing the device to automatically rollback to the last stable configuration if a misconfiguration causes a loss of Cloud connection.

• Increase 802.11 RTS/CTS disable option to reduce signaling overhead and latency. This improves data transmission efficiency in environments with strong signals and minimal interference, such as those using directional antennas.

v1.5.84

[Issues Fixed]

1. Resolved mDNS loop issue. When there are multiple AP in a network with multiple SSID and mDNS Forwarding enabled, power cycle one of the AP may causes network unstable.

v1.5.83

[Issues Fixed]

1. Enhance the gateway detection mechanism in Bridge Mode to solve the problem that captive portal clients could not correctly redirect to gateway.

2. Solve the issue that LSP can still access when Local Web Pages was disabled.

3. Fix the problem that AP goes offline when the third octet of gateway (GW) subnet mask is less than 255 (e.g., GW IP 192.168.1.1, mask 255.255.254.0).

4. Fix the issue that TX Bytes and RX Bytes statistics in the disconnection log always show 0.

5. Fix AP cannot send 802.11v post-association packets properly when band steering is enabled.

v1.5.82

• Support EnGenius fast-handover algorithm 2.0

• Remove dropbear chacha20-poly1305@openssh.com encryption due to security concern.

• Fix the issue that clients may get disconnected after editing ACL rules.

• Add country code for Japan.

v1.5.81

• Add support for SAMLv2 (Security Assertion Markup Language version 2) in Captive portal with Azure-AD.

• Support HTTPS-Only for local device page.

• Support WPA2-PSK[AES] + WPA-PSK[TKIP] encryption mode.

• Speed up the LED turn-off time when the user disables the LED Light function.

Appendix for v1.x.81

1. Add support for SAMLv2 in Captive portal with Azure-AD

A captive portal is a web page that users must interact with to gain network access, often seen in public Wi-Fi networks. This update introduces support for SAMLv2 (Security Assertion Markup Language version 2), a prominent protocol used for exchanging authentication and authorization data between identity providers and service providers.

(a) What is SAMLv2?

SAMLv2 is an XML-based open standard for secure exchange of authentication and authorization data. It enables Single Sign-On (SSO), allowing users to authenticate once and gain access to multiple applications without re-entering credentials. In the context of Azure AD, SAMLv2 facilitates secure communication between Azure AD (the identity provider) and various services (service providers) users want to access.

(b) Implications of This Update

• Enhanced Authentication: Users can now authenticate through Azure AD when accessing a network via a captive portal. This means that organizations leveraging Azure AD for identity management can extend its use to captive portals, ensuring a consistent and secure authentication process.

• Single Sign-On (SSO): With SAMLv2, users benefit from SSO capabilities. They log in once with their Azure AD credentials and gain seamless access to multiple services and applications without the need to re-authenticate, improving user experience and productivity.

• Increased Security: SAMLv2 enhances security by enabling strong authentication and reducing password fatigue. It ensures that authentication tokens are securely transmitted and managed, protecting user credentials from potential attacks.

(c) Practical Applications

Organizations can now implement SAMLv2-based captive portals, allowing users to connect to networks using their Azure AD credentials. This integration streamlines access management and bolsters security, making it especially beneficial for enterprises with a high reliance on Azure AD for identity services.

In summary, the support for SAMLv2 in Azure-AD captive portals facilitates a more secure, efficient, and user-friendly authentication process, aligning with modern enterprise needs for robust identity and access management.

1. Support HTTPS-Only for local device page

To address security concerns, we have introduced an HTTPS-only switch that allows users to control access to the Local Service Page (LSP). This feature is essential for enhancing the security of local device management by ensuring that all communications are encrypted.

(a) Importance of HTTPS for Security

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP and is widely used to secure data transmission over the internet. When enabled, HTTPS ensures that all data exchanged between the user's browser and the local device page is encrypted. This encryption is crucial for several reasons:

• Data Privacy: HTTPS uses TLS (Transport Layer Security) to encrypt the data, making it unreadable to any third party that might intercept the communication. This protects sensitive information such as login credentials and configuration settings from being exposed.

• Data Integrity: Encryption also ensures that the data transferred has not been altered during transmission. It prevents tampering and ensures that the information received by the user is exactly what the server sent.

• Authentication: HTTPS verifies the identity of the local device page, ensuring that users are connecting to the correct page and not a malicious site impersonating it. This helps prevent man-in-the-middle attacks where an attacker might intercept and alter communications between the user and the device.

• User Trust: Users are more likely to trust and engage with local device pages that employ HTTPS, as indicated by the padlock icon in the browser's address bar. This visual assurance helps build confidence in the security of the connection.

(b) Implementation and Control

By introducing an HTTPS-only switch, we empower users to enforce this level of security. Users can easily enable this switch to ensure that all access to the Local Service Page is through HTTPS. This change mitigates risks associated with unencrypted HTTP connections, such as eavesdropping and data breaches.

In summary, the HTTPS-only feature significantly enhances the security of local device pages by ensuring encrypted, authentic, and tamper-proof communication, thereby protecting user data and fostering trust.

v1.5.80

• Support wireless client MAC-based WMM.

• Support application DSCP tagging.

• Enhance Traffic Log to support additional NAT information to syslog server.

• Support Radsec to provide TLS encryption for Radius connection initiated from AP.

• Enhance MyPSK Radius requests for external Radius server to contain both RoamingIQ attribute and mac authentication attribute.

• Support additional dolphin action to run Radius server existence test.

• Support group of multiple AD configuration for single SSID.

• Use dolphin subscribe actions for all channel utilization scan in diag tools.

• Support malware URL Blocking.

• Support website filtering.

• Support hotspot2.0 and openRoaming.

• Support client-balancing 2.0

• Fix mesh topology that may sometimes display failed.

• Enhance Multicast to Unicast function for legacy clients.

Appendix for v1.x.80

1. Support wireless client MAC-based WMM

(a) Wi-Fi Multimedia (WMM) Overview:

Wi-Fi Multimedia (WMM) is a QoS (Quality of Service) standard that is an integral part of modern Wi-Fi technology, based on the IEEE 802.11e standard. WMM is essential in environments where different types of data compete for bandwidth because it ensures that time-sensitive applications like voice and video conferencing perform well even in congested network conditions. This protocol prioritizes traffic according to four access categories:

• Voice: Highest priority, dedicated to voice-over-IP (VoIP) services.

• Video: High priority, allocated for streaming video.

• Best Effort: Standard priority for general data traffic such as web browsing.

• Background: Lowest priority, intended for data that is not time-sensitive, like backups or bulk data transfers.

(b) What Does "MAC-Based WMM Support" Mean?

The feature "Support wireless client mac-based WMM" refers to the capability of the wireless access point (AP) to apply WMM rules based on the MAC address of each connecting client device. A MAC address is a unique identifier assigned to network interfaces for communications on the physical network segment. Implementing MAC-based WMM allows network administrators to assign different data priorities to devices according to their MAC addresses. This functionality is particularly useful in diverse operational environments where devices have varying bandwidth and latency requirements.

(c) Practical Applications of Mac-Based WMM

Here are several scenarios where mac-based WMM can significantly enhance network management and performance:

Tailored Experience: Enterprises can customize network performance based on the roles or departments within the organization. For example, devices belonging to the executive team or those used in critical operations might be assigned higher data priorities.

Enhanced Security: By controlling which devices have priority access, administrators can better manage network security protocols and reduce the risk of unauthorized data access.

Optimized Network Utilization: Mac-based WMM enables the network to adapt dynamically to changing conditions and user demands, prioritizing critical applications automatically.

Improved Scalability: As more devices join the network, administrators can manage traffic effectively without manual reconfiguration, ensuring consistent performance across all connected devices.

1. Support application DSCP tagging

(a) What is DSCP?

DSCP stands for Differentiated Services Code Point. It is a field in the IP header used to enable Quality of Service (QoS) on networks. DSCP replaces the older system of IP precedence with a more flexible and granular approach to traffic classification and prioritization. The DSCP field consists of six bits, allowing for 64 different traffic classes that can be defined and used to manage packet forwarding policies.

DSCP plays a crucial role in network traffic management by providing a mechanism for marking packets to receive different levels of service based on their assigned class. This capability is essential for managing congestion and ensuring that high-priority traffic, such as real-time voice or video, receives the necessary bandwidth and minimal latency.

(b) How Does DSCP Work?

When a packet is sent from a source, the DSCP value is set in its IP header, indicating the level of priority it should receive across the network. Network routers and switches read this DSCP value and make decisions about the packet's forwarding priority and queue placement. By doing so, networks can differentiate between various types of traffic, prioritizing them according to organizational policies and network requirements.

(c) Benefits of DSCP Tagging

1. Improved Network Performance: By prioritizing critical applications, DSCP helps in managing network resources efficiently, thus enhancing overall performance. Traffic like VoIP and video conferencing can operate smoothly even under heavy network load.

2. Enhanced Quality of Service: DSCP enables more granular control over packet forwarding decisions, allowing network administrators to fine-tune QoS policies. This leads to better service quality, especially for latency-sensitive applications.

3. Scalability: DSCP scales well with the size of the network, providing a consistent approach to QoS even as the network grows and traffic volume increases.

4. Flexibility: The ability to define multiple levels of service makes DSCP highly flexible. Organizations can customize their traffic management strategies to align with specific business needs.

(d) Applications of DSCP Tagging in Enterprise Networks

• Voice and Video Prioritization: DSCP is extensively used to ensure that voice and video traffic is given priority over other types of data, reducing delays and improving communication quality.

• Data Center Traffic Management: In data centers, DSCP can help manage the flow of traffic between servers, storage systems, and external networks, optimizing response times and service delivery.

• Remote Work Solutions: With the rise of remote work, DSCP can play a pivotal role in prioritizing VPN traffic to ensure that business-critical applications have the bandwidth they need.

1. Support hotspot2.0 and openRoaming

(a) What is Hotspot 2.0?

Hotspot 2.0, also known as Wi-Fi Certified Passpoint, is a standard created by the Wi-Fi Alliance to streamline and secure the process of connecting to Wi-Fi hotspots. It allows mobile devices to automatically discover and connect to Wi-Fi networks without user intervention, using a seamless, secure authentication process based on the credentials issued by the service provider, much like cellular networks.

(b) Key Features of Hotspot 2.0

• Seamless Connectivity: Hotspot 2.0 enables devices to automatically connect to Wi-Fi networks with robust security protocols, without requiring users to manually search for and select networks.

• Enhanced Security: It supports advanced security protocols, such as WPA2-Enterprise and WPA3-Enterprise, providing end-to-end encryption and preventing unauthorized access.

• Simplified User Experience: By automating the discovery and connection process, Hotspot 2.0 eliminates the need for users to repeatedly enter login credentials.

• Interoperability: Designed to work across different wireless service providers and geographies, facilitating easier roaming and connectivity.

(c) What is OpenRoaming?

OpenRoaming is a federation service that allows users to seamlessly roam between Wi-Fi and cellular networks, removing the need to manually connect to different Wi-Fi networks. It is a collaboration spearheaded by the Wireless Broadband Alliance (WBA) that brings together a consortium of companies aiming to create a globally interconnected network.

(d) Benefits of OpenRoaming

• Effortless Network Transition: With OpenRoaming, devices can automatically switch between Wi-Fi and cellular networks without user interaction, depending on the best available network.

• Universal Coverage: It aims to combine the benefits of both private and public Wi-Fi networks with cellular service, expanding network coverage dramatically.

• Secure Connectivity: OpenRoaming ensures that security standards such as WPA3 are met, keeping the user's data protected during transmission across different networks.

• Enhanced User Experience: Provides a smooth, uninterrupted service as users move between different network environments, ideal for travelling users and mobile professionals.

(e) Applications and Implications of Hotspot 2.0 and OpenRoaming

1. Travel and Hospitality: For travelers, Hotspot 2.0 and OpenRoaming can significantly enhance connectivity in airports, hotels, and public spaces, offering seamless access to high-quality Wi-Fi.

2. Urban Mobility: In smart cities, these technologies can facilitate uninterrupted internet access across different urban spaces, improving navigation, streaming, and communication services.

3. Enterprise Connectivity: Businesses can provide secure, seamless Wi-Fi access to employees and visitors, improving productivity and user satisfaction.

4. Telecommunications: For telecom operators, integrating Hotspot 2.0 and OpenRoaming can reduce the load on cellular networks and provide a better balance of traffic across networks.

The inclusion of "Support for Hotspot 2.0 and OpenRoaming" in our firmware underlines our commitment to enhancing connectivity and user experience. These features enable devices to leverage advanced network technologies to automatically connect to the best available network, securely and effortlessly. By adopting these standards, we are setting a new benchmark for seamless and secure mobile connectivity, catering to the needs of modern users who require reliable and effortless internet access wherever they go.

v1.5.74

• Fix the issue that AP sometimes goes offline even when the network is functioning normally.

v1.5.73

• Fix the device online status issue where certificates may sometimes disappear after device firmware update.

• Fix AP sometimes getting offline upon device firmware updates, requiring a reboot to get AP online.

• Fix AP offline issue caused by UTF-8 device name.

• Resolve the issue of a full system reload occurring when adding/deleting MyPSK Users.

v1.5.70

• Add multi-language support for System Name in LSP--You can modify the name of your AP from the cloud page where multiple languages are supported. Any changes made will synchronize to the LSP page “Device Overview” -> “System Name” field

• Update LSP web GUI style--We've revamped the LSP web GUI with a sleek and modern design, enhancing visual appeal without compromising any of the existing LSP functionality. Enjoy an updated interface that not only looks stylish but also aligns with contemporary design standards, providing a more visually pleasing and user-friendly experience.

• Support shaping policies or block schemes on a per-application basis--Elevate network management with our SSID traffic throttling feature, now upgraded to customize bandwidth limits for specific applications such as YouTube, Apple iCloud, Facebook, Netflix, Apple App Store, and Line, etc. Facilitate enterprise clients to efficiently allocate limited bandwidth, ensuring optimal service delivery for a larger clientele.

• If mDNS forwarding is enabled, BCMC suppression will not block mDNS packets.

1. mDNS (Multicast DNS) Overview:

   mDNS, or Multicast DNS, is a protocol that allows devices on a local network to discover and connect to each other without the need for a centralized DNS (Domain Name System) server. It enables automatic assignment of domain names to devices, making it easier for users to access services on the network without manual configuration.

   In practical terms, mDNS simplifies the process of identifying and connecting to devices such as printers, smart home devices, and other networked services within a local environment. Instead of relying on traditional DNS, which typically involves a central server, mDNS uses multicast packets to resolve domain names to IP addresses directly on the local network.

2. BCMC (Broadcast/Multicast Control) suppression Functionality:

   On the other hand, BCMC, or Broadcast/Multicast Control, is a feature designed to manage and control the impact of broadcast and multicast traffic on a network. Broadcasting and multicasting can lead to increased network congestion and reduced efficiency, especially in large-scale deployments.

   BCMC helps address these challenges by suppressing or controlling unnecessary broadcast and multicast traffic. By doing so, it ensures that the network operates more efficiently, reducing the risk of bandwidth saturation and enhancing overall performance.

3. Interplay between mDNS and BCMC:

   In certain network scenarios, there may be a potential conflict between mDNS and BCMC functionalities. By allowing mDNS packets to pass through when mDNS forwarding is enabled, the network ensures that devices can continue to discover and communicate with each other seamlessly using the mDNS protocol. This synergy between mDNS and BCMC functionality aims to strike a balance between efficient network management and the need for smooth, decentralized device discovery and connectivity in local environments.

• Client List supports more OS types - Meta VR devices, Honeywell IoT device…etc--Clients List feature now includes expanded compatibility with various operating systems such as Meta VR devices, Honeywell IoT devices, and more. To ensure ongoing accuracy and relevance, we regularly update our fingerprint identification system. This proactive approach allows us to seamlessly integrate newly released devices into the Cloud Clients List page, ensuring that you have precise and up-to-date information about connected clients.

• SSID on LAN : support AD and LDAP captive portal authentication.

v1.5.67

• Fixed the issue for encountering failure when selecting specific country: Liechtenstein, Montenegro, or Angola.

v1.5.66

• Update openssl version (from 1.1.1n to 3.0.9) to support TLS1.2

• Optimize captive portal re-authentication with backup cache.

• Improve client balance background scan algorithm: optimize the algorithm flow by reducing unnecessary actions in client balance background scan algorithm to increase the efficiency.

• Set BCMC suppression enabled by default. Enabling BCMC suppression may eliminate unnecessary broadcast and multicast packets from Ethernet to wireless interface and result in less wireless interference.

• Set min. bitrate value as 12Mbps for each radio interface. Higher minimum bitrate value can help reduce the client connections with lower signal strength and result in faster roaming to other AP to avoid AP sticky connection issue.

v1.5.61

• Fixed traffic log for wrong format issue.

• Fixed abnormal banned message displaying when message length is more than one line.

• Don't force disabling accounting server in voucher service.

• Fixed Wi-Fi crash issue in v1.x.60 FW which caused system reboot.

• Adjust DHCP Discover-packet sending scheme when both L2 isolation and portal are enabled.

v1.5.60

• Update channel spec to v230404.

• Revise L2-Isolation to allow broadcast and multicast traffics to go through.

• Add a new function for channel candidate list.

• Enhance Application Analysis to support per-client statistics.

• Disable default open Management SSID.

• Enhance DCS mechanism to support CSA (Channel Switching Announcement).

v1.5.55

• Support SNMPv3 with multiple user accounts.

• Support application blocking feature.

• Support 802.11r in more security types:

(a) WPA3 Personal (SAE)

(b) WPA3-Personal/WPA2-PSK mixed

(c) WPA3 Enterprise with suite-b disabled

• Support packet capture functions.

• WPA3-Personal supports Dynamic Client VLAN Pooling.

• WPA3-Enterprise supports external Radius with VLAN assignment.

• Support DFS channel 144.

v1.5.51

• Fixed the issue with high CPU loading when users enabled Air-Guard function under multiple ECW-AP S model environment.

v1.5.50

• Update openssl to 1.1.1n

• Support AD server with multi-group feature.

• Optimize Wi-Fi reload time.

• Support Wi-Fi Calling QoS.

• Support 1000 myPSK rules per AP.

• Support SSID-based IPSec VPN tunneling (StrongSWAN).

• Support EnGenius auto VPN (mediator).

• Support SMBv2/v3 for AD authentication.

• Support BLE Presence Reporting.

v1.5.48

• Adjust EAP-Enterprise rekey interval to avoid wireless IOT issues.

v1.5.47

• Fix hostapd daemon dead issue.

• Add protection for hostapd zombie symptom.

• Fix VLAN by RADIUS issue.

v1.5.46

• Enhance IOT client association compatibility.

v1.5.45

• Support RADIUS CoA disconnect-client requests (802.1x)

• Support SmartTV SSID

• LSP page encloses language support for Japanese language.

• Resolved Fragattack vulnerability issues.

• Support EoGRE tunnel and DHCP option 82.

• WIDS supports co-defense scheme.

v1.5.42

• Support multiple domains of AD server.

• Adjust DCS algorithm.

• Recognize new iOS/MAC OS version.

• Fixed captive portal for IPv6 issue.

• Adjust log messages.

• Fixed diag tool/Speed Test issue

• Add configuration to accept RADIUS server's VLAN attribute or not.

• Support wireless spectrum analysis.

• Support DFS channel fallback scheme.

• Support MAC-based authentication with RADIUS (OPEN).

• WPA3-SAE and WAP3/WAP2 mixed mode support Dynamic Client VLAN Pooling.

• Support zero-wait DFS.

• Support EnGenius Air Guard features.

• Support instant WIDS event log report.

• Execute diag tool/All Channel Utilization by scanning radio

v1.8.85

[New Features]

• Increased MyPSK entry to 5,000 to support larger MDU/Domitory environment.

• Supports sub-option codes within DHCP Option 43, enabling EnGenius APs to identify the correct Access Controller (AC) in mixed environments with multiple AP and AC brands.

• Support client traffic logs when SSID is set is set to NAT mode, providing more information for trouble shooting.

• Supports Configuration Rollback function, allowing the device to automatically rollback to the last stable configuration if a misconfiguration causes a loss of Cloud connection.

• Increase 802.11 RTS/CTS disable option to reduce signaling overhead and latency. This improves data transmission efficiency in environments with strong signals and minimal interference, such as those using directional antennas.

v1.8.84

[Issues Fixed]

1. Resolved mDNS loop issue. When there are multiple AP in a network with multiple SSID and mDNS Forwarding enabled, power cycle one of the AP may causes network unstable.

v1.8.83

[Issues Fixed]

1. Enhance the gateway detection mechanism in Bridge Mode to solve the problem that captive portal clients could not correctly redirect to gateway.

2. Solve the issue that LSP can still access when Local Web Pages was disabled.

3. Fix the problem that AP goes offline when the third octet of gateway (GW) subnet mask is less than 255 (e.g., GW IP 192.168.1.1, mask 255.255.254.0).

4. Fix the issue that TX Bytes and RX Bytes statistics in the disconnection log always show 0.

5. Fix AP cannot send 802.11v post-association packets properly when band steering is enabled.

v1.8.82

• Support EnGenius fast-handover algorithm 2.0

• Remove dropbear chacha20-poly1305@openssh.com encryption due to security concern.

• Fix the issue that clients may get disconnected after editing ACL rules.

• Add country code for Japan.

v1.8.81

• Add support for SAMLv2 (Security Assertion Markup Language version 2) in Captive portal with Azure-AD.

• Support HTTPS-Only for local device page.

• Support WPA2-PSK[AES] + WPA-PSK[TKIP] encryption mode.

• Speed up the LED turn-off time when the user disables the LED Light function.

Appendix for v1.x.81

1. Add support for SAMLv2 in Captive portal with Azure-AD

A captive portal is a web page that users must interact with to gain network access, often seen in public Wi-Fi networks. This update introduces support for SAMLv2 (Security Assertion Markup Language version 2), a prominent protocol used for exchanging authentication and authorization data between identity providers and service providers.

(a) What is SAMLv2?

SAMLv2 is an XML-based open standard for secure exchange of authentication and authorization data. It enables Single Sign-On (SSO), allowing users to authenticate once and gain access to multiple applications without re-entering credentials. In the context of Azure AD, SAMLv2 facilitates secure communication between Azure AD (the identity provider) and various services (service providers) users want to access.

(b) Implications of This Update

• Enhanced Authentication: Users can now authenticate through Azure AD when accessing a network via a captive portal. This means that organizations leveraging Azure AD for identity management can extend its use to captive portals, ensuring a consistent and secure authentication process.

• Single Sign-On (SSO): With SAMLv2, users benefit from SSO capabilities. They log in once with their Azure AD credentials and gain seamless access to multiple services and applications without the need to re-authenticate, improving user experience and productivity.

• Increased Security: SAMLv2 enhances security by enabling strong authentication and reducing password fatigue. It ensures that authentication tokens are securely transmitted and managed, protecting user credentials from potential attacks.

(c) Practical Applications

Organizations can now implement SAMLv2-based captive portals, allowing users to connect to networks using their Azure AD credentials. This integration streamlines access management and bolsters security, making it especially beneficial for enterprises with a high reliance on Azure AD for identity services.

In summary, the support for SAMLv2 in Azure-AD captive portals facilitates a more secure, efficient, and user-friendly authentication process, aligning with modern enterprise needs for robust identity and access management.

1. Support HTTPS-Only for local device page

To address security concerns, we have introduced an HTTPS-only switch that allows users to control access to the Local Service Page (LSP). This feature is essential for enhancing the security of local device management by ensuring that all communications are encrypted.

(a) Importance of HTTPS for Security

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP and is widely used to secure data transmission over the internet. When enabled, HTTPS ensures that all data exchanged between the user's browser and the local device page is encrypted. This encryption is crucial for several reasons:

• Data Privacy: HTTPS uses TLS (Transport Layer Security) to encrypt the data, making it unreadable to any third party that might intercept the communication. This protects sensitive information such as login credentials and configuration settings from being exposed.

• Data Integrity: Encryption also ensures that the data transferred has not been altered during transmission. It prevents tampering and ensures that the information received by the user is exactly what the server sent.

• Authentication: HTTPS verifies the identity of the local device page, ensuring that users are connecting to the correct page and not a malicious site impersonating it. This helps prevent man-in-the-middle attacks where an attacker might intercept and alter communications between the user and the device.

• User Trust: Users are more likely to trust and engage with local device pages that employ HTTPS, as indicated by the padlock icon in the browser's address bar. This visual assurance helps build confidence in the security of the connection.

(b) Implementation and Control

By introducing an HTTPS-only switch, we empower users to enforce this level of security. Users can easily enable this switch to ensure that all access to the Local Service Page is through HTTPS. This change mitigates risks associated with unencrypted HTTP connections, such as eavesdropping and data breaches.

In summary, the HTTPS-only feature significantly enhances the security of local device pages by ensuring encrypted, authentic, and tamper-proof communication, thereby protecting user data and fostering trust.

v1.5.80

• Support wireless client MAC-based WMM.

• Support application DSCP tagging.

• Enhance Traffic Log to support additional NAT information to syslog server.

• Support Radsec to provide TLS encryption for Radius connection initiated from AP.

• Enhance MyPSK Radius requests for external Radius server to contain both RoamingIQ attribute and mac authentication attribute.

• Support additional dolphin action to run Radius server existence test.

• Support group of multiple AD configuration for single SSID.

• Use dolphin subscribe actions for all channel utilization scan in diag tools.

• Support malware URL Blocking.

• Support website filtering.

• Support hotspot2.0 and openRoaming.

• Support client-balancing 2.0

• Fix mesh topology that may sometimes display failed.

• Enhance Multicast to Unicast function for legacy clients.

Appendix for v1.x.80

1. Support wireless client MAC-based WMM

(a) Wi-Fi Multimedia (WMM) Overview:

Wi-Fi Multimedia (WMM) is a QoS (Quality of Service) standard that is an integral part of modern Wi-Fi technology, based on the IEEE 802.11e standard. WMM is essential in environments where different types of data compete for bandwidth because it ensures that time-sensitive applications like voice and video conferencing perform well even in congested network conditions. This protocol prioritizes traffic according to four access categories:

• Voice: Highest priority, dedicated to voice-over-IP (VoIP) services.

• Video: High priority, allocated for streaming video.

• Best Effort: Standard priority for general data traffic such as web browsing.

• Background: Lowest priority, intended for data that is not time-sensitive, like backups or bulk data transfers.

(b) What Does "MAC-Based WMM Support" Mean?

The feature "Support wireless client mac-based WMM" refers to the capability of the wireless access point (AP) to apply WMM rules based on the MAC address of each connecting client device. A MAC address is a unique identifier assigned to network interfaces for communications on the physical network segment. Implementing MAC-based WMM allows network administrators to assign different data priorities to devices according to their MAC addresses. This functionality is particularly useful in diverse operational environments where devices have varying bandwidth and latency requirements.

(c) Practical Applications of Mac-Based WMM

Here are several scenarios where mac-based WMM can significantly enhance network management and performance:

Tailored Experience: Enterprises can customize network performance based on the roles or departments within the organization. For example, devices belonging to the executive team or those used in critical operations might be assigned higher data priorities.

Enhanced Security: By controlling which devices have priority access, administrators can better manage network security protocols and reduce the risk of unauthorized data access.

Optimized Network Utilization: Mac-based WMM enables the network to adapt dynamically to changing conditions and user demands, prioritizing critical applications automatically.

Improved Scalability: As more devices join the network, administrators can manage traffic effectively without manual reconfiguration, ensuring consistent performance across all connected devices.

1. Support application DSCP tagging

(a) What is DSCP?

DSCP stands for Differentiated Services Code Point. It is a field in the IP header used to enable Quality of Service (QoS) on networks. DSCP replaces the older system of IP precedence with a more flexible and granular approach to traffic classification and prioritization. The DSCP field consists of six bits, allowing for 64 different traffic classes that can be defined and used to manage packet forwarding policies.

DSCP plays a crucial role in network traffic management by providing a mechanism for marking packets to receive different levels of service based on their assigned class. This capability is essential for managing congestion and ensuring that high-priority traffic, such as real-time voice or video, receives the necessary bandwidth and minimal latency.

(b) How Does DSCP Work?

When a packet is sent from a source, the DSCP value is set in its IP header, indicating the level of priority it should receive across the network. Network routers and switches read this DSCP value and make decisions about the packet's forwarding priority and queue placement. By doing so, networks can differentiate between various types of traffic, prioritizing them according to organizational policies and network requirements.

(c) Benefits of DSCP Tagging

1. Improved Network Performance: By prioritizing critical applications, DSCP helps in managing network resources efficiently, thus enhancing overall performance. Traffic like VoIP and video conferencing can operate smoothly even under heavy network load.

2. Enhanced Quality of Service: DSCP enables more granular control over packet forwarding decisions, allowing network administrators to fine-tune QoS policies. This leads to better service quality, especially for latency-sensitive applications.

3. Scalability: DSCP scales well with the size of the network, providing a consistent approach to QoS even as the network grows and traffic volume increases.

4. Flexibility: The ability to define multiple levels of service makes DSCP highly flexible. Organizations can customize their traffic management strategies to align with specific business needs.

(d) Applications of DSCP Tagging in Enterprise Networks

• Voice and Video Prioritization: DSCP is extensively used to ensure that voice and video traffic is given priority over other types of data, reducing delays and improving communication quality.

• Data Center Traffic Management: In data centers, DSCP can help manage the flow of traffic between servers, storage systems, and external networks, optimizing response times and service delivery.

• Remote Work Solutions: With the rise of remote work, DSCP can play a pivotal role in prioritizing VPN traffic to ensure that business-critical applications have the bandwidth they need.

1. Support hotspot2.0 and openRoaming

(a) What is Hotspot 2.0?

Hotspot 2.0, also known as Wi-Fi Certified Passpoint, is a standard created by the Wi-Fi Alliance to streamline and secure the process of connecting to Wi-Fi hotspots. It allows mobile devices to automatically discover and connect to Wi-Fi networks without user intervention, using a seamless, secure authentication process based on the credentials issued by the service provider, much like cellular networks.

(b) Key Features of Hotspot 2.0

• Seamless Connectivity: Hotspot 2.0 enables devices to automatically connect to Wi-Fi networks with robust security protocols, without requiring users to manually search for and select networks.

• Enhanced Security: It supports advanced security protocols, such as WPA2-Enterprise and WPA3-Enterprise, providing end-to-end encryption and preventing unauthorized access.

• Simplified User Experience: By automating the discovery and connection process, Hotspot 2.0 eliminates the need for users to repeatedly enter login credentials.

• Interoperability: Designed to work across different wireless service providers and geographies, facilitating easier roaming and connectivity.

(c) What is OpenRoaming?

OpenRoaming is a federation service that allows users to seamlessly roam between Wi-Fi and cellular networks, removing the need to manually connect to different Wi-Fi networks. It is a collaboration spearheaded by the Wireless Broadband Alliance (WBA) that brings together a consortium of companies aiming to create a globally interconnected network.

(d) Benefits of OpenRoaming

• Effortless Network Transition: With OpenRoaming, devices can automatically switch between Wi-Fi and cellular networks without user interaction, depending on the best available network.

• Universal Coverage: It aims to combine the benefits of both private and public Wi-Fi networks with cellular service, expanding network coverage dramatically.

• Secure Connectivity: OpenRoaming ensures that security standards such as WPA3 are met, keeping the user's data protected during transmission across different networks.

• Enhanced User Experience: Provides a smooth, uninterrupted service as users move between different network environments, ideal for travelling users and mobile professionals.

(e) Applications and Implications of Hotspot 2.0 and OpenRoaming

1. Travel and Hospitality: For travelers, Hotspot 2.0 and OpenRoaming can significantly enhance connectivity in airports, hotels, and public spaces, offering seamless access to high-quality Wi-Fi.

2. Urban Mobility: In smart cities, these technologies can facilitate uninterrupted internet access across different urban spaces, improving navigation, streaming, and communication services.

3. Enterprise Connectivity: Businesses can provide secure, seamless Wi-Fi access to employees and visitors, improving productivity and user satisfaction.

4. Telecommunications: For telecom operators, integrating Hotspot 2.0 and OpenRoaming can reduce the load on cellular networks and provide a better balance of traffic across networks.

The inclusion of "Support for Hotspot 2.0 and OpenRoaming" in our firmware underlines our commitment to enhancing connectivity and user experience. These features enable devices to leverage advanced network technologies to automatically connect to the best available network, securely and effortlessly. By adopting these standards, we are setting a new benchmark for seamless and secure mobile connectivity, catering to the needs of modern users who require reliable and effortless internet access wherever they go.

v1.5.74

• Fix the issue that AP sometimes goes offline even when the network is functioning normally.

v1.5.73

• Fix the device online status issue where certificates may sometimes disappear after device firmware update.

• Fix AP sometimes getting offline upon device firmware updates, requiring a reboot to get AP online.

• Fix AP offline issue caused by UTF-8 device name.

• Resolve the issue of a full system reload occurring when adding/deleting MyPSK Users.

v1.5.70

• Add multi-language support for System Name in LSP--You can modify the name of your AP from the cloud page where multiple languages are supported. Any changes made will synchronize to the LSP page “Device Overview” -> “System Name” field

• Update LSP web GUI style--We've revamped the LSP web GUI with a sleek and modern design, enhancing visual appeal without compromising any of the existing LSP functionality. Enjoy an updated interface that not only looks stylish but also aligns with contemporary design standards, providing a more visually pleasing and user-friendly experience.

• Support shaping policies or block schemes on a per-application basis--Elevate network management with our SSID traffic throttling feature, now upgraded to customize bandwidth limits for specific applications such as YouTube, Apple iCloud, Facebook, Netflix, Apple App Store, and Line, etc. Facilitate enterprise clients to efficiently allocate limited bandwidth, ensuring optimal service delivery for a larger clientele.

• If mDNS forwarding is enabled, BCMC suppression will not block mDNS packets.

1. mDNS (Multicast DNS) Overview:

   mDNS, or Multicast DNS, is a protocol that allows devices on a local network to discover and connect to each other without the need for a centralized DNS (Domain Name System) server. It enables automatic assignment of domain names to devices, making it easier for users to access services on the network without manual configuration.

   In practical terms, mDNS simplifies the process of identifying and connecting to devices such as printers, smart home devices, and other networked services within a local environment. Instead of relying on traditional DNS, which typically involves a central server, mDNS uses multicast packets to resolve domain names to IP addresses directly on the local network.

2. BCMC (Broadcast/Multicast Control) suppression Functionality:

   On the other hand, BCMC, or Broadcast/Multicast Control, is a feature designed to manage and control the impact of broadcast and multicast traffic on a network. Broadcasting and multicasting can lead to increased network congestion and reduced efficiency, especially in large-scale deployments.

   BCMC helps address these challenges by suppressing or controlling unnecessary broadcast and multicast traffic. By doing so, it ensures that the network operates more efficiently, reducing the risk of bandwidth saturation and enhancing overall performance.

3. Interplay between mDNS and BCMC:

   In certain network scenarios, there may be a potential conflict between mDNS and BCMC functionalities. By allowing mDNS packets to pass through when mDNS forwarding is enabled, the network ensures that devices can continue to discover and communicate with each other seamlessly using the mDNS protocol. This synergy between mDNS and BCMC functionality aims to strike a balance between efficient network management and the need for smooth, decentralized device discovery and connectivity in local environments.

• Client List supports more OS types - Meta VR devices, Honeywell IoT device…etc--Clients List feature now includes expanded compatibility with various operating systems such as Meta VR devices, Honeywell IoT devices, and more. To ensure ongoing accuracy and relevance, we regularly update our fingerprint identification system. This proactive approach allows us to seamlessly integrate newly released devices into the Cloud Clients List page, ensuring that you have precise and up-to-date information about connected clients.

• SSID on LAN : support AD and LDAP captive portal authentication.

v1.5.67

• Fixed the issue for encountering failure when selecting specific country: Liechtenstein, Montenegro, or Angola.

v1.5.66

• Update openssl version (from 1.1.1n to 3.0.9) to support TLS1.2

• Optimize captive portal re-authentication with backup cache.

• Improve client balance background scan algorithm: optimize the algorithm flow by reducing unnecessary actions in client balance background scan algorithm to increase the efficiency.

• Set BCMC suppression enabled by default. Enabling BCMC suppression may eliminate unnecessary broadcast and multicast packets from Ethernet to wireless interface and result in less wireless interference.

• Set min. bitrate value as 12Mbps for each radio interface. Higher minimum bitrate value can help reduce the client connections with lower signal strength and result in faster roaming to other AP to avoid AP sticky connection issue.

v1.5.61

• Fixed traffic log for wrong format issue.

• Fixed abnormal banned message displaying when message length is more than one line.

• Don't force disabling accounting server in voucher service.

• Fixed Wi-Fi crash issue in v1.x.60 FW which caused system reboot.

• Adjust DHCP Discover-packet sending scheme when both L2 isolation and portal are enabled.

v1.5.60

• Update channel spec to v230404.

• Revise L2-Isolation to allow broadcast and multicast traffics to go through.

• Add a new function for channel candidate list.

• Enhance Application Analysis to support per-client statistics.

• Disable default open Management SSID.

• Enhance DCS mechanism to support CSA (Channel Switching Announcement).

v1.5.56

• Fixed vulnerability issue (CVE-2022-38546).

v1.5.55

• Support SNMPv3 with multiple user accounts.

• Support application blocking feature.

• Support 802.11r in more security types:

(a) WPA3 Personal (SAE)

(b) WPA3-Personal/WPA2-PSK mixed

(c) WPA3 Enterprise with suite-b disabled

• Support packet capture functions.

• WPA3-Personal supports Dynamic Client VLAN Pooling.

• WPA3-Enterprise supports external Radius with VLAN assignment.

• Support DFS channel 144.

v1.5.50

• Update openssl to 1.1.1n

• Support AD server with multi-group feature.

• Optimize Wi-Fi reload time.

• Support Wi-Fi Calling QoS.

• Support 1000 myPSK rules per AP.

• Support SSID-based IPSec VPN tunneling (StrongSWAN).

• Support EnGenius auto VPN (mediator).

• Support SMBv2/v3 for AD authentication.

v1.5.48

• Adjust EAP-Enterprise rekey interval to avoid wireless IOT issues.

v1.5.47

• Fix hostapd daemon dead issue.

• Add protection for hostapd zombie symptom.

• Fix VLAN by RADIUS issue.

v1.5.46

• Enhance IOT client association compatibility.

v1.5.45

• Support RADIUS CoA disconnect-client requests (802.1x)

• Support SmartTV SSID

• LSP page encloses language support for Japanese language.

• Resolved Fragattack vulnerability issues.

• Support EoGRE tunnel and DHCP option 82.

v1.5.41

• Support multiple domains of AD server.

• Adjust DCS algorithm.

• Recognize new iOS/MAC OS version.

• Fixed captive portal for IPv6 issue.

• Adjust log messages.

• Fixed diag tool/Speed Test issue

• Add configuration to accept RADIUS server's VLAN attribute or not.

• Support wireless spectrum analysis.

• Support DFS channel fallback scheme.

• Support MAC-based authentication with RADIUS (OPEN).

• WPA3-SAE and WAP3/WAP2 mixed mode support Dynamic Client VLAN Pooling.

v1.5.35

• Support DCS (Dynamic Channel Selection) by background scanning.

• Enhance bcmc function that may block DHCP broadcast OFFER/ACK packets.

• Support auto-channel with "Exclude DFS" config.

• Support EnGenius cloud diagnostic mode.

• Enclose fix for FragAttacks security issue.

v1.5.30

• Support system-reserved IP range pool.

• Support RADIUS CoA disconnect-client requests.

• Perform periodically scanning for 802.11k report without background scanning.

• Support intelligent band-steering.

• Support proxy ARP.

• Support 802.1x/captive portal with Google Auth.

• Support RADIUS WISPr traffic control and traffic quantity attributes.

• Support RADIUS MAC-Auth in captive portal.

• Support captive portal authentication by LDAP/AD server: single SSID, single server.

• Update 2.4GHz HT20 auto-channel algorithm for using 1,6,11 channels.

v1.4.28

• Optimized wireless connectivity for 11AX models.

v1.4.27

• Fix target assert issue caused by iPhone11/iPhone12 for 802.11ax models.

• Add log message for Wi-Fi reload event.

• Add protection to prevent Wi-Fi interface could not be brought up.

• Force client balancing disabled on ECW220/ECW230.

v1.4.26

• Support Facebook Wi-Fi.

• Add client's TX/RX Byte information in disassociation event log.

• Modify LSP Page about HTTP/HTTPS proxy setting.

• Handle HTTP error code 504 upon check-in to cloud server.

v1.4.25

• Handle private MAC address detection with blocked info messages.

• Adjust mesh related syslog contents.

• Support RSTP.

• Support background scanning ON/OFF option.

• Update certificate for HTTPS access to LSP page.

• ECW230v3 supports CE/FCC DFS channels.

• Remove unnecessary WLAN event logs.

v1.4.23

• Handle larger max. client limit value from cloud server.

• Fixed the issue that LED on/off would trigger network reload with specific configurations.

v1.4.22

• Support MAC address authentication with RADIUS server.

• Support MyPSK with RADIUS server authentication.

• Handle VLAN ID attribute from RADIUS authentication responses.

• Support SSDP responder and adjust mDNS response content.

v1.4.21

• Band Steering feature encloses improvement for 802.11k/v and utilizes 802.11r fasting roaming technique to avoid re-authentication upon connection to different radio band.

• Procedures of applying WLAN configuration has been optimized to shorten needed time for setting update.

• Enhance Captive Portal secure login with HTTPS-based information exchange.

• Support my-PSK with dynamic VLAN for WPA2-PSK authentication. (only available from EnGenius Cloud, not external radius)

• Mesh AP node supports traffic shaping.

• Support SNMP v2/v3 for local management with Get function.

• Support multicast to unicast per radio.

• Captive Portal feature supports client-leave-network timeout.

• Support Client Balancing to steer the client to connect to best available AP.

• Support dynamic VLAN (VLAN Pooling).

• Support Broadcast/Multicast suppression.

v1.4.15

• Adjust channel candidates of Auto-channel selection (ACS).

• Adjust power table limitation of Malaysia and Indonesia.

v1.4.14

• Apply auto-channel selection mechanism update

v1.4.12

• Apply regulatory domain update

v1.4.11

• Adjust DTIM from 2 to 3

• Adjust amsdu parameter from 7 to 3 for Wi-Fi 6 models

• Turn Uplink OFDMA on by default for Wi-Fi 6 models

v1.5.85

[New Features]

• Increased MyPSK entry to 5,000 to support larger MDU/Domitory environment.

• Supports sub-option codes within DHCP Option 43, enabling EnGenius APs to identify the correct Access Controller (AC) in mixed environments with multiple AP and AC brands.

• Support client traffic logs when SSID is set is set to NAT mode, providing more information for trouble shooting.

• Supports Configuration Rollback function, allowing the device to automatically rollback to the last stable configuration if a misconfiguration causes a loss of Cloud connection.

• Increase 802.11 RTS/CTS disable option to reduce signaling overhead and latency. This improves data transmission efficiency in environments with strong signals and minimal interference, such as those using directional antennas.

v1.5.84

[Issues Fixed]

1. Resolved mDNS loop issue. When there are multiple AP in a network with multiple SSID and mDNS Forwarding enabled, power cycle one of the AP may causes network unstable.

v1.5.83

[Issues Fixed]

1. Enhance the gateway detection mechanism in Bridge Mode to solve the problem that captive portal clients could not correctly redirect to gateway.

2. Solve the issue that LSP can still access when Local Web Pages was disabled.

3. Fix the problem that AP goes offline when the third octet of gateway (GW) subnet mask is less than 255 (e.g., GW IP 192.168.1.1, mask 255.255.254.0).

4. Fix the issue that TX Bytes and RX Bytes statistics in the disconnection log always show 0.

5. Fix AP cannot send 802.11v post-association packets properly when band steering is enabled.

v1.5.82

• Support EnGenius fast-handover algorithm 2.0

• Remove dropbear chacha20-poly1305@openssh.com encryption due to security concern.

• Fix the issue that clients may get disconnected after editing ACL rules.

• Add country code for Japan.

v1.5.81

• Add support for SAMLv2 (Security Assertion Markup Language version 2) in Captive portal with Azure-AD.

• Support HTTPS-Only for local device page.

• Support WPA2-PSK[AES] + WPA-PSK[TKIP] encryption mode.

• Speed up the LED turn-off time when the user disables the LED Light function.

Appendix for v1.x.81

1. Add support for SAMLv2 in Captive portal with Azure-AD

A captive portal is a web page that users must interact with to gain network access, often seen in public Wi-Fi networks. This update introduces support for SAMLv2 (Security Assertion Markup Language version 2), a prominent protocol used for exchanging authentication and authorization data between identity providers and service providers.

(a) What is SAMLv2?

SAMLv2 is an XML-based open standard for secure exchange of authentication and authorization data. It enables Single Sign-On (SSO), allowing users to authenticate once and gain access to multiple applications without re-entering credentials. In the context of Azure AD, SAMLv2 facilitates secure communication between Azure AD (the identity provider) and various services (service providers) users want to access.

(b) Implications of This Update

• Enhanced Authentication: Users can now authenticate through Azure AD when accessing a network via a captive portal. This means that organizations leveraging Azure AD for identity management can extend its use to captive portals, ensuring a consistent and secure authentication process.

• Single Sign-On (SSO): With SAMLv2, users benefit from SSO capabilities. They log in once with their Azure AD credentials and gain seamless access to multiple services and applications without the need to re-authenticate, improving user experience and productivity.

• Increased Security: SAMLv2 enhances security by enabling strong authentication and reducing password fatigue. It ensures that authentication tokens are securely transmitted and managed, protecting user credentials from potential attacks.

(c) Practical Applications

Organizations can now implement SAMLv2-based captive portals, allowing users to connect to networks using their Azure AD credentials. This integration streamlines access management and bolsters security, making it especially beneficial for enterprises with a high reliance on Azure AD for identity services.

In summary, the support for SAMLv2 in Azure-AD captive portals facilitates a more secure, efficient, and user-friendly authentication process, aligning with modern enterprise needs for robust identity and access management.

1. Support HTTPS-Only for local device page

To address security concerns, we have introduced an HTTPS-only switch that allows users to control access to the Local Service Page (LSP). This feature is essential for enhancing the security of local device management by ensuring that all communications are encrypted.

(a) Importance of HTTPS for Security

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP and is widely used to secure data transmission over the internet. When enabled, HTTPS ensures that all data exchanged between the user's browser and the local device page is encrypted. This encryption is crucial for several reasons:

• Data Privacy: HTTPS uses TLS (Transport Layer Security) to encrypt the data, making it unreadable to any third party that might intercept the communication. This protects sensitive information such as login credentials and configuration settings from being exposed.

• Data Integrity: Encryption also ensures that the data transferred has not been altered during transmission. It prevents tampering and ensures that the information received by the user is exactly what the server sent.

• Authentication: HTTPS verifies the identity of the local device page, ensuring that users are connecting to the correct page and not a malicious site impersonating it. This helps prevent man-in-the-middle attacks where an attacker might intercept and alter communications between the user and the device.

• User Trust: Users are more likely to trust and engage with local device pages that employ HTTPS, as indicated by the padlock icon in the browser's address bar. This visual assurance helps build confidence in the security of the connection.

(b) Implementation and Control

By introducing an HTTPS-only switch, we empower users to enforce this level of security. Users can easily enable this switch to ensure that all access to the Local Service Page is through HTTPS. This change mitigates risks associated with unencrypted HTTP connections, such as eavesdropping and data breaches.

In summary, the HTTPS-only feature significantly enhances the security of local device pages by ensuring encrypted, authentic, and tamper-proof communication, thereby protecting user data and fostering trust.

v1.5.80

• Support wireless client MAC-based WMM.

• Support application DSCP tagging.

• Enhance Traffic Log to support additional NAT information to syslog server.

• Support Radsec to provide TLS encryption for Radius connection initiated from AP.

• Enhance MyPSK Radius requests for external Radius server to contain both RoamingIQ attribute and mac authentication attribute.

• Support additional dolphin action to run Radius server existence test.

• Support group of multiple AD configuration for single SSID.

• Use dolphin subscribe actions for all channel utilization scan in diag tools.

• Support malware URL Blocking.

• Support website filtering.

• Support hotspot2.0 and openRoaming.

• Support client-balancing 2.0

• Fix mesh topology that may sometimes display failed.

• Enhance Multicast to Unicast function for legacy clients.

Appendix for v1.x.80

1. Support wireless client MAC-based WMM

(a) Wi-Fi Multimedia (WMM) Overview:

Wi-Fi Multimedia (WMM) is a QoS (Quality of Service) standard that is an integral part of modern Wi-Fi technology, based on the IEEE 802.11e standard. WMM is essential in environments where different types of data compete for bandwidth because it ensures that time-sensitive applications like voice and video conferencing perform well even in congested network conditions. This protocol prioritizes traffic according to four access categories:

• Voice: Highest priority, dedicated to voice-over-IP (VoIP) services.

• Video: High priority, allocated for streaming video.

• Best Effort: Standard priority for general data traffic such as web browsing.

• Background: Lowest priority, intended for data that is not time-sensitive, like backups or bulk data transfers.

(b) What Does "MAC-Based WMM Support" Mean?

The feature "Support wireless client mac-based WMM" refers to the capability of the wireless access point (AP) to apply WMM rules based on the MAC address of each connecting client device. A MAC address is a unique identifier assigned to network interfaces for communications on the physical network segment. Implementing MAC-based WMM allows network administrators to assign different data priorities to devices according to their MAC addresses. This functionality is particularly useful in diverse operational environments where devices have varying bandwidth and latency requirements.

(c) Practical Applications of Mac-Based WMM

Here are several scenarios where mac-based WMM can significantly enhance network management and performance:

Tailored Experience: Enterprises can customize network performance based on the roles or departments within the organization. For example, devices belonging to the executive team or those used in critical operations might be assigned higher data priorities.

Enhanced Security: By controlling which devices have priority access, administrators can better manage network security protocols and reduce the risk of unauthorized data access.

Optimized Network Utilization: Mac-based WMM enables the network to adapt dynamically to changing conditions and user demands, prioritizing critical applications automatically.

Improved Scalability: As more devices join the network, administrators can manage traffic effectively without manual reconfiguration, ensuring consistent performance across all connected devices.

1. Support application DSCP tagging

(a) What is DSCP?

DSCP stands for Differentiated Services Code Point. It is a field in the IP header used to enable Quality of Service (QoS) on networks. DSCP replaces the older system of IP precedence with a more flexible and granular approach to traffic classification and prioritization. The DSCP field consists of six bits, allowing for 64 different traffic classes that can be defined and used to manage packet forwarding policies.

DSCP plays a crucial role in network traffic management by providing a mechanism for marking packets to receive different levels of service based on their assigned class. This capability is essential for managing congestion and ensuring that high-priority traffic, such as real-time voice or video, receives the necessary bandwidth and minimal latency.

(b) How Does DSCP Work?

When a packet is sent from a source, the DSCP value is set in its IP header, indicating the level of priority it should receive across the network. Network routers and switches read this DSCP value and make decisions about the packet's forwarding priority and queue placement. By doing so, networks can differentiate between various types of traffic, prioritizing them according to organizational policies and network requirements.

(c) Benefits of DSCP Tagging

1. Improved Network Performance: By prioritizing critical applications, DSCP helps in managing network resources efficiently, thus enhancing overall performance. Traffic like VoIP and video conferencing can operate smoothly even under heavy network load.

2. Enhanced Quality of Service: DSCP enables more granular control over packet forwarding decisions, allowing network administrators to fine-tune QoS policies. This leads to better service quality, especially for latency-sensitive applications.

3. Scalability: DSCP scales well with the size of the network, providing a consistent approach to QoS even as the network grows and traffic volume increases.

4. Flexibility: The ability to define multiple levels of service makes DSCP highly flexible. Organizations can customize their traffic management strategies to align with specific business needs.

(d) Applications of DSCP Tagging in Enterprise Networks

• Voice and Video Prioritization: DSCP is extensively used to ensure that voice and video traffic is given priority over other types of data, reducing delays and improving communication quality.

• Data Center Traffic Management: In data centers, DSCP can help manage the flow of traffic between servers, storage systems, and external networks, optimizing response times and service delivery.

• Remote Work Solutions: With the rise of remote work, DSCP can play a pivotal role in prioritizing VPN traffic to ensure that business-critical applications have the bandwidth they need.

1. Support hotspot2.0 and openRoaming

(a) What is Hotspot 2.0?

Hotspot 2.0, also known as Wi-Fi Certified Passpoint, is a standard created by the Wi-Fi Alliance to streamline and secure the process of connecting to Wi-Fi hotspots. It allows mobile devices to automatically discover and connect to Wi-Fi networks without user intervention, using a seamless, secure authentication process based on the credentials issued by the service provider, much like cellular networks.

(b) Key Features of Hotspot 2.0

• Seamless Connectivity: Hotspot 2.0 enables devices to automatically connect to Wi-Fi networks with robust security protocols, without requiring users to manually search for and select networks.

• Enhanced Security: It supports advanced security protocols, such as WPA2-Enterprise and WPA3-Enterprise, providing end-to-end encryption and preventing unauthorized access.

• Simplified User Experience: By automating the discovery and connection process, Hotspot 2.0 eliminates the need for users to repeatedly enter login credentials.

• Interoperability: Designed to work across different wireless service providers and geographies, facilitating easier roaming and connectivity.

(c) What is OpenRoaming?

OpenRoaming is a federation service that allows users to seamlessly roam between Wi-Fi and cellular networks, removing the need to manually connect to different Wi-Fi networks. It is a collaboration spearheaded by the Wireless Broadband Alliance (WBA) that brings together a consortium of companies aiming to create a globally interconnected network.

(d) Benefits of OpenRoaming

• Effortless Network Transition: With OpenRoaming, devices can automatically switch between Wi-Fi and cellular networks without user interaction, depending on the best available network.

• Universal Coverage: It aims to combine the benefits of both private and public Wi-Fi networks with cellular service, expanding network coverage dramatically.

• Secure Connectivity: OpenRoaming ensures that security standards such as WPA3 are met, keeping the user's data protected during transmission across different networks.

• Enhanced User Experience: Provides a smooth, uninterrupted service as users move between different network environments, ideal for travelling users and mobile professionals.

(e) Applications and Implications of Hotspot 2.0 and OpenRoaming

1. Travel and Hospitality: For travelers, Hotspot 2.0 and OpenRoaming can significantly enhance connectivity in airports, hotels, and public spaces, offering seamless access to high-quality Wi-Fi.

2. Urban Mobility: In smart cities, these technologies can facilitate uninterrupted internet access across different urban spaces, improving navigation, streaming, and communication services.

3. Enterprise Connectivity: Businesses can provide secure, seamless Wi-Fi access to employees and visitors, improving productivity and user satisfaction.

4. Telecommunications: For telecom operators, integrating Hotspot 2.0 and OpenRoaming can reduce the load on cellular networks and provide a better balance of traffic across networks.

The inclusion of "Support for Hotspot 2.0 and OpenRoaming" in our firmware underlines our commitment to enhancing connectivity and user experience. These features enable devices to leverage advanced network technologies to automatically connect to the best available network, securely and effortlessly. By adopting these standards, we are setting a new benchmark for seamless and secure mobile connectivity, catering to the needs of modern users who require reliable and effortless internet access wherever they go.

v1.5.74

• Fix the issue that AP sometimes goes offline even when the network is functioning normally.

v1.5.73

• Fix the device online status issue where certificates may sometimes disappear after device firmware update.

• Fix AP sometimes getting offline upon device firmware updates, requiring a reboot to get AP online.

• Fix AP offline issue caused by UTF-8 device name.

• Resolve the issue of a full system reload occurring when adding/deleting MyPSK Users.

v1.5.70

• Add multi-language support for System Name in LSP--You can modify the name of your AP from the cloud page where multiple languages are supported. Any changes made will synchronize to the LSP page “Device Overview” -> “System Name” field

• Update LSP web GUI style--We've revamped the LSP web GUI with a sleek and modern design, enhancing visual appeal without compromising any of the existing LSP functionality. Enjoy an updated interface that not only looks stylish but also aligns with contemporary design standards, providing a more visually pleasing and user-friendly experience.

• Support shaping policies or block schemes on a per-application basis--Elevate network management with our SSID traffic throttling feature, now upgraded to customize bandwidth limits for specific applications such as YouTube, Apple iCloud, Facebook, Netflix, Apple App Store, and Line, etc. Facilitate enterprise clients to efficiently allocate limited bandwidth, ensuring optimal service delivery for a larger clientele.

• If mDNS forwarding is enabled, BCMC suppression will not block mDNS packets.

1. mDNS (Multicast DNS) Overview:

   mDNS, or Multicast DNS, is a protocol that allows devices on a local network to discover and connect to each other without the need for a centralized DNS (Domain Name System) server. It enables automatic assignment of domain names to devices, making it easier for users to access services on the network without manual configuration.

   In practical terms, mDNS simplifies the process of identifying and connecting to devices such as printers, smart home devices, and other networked services within a local environment. Instead of relying on traditional DNS, which typically involves a central server, mDNS uses multicast packets to resolve domain names to IP addresses directly on the local network.

2. BCMC (Broadcast/Multicast Control) suppression Functionality:

   On the other hand, BCMC, or Broadcast/Multicast Control, is a feature designed to manage and control the impact of broadcast and multicast traffic on a network. Broadcasting and multicasting can lead to increased network congestion and reduced efficiency, especially in large-scale deployments.

   BCMC helps address these challenges by suppressing or controlling unnecessary broadcast and multicast traffic. By doing so, it ensures that the network operates more efficiently, reducing the risk of bandwidth saturation and enhancing overall performance.

3. Interplay between mDNS and BCMC:

   In certain network scenarios, there may be a potential conflict between mDNS and BCMC functionalities. By allowing mDNS packets to pass through when mDNS forwarding is enabled, the network ensures that devices can continue to discover and communicate with each other seamlessly using the mDNS protocol. This synergy between mDNS and BCMC functionality aims to strike a balance between efficient network management and the need for smooth, decentralized device discovery and connectivity in local environments.

• Client List supports more OS types - Meta VR devices, Honeywell IoT device…etc--Clients List feature now includes expanded compatibility with various operating systems such as Meta VR devices, Honeywell IoT devices, and more. To ensure ongoing accuracy and relevance, we regularly update our fingerprint identification system. This proactive approach allows us to seamlessly integrate newly released devices into the Cloud Clients List page, ensuring that you have precise and up-to-date information about connected clients.

• SSID on LAN : support AD and LDAP captive portal authentication.

v1.5.67

• Fixed the issue for encountering failure when selecting specific country: Liechtenstein, Montenegro, or Angola.

v1.5.66

• Update openssl version (from 1.1.1n to 3.0.9) to support TLS1.2

• Optimize captive portal re-authentication with backup cache.

• Improve client balance background scan algorithm: optimize the algorithm flow by reducing unnecessary actions in client balance background scan algorithm to increase the efficiency.

• Set BCMC suppression enabled by default. Enabling BCMC suppression may eliminate unnecessary broadcast and multicast packets from Ethernet to wireless interface and result in less wireless interference.

• Set min. bitrate value as 12Mbps for each radio interface. Higher minimum bitrate value can help reduce the client connections with lower signal strength and result in faster roaming to other AP to avoid AP sticky connection issue.

v1.5.61

• Fixed traffic log for wrong format issue.

• Fixed abnormal banned message displaying when message length is more than one line.

• Don't force disabling accounting server in voucher service.

• Fixed Wi-Fi crash issue in v1.x.60 FW which caused system reboot.

• Adjust DHCP Discover-packet sending scheme when both L2 isolation and portal are enabled.

v1.5.60

• Update channel spec to v230404.

• Revise L2-Isolation to allow broadcast and multicast traffics to go through.

• Add a new function for channel candidate list.

• Enhance Application Analysis to support per-client statistics.

• Disable default open Management SSID.

• Enhance DCS mechanism to support CSA (Channel Switching Announcement).

v1.5.56

• Fixed vulnerability issue (CVE-2022-38546).

v1.5.55

• Support SNMPv3 with multiple user accounts.

• Support application blocking feature.

• Support 802.11r in more security types:

(a) WPA3 Personal (SAE)

(b) WPA3-Personal/WPA2-PSK mixed

(c) WPA3 Enterprise with suite-b disabled

• Support packet capture functions.

• WPA3-Personal supports Dynamic Client VLAN Pooling.

• WPA3-Enterprise supports external Radius with VLAN assignment.

• Support DFS channel 144.

v1.5.50

• Update openssl to 1.1.1n

• Support AD server with multi-group feature.

• Optimize Wi-Fi reload time.

• Support Wi-Fi Calling QoS.

• Support 1000 myPSK rules per AP.

• Support SSID-based IPSec VPN tunneling (StrongSWAN).

• Support EnGenius auto VPN (mediator).

• Support SMBv2/v3 for AD authentication.

v1.5.48

• Adjust EAP-Enterprise rekey interval to avoid wireless IOT issues.

v1.5.47

• Fix hostapd daemon dead issue.

• Add protection for hostapd zombie symptom.

• Fix VLAN by RADIUS issue.

v1.5.46

• Enhance IOT client association compatibility.

v1.5.45

• Support RADIUS CoA disconnect-client requests (802.1x)

• Support SmartTV SSID

• LSP page encloses language support for Japanese language.

• Resolved Fragattack vulnerability issues.

• Support EoGRE tunnel and DHCP option 82.

v1.5.41

• Support multiple domains of AD server.

• Adjust DCS algorithm.

• Recognize new iOS/MAC OS version.

• Fixed captive portal for IPv6 issue.

• Adjust log messages.

• Fixed diag tool/Speed Test issue

• Add configuration to accept RADIUS server's VLAN attribute or not.

• Support wireless spectrum analysis.

• Support DFS channel fallback scheme.

• Support MAC-based authentication with RADIUS (OPEN).

• WPA3-SAE and WAP3/WAP2 mixed mode support Dynamic Client VLAN Pooling.

v1.5.35

• Support DCS (Dynamic Channel Selection) by background scanning.

• Enhance bcmc function that may block DHCP broadcast OFFER/ACK packets.

• Support auto-channel with "Exclude DFS" config.

• Support EnGenius cloud diagnostic mode.

• Enclose fix for FragAttacks security issue.

v1.5.30

• Support system-reserved IP range pool.

• Support RADIUS CoA disconnect-client requests.

• Perform periodically scanning for 802.11k report without background scanning.

• Support intelligent band-steering.

• Support proxy ARP.

• Support 802.1x/captive portal with Google Auth.

• Support RADIUS WISPr traffic control and traffic quantity attributes.

• Support RADIUS MAC-Auth in captive portal.

• Support captive portal authentication by LDAP/AD server: single SSID, single server.

• Update 2.4GHz HT20 auto-channel algorithm for using 1,6,11 channels.

v1.5.28

• Optimized wireless connectivity for 11AX models.

v1.5.27

• Fix target assert issue caused by iPhone11/iPhone12 for 802.11ax models.

• Add log message for Wi-Fi reload event.

• Add protection to prevent Wi-Fi interface could not be brought up.

v1.4.26

• Support Facebook Wi-Fi.

• Add client's TX/RX Byte information in disassociation event log.

• Modify LSP Page about HTTP/HTTPS proxy setting.

• Handle HTTP error code 504 upon check-in to cloud server.

v1.4.25

• Handle private MAC address detection with blocked info messages.

• Adjust mesh related syslog contents.

• Support RSTP.

• Support background scanning ON/OFF option.

• Update certificate for HTTPS access to LSP page.

• Remove unnecessary WLAN event logs.

v1.4.23

• Handle larger max. client limit value from cloud server.

• Fixed the issue that LED on/off would trigger network reload with specific configurations.

v1.4.22

• Support MAC address authentication with RADIUS server.

• Support MyPSK with RADIUS server authentication.

• Handle VLAN ID attribute from RADIUS authentication responses.

• Support SSDP responder and adjust mDNS response content.

v1.4.21

• Band Steering feature encloses improvement for 802.11k/v and utilizes 802.11r fasting roaming technique to avoid re-authentication upon connection to different radio band.

• Procedures of applying WLAN configuration has been optimized to shorten needed time for setting update.

• Enhance Captive Portal secure login with HTTPS-based information exchange.

• Support my-PSK with dynamic VLAN for WPA2-PSK authentication. (only available from EnGenius Cloud, not external radius)

• Mesh AP node supports traffic shaping.

• Support SNMP v2/v3 for local management with Get function.

• Support multicast to unicast per radio.

• Captive Portal feature supports client-leave-network timeout.

• Support Client Balancing to steer the client to connect to best available AP.

• Support dynamic VLAN (VLAN Pooling).

• Support Broadcast/Multicast suppression.

v1.4.15

• Adjust channel candidates of Auto-channel selection (ACS).

• Adjust power table limitation of Malaysia and Indonesia.

v1.4.14

• Apply auto-channel selection mechanism update

v1.4.12

• Apply regulatory domain update

v1.4.11

• Adjust DTIM from 2 to 3

• Adjust amsdu parameter from 7 to 3 for Wi-Fi 6 models

• Turn Uplink OFDMA on by default for Wi-Fi 6 models

v1.5.85

[New Features]

• Increased MyPSK entry to 5,000 to support larger MDU/Domitory environment.

• Supports sub-option codes within DHCP Option 43, enabling EnGenius APs to identify the correct Access Controller (AC) in mixed environments with multiple AP and AC brands.

• Support client traffic logs when SSID is set is set to NAT mode, providing more information for trouble shooting.

• Supports Configuration Rollback function, allowing the device to automatically rollback to the last stable configuration if a misconfiguration causes a loss of Cloud connection.

• Increase 802.11 RTS/CTS disable option to reduce signaling overhead and latency. This improves data transmission efficiency in environments with strong signals and minimal interference, such as those using directional antennas.

v1.5.84

[Issues Fixed]

1. Resolved mDNS loop issue. When there are multiple AP in a network with multiple SSID and mDNS Forwarding enabled, power cycle one of the AP may causes network unstable.

v1.5.83

[Issues Fixed]

1. Enhance the gateway detection mechanism in Bridge Mode to solve the problem that captive portal clients could not correctly redirect to gateway.

2. Solve the issue that LSP can still access when Local Web Pages was disabled.

3. Fix the problem that AP goes offline when the third octet of gateway (GW) subnet mask is less than 255 (e.g., GW IP 192.168.1.1, mask 255.255.254.0).

4. Fix the issue that TX Bytes and RX Bytes statistics in the disconnection log always show 0.

5. Fix AP cannot send 802.11v post-association packets properly when band steering is enabled.

v1.5.82

• Support EnGenius fast-handover algorithm 2.0

• Remove dropbear chacha20-poly1305@openssh.com encryption due to security concern.

• Fix the issue that clients may get disconnected after editing ACL rules.

• Add country code for Japan.

v1.5.81

• Add support for SAMLv2 (Security Assertion Markup Language version 2) in Captive portal with Azure-AD.

• Support HTTPS-Only for local device page.

• Support WPA2-PSK[AES] + WPA-PSK[TKIP] encryption mode.

• Speed up the LED turn-off time when the user disables the LED Light function.

Appendix for v1.x.81

1. Add support for SAMLv2 in Captive portal with Azure-AD

A captive portal is a web page that users must interact with to gain network access, often seen in public Wi-Fi networks. This update introduces support for SAMLv2 (Security Assertion Markup Language version 2), a prominent protocol used for exchanging authentication and authorization data between identity providers and service providers.

(a) What is SAMLv2?

SAMLv2 is an XML-based open standard for secure exchange of authentication and authorization data. It enables Single Sign-On (SSO), allowing users to authenticate once and gain access to multiple applications without re-entering credentials. In the context of Azure AD, SAMLv2 facilitates secure communication between Azure AD (the identity provider) and various services (service providers) users want to access.

(b) Implications of This Update

• Enhanced Authentication: Users can now authenticate through Azure AD when accessing a network via a captive portal. This means that organizations leveraging Azure AD for identity management can extend its use to captive portals, ensuring a consistent and secure authentication process.

• Single Sign-On (SSO): With SAMLv2, users benefit from SSO capabilities. They log in once with their Azure AD credentials and gain seamless access to multiple services and applications without the need to re-authenticate, improving user experience and productivity.

• Increased Security: SAMLv2 enhances security by enabling strong authentication and reducing password fatigue. It ensures that authentication tokens are securely transmitted and managed, protecting user credentials from potential attacks.

(c) Practical Applications

Organizations can now implement SAMLv2-based captive portals, allowing users to connect to networks using their Azure AD credentials. This integration streamlines access management and bolsters security, making it especially beneficial for enterprises with a high reliance on Azure AD for identity services.

In summary, the support for SAMLv2 in Azure-AD captive portals facilitates a more secure, efficient, and user-friendly authentication process, aligning with modern enterprise needs for robust identity and access management.

1. Support HTTPS-Only for local device page

To address security concerns, we have introduced an HTTPS-only switch that allows users to control access to the Local Service Page (LSP). This feature is essential for enhancing the security of local device management by ensuring that all communications are encrypted.

(a) Importance of HTTPS for Security

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP and is widely used to secure data transmission over the internet. When enabled, HTTPS ensures that all data exchanged between the user's browser and the local device page is encrypted. This encryption is crucial for several reasons:

• Data Privacy: HTTPS uses TLS (Transport Layer Security) to encrypt the data, making it unreadable to any third party that might intercept the communication. This protects sensitive information such as login credentials and configuration settings from being exposed.

• Data Integrity: Encryption also ensures that the data transferred has not been altered during transmission. It prevents tampering and ensures that the information received by the user is exactly what the server sent.

• Authentication: HTTPS verifies the identity of the local device page, ensuring that users are connecting to the correct page and not a malicious site impersonating it. This helps prevent man-in-the-middle attacks where an attacker might intercept and alter communications between the user and the device.

• User Trust: Users are more likely to trust and engage with local device pages that employ HTTPS, as indicated by the padlock icon in the browser's address bar. This visual assurance helps build confidence in the security of the connection.

(b) Implementation and Control

By introducing an HTTPS-only switch, we empower users to enforce this level of security. Users can easily enable this switch to ensure that all access to the Local Service Page is through HTTPS. This change mitigates risks associated with unencrypted HTTP connections, such as eavesdropping and data breaches.

In summary, the HTTPS-only feature significantly enhances the security of local device pages by ensuring encrypted, authentic, and tamper-proof communication, thereby protecting user data and fostering trust.

v1.5.80

• Support wireless client MAC-based WMM.

• Support application DSCP tagging.

• Enhance Traffic Log to support additional NAT information to syslog server.

• Support Radsec to provide TLS encryption for Radius connection initiated from AP.

• Enhance MyPSK Radius requests for external Radius server to contain both RoamingIQ attribute and mac authentication attribute.

• Support additional dolphin action to run Radius server existence test.

• Support group of multiple AD configuration for single SSID.

• Use dolphin subscribe actions for all channel utilization scan in diag tools.

• Support malware URL Blocking.

• Support website filtering.

• Support hotspot2.0 and openRoaming.

• Support client-balancing 2.0

• Fix mesh topology that may sometimes display failed.

• Enhance Multicast to Unicast function for legacy clients.

Appendix for v1.x.80

1. Support wireless client MAC-based WMM

(a) Wi-Fi Multimedia (WMM) Overview:

Wi-Fi Multimedia (WMM) is a QoS (Quality of Service) standard that is an integral part of modern Wi-Fi technology, based on the IEEE 802.11e standard. WMM is essential in environments where different types of data compete for bandwidth because it ensures that time-sensitive applications like voice and video conferencing perform well even in congested network conditions. This protocol prioritizes traffic according to four access categories:

• Voice: Highest priority, dedicated to voice-over-IP (VoIP) services.

• Video: High priority, allocated for streaming video.

• Best Effort: Standard priority for general data traffic such as web browsing.

• Background: Lowest priority, intended for data that is not time-sensitive, like backups or bulk data transfers.

(b) What Does "MAC-Based WMM Support" Mean?

The feature "Support wireless client mac-based WMM" refers to the capability of the wireless access point (AP) to apply WMM rules based on the MAC address of each connecting client device. A MAC address is a unique identifier assigned to network interfaces for communications on the physical network segment. Implementing MAC-based WMM allows network administrators to assign different data priorities to devices according to their MAC addresses. This functionality is particularly useful in diverse operational environments where devices have varying bandwidth and latency requirements.

(c) Practical Applications of Mac-Based WMM

Here are several scenarios where mac-based WMM can significantly enhance network management and performance:

Tailored Experience: Enterprises can customize network performance based on the roles or departments within the organization. For example, devices belonging to the executive team or those used in critical operations might be assigned higher data priorities.

Enhanced Security: By controlling which devices have priority access, administrators can better manage network security protocols and reduce the risk of unauthorized data access.

Optimized Network Utilization: Mac-based WMM enables the network to adapt dynamically to changing conditions and user demands, prioritizing critical applications automatically.

Improved Scalability: As more devices join the network, administrators can manage traffic effectively without manual reconfiguration, ensuring consistent performance across all connected devices.

1. Support application DSCP tagging

(a) What is DSCP?

DSCP stands for Differentiated Services Code Point. It is a field in the IP header used to enable Quality of Service (QoS) on networks. DSCP replaces the older system of IP precedence with a more flexible and granular approach to traffic classification and prioritization. The DSCP field consists of six bits, allowing for 64 different traffic classes that can be defined and used to manage packet forwarding policies.

DSCP plays a crucial role in network traffic management by providing a mechanism for marking packets to receive different levels of service based on their assigned class. This capability is essential for managing congestion and ensuring that high-priority traffic, such as real-time voice or video, receives the necessary bandwidth and minimal latency.

(b) How Does DSCP Work?

When a packet is sent from a source, the DSCP value is set in its IP header, indicating the level of priority it should receive across the network. Network routers and switches read this DSCP value and make decisions about the packet's forwarding priority and queue placement. By doing so, networks can differentiate between various types of traffic, prioritizing them according to organizational policies and network requirements.

(c) Benefits of DSCP Tagging

1. Improved Network Performance: By prioritizing critical applications, DSCP helps in managing network resources efficiently, thus enhancing overall performance. Traffic like VoIP and video conferencing can operate smoothly even under heavy network load.

2. Enhanced Quality of Service: DSCP enables more granular control over packet forwarding decisions, allowing network administrators to fine-tune QoS policies. This leads to better service quality, especially for latency-sensitive applications.

3. Scalability: DSCP scales well with the size of the network, providing a consistent approach to QoS even as the network grows and traffic volume increases.

4. Flexibility: The ability to define multiple levels of service makes DSCP highly flexible. Organizations can customize their traffic management strategies to align with specific business needs.

(d) Applications of DSCP Tagging in Enterprise Networks

• Voice and Video Prioritization: DSCP is extensively used to ensure that voice and video traffic is given priority over other types of data, reducing delays and improving communication quality.

• Data Center Traffic Management: In data centers, DSCP can help manage the flow of traffic between servers, storage systems, and external networks, optimizing response times and service delivery.

• Remote Work Solutions: With the rise of remote work, DSCP can play a pivotal role in prioritizing VPN traffic to ensure that business-critical applications have the bandwidth they need.

1. Support hotspot2.0 and openRoaming

(a) What is Hotspot 2.0?

Hotspot 2.0, also known as Wi-Fi Certified Passpoint, is a standard created by the Wi-Fi Alliance to streamline and secure the process of connecting to Wi-Fi hotspots. It allows mobile devices to automatically discover and connect to Wi-Fi networks without user intervention, using a seamless, secure authentication process based on the credentials issued by the service provider, much like cellular networks.

(b) Key Features of Hotspot 2.0

• Seamless Connectivity: Hotspot 2.0 enables devices to automatically connect to Wi-Fi networks with robust security protocols, without requiring users to manually search for and select networks.

• Enhanced Security: It supports advanced security protocols, such as WPA2-Enterprise and WPA3-Enterprise, providing end-to-end encryption and preventing unauthorized access.

• Simplified User Experience: By automating the discovery and connection process, Hotspot 2.0 eliminates the need for users to repeatedly enter login credentials.

• Interoperability: Designed to work across different wireless service providers and geographies, facilitating easier roaming and connectivity.

(c) What is OpenRoaming?

OpenRoaming is a federation service that allows users to seamlessly roam between Wi-Fi and cellular networks, removing the need to manually connect to different Wi-Fi networks. It is a collaboration spearheaded by the Wireless Broadband Alliance (WBA) that brings together a consortium of companies aiming to create a globally interconnected network.

(d) Benefits of OpenRoaming

• Effortless Network Transition: With OpenRoaming, devices can automatically switch between Wi-Fi and cellular networks without user interaction, depending on the best available network.

• Universal Coverage: It aims to combine the benefits of both private and public Wi-Fi networks with cellular service, expanding network coverage dramatically.

• Secure Connectivity: OpenRoaming ensures that security standards such as WPA3 are met, keeping the user's data protected during transmission across different networks.

• Enhanced User Experience: Provides a smooth, uninterrupted service as users move between different network environments, ideal for travelling users and mobile professionals.

(e) Applications and Implications of Hotspot 2.0 and OpenRoaming

1. Travel and Hospitality: For travelers, Hotspot 2.0 and OpenRoaming can significantly enhance connectivity in airports, hotels, and public spaces, offering seamless access to high-quality Wi-Fi.

2. Urban Mobility: In smart cities, these technologies can facilitate uninterrupted internet access across different urban spaces, improving navigation, streaming, and communication services.

3. Enterprise Connectivity: Businesses can provide secure, seamless Wi-Fi access to employees and visitors, improving productivity and user satisfaction.

4. Telecommunications: For telecom operators, integrating Hotspot 2.0 and OpenRoaming can reduce the load on cellular networks and provide a better balance of traffic across networks.

The inclusion of "Support for Hotspot 2.0 and OpenRoaming" in our firmware underlines our commitment to enhancing connectivity and user experience. These features enable devices to leverage advanced network technologies to automatically connect to the best available network, securely and effortlessly. By adopting these standards, we are setting a new benchmark for seamless and secure mobile connectivity, catering to the needs of modern users who require reliable and effortless internet access wherever they go.

v1.5.74

• Fix the issue that AP sometimes goes offline even when the network is functioning normally.

v1.5.73

• Fix the device online status issue where certificates may sometimes disappear after device firmware update.

• Fix AP sometimes getting offline upon device firmware updates, requiring a reboot to get AP online.

• Fix AP offline issue caused by UTF-8 device name.

• Resolve the issue of a full system reload occurring when adding/deleting MyPSK Users.

v1.5.70

• Add multi-language support for System Name in LSP--You can modify the name of your AP from the cloud page where multiple languages are supported. Any changes made will synchronize to the LSP page “Device Overview” -> “System Name” field

• Update LSP web GUI style--We've revamped the LSP web GUI with a sleek and modern design, enhancing visual appeal without compromising any of the existing LSP functionality. Enjoy an updated interface that not only looks stylish but also aligns with contemporary design standards, providing a more visually pleasing and user-friendly experience.

• Support shaping policies or block schemes on a per-application basis--Elevate network management with our SSID traffic throttling feature, now upgraded to customize bandwidth limits for specific applications such as YouTube, Apple iCloud, Facebook, Netflix, Apple App Store, and Line, etc. Facilitate enterprise clients to efficiently allocate limited bandwidth, ensuring optimal service delivery for a larger clientele.

• If mDNS forwarding is enabled, BCMC suppression will not block mDNS packets.

1. mDNS (Multicast DNS) Overview:

   mDNS, or Multicast DNS, is a protocol that allows devices on a local network to discover and connect to each other without the need for a centralized DNS (Domain Name System) server. It enables automatic assignment of domain names to devices, making it easier for users to access services on the network without manual configuration.

   In practical terms, mDNS simplifies the process of identifying and connecting to devices such as printers, smart home devices, and other networked services within a local environment. Instead of relying on traditional DNS, which typically involves a central server, mDNS uses multicast packets to resolve domain names to IP addresses directly on the local network.

2. BCMC (Broadcast/Multicast Control) suppression Functionality:

   On the other hand, BCMC, or Broadcast/Multicast Control, is a feature designed to manage and control the impact of broadcast and multicast traffic on a network. Broadcasting and multicasting can lead to increased network congestion and reduced efficiency, especially in large-scale deployments.

   BCMC helps address these challenges by suppressing or controlling unnecessary broadcast and multicast traffic. By doing so, it ensures that the network operates more efficiently, reducing the risk of bandwidth saturation and enhancing overall performance.

3. Interplay between mDNS and BCMC:

   In certain network scenarios, there may be a potential conflict between mDNS and BCMC functionalities. By allowing mDNS packets to pass through when mDNS forwarding is enabled, the network ensures that devices can continue to discover and communicate with each other seamlessly using the mDNS protocol. This synergy between mDNS and BCMC functionality aims to strike a balance between efficient network management and the need for smooth, decentralized device discovery and connectivity in local environments.

• Client List supports more OS types - Meta VR devices, Honeywell IoT device…etc--Clients List feature now includes expanded compatibility with various operating systems such as Meta VR devices, Honeywell IoT devices, and more. To ensure ongoing accuracy and relevance, we regularly update our fingerprint identification system. This proactive approach allows us to seamlessly integrate newly released devices into the Cloud Clients List page, ensuring that you have precise and up-to-date information about connected clients.

• SSID on LAN : support AD and LDAP captive portal authentication.

v1.5.67

• Fixed the issue for encountering failure when selecting specific country: Liechtenstein, Montenegro, or Angola.

v1.5.66

• Update openssl version (from 1.1.1n to 3.0.9) to support TLS1.2

• Optimize captive portal re-authentication with backup cache.

• Improve client balance background scan algorithm: optimize the algorithm flow by reducing unnecessary actions in client balance background scan algorithm to increase the efficiency.

• Set BCMC suppression enabled by default. Enabling BCMC suppression may eliminate unnecessary broadcast and multicast packets from Ethernet to wireless interface and result in less wireless interference.

• Set min. bitrate value as 12Mbps for each radio interface. Higher minimum bitrate value can help reduce the client connections with lower signal strength and result in faster roaming to other AP to avoid AP sticky connection issue.

v1.5.61

• Fixed traffic log for wrong format issue.

• Fixed abnormal banned message displaying when message length is more than one line.

• Don't force disabling accounting server in voucher service.

• Fixed Wi-Fi crash issue in v1.x.60 FW which caused system reboot.

• Adjust DHCP Discover-packet sending scheme when both L2 isolation and portal are enabled.

v1.5.60

• Update channel spec to v230404.

• Revise L2-Isolation to allow broadcast and multicast traffics to go through.

• Add a new function for channel candidate list.

• Enhance Application Analysis to support per-client statistics.

• Disable default open Management SSID.

• Enhance DCS mechanism to support CSA (Channel Switching Announcement).

v1.5.56

• Fixed vulnerability issue (CVE-2022-38546).