This chapter shows you how to use the Zyxel Device’s various features.

In this section, we show you how to:

The Zyxel Device has different Operation Modes (OP modes) to act as different roles in a network. You can select different OP modes for each radios. Not all OP modes are supported by all models. To select the OP mode, go to Configuration > Wireless > AP Management.

The Zyxel Device supports the following OP modes:

To set up WiFi networks for WiFi clients in AP Mode, you need to first create a Radio Profile, Security Profile, and SSID profile. Each profile is described below.

This tutorial uses the following scenario:

A small company wants to configure two WiFi networks, one for employees, and one for guests. Follow the steps below to configure the WiFi networks.

The 2.4 GHz band provides wider coverage but slower speeds, while the 5 GHz band provides higher speeds but a smaller coverage area. Configure the WiFi networks to broadcast on both bands.

In this example, the office does not use a RADIUS server for user authentication.

WPA2-MIX allows both WPA and WPA2 clients to connect to the same WiFi network. Configure two Security Profiles using wpa2-mix with Personal authentication:

Configure a different pre-shared key for each profile to prevent guests from accessing the employee WiFi network.

In this example, the employee WiFi network uses both the 2.4 GHz and 5 GHz bands. The guest WiFi network uses only the 2.4 GHz band. Configure two SSID profiles to broadcast these networks and assign the Security Profiles created in the previous step to each SSID profile.

To broadcast the WiFi networks, assign the Radio Profiles and SSID Profiles created in the previous steps to the Zyxel Device.

To wirelessly extend a WiFi network (WDS), you need two Zyxel Devices, one in Repeater mode and one in Root AP mode. You should already have the root AP set up.

If your Zyxel Device supports wireless bridging, you can extend a wired network from the port on the WiFi repeater, do the following steps:

To set up a WDS in APC-managed Zyxel Devices, see the ZyWALL ATP, USG FLEX, or NCC User’s Guide.

The following example shows you how to create two WiFi networks (Zyxel_General and Zyxel_Guest) using the following settings for both Radio 1 (2.4 GHz) and Radio 2 (5 GHz). You should have already created two security profiles, Security_Profile1 and Security_Profile2, on the Configuration > Object > AP Profile > SSID > Security List screen. See Creating a Security Profile for a tutorial on creating security profiles.

For the Guest WiFi, enable Enable Intra-BSS Traffic blocking to prohibit Guest WiFi clients from directly connecting to each other. To separate the Guest WiFi network from the General internal WiFi network, create two VLANs, VLAN 10 and VLAN 20, on your firewall (F), such as ZyWALL. Set the General WiFi network to be in VLAN 10, where your internal network is. Set the Guest WiFi network to be in VLAN 20. This way, Guest WiFi clients will not be able to access the wired LAN network of the firewall (F) in VLAN 10 while still able to access the Internet.

To optimize WiFi settings for clients, adjust channel selection, transmission power and roaming settings.

Do the following to optimize channel selection:

Enable DCS for Each Radio

When the Zyxel Device is performing a Dynamic Channel Selection (DCS) scan, and selecting a Dynamic Frequency Selection (DFS) channel (CH52 ~ CH144) for its service channel, the Zyxel Device is currently conducting the Channel Availability Check (CAC). The process wait time is 10 minutes:

During the process the Zyxel Device LED will blink in blue. When completed, the Zyxel Device LED will change.

Enable DCS for All Radios

In high-interference environments, use a narrower channel width to reduce interference and improve overall network performance. The following table shows the recommended channel width for each band in different deployment scenarios:

Configure the channel width in one of the following management methods:

In the NCC portal, you can use Channel Utilization to check channel interference for each frequency band. To monitor channel utilization, go to Site-wide > Devices > Access points. Click the icon. Then, select Channel Utilization 2.4 GHz, Channel Utilization 5 GHz, or Channel Utilization 6 GHz to view the channel utilization of each radio.

Check the Channel Utilization for each radio. High channel utilization may indicate one or more of the following:

Do not set transmission power to max by default as it could cause interference with other Access Points. The transmission power should be set to minimize coverage overlap with neighboring Zyxel Devices while avoiding dead zones. The following table shows the recommended maximum transmission power for different deployment scenarios.

Based on the suggested maximum transmission power, reduce the transmit power by 3 to 5 dBm, and then fine-tune it in 2 dBm increments based on your WiFi environment.

For example, if the suggested maximum transmission power is 20 dBm, reduce it to 17 dBm or 15 dBm. If the signal becomes too weak, increase it from 17 dm to 19 dbm, or from 15 dbm to 17 dbm.

You can adjust the transmission power in one of the following management methods:

You can do the following to optimize roaming quality:

Place the Zyxel Device based on the WiFi signal strength clients receive. You can check the signal strength of WiFi clients in one of the following management methods:

The following table shows the recommended signal strengths values:

Disassociate station threshold allows the Zyxel Device to disconnect WiFi clients with weak signal strength so they can connect to another access point with a stronger signal. The recommended disassociate station threshold is shown below:

Configure disassociate station threshold in one of the below modes:

When finished, click OK.

To check the traffic status of your Zyxel Device:

Enter a value between -20 to -105 dBm in Disassociate Station Threshold according to the Recommended Disassociate Station Threshold table. Select High, Standard, or Low from Optimization aggressiveness based on the how aggressively you want the Zyxel Device to disconnect WiFi clients with weak signal strength.

Restricting network bandwidth for each WiFi client ensures that all clients have equitable access to the network, preventing a few WiFi clients from monopolizing the bandwidth.

In this section, we show you how to:

Different Security Modes provide different levels of protection and authentication methods. They determine how users authenticate with the WiFi network and how WiFi traffic is encrypted.

This tutorial explains the differences between the following Security Modes and when to use each one.

Go to Configuration > Object > AP Profile > SSID > Security List to access the Security Profile screen.

The following table describes the authentication methods and encryption protocols used by each Security Mode.

Users connect to the WiFi network without entering a password while their WiFi traffic remains protected.

This Security Mode is suitable for:

This Security Mode is old and should not be used today. It’s an older WiFi security standard and can be easily compromised due to weakness in its encryption.

Uses AES-CCMP encryption to encrypt WiFi traffic. Users authenticate using either a shared password (Personal) or a RADIUS server (Enterprise).

This Security Mode is suitable for:

Allows both WPA and WPA2 clients to connect to the WiFi network. Use this mode if you have client devices that only support WPA and devices that support WPA2.

This Security Mode is suitable for:

Uses Simultaneous Authentication of Equals (SAE) for authentication and AES encryption to protect WiFi traffic. It provides stronger security than WPA2. It is the recommended Security Mode if your client devices support WPA3.

This Security Mode is suitable for:

Changing the security settings on a WiFi network enhances protection by blocking unauthorized client devices. This option is ideal for small WiFi networks with a few WiFi clients. For WiFi networks with a lot of clients, see RADIUS Server Setup for more information.

Setting up a RADIUS server on your Zyxel Device allows centralized user authentication and authorization, which enhances network security. This option is ideal for enterprise users who need to manage many WiFi clients.

This example shows you how to configure the rogue AP detection feature on the Zyxel Device. A rogue AP is a WiFi access point operating in a network’s coverage area that is not a sanctioned part of that network. See Rogue AP for background information on the rogue AP function and security considerations.

In this example, you want to ensure that your company’s data is not accessible to an attacker gaining entry to your WiFi network through a rogue AP.

Your WiFi network operates in an office building. It consists of four Zyxel access points (all NWAs) and a variable number of WiFi clients. You also know that the coffee shop on the ground floor has a WiFi network consisting of a single access point (AP 1), which can be detected and accessed from your floor of the building. There are no other static WiFi networks in your coverage area.

The following diagram shows the WiFi networks in your area. Your access points are marked A, B, C and D. You also have a computer, marked E, connected to the wired network. The coffee shop’s access point is marked 1.

In the figure, the solid circle represents the range of your WiFi network, and the dashed circle represents the extent of the coffee shop’s WiFi network. Note that the two networks overlap. This means that one or more of your APs can detect the AP 1 in the other WiFi network.

When configuring the rogue AP feature on your Zyxel Device in this example, you will need to use the information in the following table. You need the IP addresses of your APs to access their Web configurators, and you need the MAC address of each AP to configure the friendly AP list.

To find rogue APs, create a list of known friendly APs, then scan for all APs in your coverage area. Check if other APs are known and if not add them to the Rogue AP list.

Take the following steps to set up and save a list of access points you want to allow in your network’s coverage area.

Access point A is now configured to do the following.

Now you need to configure the other WiFi access points in your network to do the same things.

For each access point, take the following steps.

A MAC filter list blocks or allows a list of clients based on their MAC addresses, ensuring only authorized clients can access the network. This example shows how to block certain clients based on their MAC addresses.

This example shows you how to allow certain users to access only specific parts of your network. You can do this by using multiple MAC filters and layer-2 isolation profiles.

In this example, you run a company network in which certain employees must wirelessly access secure file servers containing valuable proprietary data.

You have two secure servers (1 and 2 in the following figure). WiFi user “Alice” (A) needs to access server 1 (but should not access server 2) and WiFi user “Bob” (B) needs to access server 2 (but should not access server 1). Your Zyxel Device is marked ZD. C is a workstation on your wired network, D is your main network switch, and E is the security gateway you use to connect to the Internet.

In this example, you have already set up the Zyxel Device in AP Mode (see WiFi Network Setup). It uses two SSID profiles simultaneously. You have configured each SSID profile as shown in the following table.

Each SSID profile already uses a different pre-shared key.

In this example, you will configure access limitations for each SSID profile. To do this, you will take the following steps.

To configure layer-2 isolation, you need to know the MAC addresses of the devices on your network, which are as follows.

To configure MAC filtering, you need to know the MAC addresses of the devices Alice and Bob use to connect to the network, which are as follows.

First, you will set up the SERVER_1 network which allows Alice to access secure server 1 through the network switch.

You will configure the MAC filter to restrict access to Alice alone, and then configure layer-2 isolation to allow her to access only the network router, the file server and the Internet security gateway.

Take the following steps to configure the SERVER_1 network.

You have restricted access to the SERVER_1 network to only the networking device whose MAC address you entered. The SERVER_1 network is now configured.

Next, you will configure the SERVER_2 network that allows Bob to access secure server 2 and the Internet.

To do this, repeat the procedure in Configure the SERVER_1 Network, substituting the following information.

Use the following sections to ensure that your WiFi networks are set up correctly.

Take the following steps to check that the Zyxel Device is using the correct SSIDs, MAC filters and layer-2 isolation profiles.

Before you allow employees to use the network, you need to thoroughly test whether the setup behaves as it should. Take the following steps to do this.

If you cannot do something that you should be able to do, check the settings as described in Check Settings, and in the individual Security, layer-2 isolation and MAC filter profiles for the relevant network. If this does not help, see the Troubleshooting chapter in this User’s Guide.

In this section, we show you how to:

Change the management IP address of the Zyxel Device to ensure it does not duplicate the IP address of any other device on the network. If IP addresses are duplicated, you may be unable to access the Zyxel Device.

Changing the system name ensures that the Zyxel Device's name is not duplicated with other devices on the network, which may otherwise cause confusion for network administrators.

Change the Web Configuration login password to help secure your account.

In this section, we will show you how to:

Go to the NCC portal. Enter your existing Zyxel Account credentials, or log in using a social account such as Google, Apple, Microsoft Entra ID, or Passkey. Then, click Sign in.

If this is your first time logging in to the NCC portal, see First-Time Login to the NCC Portal.

Download and open the Zyxel Nebula Mobile app in your mobile device (see Dashboard > Cloud Control Status to download the app.)

Tap Add Passkey. A notification prompts you to confirm adding the passkey. The example below uses Face ID as the passkey. For more details about passkeys, please refer to Zyxel Account Authentication.

Enter the password and tap Confirmed & Sign in.

Follow the on-screen instructions to install the Google Authenticator. Scan the QR code with Google Authenticator and enter the code the Google Authenticator generates. Tap Verify to complete the authentication.

Check your email inbox. Tap Enable 2FA to activate the setting of Two-factor email authenticator. Tap Close to complete the process.

Tap Sign in.

If you add a Zyxel Device manually, tap Check to confirm that the Serial Number and MAC Address are correct. After adding the Zyxel Device using either method, tap Next. If you do not want to add a Zyxel Device now, tap Skip.

In this section, we show you how to:

Upload the firmware to the Zyxel Device for feature enhancements.

The section shows you how to restore the configuration. You need to download and upload the configuration file to restore the configuration on the Zyxel Device.

You should regularly download your configuration especially before you make major configuration changes.

This section shows how to upload a previously saved configuration file from your computer to the Zyxel Device. You might need to do this to recover settings after a reset or to fix problems after configuration changes.

In this section, we show you how to:

In this example, you will configure the first of your Zyxel Device to send a log message to your email inbox.

Backing up logs to a remote server allows you to store large amounts of log data and prevent log data lost on your Zyxel Device. The Zyxel Device can keep at most 512 logs. If the logs exceed this number, the oldest logs will be lost.

Diagnostic information helps you or customer support troubleshoot issues on the Zyxel Device. You can collect diagnostic information in both standalone and cloud-managed modes.

Click the debug folder to view the diagnostic files.

These folders contain the raw diagnostic data for troubleshooting. The folders in the debug folder are organized by the main features of the Zyxel Device and include the following:

Click diag_brief.txt to view a summary of the diagnostic information. This text file provides an overview of the Zyxel Device's system status, including CPU and memory usage, running processes, cloud connection status, and a summary of detected errors for quick troubleshooting.

To learn how to create a Zyxel Account and register a Zyxel Device using the Nebula Control Center (NCC) web portal or the Zyxel Nebula Mobile App, see Device Management Using Nebula for step-by-step instructions.

For the password, return to the NCC web portal on your computer. In the Dashboard, click the Configure icon in the left-hand bar, and then click Site Settings.

In Device configuration > Local credentials, find the Password. Use this Password to log in to your Zyxel Device. In the example below, the password is ‘eX86J%Hxn93B’.

Click the debug folder to view the diagnostic files.

These folders contain the raw diagnostic data for troubleshooting. The folders in the debug folder are organized by the main features of the Zyxel Device and include the following:

Click diag_brief.txt to view a summary of the diagnostic information. This text file provides an overview of the Zyxel Device's system status, including CPU and memory usage, running processes, cloud connection status, and a summary of detected errors for quick troubleshooting.

To learn how to create a Zyxel Account and register a Zyxel Device using the Nebula Control Center (NCC) web portal or the Zyxel Nebula Mobile App, see Device Management Using Nebula for step-by-step instructions.

This section shows you how to configure WAN access for a specific trusted computer through HTTPS, HTTP or SSH to the Zyxel Device. Remote management determines which interface and web services are allowed to access the Zyxel Device.

Perform the following to find the options to configure remote access to your Zyxel Device.

Go to the Configuration > System > SSH screen. Select whether you want to access the Zyxel Device remotely through SSH. Click Apply to save your changes. You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.