This User’s Guide covers the models listed in the following table. They can be managed in one of the following methods: remote management through Nebula Control Center (NCC) or an AP Controller (APC) such as the ZyWALL ATP, or local management in Standalone Mode. Each Zyxel Device runs in standalone mode by default, but it is recommended to use NCC management if it is available for your Zyxel Device.

For more information about Access Point (AP) management, see Management Mode.

When two or more APs are interconnected, this network is called a Wireless Distribution System (WDS). See Zyxel Device Roles for more information on root and repeater APs and how to set them up.

The screens you see in the Web Configurator may be different depending on the Zyxel Device model you are using.

The following tables show the differences between each Zyxel Device model. You can find the feature introductions in the later sections

This section describes some of the different roles that your Zyxel Device can take up within a network. Not all roles are supported by all models (see Zyxel Device Product Feature Comparison). The Zyxel Device can serve as a:

If a client (D) tries to set up his own AP (R) with weak security settings, the network becomes exposed to threats. The RF monitor (M) scans the area to detect all APs, which can help the network administrator discover these rogue APs and remove them.

Wireless Distribution System (WDS) is a network system that allows you to distribute the network to areas that require Internet connections. You can extend your network to unreachable areas with wireless repeaters.

The following figure shows you how to create a secure WDS with two wireless repeaters. The root AP (Y) is connected to a network with Internet access and has wireless repeaters (X and Z) connected to it to expand the WiFi network’s range. Clients (A and B) can access the wired network through the wireless repeaters (X and Z) and/or root AP.

The Zyxel Device can also serve as a wireless bridge in Repeater mode. A wireless bridge connects two wired networks through a wireless connection. When the Zyxel Device is connected to a root AP, enable wireless bridge to allow traffic through the Ethernet port on the Zyxel Device to a wired network. Check Zyxel Device Product Feature Comparison for models that support wireless bridge.

The following figure shows an example of a WDS with a repeater acting as a wireless bridge. The root AP (X) is connected to a network with Internet access. The wireless repeater (Y) is connected to the root AP (X) to expand the network. Clients (A and B) are connected to the wireless repeater through the switch/gateway/router (G). They can access the network with the extended wired network the wireless bridge (wireless repeater) provides.

The Zyxel Device can receive connections from WiFi clients and pass their data traffic through to the Zyxel Device to be managed (or subsequently passed on to an upstream gateway for managing).

In AP Mode, the Zyxel Device is connected to a broadband modem with Internet access and provides a WiFi network for users to use their notebooks or computers to wirelessly access the Internet.

The Zyxel Device acts as an AP and also supports the WiFi connections with other APs (in repeater mode) to form a WDS to extend its WiFi network.

In Root AP mode, you can have multiple SSIDs active for regular WiFi connections and one SSID (WDS SSID) for the connection with a repeater. WiFi clients can use either SSID to associate with the Zyxel Device in Root AP mode. A repeater must use the repeater SSID to connect to the Zyxel Device in Root AP mode. See Overview for more details.

When the Zyxel Device is in Root AP mode, repeater security between the Zyxel Device and other repeaters is independent of the security between the WiFi clients and the AP or repeater. When repeater security is enabled, both APs and repeaters must use the same pre-shared key. See AP Management and WDS Profile for more details.

Unless specified, the term “security settings” refers to the traffic between the WiFi clients and the AP. At the time of writing, repeater security is compatible with the Zyxel Device only.

The Zyxel Device can establish a WiFi connection with other APs (in either Root AP or Repeater mode) to form a WDS.

Using Repeater mode, your Zyxel Device can extend the range of the WLAN. In the figure below, the Zyxel Device in Repeater mode (Z) has a WiFi connection to the Zyxel Device in Root AP mode (X) which is connected to a wired network and also has a WiFi connection to another Zyxel Device in Repeater mode (Y) at the same time. Z acts as a repeater that forwards traffic between associated WiFi clients and the wired LAN. Y acts as a WiFi bridge (repeater with WDS wireless bridging enabled) that forwards traffic between wired clients and the wired LAN. Clients A and B access the AP and the wired network behind the AP through repeaters Z and Y.

When the Zyxel Device is in Repeater mode, repeater security between the Zyxel Device and other repeater is independent of the security between the WiFi clients and the AP or repeater. When repeater security is enabled, both APs and repeaters must use the same pre-shared key. See AP Management and WDS Profile for more details.

For NCC managed devices, you only need to enable AP Smart Mesh to automatically create WiFi links between APs. See the NCC User’s Guide for more details.

The Zyxel Device supports Rogue AP Detection (see Rogue AP). Rogue AP Detection allows the Zyxel Device to be set to work as an RF monitor to discover nearby Access Points. The information it obtains from other APs is used to tag possible rogue APs and friendly APs. The Zyxel Device can still work as an AP while it scans the environment for wireless signals.

This section describes some possible scenarios and topologies that you can set up using your Zyxel Device.

A Basic Service Set (BSS) is the set of devices forming a single WiFi network (usually an access point and one or more WiFi clients). The Service Set IDentifier (SSID) is the name of a BSS. In Multiple BSS (MBSSID) mode, the Zyxel Device provides multiple virtual APs, each forming its own BSS and using its own individual SSID profile.

You can configure multiple SSID profiles, and have all of them active at any one time.

You can assign different wireless and security settings to each SSID profile. This allows you to compartmentalize groups of users, set varying access privileges, and prioritize network traffic to and from certain BSSs.

To the WiFi clients in the network, each SSID appears to be a different access point. As in any WiFi network, clients can associate only with the SSIDs for which they have the correct security settings.

For example, you might want to set up a WiFi network in your office where Internet telephony (VoIP) users have priority. You also want a regular WiFi network for standard users, as well as a ‘guest’ WiFi network for visitors. In the following figure, VoIP_SSID users have QoS priority, SSID01 is the WiFi network for standard users, and Guest_SSID is the WiFi network for guest users. In this example, the guest user is forbidden access to the wired Local Area Network (LAN) behind the AP and can access only the Internet.

The Zyxel Device models are equipped with two or even three WiFi radios. The Zyxel Device uses the WiFi radios to transmit WiFi signals. This means you can configure different WiFi networks on the 2.4G/5G/6G bands to operate simultaneously.

BandFlex allows you to select the frequency bands operating on the radios by configuration. A frequency band is a range of frequency divided into channels which carry the WiFi signals for data transmission. If your Zyxel Device supports BandFlex, you can configure the second radio on the Zyxel Device to use the 5 GHz or 6 GHz bands, while the first radio is always set to use the 2.4 GHz band. The 6 GHz band provides less coverage but has the highest amount of channels among the three frequency bands. Use the 6 GHz band for the most congestion-free transmission if your client devices supports WiFi 6E (see Zyxel Device Product Feature Comparison).

You could use the 2.4 GHz band for regular Internet surfing and downloading while using the 5 GHz or 6 GHz band for time sensitive traffic like high-definition video, music, and gaming.

See Zyxel Device Product Feature Comparison for the supported number of radios, frequency bands, and see if your Zyxel Device supports BandFlex.

An AP can support multiple frequency bands (2.4 GHz, 5 GHz and 6 GHz), but a WiFi client can only connect to the AP using one of these frequency bands. The other frequency bands are unused. The client's data transmission speed depends on the frequency band they are connected to.

WiFi 7 MLO allows a WiFi client to connect to the AP using multiple frequency bands simultaneously. This increases speed and improves reliability of the WiFi connection. MLO makes WiFi 7 ideal for streaming 4K/8K videos, using augmented reality (AR), virtual reality (VR) applications and playing online games.

To use MLO, both the AP and the WiFi client have to support MLO.

In WiFi 6 and earlier, any interference would cause the entire WiFi channel to become unavailable. In the figure below, if part of the WiFi channel (B) experiences interference, the rest of the WiFi channel (C) becomes unavailable.

WiFi 7 preamble puncturing allows you to block the specific portion of the channel that is experiencing interference while continuing to use the rest of the WiFi channel. In the figure below, if part of the WiFi channel (B) experiences interference, the rest of the WiFi channel (C) is still available.