• Connection Type—By default, the DHCP client on the WAP device automatically broadcasts the requests for network information. If you want to use a static IP address, you must disable the DHCP client and manually configure the IP address and other network information.

  Choose one of the following options:

  • DHCP—The WAP device acquires its IP address from a DHCP server on the LAN.

  • Static IP—Manually configure the IPv4 address. The IPv4 address should be in a form similar to xxx.xxx.xxx.xxx (192.168.1.100).

• Static IP Address, Subnet Mask, and Default Gateway—Enter the static IP address, subnet mask and default gateway.

• Domain Name Servers — Select one of the following options:

  • Dynamic — The WAP device acquires the DNS server addresses from a DHCP server on the LAN.

  • Manual — Enter up to two IP addresses in the fields provided.

• IPv6 Connection Type — Select one of the following options:

  • DHCPv6 — The IPv6 address is assigned by a DHCPv6 server.

  • Static IPv6 — Manually configure the IPv6 address. The IPv6 address should be in a form similar to xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx (2001:DB8:CAD5:7D91).

• IPv6 Administrative Mode — Check Enable to enable IPv6 administrative mode.

• IPv6 Auto Configuration Administrative Mode — Check Enable to enable the IPv6 automatic address configuration.

  When the IPv6 automatic address configuration is enabled, the WAP device recognizes its IPv6 addresses and gateway by processing the router advertisements received on the LAN port. The WAP device can have multiple auto-configured IPv6 addresses.

• Static IPv6 Address — Enter the static IPv6 address. The WAP device can have a static IPv6 address even if addresses have already been configured automatically.

• Static IPv6 Address Prefix Length — Enter the prefix length of the static address, which is an integer in the range of 0 to 128. The default is 0.

• Static IPv6 Address Status — It can be one of the following status:

  • Operational — The IP address has been verified as unique and is usable on the LAN interface.

  • Tentative — The WAP device automatically initiates a duplicate address detection (DAD) process when a static IP address is assigned. This IPv6 address is tentative as it is being verified on the network and cannot be used to transmit or receive traffic.

  • Blank (no value) — No IP address is assigned.

• IPv6 Autoconfigured Global Addresses — Lists the IPv6 addresses which have been automatically assigned to the device.

• IPv6 Link Local Address — The IPv6 address used by the local physical link. The link local address is not configurable and is assigned by using the IPv6 Neighbor Discovery process.

• Default IPv6 Gateway —The statically configured default IPv6 gateway.

• IPv6 Domain Name Servers — Select one of the following options:

  • Dynamic — The DNS servers are recognized dynamically through the DHCPv6.

  • Manual — To manually specify up to two IPv6 DNS servers.

The Port Settings Table displays the following status and configurations for the LAN interface:

• Link Aggregation — Enable Link Aggregation Group (LAG). This option is enabled by default and can't be disabled by the user.

• LAG Mode— Includes the following options:

  • Standard LAG — If the negotiated speed of the two Ethernet interfaces are different, suspend the later plugin.

  • BW-First — If the negotiated speed of the two Ethernet interfaces are different, suspend the lower speed of the two.

  • Redundancy and Power First — Adjust the speed of the two Ethernet interfaces to the same speed for binding. This is the default mode.

  Note	WAP581 supports static LAG and does not support the LACP. Ensure that the LAG works with WAP581 device. This helps the user to switch the LAG from the default mode to the others.

  The Port Settings Table includes the following status and configurations for an Interface (LAN):

• Interface — Specifies the interface of the LAN

• Link Status — Displays the current port link status.

• Port Speed — When in review mode, it lists the current port speed. When in edit mode, and the Auto Negotiation is disabled, select a port speed such as 100 Mbps or 10 Mbps. The 1000 Mbps speed is the only supported when Auto-Negotiation is enabled.

• Duplex Mode —When in review mode, it lists the current port duplex mode. When in edit mode, and the Auto Negotiation is disabled, select either Half or Full duplex mode.

• Auto Negotiation — When enabled, the port negotiates with its link partner to set the fastest link speed and duplex mode available. When disabled, you can manually configure the Port Speed and Duplex Mode.

• Green Ethernet — Green Ethernet Mode supports both the auto-power-down mode and the EEE (Energy Efficient Ethernet, IEEE 802.3az) mode. The Green Ethernet Mode works only when the auto-negotiation on the port is enabled. The auto-power-down mode reduces the chip power when the signal from a link partner is not present. The WAP device automatically enters into a low-power mode when energy on the line is lost, and it resumes normal operation when energy is detected. The EEE mode supports QUIET times during low link utilization, allowing both sides of a link to disable portions of each PHY’s operating circuit and save power.

• Untagged VLAN ID — Specifies a number between 1 and 4094 for the untagged VLAN ID. The default is 1. The traffic on the VLAN that you specify in this field is not be tagged with a VLAN ID when forwarded to the network.

• Description — Description of the related VLAN.

• Management VLAN — The Management VLAN is the VLAN used to access the WAP device through Telnet or the web GUI. There must be only one VLAN as the management VLAN. If no interface (wired or wireless) is assigned to the Management VLAN, there will be no interface that a user can use to access the configuration utility.

• VLAN — Select from the drop-down list (Untagged or Tagged) VLAN.

  By default, all traffic on the WAP device uses the VLAN 1, the default untagged VLAN. This means that all traffic is untagged until you disable the untagged VLAN, change the untagged traffic VLAN ID, or change the VLAN ID for a VAP or client using RADIUS.

• LLDP Mode — Check Enable to enable the LLDP. Once enabled, the AP transmits LLDP Protocol Data Units to the neighbor devices. By default, this mode is enabled.

• TX Interval — The number of seconds between each LLDP message transmissions. The valid range is 5 to 32768 seconds. The default value is 30 seconds.

• POE Priority — Select the priority level from the drop-down list (Critical, High, Low or Unknown). The PoE priority helps the Power Sourcing Equipment (PSE), determine which powered devices should be given priority in power allocation when the PSE doesn't have enough capacity to supply power to all connected devices.

• NTP Server (1 through 4) — Specify the IPv4 address, IPv6 address, or host name of a NTP server. A default NTP server is listed from 0.ciscosb.pool.ntp.org to 3.ciscosb.pool.ntp.org.

  A host name can consist of one or more labels, which are sets of up to 63 alphanumeric characters. If a host name includes multiple labels, each is separated by a period (.). The entire series of labels and periods can be up to 253 characters long.

• Time Zone — Select the time zone for your location.

• Adjust for Daylight Saving Time — Ensure that you have chosen the appropriate time zone before you select this option. Check the checkbox to enable and configure the following fields:

  • Starts — Select the week, day, month, and time when the Daylight Savings time starts.

  • Ends — Select the week, day, month, and time when the Daylight Savings time ends.

  • Daylight Saving Offset — Specify the number of minutes to move the clock forward when Daylight Savings Time begins and backward when it ends.

• System Date — Select the current month, day, and year date from the drop-down lists.

• System Time — Select the current hour and minutes in 24-hour clock format.

• Time Zone — Select the time zone for your location.

• Adjust for Daylight Saving Time — Ensure that you have chosen the appropriate time zone before you select this option. Check the checkbox to enable and configure the following fields:

  • Starts — Select the week, day, month, and time when daylight savings time starts.

  • Ends — Select the week, day, month, and time when daylight savings time ends.

  • Daylight Saving Offset — Specify the number of minutes to move the clock forward when daylight savings time begins and backward when it ends.

When the LED is associated to a Scheduler Profile, this column shows the status depending on the presence or absence of an active profile rule at that time of the day.

• Persistence — Check Enable to save the system logs to the nonvolatile memory so that the logs are kept when the WAP device reboots. You can save up to 1000 log messages. When the limit of 1000 is reached, the oldest log message is overwritten by the newest message. Clear this field to save system logs to volatile memory. Logs in volatile memory are deleted when the system reboots.

• Severity — Select the severity from the drop-down list (Emergency, Alert, Critical, Error, Warning, Notice, Info or Debug) used to filter the event messages that will be saved in the nonvolatile memory. All other messages will be saved in the volatile memory.

• Depth — Enter the maximum number of messages, up to 1000, that can be stored in volatile memory. When the number that you configure in this field is reached, the oldest log event is overwritten by the newest log event.

• Server IPv4/IPv6 Address/Name — Enter the IPv4 or IPv6 address, or the host name of the remote log server.

  A host name can consist of one or more labels, which are sets of up to 63 alphanumeric characters. If a host name includes multiple labels, each is separated by a period (.). The entire series of labels and periods can be up to 253 characters long.

• Enable — Check Enable to enable the remote log server. Next, define the log severity and UDP port.

• Log Severity — Check the severities that an event must have for it to be sent to remote log server.

• UDP Port — Enter the logical port number for the syslog process on the remote host. The range is from 1 to 65535. The default port is 514.

  Using the default port is recommended. If you reconfigure the log port, make sure that the port number that you assign to syslog is available for use.

• Administrative Mode — Check Enable to enable the email alert feature.

• From Email Address — Enter the email address to be displayed as the sender of the email. The address is a 255-character string with only printable characters. No address is configured by default.

• Log Duration — Enter the frequency in minutes at which scheduled messages are sent. The range is from 30 to 1440 minutes. The default is 30 minutes.

• Scheduled Message Severity — Select the severity from the drop-down list (Emergency, Alert, Critical, Error, Warning, Notice, Info or debug) that an event must have for it to be sent to the configuration email address at the frequency specified by the Log Duration. The default severity is Warning.

• Urgent Message Severity — Select the severity from the drop-down list (Emergency, Alert, Critical, Error, Warning, Notice, Info or debug) that an event must have for it to be sent to the configured email address immediately. The default severity is Alert.

• Server IPv4 Address/Name — Enter the IP address or host name of the outgoing SMTP server. The server address must be a valid IPv4 address or host name. The IPv4 address should be in a form similar to xxx.xxx.xxx.xxx (192.0.2.10).

  A host name can consist of one or more labels, which are sets of up to 63 alphanumeric characters. If a host name includes multiple labels, each is separated by a period (.). The entire series of labels and periods can be up to 253 characters long.

• Data Encryption — Choose the mode of security from the drop-down list (Open or TLSv1) for the outbound email alert. Using the secure TLSv1 protocol can prevent eavesdropping and tampering during the communication across the public network.

• Port — Enter the SMTP port number to use for outbound emails. The range is a valid port number from 0 to 65535. The default port is 465.

• Username — Enter the user name for the email account that will be used to send these emails. Typically (but not always) the user name is the full email address including the domain (such as Name@example.com). The specified account will be used as the email address of the sender. The user name can contain in the range of 1 to 64 alphanumeric characters that includes "@", "-", and "." .

• Password — Enter the password for the email account that will be used to send these emails. The password can be from 1 to 64 characters.

• To Email Address 1/2/3 — Enter up to three addresses to receive the email alerts. Each email address must be a valid address.

• Email Subject — Enter the text to appear in the email subject line. This can be up to a 255-character alphanumeric string.

The User Account Table shows the currently configured users. The user cisco is preconfigured in the system and has Read/Write privileges.

All other users can have Read Only access, but not Read/Write access.

The Password Strength Meter field indicates the password strength as follows:

• Red — The password fails to meet the minimum complexity requirements.

• Orange — The password meets the minimum complexity requirements but the password strength is weak.

• Green — The password is strong.

The User Account Table shows the currently configured users. The user cisco is preconfigured in the system to have Read/Write privileges. The password for the user cisco can be changed.

The Password Strength Meter indicates the password strength as follows:

• Red — The password fails to meet the minimum complexity requirements.

• Orange — The password meets the minimum complexity requirements but the password strength is weak.

• Green — The password is strong.

• Host Name — Enter the host name for the WAP device. By default, the name is the fully qualified domain name (FQDN) of the node. The default host name is wap concatenated with the last 6 hexadecimal digits of the MAC address of the WAP device. The host name label can contain only letters, digits, and hyphens. It cannot begin or end with a hyphen. No other symbols, punctuation characters, or blank spaces are permitted. The host name can be 1 to 63 characters long.

• System Contact — Enter the contact person for the WAP device. The system contact can be 0 to 255 characters long and can include spaces and special characters.

• System Location — Enter the physical location of the WAP device. The system location can be 0 to 255 characters long and can include spaces and special characters.

• Maximum Sessions — Enter the number of web sessions, including both the HTTP and HTTPS, that can be in use at the same time.

  When a user logs on to the WAP's configuration utility, a session is created. This session is maintained until the user logs off or the session timeout expires. The range is from 1 to 10 sessions. The default is 5. If the maximum number of sessions are reached, the next user who attempts to log on to the configuration utility receives an error message about the session limit.

• Session Timeout — Enter the maximum amount of time, in minutes, that an inactive user remains logged on. When the configured timeout is reached, the user is automatically logged off. The range is from 2 to 60 minutes. The default is 10 minutes.

• HTTP Service — Enable or disable access through HTTP. By default, HTTP access is disabled. If you disable it, any current connections using that protocol are disconnected.

  • HTTP Port — Enter the logical port number to use for the HTTP connections, from 1025 to 65535. The default port number for the HTTP connections is the well-known IANA port number 80.

  • Redirect HTTP to HTTPS — Redirects management HTTP access attempts on the HTTP port to the HTTPS port. This field is available only when HTTP access is disabled.

• HTTPS Service — Enable or disable access through secure HTTP (HTTPS). By default, HTTPS access is enabled. If you disable it, any current connections using that protocol are disconnected.

  • HTTPS Port — Enter the logical port number to use for the HTTPS connections, from 1025 to 65535. The default port number for the HTTPS connections is the IANA port number 443.

  • TLSv1.0, TLSv1.1, SSLv3 — Check or uncheck the checkbox to enable or disable the protocol of the HTTPS Service.

• Management ACL Mode — If the Mode is enabled, access through the web and SNMP is restricted to the specified IP hosts. You can configure up to 5 IPv4 and 5 IPv6 addresses under the Management Access Control. If this feature is disabled, anyone can access the configuration utility from any network client by supplying the correct user name and password of the WAP device.

  Note	Verify any IP address that you enter. If you enter an IP address that does not match your administrative computer, you will lose access to the configuration interface. We recommend that you give the administrative computer a static IP address, so the address does not change over time.

• Read-only Community — Enter a read-only community name for the SNMPv2 access. The valid range is 1 to 256 alphanumeric and special characters.

  The community name acts as a simple authentication feature to restrict the devices on the network that can request data from the SNMP agent. The name functions as a password, and the request is assumed to be authentic if the sender knows the password.

• Read-write Community — Enter a read-write community name to be used for SNMP set requests. The valid range is from 1 to 256 alphanumeric and special characters. Setting a community name is similar to setting a password. Only the requests from the machines that identify themselves with this community name are accepted.

• Management Station — Determines which stations can access the WAP device through SNMP. Choose one of these options:

  • All — All stations can access the WAP device through SNMP.

  • User Defined — The set of user defined SNMP requests that are permitted.

• NMS IPv4 Address/Name — Enter the IPv4 IP address, DNS host name, or subnet of the network management system (NMS).

  A DNS host name can consist of one or more labels, which are sets of up to 63 alphanumeric characters. If a host name includes multiple labels, each is separated by a period (.). The entire series of labels and periods can be up to 253 characters long.

  As with community names, this setting provides a level of security on the SNMP settings. The SNMP agent only accepts the requests from the IP address, host name, or subnet specified here.

  To specify a subnet, enter one or more subnetwork address ranges in the form address/mask length where the address is an IP address and mask length is the number of mask bits. Both formats address/mask and address/mask length are supported. For example, if you enter a range of 192.168.1.0/24, this specifies a subnetwork with address 192.168.1.0 and a subnet mask of 255.255.255.0.

• NMS IPv6 Address/Name — The IPv6 address, DNS host name, or subnet of the devices that can execute, get, and set requests to the managed devices. The IPv6 address should be in a form similar to xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx (2001:DB8:CAD5:7D91).

• Trap Community — Enter a global community string associated with SNMP traps. Traps sent from the device provide this string as a community name. The valid range is from 1 to 60 alphanumeric and special characters.

• Trap Destination Table — Enter a list of up to three IP addresses or host names to receive the SNMP traps. Check the box and choose a Host IP Address Type (IPv4 or IPv6) before adding the Host Name/IP Address.

  An example of a DNS host name is snmptraps.foo.com. Because the SNMP traps are sent randomly from the SNMP agent, it makes sense to specify where exactly the traps should be sent. You can have a maximum of three DNS host names. Ensure that you check Enabled and select the appropriate Host IP Address Type.

• View Name — Enter a name that identifies the MIB view. View names can contain up to 32 alphanumeric characters.

• Type — Choose whether to include or exclude the view subtree or family of subtrees from the MIB view.

• OID — Enter an OID string for the subtree to include or exclude from the view. For example, the system subtree is specified by the OID string.1.3.6.1.2.1.1.

• Mask — Enter an OID mask. The mask is 47 characters in length. The format of the OID mask is xx.xx.xx (.)... or xx:xx:xx.... (:) and is 16 octets in length. Each octet is two hexadecimal characters separated by either a period (.) or a colon (:). Only hex characters are accepted in this field. For example, OID mask FA.80 is 11111010.10000000.

A family mask is used to define a family of view subtrees. The family mask indicates which sub identifiers of the associated family OID string are significant to the family's definition. A family of view subtrees enables efficient control access to one row in a table.

• Group Name — Enter the name of the group. The default group names are RO and RW. Group names can contain up to 32 alphanumeric characters.

• Security Level — Choose the security level for the group, from the following options:

  • noAuthNoPriv — No authentication and no data encryption (no security).

  • authNoPriv — Authentication, but no data encryption. With this security level, users send SNMP messages that use the SHA key or password for authentication, but not a DES key or AES128 for encryption.

  • authPriv — Authentication and data encryption. With this security level, users send the MD5 key or password for authentication and a DES for encryption. For groups that require authentication, encryption, or both, you must define the SHA, DES and AES128 keys or passwords on the SNMP Users page.

• Write Views — Choose the write access for the group's MIBs from one of the following options:

  • view-all — The group can create, alter, and delete MIBs.

  • view-none — The group cannot create, alter, or delete MIBs.

• Read Views — Choose the read access to MIBs for the group, from one of the following options:

  • view-all — The group is allowed to view and read all MIBs.

  • view-none — The group cannot view or read MIBs.

• User Name — Enter the name that identifies the SNMPv3 user. User names can contain up to 32 alphanumeric characters.

• Group — Enter the name of group that the user is mapped to. The default groups are RW and RO. You can define additional groups on the SNMP Groups page.

• Authentication Type — Choose the type of authentication to use on the SNMPv3 requests from the user, from the following options:

  • SHA — Requires SHA authentication on SNMP requests from the user.

  • None — SNMPv3 requests from this user require no authentication.

• Authentication Pass Phrase — If you specify SHA as the authentication type, enter the pass phrase to enable the SNMP agent to authenticate the requests sent by the user. The pass phrase must be between 8 and 32 characters in length.

• Encryption Type — Choose the encryption/privacy type applied to the user's SNMP requests from the following options:

  • DES — Uses DES encryption on the SNMPv3 requests from the user.

  • AES128 — Uses AES128 encryption on the SNMPv3 requests from the user.

  • None—SNMPv3 requests from this user require no privacy.

• Encryption Pass Phrase — If you specify DES as the encryption type, enter the pass phrase used to encrypt the SNMP requests. The pass phrase must be between 8 and 32 characters in length.

• IP Address — Enter the IPv4 or IPv6 address of the remote SNMP manager to receive the target.

• UDP Port — Enter the UDP port to use for sending SNMPv3 targets. The classical port number is 161.

• Users — Enter the name of the SNMP user to associate with the target. To configure SNMP users, see the SNMPv3 Users page.

• Server IP Address Type—Select the IP version that the RADIUS server uses. You can toggle between the address types to configure IPv4 and IPv6 global RADIUS address settings, but the WAP device contacts only the RADIUS server or servers with the address type that you select in this field.

• Server IP Address-1 or Server IPv6 Address-1—Enter the address for the primary global RADIUS server. When the first wireless client tries to authenticate with the WAP device, the WAP device sends an authentication request to the primary server. If the primary server responds to the authentication request, the WAP device continues to use this RADIUS server as the primary server, and authentication requests are sent to the address specified.

• Server IP Address-2 or Server IPv6 Address-2 —Enter the addresses for the backup IPv4 or IPv6 RADIUS servers. If authentication fails with the primary server, the configured backup server is tried.

• Key-1—Enter the shared secret key that the WAP device uses to authenticate to the primary RADIUS server. You can use from 1 to 64 standard alphanumeric and special characters. The key is case sensitive and must match the key configured on the RADIUS server. The text that you enter appears as asterisks.

• Key-2 —Enter the RADIUS key associated with the configured backup RADIUS servers. The server at Server IP (IPv6) Address 2 uses Key 2.

• Enable RADIUS Accounting—Enables tracking and measuring of the resources that a particular user has consumed, such as system time, amount of data transmitted and received, and so on. If you enable RADIUS accounting, it is enabled for the primary RADIUS server and all backup servers.

• EAP Method — Choose the algorithm to be used for encrypting authentication user names and passwords. The options are:

  • MD5 — A hash function defined in RFC 3748 that provides basic security.

  • PEAP — Protected Extensible Authentication Protocol, which provides a higher level of security than MD5 by encapsulating it within a TLS tunnel.

  • TLS — Transport Layer Security, as defined in RFC 5216, an open standard that provides a high level of security.

• Username — Enter the username.

• Password — Enter the password. The password character length can be a range from 1-64.

The Detected Rogue AP List table displays all detected rogue APs. The Trusted AP List displays all trusted APs. The following settings are displayed for each or the Rogue AP lists:

• MAC Address — The MAC address of the rogue AP.

• Radio — Indicates whether the rogue AP is detected on Radio 1 or Radio 2.

• Beacon Interval (Msec.) — The beacon interval used by the rogue AP. Beacon frames are transmitted by an AP at regular intervals to announce the existence of the wireless network. The default behavior is to send a beacon frame once every 100 milliseconds (or 10 per second). The Beacon Interval is set on the Radio page.

• Type — The type of the device. The options are:

  • AP — An AP rogue device that supports the IEEE 802.11 Wireless Networking Framework in infrastructure mode.

  • Ad hoc — A rogue station running in Ad hoc mode. The Ad hoc mode is an IEEE 802.11 Wireless Networking Framework also referred to as peer-to-peer mode or an Independent Basic Service Set (IBSS).

• SSID — The Service Set Identifier (SSID) for the WAP device.

• Privacy — Indicates whether there is any security on the rogue device. The options are:

  • Off — Security mode is off (no security).

  • On — Security mode is on.

• WPA — Shows whether the WPA security is on or off for the rogue AP.

• Band — The IEEE 802.11 mode being used on the rogue AP, such as IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, and IEEE 802.11ac.

  The number shown indicates the mode:

  • 2.4 indicates IEEE 802.11b, 802.11g, or 802.11n mode (or a combination of the modes).

  • 5 indicates IEEE 802.11a, 802.11n, or 802.11ac mode (or a combination of the modes).

• Channel — The channel on which the rogue AP is currently broadcasting.

• Rate — The rate in megabits per second at which the rogue AP is currently transmitting. The current rate is always one of the rates shown in the Supported Rates field.

• Signal — The strength of the radio signal emitting from the rogue AP. The number representing the strength in decibels (dB) is displayed on the right side of the bar.

• Beacons — The total number of beacons received from the rogue AP since it was first discovered.

• Last Beacon — The date and time of the last beacon received from the rogue AP.

• Rates — Supported and basic (advertised) rates set for the rogue AP. Rates are shown in megabits per second (Mbps). All Supported Rates are listed, with Basic Rates shown in bold. Rate sets are configured on the Radio page.

The list contains the MAC addresses of all APs that have been added to the Trusted AP List. By default, the filename is Rogue1.cfg. You can use a text editor or web browser to open the file and view its contents.

The imported file must be a plain-text file with a .txt or .cfg extension. Entries in the file are MAC addresses in hexadecimal format with each octet separated by colons, for example, 00:11:22:33:44:55. You must separate entries with a single space. For the AP to accept the file, it must contain only MAC addresses.

• Replace — Imports the list and replaces the contents of the Trusted AP List.

• Merge — Imports the list and adds the APs in the imported file to the APs currently shown in the Trusted AP List.

When the import is complete, the screen refreshes and the MAC addresses of the APs in the imported file appear in the Trusted AP List.

• Password Minimum Character Class — Enter the minimum number of character classes that must be represented in the password string. The four possible character classes are uppercase letters, lowercase letters, numbers, and special characters available on a standard keyboard. The default value for this field is 3. The range can be between 0-4 characters.

• Password Different from Current — Check to enable that users enter a different password when their current password expires. If left unchecked, users can reenter the same password when it expires.

• Maximum Password Length — The maximum password character length is a range from 64 to 127. The default is 64.

• Minimum Password Length — The minimum password character length is a range from 0 to 32. The default is 8.

• Password Aging Support — Check to enable password expiration after a configured time period.

• Password Aging Time — Enter the number of days before a newly created password expires, from 1 to 365. The default is 180 days.

• WPA-PSK Minimum Character Class — Choose the minimum number of character classes that must be represented in the key string. The four possible character classes are uppercase letters, lowercase letters, numbers, and special characters available on a standard keyboard. The default value for this field is 3. The range can be between 0-4 characters.

• WPA-PSK Different from Current — Check Enable to enable users to configure a different key after their current key expires. If disabled, users can use the old or previous key after their current key expires.

• Maximum WPA-PSK Length — Enter a key length value. The maximum key length in number of characters is from 32 to 63. The default is 63.

• Minimum WPA-PSK Length — Enter a key length value. The minimum key length in number of characters is from 8 to 16. The default is 8.