OVERVIEW

Grandstream’s versatile Wi-Fi Access Points (APs) deliver high-performance networking and reliable coverage for both indoor and outdoor environments. The outdoor models are built to withstand challenging conditions with durable, weatherproof designs. These APs are compatible with Grandstream’s robust management platforms, including both cloud-based and on-premise solutions, providing seamless control and scalability. Additionally, an embedded controller in the user interface enables straightforward local network management. Grandstream Wi-Fi APs are designed to meet the needs of businesses and enterprises of all sizes, with the flexibility to grow alongside your organization.

PRODUCT OVERVIEW

Technical Specifications

Technical Specifications

INSTALLATION

Before deploying and configuring the GWN76xx, the device needs to be properly powered up and connected to the network. This section describes detailed information on installation, connection, and warranty policy of the GWN76xx.

Equipment Packaging

• GWN76xx

GWN76xx Equipment Packaging

• GWN7600LR

Below is the equipment packaging for the GWN7600LR model.

GWN7600LR Equipment Packaging

GWN76XX Access Point Ports

Port	Description
Power	Power adapter connector (24V, 1A) for GWN7600 and GWN7610.
NET/PoE	Ethernet RJ45 port (10/100/1000Mbps) supporting PoE/PoE+. *GWN7600 supports PoE (802.3af) only.
NET	Ethernet RJ45 port (10/100/1000Mbps) to your router or another GWN76XX series.
USB	USB 2.0 port (for future IOT & location-based applications) *Available on GWN7610 and GWN7600 only.
RESET	Factory reset button. Press for 7 seconds to reset factory default settings. Quick press will only reboot the unit.

Power and Connect GWN76XX Access Point

Step 1:

Connect one end of a RJ-45 Ethernet cable to the NET or PoE/NET port of the GWN76XX unit.

Step 2:

Connect the other end of the Ethernet cable(s) into a LAN port to your Network. (Use PoE/PoE+ switch for GWN76XX).

Step 3:

For GWN7610/GWN7600 connect the 24V DC power adapter into the power jack on the back of the access point. Insert the main plug of the power adapter into a surge-protected power outlet. Otherwise, PoE can be used if the switch port does provide PoE power.

Step 4:

Wait for the GWN76XX to boot up and acquire an IP address from the DHCP Server.

Wall/Ceiling Mount Installation GWN76XX

GWN7610, GWN7600 can be mounted on the wall or ceiling, please refer to the following steps for the appropriate installation. This is the GWN7600 example:

Wall Mount – GWN76xx

Step1:

Position the mounting bracket at the desired location on the wall with the arrow pointing up.

Step 2:

Use a pencil to mark the four mounting holes (screw holes DIA 5.5mm, reticle hole DIA 25mm).

Step 3:

Insert screw anchors into the 5.5 mm holes. Attach the mounting bracket to the wall by inserting the screws into the anchors.

Step 4:

Connect the power cable and the Ethernet cable (RJ45) to the correct ports of your GWN7610/GWN7600.

Step 5:

Align the arrow on the GWN AP with the arrow on the locking tab of the mounting bracket and ensure that your GWN is firmly seated on the mounting bracket.

Step 6:

Turn the GWN clockwise until it locks into place and fits the locking tab.

Ceiling Mount

Step 1:

Remove the ceiling tile.

Step 2:

Place the ceiling backing plate in the center of the ceiling tile and mark the mounting screw holes (screw holes DIA 5.5mm, reticle hole DIA 25mm).

Step 3:

Insert the screws through the mounting bracket.

Step 4:

Connect the power cable and the Ethernet cable (RJ45) to the correct ports of your GWN76XX.

Step 5:

Align the arrow on the GWN AP with the arrow on the locking tab of the mounting bracket and ensure that your GWN is firmly seated on the mounting bracket and connect the network and power cables.

Step 6:

Turn the GWN clockwise until it locks into place and fits the locking tab.

Mounting Instructions for GWN7600LR

Please refer to the following steps to mount your GWN7600LR correctly.

1. Prepare the Cover Bracket by inserting the 4 screws (PM8) into corresponding holes.
2. Attach the Cover Bracket with screws on the vertical/horizontal Mounting Bolt where GWN7600LR will be installed.
3. Assemble the Base Bracket with the Cover Bracket using provided locknuts and screws (PM8).
4. Connect the Ethernet cable (RJ45) to the correct ports of your GWN7600LR.
5. Align the GWN7600LR with the Base Bracket and pull it down to the right position.
6. Install the 2x Assembled screws to fix GWN7600LR on the Mounting Bolt.

GETTING STARTED

The GWN76XX Wireless Access Point provides an intuitive web GUI configuration interface for easy management to give users access to all the configurations and options for the GWN76XX’s setup.

This section provides step-by-step instructions on how to read LED patterns, discover the GWN76XX, and use its Web GUI interface.

LED Patterns

The panel of the GWN76XX has different LED patterns for different activities, to help users read the status of the GWN76XX whether it is powered up correctly, provisioned, in the upgrading process, and more, for more details please refer to the below table.

LED Patterns

Discover the GWN76XX

Once the GWN76XX is powered up and connected to the Network correctly, users can discover the GWN76XX using one of the below methods:

Method1: Discover the GWN76XX using its MAC address

1. Locate the MAC address on the stickers of the unit, which is located on the back of the device, or on the package.
2. From a computer connected to same network as the GWN76XX , type in the following address using the GWN76XX’s MAC address on your browser https://gwn_.local<mac>.local

Method 2: Discover the GWN76XX using the GWN Discovery Tool

1. Download and install the GWN Discovery Tool from the following link: https://www.grandstream.com/support/tools
2. Open the GWNDiscoveryTool, click on Select to define the network interface, then click on Scan.
3. The tool will discover all GWN76XX Access Points connected on the network showing their MAC, IP addresses, and firmware version.
4. Click on Manage Device to be redirected directly to the GWN76XX’s configuration interface, or type in manually the displayed IP address on your browser.

Use the Web GUI

Users can access the GWN76XX using its WebGUI, the following sections will explain how to access and use the Web Interface.

Access Web GUI

The GWN76XX embedded Web server responds to HTTPS GET/POST requests. Embedded HTML pages allow users to configure the device through a Web browser such as Microsoft IE, Mozilla Firefox, Google Chrome, etc.

To access the Web GUI:

1. Make sure to use a computer connected to the same local Network as the GWN76XX.
2. Ensure the device is properly powered up.
3. Open a Web browser on the computer and type in the URL using the MAC address as shown in [Discover the GWN76XX ] or the IP address using the following format: http(s)://IP_Address
4. Enter the administrator’s login and password to access the Web Configuration Menu. The default administrator’s username is always “admin” and the password is the unique default Wi-Fi Password available on the sticker on the back of the unit.

WEB GUI Languages

Currently, the GWN76XX series web GUI supports 17 languages including English, Chinese, Spanish, etc. Users can select the displayed language at the upper right of the web GUI either before or after login.

Overview Page

Overview is the first page shown after successful login to the GWN76xx’s Web Interface. This page provides an overall view of the GWN76xx information presented in a Dashboard style for easy monitoring along with firmware version and date-time information at the top.

Users can quickly see the status of the GWN76xx for different items, please refer to the following table:

AP	Shows the number of Access Points that are Discovered, Paired (Online), and Offline. Users may click on (•••) to go to the Access Points page for basic and advanced configuration options for the APs.
Clients	Shows the total number of connected clients, and a count of connected clients to each Channel. Users may click on (•••) to go to the Clients page for more options.
AP Channel Distribution	Shows the Channel used for all APs that are paired with this Access Point.
Top AP	Shows the Top APs list, users may sort the list by number of clients connected to each AP or data usage combining upload and download. Users may click on to go to the Access Points page for basic and advanced configuration options for the APs.
Top SSID	Shows the Top SSIDs list, users may assort the list by number of clients connected to each SSID or data usage combining upload and download. Users may click on (•••) to go to the SSID page for more options.
Top Clients	Shows the Top Clients list, users may sort the list of clients by their upload or download. Users may click on (•••) to go to the Clients page for more options.
Alert/Notification	Shows 3 types of Alerts/Notifications: Critical, Major and Normal. Users can click (•••) to pop up the list of Alert and Notification.

New Firmware Notification: Starting from firmware version 1.0.5.13/1.0.5.14, and once a different OFFICIAL firmware is released on the Grandstream Networks website, the master AP will pop up a reminder notification to the administrator to upgrade the device. You can click on the New button to be redirected to the release note of the new firmware version, for upgrading steps please refer to section [UPGRADING AND BACKUP/RESTORE].

Save and Apply Changes

When clicking on the “Save” button after configuring or changing any option on the web GUI pages. A message mentioning the number of changes will appear on the upper menu. Click button to apply changes.

GWN MANAGEMENT PLATFORMS

GDMS Networking

Starting from firmware 1.0.6.41/1.0.6.43, the GWN76xx can be managed by your GDMS Networking account, GDMS Networking web interface now can be accessed at https://www.gdms.cloud.

GWN Manager

Starting from firmware 1.0.13.1, the GWN76xx can be managed and monitored by your GWN Manager account, GWN Manager On-premises Access Points Controller platform can be installed using the link below: https://www.grandstream.com/support/firmware

USING GWN76XX AS A STANDALONE ACCESS POINT

The GWN76XX can be used in Standalone mode, where it can act as Master Access Point Controller or in Slave mode and managed by another GWN76XX Master.

This section will describe how to use and configure the GWN76XX in standalone mode.

Connect to GWN76XX Default Wi-Fi Network

GWN76XX can be used as a standalone access point out of the box, or after a factory reset with Wi-Fi enabled by default.

After powering the GWN76XX and connecting it to the network, GWN76XX will broadcast a default SSID based on its MAC address GWN [MAC’s last 6 digits], and a random password.

Note that GWN76XX’s default SSID and password information are printed on the MAC tag of the unit as shown in the below figure.

USING GWN76XX AS MASTER ACCESS POINT CONTROLLER

Master Mode allows a GWN76XX to act as an Access Point Controller managing other GWN76XX access points. This will allow users to add other access points under one controller and manage them in an easy and centralized way.

Master/Slave mode is helpful with large installations that need more area zone coverage with the same controller.

Login Page

After login, users can use the Setup Wizard tool to go through the configuration setup or exit and configure it manually. Setup Wizard can be accessed anytime by clicking on while on the web interface.

Discover and Pair Other GWN76xx Access Points

First, note that by default the GWN controller access point will automatically discover all APs connected to the same LAN (broadcast domain), there is also a possibility to pair and provision remote APs using DHCP option 43 with the master direction explained below.

Master Direction

To pair and manage access points located on remote networks, the admin needs to configure the IP address of the master AP on DHCP option 43 which will be sent to the slave access point during the booting stage and allow the save/master connection to be established remotely. GWN76xx accepts option 224 encapsulated in option 43, and the syntax is in TLV format. A simple example of DHCP 43 configuration would be:

224(Type)12(Length)10.157.0.234(Value) translated into Hex as e00c31302e3135372e302e323334

Scenario example: a company has two offices connected via VPN (master AP located on network 192.168.1.0/24 and slave AP located on remote network 192.168.2.0/2). On the remote network, the admin can set DHCP option 43 using the GWN70xx router as the following value:

encap: 43,224,”192.168.1.100”.

After that, the slave AP will be listed on the master AP discovered devices and ready for the pairing and provisioning process which is described in the next steps.

To Pair a GWN76XX access point connected to the same Network as the GWN76xx follow the below steps:

1. Connect to the GWN76xx Web GUI as Master and go to Access Points → Configuration.

2. Click on  to discover access points within GWN76xx Network, the following page will appear.

3. Click on Pair  under Actions, to pair the discovered access point as slave with the GWN76xx acting as Master.

The paired GWN76XX access point will appear Online, users can click on  to unpair it.

AP Location

GWN76xx supports a handy feature which allows users to locate other Access points by blinking LED. To use the feature, navigate on the master web GUI under “Access Points → Status” page and click on the icon near the desired AP, and it corresponding unit will start blinking the LEDs.

Transfer AP – Transfer Network Group

Users can easily transfer the AP from the local master to the GDMS Networking or GWN Manager account by clicking on When you already have Network/Wi-Fi configurations on your GWN account, using this feature will let you choose existing Network/SSID to adopt your local AP.

Navigate to AP Web UI → Access Points → Configuration page, please refer to the figure below:

Then select where to transfer the select AP, either GDMS Networking or GWN Manager.

After this step, you will be redirected to GDMS Networking/GWN Manager page, select the network and click on “Save” button to complete the transfer.

This feature will allow you to transfer your local configurations to your cloud account. For more details, please refer to GDMS Networking – User Guide.

Failover Master

In a Master-Slave architecture, having a backup Master is critical for redundancy and failover function, thus, and in order to avoid a single point of failure in your wireless network, you can specify a slave AP as failover master. Whenever it detects the master is down, it will promote itself as failover master within a time frame of around 20~30 minutes by entering failover mode. After then, if the master AP comes back, failover master will automatically go back to slave mode, or if the master does not come back to alive, Administrator can login using “failover” account to turn the failover master as true master and take over all controls.

Users could select the Failover Master by following below steps:

Log into Web GUI of the Master access point then navigate to Access points → Configuration then click on and finally select the candidate access point from the drop-down list to be used as a Failover AP.

Failover Mode

Once Failover slave has been selected, the primary master will send the configuration of the network to the Failover slave and the slave will start monitoring the status of the primary master to detect any failure for any reason (network connection loss, power outage).

In case of failure, the Failover slave will promote itself to a temporary backup master while waiting for the primary master to come back.

During the Failover mode users could access the web GUI of the Failover slave using a special Failover account with same admin password.

• Username = failover
• Password = admin password

The Failover mode has only read permission on the configuration and limited options, users still can reboot other slave Access points in case it is needed.

Users also can press on « Switch to Master » button to set the Failover slave as the new primary master of the wireless network, once this is done they have full write permission control over the web GUI option as usual. Use that button to switch to master and takeover the rest of the APs.

Takeover Feature

This feature is used to re-pair the slave APs whose master has gone offline with another master AP in the same subnet. Please follow the steps to takeover slave APs from another master:

Step 1. Log in to the Web GUI of Master and click on “Discover APs” on the Access Points Page.

Step 2. Select the one or multiple APs to be taken over then click on the “takeover” button of the target AP.

Step 3. Enter the Takeover key which is the admin password of the previous master AP.

Transfer to Master

From the Master Access Point, the Administrator does have the capability to assign any Slave Access point to become the new Master to manage all the already paired Access points.

Navigate to Web UI → Access Points → Status, refer to the figure below:

Click on button, the following warning message will prompt to confirm the procedure:

When the process is finished, the original Master will turn to be a slave for the new Assigned Master and to log in to the new Master AP web interface, you will need to use the previous Master Admin password.

Client Bridge

The Client Bridge feature allows an access point to act as a wireless bridge and connect the wired-only clients to the wireless network. When an access point is configured in this way, it will share the Wi-Fi connection to the LAN ports directly. This is not to be confused with a mesh setup. The configured AP will not accept wireless clients in this mode.

Once an SSID has the Client Bridge Support enabled, the AP adopted in this SSID can be turned into Bridge Client mode by click the then the Bridge button .

Please note that once an AP is turned into Client Bridge mode, it cannot be controlled by a Master anymore, and a factory reset is required to turn it back into normal AP mode.

To verify, you may access the bridged AP configuration, then under Status, the option “Client Bridge Mode” would be set to Isolated as shown in the figure down below:

USING GWN76xx AS SLAVE ACCESS POINT

GWN access points can be paired as a slave to a master, this master can be another GWN access point, GWN router, or GDMS Networking/GWN Manager.

If the GWN access point is added to either GDMS Networking or GWN Manager, the Speed Test feature will be available to users. Please for more details check GWN Management Platforms – User Guide (Configure a GWN Access Point).

Slave Mode allows the users to access specific service and system settings.

Notes:

• If the AP is slave to a Master controller, the default username is admin, and the default password is the master AP’s password.
• If the AP is paired to the GDMS Networking the default username is admin, and the default password is the SSH Password (GDMS Networking → System → Settings).

Service

The TR-069 interface page allows the settings to enable remote and safe configuration of network devices. Refer to section [TR-069] for details regarding each field.

System

The system section provides access to the Manager settings and Debug sections.

Manager Settings

The Master (Manager Address) and Port can be found here to GWN76xx AP be discovered by the Manager.

Manager settings

Debug

Core Files
when a crash event happens on the unit, it will automatically generate a core dump file that can used by the engineering team for debugging purposes.

Ping/Traceroute
Allows the users to Ping and traceroute. Input the target’s IP address or URL and click on run.

One key Debug
Allows to capture Wireless, Portal, or Mesh traffic and logs will be found in Core Files.

SSH Remote Access
Enables the SSH remote access on the slave AP.

Log
Allows the users to retrieve the logs generated for troubleshooting purposes.

ACCESS POINTS

From the access points page, the administrator can monitor different information regarding the access points of the selected network, this section is separated into 2 sub-sections: Status and Configuration.

Status

The Status page lists all the access points assigned to the selected network, along with the possibility to perform some basic operations such as locating the device (LEDs start blinking in White) or clearing the usage data, also users can check more detailed information about each access point and benefit from useful debugging tools which can help diagnose issues when they appear.

To get more detailed information about the status of a specific access point, users can click on the desired AP then a page similar to the following will show up:

The first tab “Info” shows general information about the access point such as the firmware version, IP address, Uptime, etc. The second tab “Current Client” displays the clients connected to this AP and the last tab is used by administrator for debugging purposes and provides the following tools:

• Core Files, when a crash event happens on the unit, it will automatically generate a coredump file that can used by engineering team for debugging purposes.
• Ping/Traceroute tools, such as the ping utility, traceroute tool.
• Capture helps to capture traffic based on duration, interface, protocol, MAC address, IP address and ports, and there is also the option for custom rules.
• One Key Debugging, to capture Wireless, Portal or Mesh traffic and logs will be found in Core Files.

Configuration

The configuration page allows the administrator to Upgrade, Reboot, Add to SSIDs, Configure, Transfer network group, Transfer AP, Discover AP, Failover.

Upgrade

Select slave AP(s) to upgrade and press button.

Refer to [Upgrading Slave Access Points] for more details.

Reboot slave AP

To reboot a slave AP, select it then click on button. the below confirmation message will be displayed:

Move Access Points

The administrator can move GWN Access points from one network to another. Click on Move button and the following window will popup, select the network where to move the access point and click on move.

Delete Access Points

To delete an access point, select it, then click on reboot button, the following confirmation message will be displayed:

Configure Access Points

To configure an access point, select and click on button. A new config page will popup:

The following settings can be configured from this page:

Access Point Configuration Settings

Reset Access Points

To reset an access point, select and click on button, a confirmation message will be displayed, click on to confirm the operation.

SSID

When using GWN76XX as Master Access Point, users can create different SSIDs and assign GWN76XX Slave Access Points to them.

Log in as Master to the GWN76XX Web GUI and go to SSID.

Click on “Add” button to add a new SSID.

When editing or adding a new SSID, users will have two tabs to configure:

• Wi-Fi: Please refer to the below table for Wi-Fi tab options

SSID – Wi-Fi

• Device Membership: Used to add or remove paired access points to the SSID. The MAX SSID number is separately counted for each band (2.4GHzor 5Ghz).

The maximum allowed SSID for each band now is as below:

Model	MAX SSID
GWN7610/GWN7600(LR)	32

Click on to add the GWN76XX to the SSID or click on to remove it.

Wi-Fi Phones (WP) series device fast configuration

This feature helps to quickly create and configure SSID based on Wi-Fi phones (WP series) default configurations, WP phones come by default with an SSID name and password.

Navigate to SSIDs page, then click on Configure WP Series Devices button as shown below:

Specify the timeout duration for SSID (wp_master) to be visible, if no device was connected during that period then it will be disabled, the timeout duration is in minutes within the range of 10-1440 minutes.

Click “Save” button, and use a WP phone to connect to the SSID (wp_master).

The SSID default password is already pre-configured with the WP phone.

For more details visit: https://documentation.grandstream.com/knowledge-base/wp816-user-guide/#auto-connection

CLIENTS

Users can access clients list connected to GWN76XX from Web GUI → Clients to perform different actions to wireless clients.

• Click on under Actions to check client’s status and modify basic settings such Device’s Name.
• Click on to block a client’s MAC address from connecting to the zone’s SSID.
• Click on to release Wi-Fi offline client IP lease.

Users can press button to customize items to display on the page. Following items are supported:

ACCESS CONTROL

Access List

From this menu, users can manage the blacklist of clients that will be blocked from accessing the Wi-Fi network globally, click on “Edit” icon as shown below to add/remove MAC addresses of the client to/from global blacklist.

A second option is to add custom access lists that will be used as matching mechanism for MAC address filtering option under SSIDs to allow (whitelist) or disallow (blacklist) clients access to the Wi-Fi network.

Click on “Add” button in order to create new access list, then fill it with all MAC addresses to be matched.

Users can also Import/Export the client access lists in CSV format as shown below:

Users can check « Enable Schedule » to assign a schedule to the list and set the time it will take effect.

Once this is done, this access list can be used under SSID Wi-Fi settings to filter clients either using whitelist or blacklist mode.

Time Policy

The timed client disconnect feature allows the system administrator to set a fixed time for which clients should be allowed to connect to the access point, after which the client will no longer be allowed to connect until the user configurable cool-down period is reached.

The configuration is based on a policy where the administrator can set the amount of time for which clients are allowed to connect to the Wi-Fi. The administrator can also set the reconnect type and value for the users  to reconnect after they have been disconnected.

To create a new policy, go under Captive Portal  →  Time Policy and add new one.

Then set the following parameters:

Option	Description
Name	Enter the name of the policy.
Enabled	Check the box to enable the policy.
Limit Client Connection Time	Set the amount of time a client may be connected.
Client Reconnect Timeout Type	Select the method with which we will reset a client’s connection timer so they may reconnect again. Options are: Reset Daily. Reset Weekly. Reset Hourly. Timed Reset.
Client Reconnect Timeout	If “Timed Reset” is selected, this is the period for which the client will have to wait before reconnecting.
Day of the Week	If “Reset Weekly” is selected, this is the day when the reset will be applied.
Hour of the Day	If “Reset Weekly” or “Reset Daily” is selected, this is the hour and day when the reset will be applied.

Banned Clients

The clients that have been banned after time disconnect feature has taken effect, these clients will not be allowed to connect back until timeout reset or you can unblock a client by clicking on the icon.

Bandwidth Rules

The bandwidth rule is a GWN76XX feature that allows users to limit bandwidth utilization per SSID or client (MAC address or IP address).

This option can be configured from the GWN76XX WebGUI under “Bandwidth Rules”.

The following figure shows an example of MAC address rule limitation.

Click to add a new rule, the following table provides an explanation about different options for bandwidth rules.

Field	Description
Enabled	Enable/Disable the Bandwidth rule.
SSID	Select which SSID will be affected by the bandwidth rule limitation.
Range Constraint	Choose the type of rule to be applied on bandwidth utilization from the dropdown list, three options are available: Per-SSID: Set a bandwidth limitation on the SSID level. Per-User: Set a bandwidth limitation per Client. MAC: Set a bandwidth limitation per MAC address. IP Address: Set a bandwidth limitation per IP address.
MAC	Enter the MAC address of the device to which the limitation will be applied, this option appears only when MAC type is selected.
IP address	Enter the IP address of the device to which the limitation will be applied, this option appears only when IP Address type is selected.
Enable Schedule	Enable this option to assign a schedule for the bandwidth rule.
Upload Limit	Specify the limit for the upload bandwidth using Kbps or Mbps.
Download Limit	Specify the limit for the download bandwidth using Kbps or Mbps.

The following figure shows examples of bandwidth rules:

The same settings for bandwidth management are available from the following menus:

Navigate on the web GUI under “Clients → Edit → Bandwidth Rules” where you can set the Upstream and Downstream rate in Mbps.

Private Pre-Shared Key (PPSK)

PPSK (Private Pre-Shared Key) is a way of creating Wi-Fi passwords per group of clients instead of using one single password for all clients. It’s also possible to assign it for one single device client with a MAC Address.

To configure PPSK, please navigate to Web UI → Access Control → PPSK, then click on “Add” button to add a new PPSK account.

In case where the Maximum Number of Access Clients set to 1, then an option to specify a MAC Address is added. Please refer to the figure below:

PPSK

CAPTIVE PORTAL

Captive Portal feature on GWN76XX AP helps to define a Landing Page (Web page) that will be displayed on Wi-Fi clients’ browsers when attempting to access Internet. Once connected to a GWN76XX AP, Wi-Fi clients will be forced to view and interact with that landing page before Internet access is granted.

The Captive Portal feature can be configured from the GWN76XX Web page under “Captive Portal”.

The page contains following sub-menus: Guest, Policy List, Splash Page and Vouchers.

Guest

This section lists the clients connected or trying to connect to Wi-Fi via Captive Portal.

Click on “Kick out” button to kick out connected clients.

Users can press button to customize items to display on the page. Following items are supported:

Policy List

Users can customize a portal policy in this page.

• Click on to edit the policy.
• Click on to delete the policy.
• Click on to add a policy.

The policy configuration page allows adding multiple captive portal policies which will be applied to SSIDs and contains options for different authentication types. A splash page can be easily configured as shown in the next section.

Administrator can use an internal or external splash page.

Internal Splash Page

Below table lists the items policy add page configures

Captive Portal – Policy List – Splash Page is “Internal”

Notes:

If Facebook authentication is configured, you will need to log in your Facebook account of https://developers.facebook.com/apps , and set the OAuth redirect to : https://cwp.gwn.cloud:8443/GsUserAuth.cgi?GsUserAuthMethod=3

2. If Twitter authentication is configured, you will need to log in your Twitter account of https://apps.twitter.com/app, and set the callback URLs to: http://cwp.gwn.cloud:8080/GsUserAuth.cgi

External Splash Page

Field	Description
Name	Enter the name of the Captive Portal policy
Splash Page	Select Splash Page type, in this case “External”
External Splash Page URL	Enter the External Splash Page URL, and make sure to enter the pre-authentication rules request by the external portal platform in the pre-authentication configuration option.
RADIUS Server Address	Fill in the IP address of the RADIUS server.
RADIUS Server Port	Set the RADIUS server port, the default value is 1812.
RADIUS Server Secret	Fill in the key of the RADIUS server.
RADIUS Accounting Server	Configures the address for the RADIUS accounting server address.
RADIUS Accounting Server Port	Configures RADIUS accounting server listening port (default is 1813).
RADIUS Accounting Server Secret	Enter the secret password for client authentication with RADIUS accounting server.
Accounting Update Interval	Enter Update Interval for RADIUS Accounting Server. The interval unit can be set by seconds, minutes, hours, or days.
RADIUS NAS ID	Enter RADIUS NAS ID. This field appears only when Splash Page is set to “External”.
Redirect URL	Specify URL where to redirect clients after authentication.

In case social media authentication is used, the user needs to allow some traffic between the AP and social medial platforms (Facebook API as example) to send authentication credentials and receive reply, this traffic can be allowed using the Authentication rules which are explained below.

Pre-Authentication Rules

Using this option, users can set rules to match traffic that will be allowed for connected Wi-Fi users before the authentication process. For example, if users need to set up Facebook authentication, some traffic should be allowed to the Facebook server(s) to process the user’s authentication. Or simply used to allow some type of traffic for unauthenticated users.

Post-Authentication Rules

On the other hand, post authentication rules are used to match traffic that will be banned for Wi-Fi clients after authentication. As an example, if you want to disallow connected Wi-Fi clients to issue Telnet or SSH traffic after authentication then you can set post authentication rules to match that traffic and once a connected client passes the authentication process they will be banned from issuing telnet and SSH connections.

Splash Page

Files configuration page allows users to view and upload HTML pages and related files (images…).

User can add folder in corresponding folder by selecting the folder and click on .

• Click on to upload a file from local device.
• Click on to download the files in Captive Portal folder.
• Click on to edit the corresponding file, in another word, to replace the file with a new one.
• Click on to delete the file.

Vouchers

Voucher Feature Description

Voucher feature will allow clients to have internet access for a limited duration using a code that is randomly generated from GWN controller.

Note that multiple users can use a single voucher for connection with expiration duration of the voucher that starts counting after first successful connection from one of the users that are allowed.

Another interesting feature is that the administrators can set data bandwidth limitation on each created voucher depending on the current load on the network, users’ profile (VIP customers get more speed than regular ones…etc.) and the internet connection available (fiber, DSL, or cable…etc.) to avoid network congestion and slowness of the service.

Each created voucher can be printed and served to the customers for usage, and the limit is 1000 vouchers.

The usage of voucher feature needs to be combined with captive portal that is explained after this section, in order to have the portal page requesting clients to enter voucher code for authentication.

Voucher Configuration

To configure/create vouchers for clients to use, follow below steps:

1. On controller web GUI, navigate under “Captive Portal 🡪 Vouchers”
2. Click on button in order to add a new voucher.
3. Enter voucher details which are explained on the next table.
4. Press save to create the voucher(s).

Notes:

• Users can specify how many vouchers to generate with the same profile, this way the GWN will generate as many vouchers as needed with the same settings to avoid creating them one by one.
• The administrators can verify the status of each voucher on the list (In use, not used, expired …etc.).
• Press to print the voucher, to delete it or to renew the voucher.

The below figure shows the list of the vouchers after GWN randomly generates the code for each one.

Users can click on buttons and to delete and print multiple vouchers or click button to print all vouchers at once.

Also, users can use the drop-down list filter to filter the vouchers that were created at specific date-time.

The following table summarizes description for voucher configuration parameters:

Field	Description
Create Quantity	Specify how many vouchers to generate with the same profile/settings (duration, bandwidth, and number of users). Valid range: 1 – 1000.
Max Devices	Specify how many users can use same voucher. Valid range: 1 – 5.
Byte Limit	Specify download byte limit for the voucher. The unit can be either M (Megabyte) or G (Gigabyte). Valid range: 10 – 1048576 (M) 1 – 1024 (G)
Duration	Specify the duration after which the voucher will expire, and clients will be disconnected from the internet. Note: in case of multiple users, the duration will start counting after the first user starts using the voucher.
Validity Time	Set the validity period of the credentials, limited to 1-365. The unit is day.
Download Limit	Set the download bandwidth speed limit (in Kbps or Mbps).
Upload Limit	Set the upload bandwidth speed limit (in Kbps or Mbps).
Notes	Notes for the administrator when checking the list vouchers list.

Using Voucher with GWN Captive Portal

In order to successfully use the voucher feature, users will need to create a captive portal in order to request voucher authentication codes from users before allowing them to access the internet. More details about captive portal will be covered in the next section, for voucher configuration please follow below steps.

1. Go under “Captive Portal 🡪 Policy List” menu.
2. Press in order to add new captive portal policy.
3. Set the following parameters as shown on the screenshot for basic setup then save and apply.

Then go under your SSID configuration page and enable the generated captive portal under Wi-Fi settings tab.

RADIO

When using GWN76XX as Master Access Point, users can edit the frequency band used by the AP and channel used along with the Transmission power for each band.

Log in as Master to the GWN76XX Web GUI and go to Radio.

Radio – Global configuration

SECURITY

Rogue AP

The GWN Access Points offer the ability to prevent malicious intrusion to the network and increase the wireless security access of clients when introducing Rogue AP detection. The detected APs will be listed with all the details under the detected section for further intervention.

The figure below is the configuration page in order to enable the Rogue AP detection and we can set the trusted APs on the network.

Field	Description
Enable Rogue AP Detection	Select to either to enable or disable Rogue AP scan.
Detect range	Specify the rogue AP detect range. • Same channel: AP will execute simple detection on the APs around, this mode almost has no effects on the wireless network communication. • All channels: AP will execute a deep detection every 5 minutes. And the clients connecting to the AP will have few seconds of communication interrupt. Default is Same Channel.
Countermeasure Level	Countermeasure level specifies the type of attacks which will be suspected by the AP. Select different levels: • High: Untrusted BSSID, Illegal access without authentication, Illegal access, Spoofing SSID. • Medium: Untrusted BSSID, Illegal access without authentication, Illegal access. • Low: Untrusted BSSID, Illegal access without authentication. Default is Disabled.
Containment Range	Specify the containment range: • Same channel: detect AP will countermeasure the APs in the same channel. • All channels: detect AP will countermeasure the APs in all channels at the cost of consuming of much AP performance. Default is Same Channel.
Sub-string for Spoofing SSID	The AP broadcasting SSID with the specified string will be classified as a Spoofing SSID.
Trusted AP	You can specify MAC address of the trusted AP, which should be formatted as XX:XX:XX:XX:XX:XX. If an AP is defined as trusted AP, no countermeasures will be executed on it.
Untrusted AP	You can specify MAC address of the untrusted AP, which should be formatted as XX:XX:XX:XX:XX:XX. If an AP is defined as untrusted AP, countermeasures will be executed on it when countermeasure is enabled.

The figure below shows a list of all the detected rogue AP on the network scanned by the GWN access point.

Firewall

This section allows users to control the outgoing and incoming traffic from clients by manually setting up policies to either deny or permit the traffic based on protocol type and by specifying SSIDs and destinations.

Field	Description
Service Protocol	Select type of traffic to be affected by the outbound rule like ICMP, HTTP, HTTPS… or you may add another type of traffic when selecting Custom. When set to Custom, user could enter the following: • Protocol: TCP or UDP • Port: define the port used by this protocol.
Policy	Either select to Permit or Deny Outbound traffic.
Destination	Select either: • Particular Domain: enter FQDN of a destination or string: for instance, entering test will block service to any domain name containing string test. • Particular IP: IP address of destination. • Particular Network: Network IP address. • All: the rule will apply on all destinations.
SSID	Select one or multiple SSIDs to apply the rule on.

User can define outbound and inbound rules on the traffic from the options in figure below:

Field	Description
Service Protocol	Select type of traffic to be affected by the inbound rule like ICMP, HTTP, HTTPS… or you may add another type of traffic when selecting Custom. When set to Custom, user could enter the following: • Protocol: TCP or UDP • Port: define the port used by this protocol.
Policy	Either select to Permit or Deny inbound traffic.
Source	Select either: • Particular IP: IP address of source. • Particular Network: Network IP address. • All: the rule will apply on all destinations.
Destination	Configure the destination address. • All • Particular • IP Particular Domain • Particular Network

ARP Attack Defense

GWN Access points also support ARP Attack Defense security feature. This feature protects clients from spoofing MAC addresses by binding the MAC address to an IP address.

ARP List

Navigate to Web UI → Security → ARP Attack Defense, on the ARP list tab, the user can see the current ARP table (MAC address → IP address combination), Click on “Bind” icon to bind the MAC address to an IP address.

IP-MAC Binding

To make an IP-MAC address Binding manually, on the IP-MAC Binding tab, click on “Add” button and then enter the IP address and the MAC address then click save.

To unbind or edit, click on “Delete or Edit” icons under Actions. Please refer to figure below:

ARP Attack Defense

Strict ARP Learning option only learns ARP from the ARP Reply responding to the ARP Request sent by this device.

Neighbor Discovery (ND) Attack Defense

ND Attack Defense is the equivalent of ARP Attack defense but using IPv6 addresses.

Navigate to Web UI → Security → ND Attack Defense page, then you can enable this security feature by clicking on “Source MAC Consistency Check for ND Messages“, now the device will check for Source MAC addresses to avoid any spoofing. There is also the option to log these events by checking “Log” option.

SERVICE

Hotspot 2.0

This section lists the configuration page to Hotspot 2.0. This is a technology that allows mobile devices to automatically connect to available Passpoint-certified Wi-Fi hotspots. This gives the device liberty to hop from one hotspot on a network to another without the need to log in to each hotspot. This feature is currently on beta. 

To enable this feature, proceed from Access Point’s web page 🡪 Service 🡪 Hotspot 2.0:

General Settings
Name	Set name of the hotspot.
Domain ID	Set the Domain ID.
HESSID	Configure the Homogenous Extended Service Set Identifier information for Hotspot2.0. This value must be consistent with the BSSID of an AP to identify the AP set that provides the same network access service. The format is H:H:H:H:H:H, where H is a 2-digit hexadecimal number.
Network Access	Enable or disable internet access.
Network Type	Select network type: • Private network • Private network with guest access • Chargeable public network • Free public network • Personal device network • Emergency services only network • Test or experimental • Wildcard
IPv4 Type	Select IPv4 Type: • Address type not available • Public IPv4 address available • Port-restricted IPv4 address available • Single NATed private IPv4 address available • Double NATed private IPv4 address available • Port-restricted IPv4 address and single NATed IPv4 address available • Port-restricted IPv4 address and double NATed IPv4 address available • Availability of the address type not known
IPv6 Type	Select IPv6 Type: • Address type not available • Address type available • Availability of the address type not known
Network Auth Type	Configure the Network authentication type to help users find and select the right network. Select either: • Acceptance of terms and conditions • On-line enrollment supported • http/https redirection • DNS redirection • Not configured
OSU SSID	Configure the Online Sign Up service’s SSID. You need to add a SSID with Security Mode is Open or OSEN or WPA2/OSEN.
Venue
Venue Group	Select the Venue Group type: • Unspecified • Assembly • Business • Educational • Factory • Institutional • Mercantile • Storage • Utility • Vehicular • Outdoor
Venue Type	Select the Venue type, which will depend on the Venue Group.
Language Code	Select the language.
Venue Name	Set the Venue name.
Operator Name
Language Code	Select the language.
Operator Name	Set the Operator name.
Roaming Consortium
Roaming Consortium Name	Configure the Roaming Consortium Name to identify network operators. The format is H-H-H or H-H-H-H-H, where H is a 2-digit hexadecimal number.
Domain
Domain	Enter the domain name.
Realm
Realm	Select the EAP Method: EAP-TLS, EAP-SIM, EAP-TTLS, EAP-AKA and EAP-AKA’.
Cellular Network Information
Cellular Network Information	Enter the Name, Country Code and Network Code.
Port Configuration
IP Protocol	Configure the protocol type: ICMP, TCP, UDP or ESP.
Port Number	Set the protocol port.
Port Status	Set the port status to either: Open, Close or Unknown.
Terms and Condition
Filename	Specify the filename.
Timestamp	Select the timestamp
Advice of Charge
Type	Select the type: • Time-based • Data-volume-based • Time-and-data-volume-based • Unlimited
Realm	Select the Realm.
Language Code	Select the language code.
Currency Code	Select the currency: XSU, BTN, INR, CNY, MOP, HKD, XAF.
XML Content	Upload XML file
Advanced
WAN Link Status	Set the WAN Link Status to either: Not configured, Link-up, Link-down or Link-test.
WAN Downlink Speed	Set Download speed.
WAN Uplink Speed	Set Upload speed.
GAS Fragmentation Limit	Set GAS fragmentation limit. Default is 1400.
GAS Comeback Delay	Set GAS comeback delay. Default is 0.
Disable Downstream Group-Addressed Forwarding	When this option is disabled, it means the DGAF is enabled, the AP will forward all downlink broadcast ARP messages and wireless group broadcasts. When this option is enabled, the DGAF function is disabled, the AP will discard all downlink broadcast ARP messages and wireless group broadcasts. Disable DGAF function to prevent attackers from using the vulnerability of all clients in the same BSS using the same Group Temporal Key (GTK) to forge Group address frames and then attack the clients.

SNMP

This section lists the SNMP options available to integrate the GWN76xx with monitoring systems.

Field	Description
Enable	Enable SNMPv1/SNMPv2c.
Community String	Enter the SNMP Community string.
Enable	Enable SNMPv3.
Username	Enter the SNMPv3 authentication username.
Authentication Mode	Set the authentication mode to: either MD5 or SHA.
Authentication password	Enter the SNMPv3 authentication password.
Privacy Mode	Set the authentication mode to: either AES128 or DES.
Privacy password	Enter the privacy password.

DHCP Server

Users could create and manage multiple DHCP server pools which will be mapped to the SSID using VLAN tag, for example when creating a DHCP pool under “System Settings 🡪 DHCP Server” users need to set a VLAN ID and the same ID should be set under the SSID field to map the configured DHCP pool with the SSID. This way users could configure multiple SSIDs mapped to multiple VLANs on the network in which case they are isolated by layer 2 switching.

The table below summarizes the configuration parameters for DHCP server.

Field	Description
Name	Set the name of the DHCP Pool.
Enable	Enable/Disable the DHCP pool.
VLAN ID	Set a VLAN ID, same one should be set on SSID settings to map it with the DHCP pool.
DHCP Server Static Address	Configure the static address of the DHCP server (through which GWN Master AP will be accessible).
DHCP Server Subnet Mask	Set the subnet mask for the DHCP Pool.
DHCP Start Address	Set the start address for DHCP
DHCP End Address	Set the end address for DHCP
DHCP Lease Time	Set the DHCP lease time for the clients (default 12h).
DHCP Options	Add the Option items for DHCP, detailed option contents can be found via: https://wiki.openwrt.org/doc/howto/dhcp.dnsmasq
DHCP Gateway	Set the gateway for DHCP, and it is better to set the gateway, should be different that the static IP of the access point and on the same subnet.
DHCP Preferred DNS	Set the preferred DNS for DHCP
DHCP Alternated DNS	Set the alternated DNS for DHCP

NAT Pool

GWN76xx NAT feature defines an address pool from which the Wi-Fi clients will acquire their IP address so that the access point acts as a lightweight home router.

Notes:

1. This option cannot be enabled when Client IP Assignment is set to Bridge mode.

2. This option is not supported in GWN7610

Field	Description
Default Gateway	Set the gateway IP address. Note: The gateway address cannot be in the same network segment as the uplink network.
DHCP Server Subnet Mask	Set the gateway mask.
DHCP Lease Time	Set the DHCP Lease time.
DHCP Preferred DNS	Set the preferred DNS for DHCP
DHCP Alternate DNS	Set the alternated DNS for DHCP

Static DHCP

Users can use this feature in order to set static DHCP that binds to certain clients, to whom you do not want the IP address to change.

To configure Static DHCP, please follow below steps:

1. Click button to create a new entry.
2. Enter the name of the device, along with its MAC address and IP address

• Press Save and Apply to submit the changes.

DHCP Relay

DHCP Relay is a network device that forwards IP addresses from the DHCP Server to clients devices, even if the DHCP server is on a different network (ex: VLAN). This way we can have a dedicated DHCP server on many networks. GWN access points can be configured as a DHCP relay agent. Please follow the steps below:

Prerequisite: before configuring DHCP Relay, first we have to assign a static IP address to both devices that will be acting as a DHCP Server and DHCP Relay in our case it’s two GWN76xx Access Points.

1. The first step in our example is to make a GWN access point as a DHCP Server, please refer to DHCP Server configuration.
2. Navigate to Web UI → Access Points → Configuration, click on the access point or click on the “Edit” icon, then the device configuration window will show up. Set a static IP for both access points (one acting as a DHCP Server and the other one as a DHCP Relay), please refer to the figure below.

3. To configure DHCP Relay, please navigate to GWN access point Web UI → Service → DHCP Server → DHCP Relay tab, Then enable DHCP Relay and then enter the DHCP Server Address (ex: GWN access point).

TR-069

Field	Description
Enable TR-069	Configure whether to enable TR-069. Note: Once enabled, this device cannot be managed by GDMS Networking anymore.
ACS URL	URL for TR-069 Auto Configuration Server (ACS).
ACS Username	When AP sends a connection request to ACS, the username that ACS authenticates TR-069 client, that is AP, must be consistent with the configuration on the ACS side.
ACS Password	The password of ACS for AP authentication must be consistent with the configuration of ACS side.
Enable Periodic Inform	If enabled, AP will send connection inform packets to ACS regularly.
Periodic Inform Interval (s)	Enter the time interval when AP sends connection Inform packets to ACS regularly
CPE Cert File	Enter the certificate that AP needs to use when connecting to ACS through SSL.
CPE Cert Key	Enter the certificate key that AP needs to use when connecting to ACS through SSL.

Notes:

1. Restrictions:

Both Master and Slave (regardless of whether it has been taken over by GDMS Networking/Local Master) support TR-069 function, and you can go to their respective local web terminal to open TR-069 and make related configuration.

If the Slave under the GDMS Networking, it will be disconnected from the Cloud. The AP can still show on the Cloud, but it is not manageable (similar to the AP taken over by the Master can be added to the Cloud); if the Slave is under the Local Master, the connection with the Local Master will be disconnected, and the Master will no longer show this AP.

2. Failover does not support TR-069 function. When multiple slaves are managed under Local Master, set a slave to failover mode. When the Master fails, the slave acts as the Master to manage other slaves. At this time, if you want to migrate to the TR-069 platform, you can only configure TR-069 for each of the other Slaves through their own local web pages. So, they need to be migrated one by one, and APs in Failover mode cannot be migrated. (After failover master get transferred into official master, by admin to login and confirm, there will be no such restriction anymore)

3. Master supports the migration of the whole setup including its slaves to TR-069, and the behavior is irreversible. If the Master turns on TR-069, all online Slave APs it controls will be migrated to the TR-069 platform, and the Master’s identity will also be changed to Slave. In this process, you need to ensure the TR-069 configuration information, especially the ACS URL is configured correctly, otherwise the migration will fail, and all AP roles remain unchanged, and the function does not affect the use.

4. If a slave is offline, it will not be migrated to TR-069. After it goes online again, it will not be migrated to the TR-069 platform either. It is still in the state of being taken over by the original Master, but is no longer managed by the Master. It cannot be managed by Cloud, but can only be taken over by other Masters or factory reset.

5. APs managed by TR-069 can be “Take Over” by Local Master. After Taken Over, TR-069 shuts down by itself, and the Local Master issues the configuration to the AP to overwrite the original configuration from TR-069. This process will take a certain amount of time.

6. An AP under TR-069 will be disconnected from TR-069 by itself after the TR-069 function is turned off on the AP’s local web UI, but it will not affect its function use and can continue to be taken over by Master/GDMS Networking.

SYSTEM

Settings

Users can access Maintenance page from GWN76XX WebGUI🡪System 🡪 Settings.

LEDs

GWN76XX Access Points series also support the LED schedule feature. This feature is used to set the timing when the LEDs are ON and when they will go OFF at customer’s convenience.

This can be useful for example when the LEDs become disturbing during some periods of the day, this way with the LED scheduler, you can set the timing so that the LEDs are off at night after specific hours and maintain the Wi-Fi service for other clients without shutting down the AP.

Following options are available:

Field	Description
LEDs Always Off	Configure whether to disable the AP LED dictator
LEDs Always On	Configure whether to enable the AP LED dictator
Schedule	Please choose a schedule to assign to LEDs, users can configure schedules under the menu

Following example on the next page sets the LEDs to be turned on from 8am till 8pm every day.

Basic

Basic page allows Country and Time configuration.

Field	Description
LED VLAN VLAN ID Allow DHCP Option 43 to Override Management VLAN	This feature is an enhancement in regards to optimizing and reducing energy consumption of the AP. Users can select to either Always on / Always off or to Schedule the period where the LEDs can remain on. Management VLAN: This feature allows GWN AP to be discovered/managed on a VLAN network. If enabled, APs will get IP from this VLAN. Enter VLAN ID Configures AP to get provisioned for management VLAN from DHCP Option 43 in the local server automatically. The default management VLAN will be overridden by the provisioned settings. Note: Once enabled, users cannot manually change the management VLAN.
Rebind Protection	Anti-domain name hijacking protection. If enabled, when the address returned by the superior DNS is a private LAN address, it will be regarded as a domain name hijacking, thus discarding the analytical result. If disabled, the analytical results will not be discarded.
Legacy TLS Compatibility	Due to the security enhancement, unless Legacy TLS Compatibility (only available on 1.0.15.4 or higher version) is enabled, master AP on 1.0.15.4 or higher firmware will not be compatible with slave AP on firmware lower than 1.0.15.4. Master AP on firmware lower than 1.0.15.4 will also not be compatible with slave AP on firmware 1.0.15.4 or higher. Cloud and GWN Manager will still support both firmware. Default is enabled.
Web HTTPS Port	Specifies HTTPS port. By default, is 443.
Country/Region	Select the country from the drop-down list. This can affect the number of channels depending on the country standards.
Scene	Depending on the deployment type (Indoor or Outdoor) the additional 5Ghz channels (DFS Channels) will be available to be used. Please refer to table DFS Channels supported by Model. Note: This field appears for Country/Region supporting DFS.
Time Zone	Configure time zone for the GWN76XX. Make sure to reboot the device to take effect.
NTP Server	Configure the IP address or URL of the NTP server. The device will obtain the date and time from the configured server.
Date Display Format	Change the Date Display Format, three options are possible YYYY/MM/DD, MM/DD/YYYY and DD/MM/YYYY.
Reboot Schedule	Select the time schedule when AP will be rebooted. Refer to [S] to define time.

Account

The Access Web page provide configuration for admin and user password.

Field	Description
Current Administrator Password	Enter the current administrator password.
New Administrator Password	Change the current password. This field is case sensitive with a maximum length of 32 characters.
Confirm New Administrator Password	Enter the new administrator password one more time to confirm.
New User Password	Configure the password for user-level Web GUI access. This field is case sensitive with a maximum length of 32 characters.
Confirm New User Password	Enter the new User password again to confirm.

Note: User passwords registered for authentication through the web portal are stored in an encrypted form.

Mesh

In Mesh Network, wireless connection is established between multiple APs, which is used to pass-through data traffic rather than client association. Each AP will evaluate the performance of wireless channel based on several factors and choose one or multiple appropriate APs to setup connection.

In a mesh network, access points are categorized to two types:

• CAP (Central Access Point): this is an access point that has an uplink connection to the wired network.
• RE (Range Extender): This is an access point that participate on the mesh network topology and has a wireless uplink connection to the central network.

In order to deploy mesh access points (RE), users/installers can follow below steps:

1. Make sure to have the master and CAPs access points already deployed (sometimes the CAPs access points can be the master controller of the network).
2. Next, we need to pair the REs access points to the master. This can be done in two ways:
3. Connect all REs to the same wired LAN as the master then perform the normal process of discovery/pairing process, and after successfully pairing the APs they can be deployed on the field.
4. REs can also be discovered wirelessly when powered via PSU or PoE Injector, and administrators can configure them after discovery. This requires that the REs must be within the range of the Master or CAP Slave’s signals coverage.

Note: If there are other GWN APs broadcasting in the same field with different subnet, RE may be wirelessly connected to those networks and cannot be discovered and paired by your Master. Therefore, it is recommended to use the first method of wired pairing and then deploy those REs.

1. After that all slave access points have been deployed and paired to the master, you can directly manage them to operate the mesh network. Mesh service configuration is the same as transitional GWN WLAN.
2. Log into the master page, and under Access Points page you can see the information, for example the AP in the “Online Wireless” state is the RE (Range Extender) with a wireless uplink to the CAP. The APs showing “Online” state are either a wired master or CAP.

For Global mesh network settings, on GWN76XX, navigate to the menu “System🡪 Settings 🡪 Mesh”

for setting up the following parameters described below:

The following table down below describes the Mesh configuration settings for the GWN76XX:

Filed	Description
Enable Mesh	When checked the Mesh feature will be activated. Default is disabled.
Scan Interval	Interval in seconds to scan for available Mesh neighbors. Must be less than or equal to 300 seconds.
Interface	5GHz band. Note: Mesh does not support 2.4GHz, due to the channel interference.
Wireless Cascades	Define how many AP can be cascaded wirelessly with the AP. The minimum value is 1 and maximum value is 3.

For more detailed information about GWN Mesh network feature, you may refer to the following technical document: Mesh Network Guide.

Important notes:

1. The RE should be set with DHCP Mode for a Client device connected to NET PORT to acquire an IP Address.

2. If RE is set with static IP, then using a PoE injector is recommended as any Network activity detected by the AP will cause the Mesh to fail. Otherwise, user will only need to make sure that there is no DHCP Server in the network connected to the AP’s Ethernet port.

Schedule

Users can use the schedule configuration menu to set specific schedule for GWN features while giving the flexibility to specify the date and time to turn ON/OFF the selected feature.

The Schedule can be used for setting up specific time for Wi-Fi where the service will be active or for LED schedule or bandwidth rules …etc.

To configure a new schedule, follow below steps:

1. Go under System 🡪 Schedule and click on Create New Schedule.

2. Select the periods on each day that will be included on the schedule and enter a name for the schedule (ex: office hours).
3. Users can choose to set weekly schedule or absolute schedule (for specific days for example), and if both weekly schedule and absolute schedules are configured on the same day then the absolute schedule will take effect and the weekly program will be cancelled for that specific date.
4. Once the schedule periods are selected, click on Save to save the schedule.

The list of created schedules will be displayed as shown on the figure below. With the possibility to edit or delete each schedule:

Maintenance

Upgrade

The Upgrade Web page allows upgrade related configuration.

Syslog

On the GWN76XX, users could dump the syslog information to a remote server under Web GUI → System → Maintenance → Syslog Tab. Enter the syslog server hostname or IP address and select the level for the syslog information. Eight levels of syslog are available: Emergency, Alert, Critical, Error, Warning, Notice, Information and Debug.

Here is an example of the device name shown in Wireshark capture, please refer to the figure below:

Syslog Parameters

Alert

The Alert page allows the administrator to select a predefined set of system events and to send notifications upon the change of the set events via email.

Email

Field	Description
Enable Email Notification	Set whether to enable Email notification.

Alert Configure

The following table describes the notifications configuration settings:

Filed	Description
Memory Usage	Configure whether to send notification if memory usage is greater than the configured threshold.
AP Throughput	Once enabled, master will generate an Alert when AP throughput reaches the configured threshold.
SSID Throughput	Once enabled, master will generate an Alert when SSID throughput reaches the configured threshold.
Admin Password Change	Configure whether to send notification on admin password change.
Firmware upgrade	Configure whether to send notification on firmware upgrade.
Rogue AP	Once enabled, system will generate an Alert when there is a Rogue AP detected.
AP Offline	Configure whether to send notification when AP going offline.

UPGRADING AND BACKUP/RESTORE

Upgrading Firmware

The GWN76XX can be upgraded to a new firmware version remotely or locally. This section describes how to upgrade your GWN76XX.

Upgrading via Web GUI

The GWN76XX can be upgraded via TFTP/HTTP/HTTPS by configuring the URL/IP Address for the TFTP/HTTP/HTTPS server and selecting a download method. Configure a valid URL for TFTP, HTTP or HTTPS; the server name can be FQDN or IP address.

Examples of valid URLs:

• firmware.grandstream.com/BETA
• 192.168.5.87

The upgrading configuration can be accessed via:

Web GUI🡪System Settings🡪Maintenance🡺Upgrade

Upgrading Slave Access Points

When the GWN76XX is being paired as slave using another GWN76XX Access Point acting as Controller, users can upgrade their paired access points from the GWN76XX Master Controller.

To upgrade a slave access point, log in to the GWN76XX acting as Master Controller and go to Access Points.

Make sure that firmware server path is set correctly under Maintenance, check the desired APs to upgrade, and click on to upgrade the selected paired access points.

Sequential Upgrade

If you choose multiple slave devices to upgrade their firmware, two options are available: “All-at-Once” and “Sequential”. “All-at-Once” will use the default method, all checked slaves will upgrade their firmware at the same time, while using the “Sequential” upgrade method, the slaves will upgrade their firmware one by one to:

• Avoid entire Wi-Fi service interruption by full system firmware upgrade.
• Reduce network bandwidth consumption caused by firmware downloading.

Once you choose sequential upgrade, the following icon will update you about the number of upgraded slaves out of the selected slaves.

Configuration Backup and Restore

The GWN76XX configuration can be backed up locally. The backup file will be used to restore the configuration on GWN76XX when necessary.

Download Configuration

Users can download the GWN76XX configuration for restore purposes under Web GUI🡪System Settings🡪Maintenance🡪Upgrade.

Click on to download the configuration file locally.

Upload Configuration

Users can upload configuration file to the GWN76XX under Web GUI 🡪 System Settings 🡪 Maintenance 🡪 Upgrade.

Click on to browse for the configuration to upload.

Reset and reboot

• Users can reboot the device under Web GUI 🡪 System Settings 🡪 Maintenance 🡪 Upgrade by clicking on button.
• The button will restore all the GWN76XX options to factory settings.

EXPERIENCING THE GWN76xx Wi-Fi ACCESS POINTS

Please visit our website: https://www.grandstream.com to receive the most up-to-date updates on firmware releases, additional features, FAQs, documentation, and news on new products.

We encourage you to browse our product-related documentation, FAQs, and User and Developer Forum for answers to your general questions.  If you have purchased our products through a Grandstream Certified Partner or Reseller, please contact them directly for immediate support.

Our technical support staff is trained and ready to answer all your questions. Contact a technical support member or submit a trouble ticket online to receive in-depth support. Thank you again for purchasing the Grandstream GWN76XX Wi-Fi Access Point, it will be sure to bring convenience and color to both your business and personal life

Thank you again for purchasing the Grandstream GWN76XX Wi-Fi Access Point, it will be sure to bring convenience and color to both your business and personal life

CHANGE LOG

This section documents significant changes from previous versions of the GWN76xx user manuals. Only major new features or major document updates are listed here. Minor updates for corrections or editing are not documented here.

Firmware Version 1.0.25.33

Product Name: GWN7600 / GWN7600LR / GWN7610

• Added new LED Pattern for uplink down/no network [LED Patterns]
• Added WP series device fast configuration support [WP device fast configuration]
• Added support for multi-VLAN Wi-Fi roaming [SSID]
• Added support for MAC-based RADIUS authentication [SSID]
• Added support of OS filtering [SSID]
• Increased the number of MAC addresses which can be added in the Client isolation [SSID]
• Increased Whitelist/Blacklist limit to 1024. [Access List]
• Added LLDP protocol support.

Firmware Version 1.0.25.19

Product Name: GWN7600 / GWN7600LR / GWN7610

• No major changes

Firmware Version 1.0.25.10

Product Name: GWN7600 / GWN7600LR / GWN7610

• Added support for Speed Test [GWN AP as a slave]

Firmware Version 1.0.25.7

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Increased PPSK accounts. [PPSK]
• Increased the client expiration time to 30 days. [Captive Portal]
• Added device name in Syslog messages. [Syslog]
• Added support for custom Channel on 2.4G band. [Radio]

Firmware Version 1.0.25.3

Product Name: GWN7610 / GWN7600 / GWN7600LR

• No major changes

Firmware Version 1.0.25.1

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support of ARP defense [ARP Attack Defense]
• Added support of IPv6 ND defense [ND Attack Defense]
• Added support for disabling Ethernet port [configure access points]
• Added support of DHCP relay and option82 [DHCP Relay]
• Added support of trunk/access mode for NET/PoE port [configure access points]
• Added support of External syslog protocol selection [Syslog]
• Added support for collecting logs by MAC [Syslog]
• Added support of Captive Portal – Active Directory Auth (LDAP) [Captive Portal]
• Added support of Captive Portal – kick out timeout unauthenticated clients [Captive Portal]
• Added support of Captive Portal – Daily access limit by auth method [Internal Splash page]
• Added support for switching RF timer [Radio]

Firmware Version 1.0.23.24

Product Name: GWN7610 / GWN7600 / GWN7600LR

• No major changes

Firmware Version 1.0.23.22

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support for GWN Cloud v1.1.23.27 and GWN Manager v1.1.23.27

Firmware Version 1.0.23.6

Product Name: GWN7600 / GWN7600LR / GWN7610

• No major changes

Firmware Version 1.0.23.3

Product Name: GWN7600 / GWN7600LR / GWN7610

• No major changes

Firmware Version 1.0.21.7

Product Name: GWN7600 / GWN7600LR / GWN7610

• No major changes

Firmware Version 1.0.19.32

Product Name: GWN7600 / GWN7600LR / GWN7610

• No major changes.

Firmware Version 1.0.19.25

Product Name: GWN7600 / GWN7600LR / GWN7610

• No major changes

Firmware Version 1.0.19.23

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support for Secondary RADIUS Server. [Secondary RADIUS Server]
• Added support for Rogue AP Alert. [Alert Configure]

Firmware Version 1.0.19.15

• No major changes

Firmware Version 1.0.19.9

• Added support of Rogue AP Detection. [Rogue AP]
• Added support of 802.11w. [802.11w]
• Added support of AutoTX Power. [RADIO]
• Added Captive Portal Enhancement. [CAPTIVE PORTAL]
• Added support of SNMP. [SNMP]
• Added support of more DFS Channels. [Scene]
• Added support of NAT. [NAT]
• Added support of Firewall. [Firewall]
• Added support of Hotspot 2.0 Beta. [Hotspot 2.0]
• Added support of Multicast/Broadcast Suppression. [Multicast/Broadcast Suppression]
• Extended support of RRM to GWN Cloud and remaining AP models. [Transmit Power Control][Coverage Hole Detection][Dynamic Channel Assignment]
• Added support of Active IGMP for the feature Convert IP multicast to unicast enhancement. [Convert IP multicast to unicast]
• Allow DHCP Option43 to override GWN Manager Address. [Allow DHCP Option 43 to override GWN Manager Address]

Firmware Version 1.0.15.20

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support for more DFS channels [Scene]

Firmware Version 1.0.15.4

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support of GWM Manager. [GWN Manager]
• Added LED pattern of yellow to indicate Mesh disconnection. [LED Patterns]
• Upgraded TLS to version 1.2

Firmware Version 1.0.11.8

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support for Client Steering. [Client Steering]
• Added support for Minimum Rate Control. [RADIO]
• Added support for batch operations for Takeover. [Takeover Feature]
• Added support for Client inactivity timeout. [SSID]
• Enhanced Voucher feature by displaying remaining bytes. [Vouchers]
• Changed LED Pattern. [LED Patterns]
• Changed Local Master External Portal Configuration. [External Splash Page]
• Changed the default setting of Mesh to OFF. [Mesh]

Firmware Version 1.0.8.18

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support of ARP Proxy. [ARP Proxy]
• Enhanced Bandwidth Rules by adding an option to limit bandwidth per user. [Range Constraint]

Firmware Version 1.0.8.9

Product Name: GWN7610 / GWN7600 / GWN7600LR

• No major changes

Firmware Version 1.0.7.13

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support of Radio Resource Management (RRM). [Dynamic Channel Assignment] [Transmit Power Control] [Coverage Hole Detection]

Firmware Version 1.0.4.22

Product Name: GWN7610

• Included patch for WPA2 4-way handshake vulnerability [VU#228519]

Firmware Version 1.0.4.20

Product Name: GWN7610

• Added support for Timed Client Disconnect and Enhanced Client Blocking [CLIENTS]
• Added support for Client Bridge [Client Bridge]
• Added support for Syslog server [Syslog]
• Added support for Configurable Web UI access port. [Web HTTPS Port]
• Added support for E-mail notifications [Email]

Firmware Version 1.0.4.12

Product Name: GWN7600 / GWN7600LR

• Added support for Timed Client Disconnect and Enhanced Client Blocking [CLIENTS]
• Added support for Client Bridge [Client Bridge]
• Added support for Syslog server [Syslog]
• Added support for Configurable Web UI access port. [Web HTTPS Port]
• Included patch for WPA2 4-way handshake vulnerability [VU#228519]

Firmware Version 1.0.3.25

Product Name: GWN7600 / GWN7600LR

• No major changes.

Firmware Version 1.0.3.21

Product Name: GWN7610

• No major changes.

Firmware Version 1.0.3.19

Product Name: GWN7610 / GWN7600 / GWN7600LR

• Added support for captive portal [CAPTIVE PORTAL]
• Added support for 802.11k/r/v [Enable Voice Enterprise]
• Added support for failover master [Failover Master]
• Added support for VLAN assignment via RADIUS [SSID][Enable Dynamic VLAN (beta)]
• Added support for Select SSID Band [SSID Band]
• Added support for Exact Radio Power Configuration in dBm [Custom Wireless Power]
• Added support for AP Location [AP Location]
• Added support for Per-Client/Per-SSID bandwidth rules [Bandwidth R]
• Added support for Wi-Fi Schedule [S]
• Added support for LED control [L]
• Added option to enable/disable DHCP option 66 & 43 override [Allow DHCP options 66 and 43 override]

Firmware Version 1.0.2.108

Product Name: GWN7610

• Added Controller protocol security enhancement. [Controller Protocol Security Enhancement]
• Added support for LED control. [LED control]
• Added support for Captive Portal. [CAPTIVE PORTAL]
• Added support for Wi-Fi schedule. [Wi-Fi Schedule]
• Added Client Isolation enhancement. [SSID]
• Added support to store Syslog locally on the unit and display it on Web GUI. [Syslog]

Firmware Version 1.0.2.15

Product Name: GWN7610

• Added New Overview Page.
• Added Web UI enhancement.
• Added support for Password change on first boot.
• Added Country code selection into the setup wizard.

Firmware Version 1.0.1.31

Product Name: GWN7600 / GWN7600LR

• This is the initial version.

Firmware Version 1.0.1.27

Product Name: GWN7610

• This is the initial version.

Certificates

COPYRIGHT

©2024 Grandstream Networks, Inc. https://www.grandstream.com
All rights reserved. Information in this document is subject to change without notice. Reproduction or
transmittal of the entire or any part, in any form or by any means, electronic or print, for any purpose
without the express written permission of Grandstream Networks, Inc. is not permitted.
The latest electronic version of this guide is available for download here:
https://www.grandstream.com/support
Grandstream is a registered trademark and the Grandstream logo is a trademark of Grandstream Networks, Inc. in the United States, Europe, and other countries

CAUTION

Changes or modifications to this product not expressly approved by Grandstream, or the operation of this
product in any way other than as detailed by this guide, could void your manufacturer warranty.

WARNING

Please do not use a different power adapter with devices as it may cause damage to the products and
void the manufacturer’s warranty.

FCC Caution

Any changes or modifications to this unit not expressly approved by the party responsible for compliance could void the user’s authority to operate the equipment.

This device complies with 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference
received, including interference that may cause undesired operation.

Note:

This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
• Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
• Consult the dealer or an experienced radio/TV technician for help.

This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment.
This equipment should be installed and operated with minimum distance 20cm between the radiator&
your body.
This transmitter must not be co-located or operating in conjunction with any other antenna transmitter.

ISEDC Warning

This device complies with Innovation, Science, and Economic Development Canada licence-exempt RSS standard(s). Operation is subject to the following two conditions: 1) this device may not cause interference, and (2) this device must accept any interference, including interference that may cause undesired operation of the device.

Le présent appareil est conforme aux CNR d’Innovation, Sciences et Développement économique Canada applicables aux appareils radio exempts de licence. L’exploitation est autorisée aux deux conditions suivantes: (1) l’appareil ne doit pas produire de brouillage, et (2) l’utilisateur de l’appareil doit accepter tout brouillage radio électrique subi, même si le brouillage est susceptible d’en compromettre le fonctionnement.

ISEDC Warning

This equipment complies with ISEDC radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with minimum distance 20cm between the radiator & your body.
This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter. Cet équipement est conforme aux ISEDC RF limites d’exposition aux radiations dans un environnement non contrôlé. Cet émetteur ne doit pas être situé ou opérant en conjonction avec une autre antenne ou émetteur.

CE Authentication

EU Regulatory Information

The simplified EU declaration of conformity referred to in Article 10(9) shall be provided as follows:
Hereby, [Grandstream Networks, Inc.] declares that the radio equipment type [GWN7610/GWN7600/GWN7600LR] are in compliance with Directive 2014/53/EU.

The full text of the EU declaration of conformity is available at the following internet address:
https://www.grandstream.com

GNU GPL INFORMATION

GWN76xx firmware contains third-party software licensed under the GNU General Public License (GPL).
Grandstream uses software under the specific terms of the GPL. Please see the GNU General Public
License (GPL) for the exact terms and conditions of the license.
Grandstream GNU GPL related source code can be downloaded from Grandstream web site:
https://www.grandstream.com/support/faq/gnu-general-public-license