DrayTek 1062C Ceiling Mount Access Point User Guide

VigoraAP 10622C
802.11ax Ceiling – mount Access Point

QUICK START GUIDE

11ax Ceiling AP
User’s Guide

1062C Ceiling Mount Access Point

Intellectual Property Rights (IPR) Information

Copyrights
© All rights reserved. This publication contains information that is protected by copyright. No part may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language without written permission from the copyright holders.

Trademarks
The following trademarks are used in this document:

• Microsoft is a registered trademark of Microsoft Corp.
• Windows, Windows 10, 11 and Explorer are trademarks of Microsoft Corp.
• Apple and Mac OS are registered trademarks of Apple Inc.
• Other products may be trademarks or registered trademarks of their respective manufacturers.

Safety Instructions and Approval

Safety Instructions

• Read the installation guide thoroughly before you set up the device.
• The device is a complicated electronic unit that may be repaired only be authorized and qualified personnel. Do not try to open or repair the device yourself.
• Do not place the device in a damp or humid place, e.g. a bathroom.
• The device should be used in a sheltered area, within a temperature range of +5 to +40 Celsius.
• Do not expose the device to direct sunlight or other heat sources. The housing and electronic components may be damaged by direct sunlight or heat sources.
• Do not deploy the cable for LAN connection outdoor to prevent electronic shock hazards.
• Do not power off the device when saving configurations or firmware upgrades. It may damage the data in a flash. Please disconnect the Internet connection on the device before powering it off when a TR-069/ ACS server manages the device.
• Keep the package out of reach of children.
• When you want to dispose of the device, please follow local regulations on conservation of the environment.

Warranty
We warrant to the original end user (purchaser) that the device will be free from any defects in workmanship or materials for a period of two (2) years from the date of purchase from the dealer. Please keep your purchase receipt in a safe place as it serves as proof of date of purchase. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, we will, at our discretion, repair or replace the defective products or components, without charge for either parts or labor, to whatever extent we deem necessary tore- store the product to proper operating condition. Any replacement will consist of a new or re-manufactured functionally equivalent product of equal value, and will be offered solely at our discretion. This warranty will not apply if the product is modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working conditions. The warranty does not cover the bundled or licensed software of other vendors. Defects which do not significantly affect the usability of the product will not be covered by the warranty. We reserve the right to revise the manual and online documentation and to make changes from time to time in the contents hereof without obligation to notify any person of such revision or changes.

Be a Registered Owner
Web registration is preferred. You can register your Vigor router via https://myvigor.draytek.com.

Firmware & Tools **Updates**
Due to the continuous evolution of DrayTek technology, all devices will be regularly upgraded. Please consult the DrayTek web site for more information on newest firmware, tools and documents. https://www.draytek.com

Chapter I Installation

I-1 Introduction
This is a generic International version of the user guide. Specification, compatibility and features vary by region. For specific user guides suitable for your region or product, please contact local distributor.
Thank you for purchasing this VigorAP 1062C!
VigorAP 1062C can operate in standalone mode for your office network or a classroom; connected to your LAN and offering you wireless access.
It makes high density with quality-performance be feasible for users as it is going to be implemented with DrayTek VigorACS supports configuration, firmware upgrade, status, and monitoring.
The Power of Ethernet (PoE) on VigorAP 1062C relieves the installation of the power plug. The massive deployment of VigorAP 1062C for hospitalities and school environment will be much easier.
With the optimized antennas built-in, DrayTek VigorAP 1062C ceiling-mount wireless access point is ideal for hospitalities, small offices, and small campus.
Easy install procedures allows any computer users to setup a network environment in very short time – within minutes, even inexperienced users. Just follow the instructions given in this user manual, you can complete the setup procedure and release the power of this access point all by yourself!

I-1-1 LED Indicators and Connectors
Before you use the VigorAP, please get acquainted with the LED indicators and connectors first.

Supports PoE power & Gigabit (2.5G).
Power Jack (DC IN)| Connecter for a power adapter.
Hole| Explanation
Factory Reset| Restores the unit back to factory default settings.
To use, insert a small item such as an unbent paperclip into the hole. You will feel the button inside depress gently. Hold it for 5 seconds.
The VigorAP will restart with the factory default configuration and the LED will blink green.

I-2 Hardware Installation

This section will guide you through installing the VigorAP.
VigorAP can be installed under certain locations: wooden ceiling, plasterboard ceilings, light-weighted steel frame and wall.

Note:
For the sake of personal safety, only trained and qualified personnel should install this access point.

I-2-1 Ceiling-mount Installation (Wooden Ceiling)
i. Place the bracket under the wooden ceiling and fasten four screws firmly.
ii. When the bracket is in place, fasten two screws firmly on the bottom of VigorAP.
iii. Secure the access point firmly in place using the included screw as shown in step iii.

I-2-2 Ceiling-mount Installation (Plasterboard Ceiling)
i. Drill four holes in your ceiling using the ceiling mount bracket as a guide, and insert the four included wall plugs/screw anchors (i).
ii. Align the ceiling mount bracket with your wall plugs/screw anchors and use the four screws to fix it into place (ii).
iii. When the bracket is in place, fasten two screws firmly on the bottom of VigorAP.
iv. Secure the access point firmly in place using the included screw as shown in step iv.

I-2-3 Suspended Ceiling (Lightweight Steel Frame) Installation
You cannot screw into ceiling tiles as they are weak and not suitable for bearing loads. Your VigorAP is supplied with mounts (T-Rail brackets) which attach directly to the metal grid (‘T-Rail’) of your suspended ceiling.
i. Choose the correct size T-Rail bracket from the bundled package.
ii. Put the T-Rail brackets on the holes of the bottom side of the device. Fasten them with suitable screws.
iii. Secure the access point firmly in place using the included screw as shown in step iii.
iv. Clip the access point onto your T-Rail using the now attached T-Rail bracket.

v. If a larger gap is required between the ceiling and the VigorAP, use the extension pieces to extend the height of the brackets.

vi. Attach the T-Rail brackets to the ceiling frame.

I-2-4 Notifications for Hardware Connection

• Connect VigorAP to Vigor router (via LAN port) with Ethernet cable.
• Connect VigorAP to the PoE switch (via LAN port) with an Ethernet cable for getting the power from the switch directly. While connecting with a PoE switch, the power adapter is not necessary but optional.

I-3 Network IP Configuration
After the network connection is built, the next step you should do is setup VigorAP 1062C with proper network parameters, so it can work properly in your network environment.
Before you can connect to the access point and start configuration procedures, your computer must be able to get an IP address in the same subnet as this AP. If it’s not connected to the same DHCP Server with the AP or you’re unsure, please follow the following instructions to configure your computer to use the static IP address in the same subnet as default IP address of this AP.
For the default IP address of this AP is set “192.168.1.2”, we recommend you to use “192.168.1.X (except 2)” in the field of IP address on this section for your computer.
If the operating system of your computer is…
Windows 10 – please go to section I-3-1

I-3-1 Windows 10 IP Address Setup
Click the Start button (it should be located at lower-left corner of your computer), then click the Settings icon.

Next, click Change adapter options.

Then, select Internet Protocol Version 4 (TCP/IPv4) and click Properties.

Under the General tab, click Use the following IP address. Then input the following settings in respective field and click OK when finish.
IP address: 192.168.1.9
Subnet Mask: 255.255.255.0

I-4 Accessing to Web User Interface
All functions and settings of this access point must be configured via web user interface. Please start your web browser (e.g., Firefox).

1. Make sure your PC connects to the VigorAP 1062C correctly.

2. Open a web browser on your PC and type http://192.168.1.2. A pop-up window will open to ask for username and password. Please type “admin/admin” on Username/Password and click OK. Note:
   You may either simply set up your computer to get IP dynamically from the router or set up the IP address of the computer to be in the same subnet as the IP address of VigorAP 1062C.
    If there is no DHCP server on the network, then VigorAP 1062C will have an IP address of 192.168.1.2.
    If there is DHCP available on the network, then VigorAP 1062C will receive it’s IP address via the DHCP server.

3.  Now, the Main Screen will appear.

4. The web page can be logged out by clicking Log Out on the top right of the web page. Or, logout the web user interface according to the chosen condition. The default setting is Auto Logout, which means the web configuration system will logout after 5 minutes without any operation. Change the setting of auto logout if you want.

Note:
If you fail to access the web configuration, please go to the section “Trouble Shooting” for detecting and solving your problem.
For using the device properly, it is necessary for you to change the password of web configuration for security and adjust primary basic settings.

I-5 Changing Password

1. Please change the password for the original security of the VigorAP.

2. Go to System Maintenance page and choose Account & Permission. Click Edit to open the modification page.

3. Enter the new login password on the fields of New Password and Confirm New Password.
   Then click Apply to continue.

4. Now, the password has been changed. Next time, use the new password to access the Web User Interface for this VigorAP.

I-6 Dashboard
Dashboard shows port status, LAN status, LAN usage, system status, and wireless overview information.
Click Dashboard from the main menu on the left side of the main page.

I-7 Two-factor Authentication
If network security is highly concerned, two-factor authentication will be strongly recommended.
For using two-factor authentication for accessing VigorAP;

1. Get and install Google Authenticator (iOS/Android) first.
2. Login VigorAP by using the user account and password.
3. Select Two-factor Authentication.
4. On the following page, switch the toggle of Enable to enable the function.
5. Use your cell phone to scan the QR-Code shown on the page. A key will be created randomly on the cell phone. Enter that key on the box of Verification Code and click the Apply button.
6. Logout VigorAP.
7. Re-login VigorAP. The first login web page requires you to enter the original user account and password. After clicking the Login button, the second login web page appears. Please enter the authentication code (created randomly) obtained from the APP (Google Authenticator) on your cell phone and click the Verify button.

Chapter II Connectivity

II-1 Operation Mode
This page provides several available modes for you to choose for different conditions. Click any one of them and click OK. The system will configure the required settings automatically.

Available settings are explained as follows:

data with the devices connected to the wired network.

Click the AP Mode radio button.

Then, click Next to configure advanced settings.
Step 1: Set the System Time.

Available settings are explained as follows:

Automatically with Time Server Manually
Time Zone| Use the drop-down list to choose the time zone.
Time Server| Displays the URL of the time server.
Interface| Select Auto. The system will specify the interface automatically.
Daylight Saving| Click to enable/disable the function of daylight saving.
Date| Use the drop-down calendar to set the date.
Time| Use the drop-down list to set the hour, minute, and second for the time setting.
Synchronize with Browser| Sync now – Click to sync the time setting with the browser.
Cancel| Click to discard the modification and return to the previous page.
Next| Click to access the next page.

Step 2: Configure the settings for Internet connection.

Click Edit to modify the advanced settings.

Available settings are explained as follows:

Change it if required.
Enabled| Switch the toggle to enable or disable this entry.
Security| Select one of the security modes (with the priority from lower to higher).
Password| Enter 8~63 ASCII characters, such as “012345678”. This feature is available for WPA Personal or WPA2 Personal or WPA2 / WPA
Personal mode, WPA3 Personal or WPA3/WPA2 Personal.
VLAN| Select one VLAN group used for this SSID.
Scheduled On| Always or any other schedule profile.
Always – This WLAN profile will be active all the time.
Or, use the drop-down list to select a preset schedule profile.
Before choosing, please go to Configuration>>Object to create schedule profiles (at least one).
SSID Band|
2.4GHz/5GHz| Select 2.4GHz or 5GHz band or both bands.
SSID Settings|
MAC Filtering List| Disabled – Disable the function of using MAC Filtering List.
Or, use the drop-down list to select a preset profile.
Before choosing, please go to Security>>MAC Filtering to create MAC filtering profiles (at least one).
Isolate Client from
Wireless LAN| Switch the toggle to enable/disable the function. If enabled, it can make the wireless clients (stations) with the same SSID not access each other.
Hide SSID| Switch the toggle to enable/disable the function. If enabled, it can prevent wireless sniffing and make it harder for unauthorized clients or
STAs to join your wireless LAN. Depending on the wireless utility, the user may only see the information except for SSID or just cannot see
anything about VigorAP while site surveying. The system allows you to set four sets of SSID for different usage.
WPA Settings|
Key Renewal Interval| WPA uses a shared key for authentication to the network. However, normal network operations use a different encryption key that is
randomly generated. This randomly generated key is periodically replaced. Enter the renewal security time (seconds) in the column.
Smaller interval leads to greater security but lower performance. Default is 3600 seconds. Set 0 to disable re-key. Such feature is available
for WPA3 Enterprise, WPA2 Enterprise, WPA Enterprise, WPA3 Personal, WPA2 Personal, WPA Personal, WPA3/WPA2 Enterprise, WPA2/WPA Enterprise, WPA3/WPA2 Personal, or WPA2/WPA Personal mode.
Cancel| Click to discard the modification and return to the previous page.
Apply| Click to save the modification and return to the previous page.

Click Update Editing to return to the previous page. Then, click Next.

Step 3: Configure the LAN settings.

Available settings are explained as follows:

network.
DHCP – DHCP stands for Dynamic Host Configuration Protocol. DHCP server can automatically dispatch related IP settings to any local user configured as a DHCP client.
Static IP

When DHCP is selected

Primary DNS Server| You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server. If your ISP does not provide it, the device will automatically apply default DNS Server IP address: 194.109.6.66 to this field.
---|---
Secondary DNS Server| You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server. If your ISP does not provide it, the device will automatically apply default secondary DNS Server IP address: 194.98.0.1 to this field.
Management VLAN| VigorAP 1062C supports tag-based VLAN for wireless clients accessing Vigor device. Only the clients with the specified VLAN ID can access into VigorAP 1062C.
Select a number as VLAN ID tagged on the transmitted packet. “None” means no VALN tag.

When Static IP is selected

IP Address| Enter a private IP address for connecting to a local private network
(Default: 192.168.1.2).
---|---
Subnet Mask|  Enter an address code that determines the size of the network.
(Default: 255.255.255.0/ 24)
Default Gateway| Enter a value of the gateway IP address for the DHCP server.
---|---
Primary DNS Server| You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server. If your ISP does not provide it, the device will automatically apply default DNS Server IP address: 194.109.6.66 to this field.
Secondary DNS Server| You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server. If your ISP does not provide it, the device will automatically apply default secondary DNS Server IP address: 194.98.0.1 to this field.
Management VLAN| VigorAP 1062C supports tag-based VLAN for wireless clients accessing Vigor device. Only the clients with the specified VLAN ID can access into VigorAP 1062C.
Select a number as VLAN ID tagged on the transmitted packet. “None” means no VALN tag.

DHCP Server Configuration – Available when Static IP is selected

DHCP Server| On – Lets the device assign IP address to every host in the LAN.
Off – Lets you manually or use other DHCP server to assign IP address to every host in the LAN.
Relay – Specify which subnet that DHCP server is located the relay agent should redirect the DHCP request to.
---|---
Start IP Address| It is available when On is selected as the DHCP Server.
Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses. If the 1st IP address of your device is 192.168.1.2, the starting IP address must be 192.168.1.3 or greater, but smaller than 192.168.1.254.
IP Pool Counts| It is available when On is selected as the DHCP Server.
Enter a value of the IP address pool for the DHCP server to end with when issuing IP addresses.
Gateway IP Address| It is available when On is selected as the DHCP Server. Enter a value of the gateway IP address for the DHCP server.
Lease Time| It is available when On is selected as the DHCP Server. It allows you to set the leased time for the specified PC.
Primary DNS| It is available when On is selected as the DHCP Server.
You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server. If your ISP does not provide it, the device will automatically apply default DNS Server IP address: 194.109.6.66 to this field.
Secondary DNS| It is available when On is selected as the DHCP Server.
You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server. If your ISP does not provide it, the device will automatically apply default DNS Server IP address: 194.109.6.66 to this field.
DHCP Server IP Address| It is available when Relay is selected as the DHCP Server. Enter an IP address of the DHCP server.
Back| Return to the previous page.
Cancel| Click to discard the modification and return to the Step 1 page.
Next| Click to access the next page.

Step 4: After finishing the configuration, click Apply & Reboot. 

II-2 Configuration
II-2-1 Physical Interface
Configure the general settings for LAN interface. Open Configuration >> Physical Interface.

Available settings are explained as follows:

Port speed capabilities:
Auto negotiation: Auto speed with all capabilities.
Selecting Auto (auto-negotiation) allows one port to negotiate with a peer port automatically to obtain the connection speed and duplex mode that both ends support. When auto-negotiation is turned on, a port on the switch negotiates with the peer automatically to determine the connection speed and duplex mode. If the peer port does not support auto-negotiation or turns off this feature, the switch determines the connection speed by detecting the signal on the cable and using half duplex mode. When the switch’s auto- negotiation is turned off, a port
uses the pre-configured speed and duplex mode when making a connection, thus requiring you to make sure that the settings of the peer port are the same in order to connect.
Cancel| Click to discard the modification
Apply| Click to save the settings.

Note:
Switch these two icons by click the mouse cursor on them.
– means “Enable”.
– means “Disable”.

II-2-2 LAN
Local Area Network (LAN) is a group of subnets regulated and ruled by the device.
II-2-2-1 LAN Networks
Open Configuration>>LAN and select the LAN Networks tab to open the following page. II-2-2 LAN
Available settings are explained as follows:

LAN Network Configuration
LAN Network
Configuration| Select the connection type for the LAN network.
DHCP – DHCP stands for Dynamic Host Configuration Protocol. DHCP server can automatically dispatch related IP settings to any local user configured as a DHCP client. Static IP
When DHCP is selected
Primary DNS Server| You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server. If your ISP does not provide it, the device will automatically apply default DNS Server IP address: 194.109.6.66 to this field.
Secondary DNS Server| You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server. If your ISP does not provide it, the device will automatically apply default secondary DNS Server IP address: 194.98.0.1 to this field.
Management VLAN| VigorAP 1062C supports tag-based VLAN for wireless clients accessing Vigor device. Only the clients with the specified VLAN ID can access into VigorAP 1062C.
Select a number as VLAN ID tagged on the transmitted packet. “None” means no VALN tag.
When Static IP is selected
IP Address| Enter a private IP address for connecting to a local private network (Default: 192.168.1.2).
Subnet Mask| Enter an address code that determines the size of the network. (Default: 255.255.255.0/ 24)
Default Gateway| Enter a value of the gateway IP address for the DHCP server.
Primary DNS Server| You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server. If your ISP does not provide it, the device will automatically apply default DNS Server IP address: 194.109.6.66 to this field.
Secondary DNS Server| You can specify secondary DNS server IP address here because your ISP often provides you more than one DNS Server. If your ISP does not provide it, the device will automatically apply default secondary DNS Server IP address: 194.98.0.1 to this field.
Management VLAN| VigorAP 1062C supports tag-based VLAN for wireless clients accessing Vigor device. Only the clients with the specified VLAN ID can access into VigorAP 1062C.
Select a number as VLAN ID tagged on the transmitted packet. “None” means no VALN tag.
DHCP Server Configuration – Available when Static IP is selected
DHCP Server| On – Lets the device assign IP address to every host in the LAN.
Off – Lets you manually or use other DHCP server to assign IP address to every host in the LAN.
Relay – Specify which subnet that DHCP server is located the relay agent should redirect the DHCP request to.
Start IP Address| It is available when On is selected as the DHCP Server.
Enter a value of the IP address pool for the DHCP server to start with when issuing IP addresses. If the 1st IP address of your device is 192.168.1.2, the starting IP address must be 192.168.1.3 or greater, but smaller than 192.168.1.254.
IP Pool Counts| It is available when On is selected as the DHCP Server.
Enter a value of the IP address pool for the DHCP server to end with when issuing IP addresses.
Gateway IP Address| It is available when On is selected as the DHCP Server.
Enter a value of the gateway IP address for the DHCP server.
Lease Time| It is available when On is selected as the DHCP Server.
It allows you to set the leased time for the specified PC.
Primary DNS| It is available when On is selected as the DHCP Server.
You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server. If your ISP does not provide it, the device will automatically apply default DNS Server IP address: 194.109.6.66 to this field.
Secondary DNS| It is available when On is selected as the DHCP Server.
You must specify a DNS server IP address here because your ISP should provide you with usually more than one DNS Server. If your ISP does not provide it, the device will automatically apply default DNS Server IP address: 194.109.6.66 to this field.
DHCP Server IP Address| It is available when Relay is selected as the DHCP Server.
Cancel| Click to discard the modification and return to the previous page.
Apply| Click to save the settings.

II-2-2-2 Bind IP to MAC
This function is used to bind the IP and MAC address in LAN to have a strengthening control in network.
With the Bind IP to MAC feature you can reserve LAN IP addresses for LAN clients. Each reserved IP address is associated with a Media Access Control (MAC) address.

Available settings are explained as follows:

Delete – Click to delete the selected entry.

To modify an existing profile, select a file and click Edit.

To add a new profile, click the +Add link to get the following page.

Available settings are explained as follows:

Address pair.
MAC Address| Use the drop-down menu to select a MAC address
IP Address| Use the drop-down menu to select an IP address .
Cancel| Discard the settings and return to the previous page.
Apply| Click it to save the settings and return to the previous page.

II-2-2-3 DHCP Options
DHCP packets can be processed by adding option number and data information when such function is enabled and configured.
This page allows you to configure additional DHCP client options.

Available settings are explained as follows:

Delete – Click to delete the selected entry.

To modify an existing profile, select a file and click Edit.

To add a new profile, click the +Add link to get the following page.

Available settings are explained as follows:

to be stored. Type of data in the Data field:
ASCII Character – A text string. Example: /path.
Hexadecimal Digit – A hexadecimal string. Valid characters are from 0 to 9 and from a to f. Example: 2f70617468.
Address List – One or more IPv4 addresses, delimited by commas.
Data| Enter the content of the data to be processed by the function of DHCP option.
Cancel| Discard the settings and return to the previous page.
Apply| Click it to save the settings and return to the previous page..

II-2-2-4 VLAN List
Virtual Local Area Networks (VLANs) allow you to subdivide your LAN to facilitate management or to improve network security.

Available settings are explained as follows:

Delete – Click to delete the selected entry.

To modify an existing profile, select a file and click Edit.

To add a new profile, click the +Add link to get the following page.

Available settings are explained as follows:

II-2-2-5 Interface VLAN
This page allows you to configure the LAN port settings to assure the VLAN profile can work normally.

Available settings are explained as follows:

VLANs.
Access – Transmits the data to and from a specific VLAN.
An access port is only assigned to a single VLAN, it sends and receives frames that aren’t tagged and only have the access VLAN value.
Untagged VLAN| Use the drop-down list to select a VLAN ID as the untagged VLAN.
The connected host sends its traffic without any VLAN tag on the frames. However, when the frame reaches this interface (LAN port), It will be added with the VLAN tag.
Tagged VLAN| Select to enable 802.1Q tagging on this VLAN. The device will add specific VLAN number to all packets on the LAN while sending them out.
All VLANs – All VLAN will be tagged.
Select VLANs – Only the selected VLAN will be tagged.
Cancel| Discard the settings and return to the previous page.
Apply| Save and apply the settings.

II-2-3 Wireless LAN

VigorAP 1062C is a highly integrated wireless local area network (WLAN) for 2.4/5 GHz 802.11b/g/n/ax WLAN applications. It supports channel operations of 20/40 MHz at 2.4 GHz and 20/40/80/160 MHz at 5 GHz. VigorAP 1062C can support data rates up to 2.4 Gbps/4.8Gbps in 802.11ax 80/160 MHz bandwidth.

Note:

• The actual data throughput will vary according to the network conditions and environmental factors, including volume of network traffic, network overhead and building materials.

VigorAP 1062C plays a role as an Access Point (AP) connecting to lots of wireless clients or Stations (STA). All the STAs will share the same Internet connection via VigorAP 1062C.

Security Overview
WEP (Wired Equivalent Privacy) is a legacy method to encrypt each frame transmitted via radio using either a 64-bit or 128-bit key. Usually access point will preset a set of four keys and it will communicate with each station using only one out of the four keys.
WPA (Wi-Fi Protected Access), the most dominating security mechanism in industry, is separated into two categories: WPA-personal or called WPA Pre- Share Key (WPA/PSK), and WPA-Enterprise or called WPA/802.1x.
In WPA-Personal, a pre-defined key is used for encryption during data transmission. WPA applies Temporal Key Integrity Protocol (TKIP) for data encryption while WPA2 applies AES. The WPA-Enterprise combines not only encryption but also authentication.
Since WEP has been proved vulnerable, you may consider using WPA for the most secure connection.
You should select the appropriate security mechanism according to your needs. No matter which security suite you select, they all will enhance the over-the- air data protection and /or privacy on your wireless network. The VigorAP 1062C is very flexible and can support multiple secure connections with both WEP and WPA at the same time.

WPS Introduction
WPS (Wi-Fi Protected Setup) provides easy procedure to make network connection between wireless station and wireless access point (VigorAP 1062C) with the encryption of WPA and WPA2.

It is the simplest way to build connection between wireless network clients and VigorAP 1062C. Users do not need to select any encryption mode and type any long encryption passphrase to setup a wireless client every time. He/she only needs to press a button on wireless client, and WPS will connect for client and VigorAP 1062C automatically.

Note:
This function is available for the wireless station with WPS supported.

There are two methods to do network connection through WPS between AP and Stations: pressing the Start PBC button or using PIN Code.
On the side of VigorAP 1062C series which served as an AP, click Start PBC on web configuration interface. On the side of a station with network card installed, press Start PBC button of network card.
If you want to use PIN code, you have to know the PIN code specified in wireless client. Then provide the PIN code of the wireless client you wish to connect to the VigorAP 1062C.

Band Steering
Band Steering detects if the wireless clients are capable of 5GHz operation, and steers them to that frequency. It helps to leave 2.4GHz band available for legacy clients and improves users’ experience by reducing channel utilization.

If dual-band is detected, the AP will let the wireless client connect to less congested wireless LAN, such as 5GHz to prevent network congestion.

Note:
To make Band Steering work successfully, SSID and security on 2.4GHz also MUST be broadcasted on 5GHz.

Airtime Fairness
Airtime fairness is essential in wireless networks that must support critical enterprise applications.
Most of the applications are either symmetric or require more downlink than uplink capacity; telephony and email send the same amount of data in each direction, while video streaming and web surfing involve more traffic sent from access points to clients than the other way around. This is essential for ensuring predictable performance and quality-of-service, as well as allowing 802.11n and legacy clients to coexist on the same network. Without airtime fairness, offices using mixed-mode networks risk having legacy clients slow down the entire network or letting the fastest client(s) crowd out other users.
With airtime fairness, every client at a given quality-of-service level has equal access to the network’s airtime.
The wireless channel can be accessed by only one wireless station at the same time.
The principle behind the IEEE802.11 channel access mechanisms is that each station has an equal probability to access the channel. When wireless stations have similar data rates, this principle leads to a fair result. In this case, stations get a similar channel access time which is called airtime.
However, when stations have various data rates (e.g., 11g, 11n), the result is not fair. The slow stations (11g) work in their slow data rate and occupy too much airtime, whereas the fast stations (11n) become much slower.
Take the following figure as an example, both Station A(11g) and Station B(11n) transmit data packets through VigorAP. Although they have an equal probability to access the wireless channel, Station B(11n) gets only a little airtime and waits too much because Station A(11g) spends a longer time to send one packet. In other words, Station B(fast rate) is obstructed by Station A(slow rate).

To improve this problem, Airtime Fairness is added for VigorAP. Airtime Fairness function tries to assign similar airtime to each station (A/B) by controlling TX traffic. In the following figure, Station B(11n) has a higher probability to send data packets than Station A(11g). In this way, Station B(fast rate) gets fair airtime and its speed is not limited by Station A(slow rate).

It is similar to the automatic Bandwidth Limit. The dynamic bandwidth limit of each station depends on the instant active station number and airtime assignment. Please note that Airtime Fairness of 2.4GHz and 5GHz are independent. But stations of different SSIDs function together because they all use the same wireless channel. IN SPECIFIC ENVIRONMENTS, this function can reduce the bad influence of slow wireless devices and improve the overall wireless performance.

Suitable environment:

1. Many wireless stations.
2. All stations mainly use download traffic.
3. The performance bottleneck is the wireless connection.

Note:
Airtime Fairness function and Bandwidth Limit function should be mutually exclusive. So their webs have extra actions to ensure these two functions are not enabled simultaneously.

II-2-3-1 SSID
By clicking the SSID tab, a web page will appear so that you could set the SSID, the security mode, and the password.

Available settings are explained as follows:

If required, use the drop-down list to select another mode.
Password| Displays the password used by this entry.
2.4GHz| Switch the toggle to enable or disable this entry.
If enabled, this entry will be applied to 2.4GHz wireless network.
5GHz| Switch the toggle to enable or disable this entry.
If enabled, this entry will be applied to 5GHz wireless network.
Option| Edit – Click to modify the selected profile.
Delete – Click the selected entry. The default SSID can not be deleted.
Cancel| Discard the settings and return to the previous page.
Apply| Save and apply the settings.

To edit an existing SSID, click the Edit link to get to the following page.

Available settings are explained as follows:

shows the modes with higher security;
WPA3 Personal, WPA3/WPA2 Personal, WPA2 Personal, WPA2/WPA Personal – Accepts only WPA clients and the encryption key should be entered in PSK. The WPA encrypts each frame transmitted from the radio using the key, which either PSK (Pre-Shared Key) entered manually in this field below or automatically negotiated via 802.1x authentication.
The WPA encrypts each frame transmitted from the radio using the key, which either PSK (Pre-Shared Key) entered manually in this field below or automatically negotiated via 802.1x authentication. Select WPA, WPA2, or Auto as WPA mode.
WPA3 Enterprise, WPA2 Enterprise, WPA2/WPA Enterprise
– The WPA encrypts each frame transmitted from the radio using the key, which either PSK (Pre-Shared Key) entered manually in this field below or automatically negotiated via 802.1x authentication.
OWE – WPA3 also introduces a new open and secure connection mode; “Opportunistic Wireless Encryption” (OWE). It allows the clients to connect without a password, ideal for hotspot networks, but the connection between each individual client is uniquely encrypted behind the scenes.
Below shows the modes with basic security;
WPA Personal – Accepts only WPA clients and the encryption key should be entered in PSK. The WPA encrypts each frame transmitted from the radio using the key, which either PSK
(Pre-Shared Key) entered manually in this field below or automatically negotiated via 802.1x authentication.
WPA Enterprise – The WPA encrypts each frame transmitted from the radio using the key, which either PSK (Pre-Shared Key) entered manually in this field below or automatically negotiated via 802.1x authentication.
WEP Personal – Accepts only WEP clients and the encryption key should be entered in WEP
None – The encryption mechanism is turned off.
Password| Enter 8~63 ASCII characters, such as “012345678”. This feature is available for WPA Personal or WPA2 Personal or WPA2 / WPA Personal mode, WPA3 Personal or WPA3/WPA2 Personal.
---|---
RADIUS Server| This feature is available for WPA3 Enterprise, WPA2 Enterprise, WPA2/WPA Enterprise, and WPA Enterprise mode.
Use the drop-down list to select a RADIUS server setting.
Note : Before configuring the RADIUS server, go to **Configuration

RADIUS to create external RADIUS profiles (at least one) first.
VLAN| Select VLAN ID # for this SSID. Packets transferred from this SSID to LAN will be tagged with the number.
If your network uses VLANs, you can assign the SSID to a VLAN on your network. Client devices that associate using the SSID are grouped into this VLAN. The VLAN ID range is from 3 to 4095. The VLAN ID is None by default, it means disabling the VLAN function for the SSID.
Scheduled On| Select Always or any other schedule profile.
Always – This WLAN profile will be active all the time.
Or, use the drop-down list to select a preset schedule profile.
Before choosing, please go to Configuration >>Object **to create schedule profiles (at least one).

SSID Band

2.4GHz/5GHz| Select 2.4GHz and/or 5GHz for applying to this wireless LAN setting.
---|---

SSID Settings

MAC Filtering List| Disabled – Disable the function of using MAC Filtering List. Or, use the drop-down list to select a preset profile.
Before choosing, please go to Security >>MAC Filtering to create MAC filtering profiles (at least one).
---|---
Isolate Client from Wireless LAN| Switch the toggle to enable or disable the function.
Makes the wireless clients (stations) with the same SSID not access for each other.
Hide SSID| Switch the toggle to enable or disable the function.
Prevents from wireless sniffing and make it harder for unauthorized clients or STAs to join your wireless LAN. Depending on the wireless utility, the user may only see the information except SSID or just cannot see any thing about VigorAP 1062C while site surveying. The system allows you to set four sets of SSID for different usage.

WPA Settings

WPA Algorithm| This feature is available for WPA2 Personal, WPA2/WPA Personal, WPA2 Enterprise, WPA2/WPA Enterprise, WPA Personal, or WPA Enterprise mode.
Select TKIP, AES, or TKIP/AES as the algorithm for WPA.
---|---
Key Renewal Interval| WPA uses a shared key for authentication to the network. However, normal network operations use a different encryption key that is randomly generated. This randomly generated key is periodically replaced. Enter the renewal security time (seconds) in the column. Smaller interval leads to greater security but lower performance. Default is 3600 seconds. Set 0 to disable re-key. This feature is available for WPA3 Personal, WPA3/WPA2 Personal, WPA2 Personal, WPA2/WPA Personal, WPA3 Enterprise, WPA2 Enterprise, WPA2/WPA Enterprise, WPA Personal, WPA Enterprise mode.

WEP Settings

Default Key| This feature is available for WEP Personal mode.
Four keys can be entered here, but only one key can be selected at a time. The format of WEP Key is restricted to 5 ASCII characters or 10 hexadecimal values in 64-bit encryption level, or restricted to 13 ASCII characters or 26 hexadecimal values in 128-bit encryption level. The allowed content is the ASCII characters from 33(!) to 126(~) except ‘#’ and ‘,’.
---|---
Key # Type| Hex/ASCII – The format of WEP Key is restricted to 5 ASCII characters or 10 hexadecimal values in 64-bit encryption level, or restricted to 13 ASCII characters or 26 hexadecimal values in 128-bit encryption level. The allowed content is the ASCII characters from 33(!) to 126(~) except ‘#’ and ‘,’. This feature is available for WEP Personal mode.
Key #| Enter 5 ASCII characters or 10 hexadecimal values in 64-bit encryption level, or 13 ASCII characters or 26 hexadecimal values in 128-bit encryption level. This feature is available for WEP Personal mode.
Cancel| Discard the settings and return to the previous page.
Update Editing| Save and apply the settings.

Click Update Editing to save the settings and return to the previous page.

II-2-3-2 Radio Settings
This page is to determine the wireless radio setting, like channel, physical mode, channel bandwidth, transmit power and etc.

Available settings are explained as follows:

Mixed(11b+11g), Mixed (11g+11n), Mixed (11b+11g+11n) and Mixed (11b+11g+11n+11ax) stations simultaneously. Simply choose Mixed (11b+11g+11n+11ax) mode.
Transmit Power| The default setting is the maximum (100%). Lowering down the value may degrade the range and throughput of wireless.
Channel| Means the channel of frequency of the wireless LAN. You may switch the channel if the selected channel is under serious interference. If you have
no idea of choosing the frequency, please select Auto Select to let the system determine for you.
Channel Bandwidth| Auto 20/40 MHz–The AP will scan for nearby wireless AP, and then use 20MHz if the number of AP is more than 10, or use 40MHz if it’s not.
20 MHz- The device will use 20MHz for data transmission and receiving between the AP and the stations.
40 MHz- The device will use 40MHz for data transmission and receiving between the AP and the stations.
Current Channel| Displays current channel number.
Current Extension Channel| Displays current extension channel.
Update Channel| Scan and Update – Click to select the best channel again when Auto Select is selected as the Channel setting.
Updated Channel
Result| Displays the best channel after pressing the Scan and Update button.
5GHz Radio|
Enabled| Switch the toggle to enable or disable the function.
Mode| At present, VigorAP can connect to 11a only, 11n only (5G), Mixed (11a+11n), Mixed (11a+11n+11ac), and Mixed (11a+11n+11ac+11ax) stations simultaneously. Simply choose Mixed (11b+11g+11n+11ax) mode.
Transmit Power| The default setting is the maximum (100%). Lowering down the value may degrade the range and throughput of wireless.
Channel| Means the channel of frequency of the wireless LAN. You may switch the channel if the selected channel is under serious interference. If you have
no idea of choosing the frequency, please select Auto Select to let the system determine for you.
Channel Bandwidth| 20 MHz- The device will use 20MHz for data transmission and receiving between the AP and the stations.
40 MHz- The device will use 40MHz for data transmission and receiving between the AP and the stations. It is for wireless LAN 2.4GHz only.
80 MHz- The device will use 80MHz for data transmission and receiving between the AP and the stations.
160 MHz- The device will use 160MHz for data transmission and receiving between the AP and the stations.
Current Channel| Displays current channel number.
Update Channel| Scan and Update – Click to scan current channel used.
Updated Channel Result| Displays current channel used.
Band Steering Settings
5Ghz Client Minimum RSSI| If it is enabled, VigorAP will detect if the wireless client is capable of dual-band or not within the time limit.
The wireless station has the capability of a 5GHz network connection, yet the signal performance might not be satisfied. Therefore, when the signal strength is below the value set here while the wireless station connecting to VigorAP, VigorAP will allow the client to connect to the 2.4GHz network.
Below shows more settings if the Advance Mode is ON
Antenna| Configure the number of antenna for transmission and reception.
Fragment Length| Sets the Fragment threshold of wireless radio. Do not modify the default value if you don’t know what it is. The default value is 2346.
RTS Threshold| Minimize the collision (unit is bytes) between hidden stations to improve wireless performance.
Set the RTS threshold of wireless radio. Do not modify the default value if you don’t know what it is. The default value is 2347.
Country Code| VigorAP broadcasts country codes by following the 802.11d standard.
However, some wireless stations will detect/scan the country code to prevent conflict occurred. If conflict is detected, the wireless station will  be warned and is unable to make a network connection. Therefore, changing the country code to ensure a successful network connection will be necessary for some clients.
WMM Capable| To apply WMM parameters for wireless data transmission, switch the toggle to enable the function.
APSD Capable| APSD (Automatic Power-Save Delivery) is an enhancement over the power-saving mechanisms supported by Wi-Fi networks. It allows access
points to buffer traffic before transmitting it to wireless devices, thus allowing wireless devices to enter into power saving mode which reduces power consumption. Not all wireless clients support APSD properly, and the only way to find out if APSD is appropriate for your network is to experiment.
Airtime Fairness| Try to assign similar airtime to each wireless station by controlling TX traffic. Switch the toggle to enable the function.
Cancel| Discard the settings and return to the previous page.
Apply| Click it to save and apply the settings.

II-2-3-3 Roaming
The network signal for a single wireless access point might be limited by its coverage range. Therefore, if you want to expand the wireless network in a large exhibition with a quick method, you can install multiple access points with enabling the Roaming feature for each AP to reach the purpose of expanding wireless signals seamlessly.
These access points connecting for each other shall be verified by pre- authentication. This page allows you to enable the roaming feature and the pre-authentication.

Available settings are explained as follows:

protocol(also known as Fast Basic Service Set (BSS) Transition. If enabled, the access point will improve the roaming experience for the wireless clients.
802.11r Mode| Over the DS – Transmit the handshake messages between the client and the new AP using the distribution system. In response to signal strength change, the client can communicate with the other AP through the original AP with Action Frames (FT Request and FT Response).  Over the Air – Transmits the messages directly over the wireless network. In response to the needs of signal strength change, the client can communicate directly with the other AP using a fast roaming authentication algorithm (without requiring reauthentication at every AP).
Note that both APs must ping each other via DS (Distribution System) / WDS.
Enabled 802.11k| Switch the toggle to enable the 802.11k protocol (also know as Radio Resource Management (RRM)). If enabled, the access point will optimize the performance of wireless networks.
Pre-Authentication for 802.1x| Enables a station to authenticate to multiple APs for roaming securer and faster. With the pre-authentication procedure defined in IEEE 802.11i specification, the pre-four-way-handshake can reduce handoff delay perceivable by a mobile node. It makes roaming faster and more secure. (Only valid in WPA2) Switch the toggle to enable/disable 802.11x Pre- Authentication.
Enable – Enable IEEE 802.1X Pre-Authentication.
Disable – Disable IEEE 802.1X Pre-Authentication.
Cache Period| Set the expire time of WPA2 PMK (Pairwise master key) cache. PMK Cache manages the list from the BSSIDs in the associated SSID with which it has pre-authenticated. Such feature is available for WPA2 Enterprise mode.
Assisted Client Roaming
Assisted Roaming by Signal Strength| When the link rate of wireless station is too low or the signal received by the wireless station is too worse, VigorAP 1062C will automatically detect (based on the link rate and RSSI requirement) and cut off the network connection for that wireless station to assist it to connect another Wireless AP to get better signal.
Enabled – Enable the function.
Assisted Roaming Signal Strength Threshold – When the signal strength of the wireless station is below the value (dBm) set here and adjacent AP (must be DrayTek AP and support such feature too) with higher signal strength value (defined in the field of Assist roaming when adjacent AP signal is better than) is detected by VigorAP 1062C, VigorAP 1062C will terminate the network connection for that wireless station. Later, the wireless station can connect to the adjacent AP (with better RSSI).
Assist roaming when adjacent AP signal is better than – Specify a value as a threshold.
Cancel| Discard the settings and return to the previous page.
Apply| Click it to save and apply the settings.

After finishing this web page configuration, please click Apply to save the settings.

II-2-3-4 AP Discovery
VigorAP 1062C can scan all regulatory channels and find working APs in the neighborhood. Based on the scanning result, users will know which channel is clean for usage. Also, it can be used to facilitate finding an AP for a WDS link. Notice that during the scanning process (about 5 seconds), no client is allowed to connect to VigorAP.
This page is used to scan the existence of the APs on the wireless LAN. Please click Scan to discover all the connected APs.

Each item is explained as follows:

shown on the box above this button
Radio Information|
Mode, Current Channel, Channel
Utilization, Channel Width| A table lists the radio information for this VigorAP 1062C.
Neighbor AP List|
SSID| Displays the SSID of the AP scanned by VigorAP 1062C.
BSSID| Displays the MAC address of the AP scanned by VigorAP 1062C.
Signal Strength (RSSI)| Displays the signal strength of the access point. RSSI is the abbreviation of Received Signal Strength Indication.
Band| Displays the wireless band(2.4GHz/5GHz) used by the AP.
Channel| Displays the wireless channel used for the AP that is scanned by VigorAP 1062C.
Mode| Displays the physical mode used by the scanned AP.
Security| Displays the security mode used by the scanned AP.
Encryption| Displays encryption mode (None, WEP, TKIP, AES, etc.) of AP.

II-2-3-5 WPS
Open Wireless LAN>>WPS to configure the corresponding settings.

Available settings are explained as follows:

mode.
2.4GHz
5GHz
2.4GHz/5GHz SSID| Displays the SSID setting for 2.4GHz/5GHz.
Method 1: WPS Button
Enable WPS| Click Start PBC to invoke Push-Button style WPS setup procedure.
VigorAP 1062C will wait for WPS requests from wireless clients about two minutes.
Method 2: Using PIN Code|
Generate PIN code from| Client – Use wireless client’s PIN code to securely connect it to the Wi-Fi network.
Client PIN Code| Enter a number as the PIN code from the wireless client.
Connect| Click to build WPS connection between this AP and another station.
Apply| Click it to save and apply the settings.
Cancel| Discard the settings.

After finishing this web page configuration, please click Apply to save the settings.

II-2-3-6 Range Extender
VigorAP can act as a wireless repeater which will help you to extend the networking wirelessly. The access point can act as Station and AP at the same time. It can use the Station function to connect to a Root AP and use the AP function to service all wireless clients within its coverage.

Available settings are explained as follows:

mode.
2.4GHz
5GHz
Peer SSID| Enter the SSID of the access point that VigorAP 1062C wants to connect to.
Scan and Update – Scan the peer SSID and connect to it again.
Update Status|
Peer MAC Address (Optional)| Enter the MAC address of the access point that VigorAP 1062C wants to connect to.
Channel| Means the channel of frequency of the wireless LAN. You may switch the channel if the selected channel is under serious interference.
At present, only Auto is available for selection which lets the system determine for you.
Security Mode| There are several modes provided for you to choose from. Each mode will bring up different parameters for you to configure.
WPA3 Personal
WPA2 Personal
OPEN
WPA Algorithm| This option is available when WPA3 Personal or WPA2 Personal is selected as Security Mode.
At present, only AES is available for selection.
Password| This option is available when WPA3 Personal or WPA2 Personal is selected as Security Mode.
Enter 8~63 ASCII characters, such as “012345678”.
Connection Status| Displays current connection status.
Cancel| Discard the settings.
Apply| Click it to save and apply the settings.

After finishing this web page configuration, please click Apply to save the settings.

II-2-3-7 WDS
Wireless Distribution System (WDS) is a protocol for linking access points (AP) wirelessly.

Available settings are explained as follows:

HE(11ax)
VHT(11ac)
HTMIX(11n)
2.4GHz WDS List|
+Add| Creates a new WDS entry for wireless band 2.4GHz.
Peer MAC Address| Displays the peer MAC addresses
Enter the peer MAC addresses in these fields. Up to four peer MAC addresses may be entered in this page. Select the checkbox in front of a
MAC address to enable it.
Enabled| Switch the toggle to enable/disable this setting.
Security| Displays the security type.
Password| Displays the password for TKIP/AES mode.
5GHz WDS List|
+Add| Creates a new WDS entry for wireless band 5GHz.
Peer MAC Address| Displays the peer MAC addresses
Enter the peer MAC addresses in these fields. Up to four peer MAC addresses may be entered in this page.
Enabled| Switch the toggle to enable/disable this setting.
Security| Displays the security type.
Password| Displays the password for TKIP/AES mode.
Cancel| Discard the settings.
Apply| Click it to save and apply the settings.

After finishing this web page configuration, please click Apply to save the settings.

II-2-4 Objects
II-2-4-1 Schedule
This page allows you to set schedule profiles that can be used for the VigorAP to dial up to the Internet at a specified time. It is especially useful for each WLAN SSID to access the Internet network at different time periods by assigning different schedule profiles.
The schedule is also applicable to other functions.

To add a new schedule profile, click the +Add link to get the following page.

Available settings are explained as follows:

Once – The schedule will be applied just once.
Daily – The schedule will be applied every day based on the above settings.
End Repeat – Switch the toggle to enable/disable the daily function.
End Repeat Date – The schedule is valid until that day.
Weekly – Specify which days in one week should perform the schedule.
Every – Select the days in one week.
End Repeat – Switch the toggle to enable/disable the daily function.
End Repeat Date – The schedule is valid until that day.
Monthly – The schedule will be applied every month .
End Repeat – Switch the toggle to enable/disable the daily function.
End Repeat Date – The schedule is valid until that day.
Cycle – Enter a number as cycle duration. Then, any action applied this schedule will be executed per several days. For example, “3” is selected as cycle duration. That means, the action applied such schedule will be executed every three days since the date defined on the Start Date.
Every (days) – Enter a number.
End Repeat – Switch the toggle to enable/disable the daily function.
End Repeat Date – The schedule is valid until that day.
Cancel| Discard the settings.
Apply| Click it to save the settings and exit the page.

II-2-5 Notification Services
VigorAP can send messages related to the system and the wireless LAN to DrayTek Wireless APP.

Available settings are explained as follows:

notification to the DrayTek Wireless APP.
Connected Devices|
Devices| Display the name (device ID) of the mobile phone(s) connected and submitted to DrayTek Wireless APP. Note that the little bell on the top-right corner of the APP must be turned on to receive the message from VigorAP 1062C.
Test Notifications| Send Test Notification – Press to send a message to DrayTek Wireless APP.
Send Status| Display the test result after pressing the Send Test Notification button.
Notification Message|
Category| At present, only two categories are available.
Enable| Switch the toggle to enable/disable the category.
Content| Display the detailed information for the selected category.

After finishing this web page configuration, please click Apply to save the settings.

II-2-6 RADIUS
Remote Authentication Dial-In User Service (RADIUS) is a security authentication client/server protocol that supports authentication, authorization and accounting, which is widely used by Internet service providers. It is the most common method of authenticating and authorizing dial-up and tunneled network users.
This web page is used to configure settings for external RADIUS server. Then WLAN users of VigorAP will be authenticated and accounted by such server for network application.

To edit an existing profile, click the Edit link of the selected profile to make modifications.
To add a new profile, click the +Add link to get the following page.

Available settings are explained as follows:

RADIUS
Authentication| Switch the toggle to enable/disable the function.
Authentication Server| +Add – Click to create a new server profile.
 Priority – Only two external server can be used.
 Server IP – Enter the IP address of the external RADIUS server.
 Secret – Enter the password for the user to be authenticated by VigorAP 1062C while the user tries to use VigorAP 1062C as the
RADIUS server.
 Authentication Port – Enter a port number for the RADIUS server.
 Option – Click Delete to remove the selected entry.
Cancel| Discards the settings and exits the page.
Apply| Click it to save the settings and exit the page.

II-2-7 Certificates
A digital certificate is an electronic document issued by a certification authority (CA) to an entity to prove ownership of a public key. It contains identifying information including the issued-to party’s name, a serial number, expiration dates etc., and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real. Vigor AP supports digital certificates that conform to the X.509 standard.
In this section, you can generate and manage local digital certificates, and import trusted CA certificates. Be sure that the system time is correct on the access point so that certificates will not be erroneously considered to be invalid because of an incorrect system time falling outside of the certificate’s valid time period. The easiest way to accomplish this is by periodically synchronizing the system time to a Network Time Protocol (NTP) server.

II-2-7-1 Local Certificates
You can generate, import or view local certificates on this page.

Available settings are explained as follows:

Access Point - Roaming 12](https://manuals.plus/wp-content/uploads/2024/03 /DrayTek-1062C-Ceiling-Mount-Access-Point-Roaming-12.png)
Regenerate| Regenerate the certificate.

To add a new local certificate profile, click the +Add link to get the following page.

Available settings are explained as follows:

Import Certificate & Keys – Vigor access point allows you to generate a certificate request and submit it the CA server, then import it as “Local Certificate”. If you have already gotten a certificate from a third party, you may import it directly. The supported types are PKCS12 Certificate and Certificate with a private key.
Method – Generate CSR|
Key Type| Displays the key type used by the certificate.
Algorithm| Displays the algorithm for generating the certificate.
Type| Select the type of Subject Alternative Name and enter its value.
IP Address
Domain Name
Email
Country (C)| Enter the country name (code) in which your organization is located.
State (ST)| Enter the state or province where your organization is located.
Location (L)| Enter the city where you’re your organization is located.
Organization (O)| Enter the legal name of your organization.
Organization Unit
(OU)| Enter the department within your organization that you wish to be
associated with this certificate.
Common Name (CN)| Enter the fully-qualified domain name / WAN IP that will be used to reach your server.
Email (E)| Enter the email address of the entry.
Cancel| Discard current settings and return to the previous page.
Apply| Save the current settings and exit the page.
Method – Import Certificate & Keys
File Type| Vigor AP allows you to generate a certificate request and submit it the CA server, then import it as “Local Certificate”. If you have already gotten a certificate from a third party, you may import it directly. The supported types are PKCS12 Certificate and Certificate with a private key.
Certificate Only – Local certificate.
Upload Certificate – Click Choose a file to select a local certificate file.
PKCS12 – Users can import the certificate whose extensions are usually .pfx or .p12. And these certificates usually need passwords.
PKCS12 is a standard for storing private keys and certificates securely. It is used in (among other things) Netscape and Microsoft Internet Explorer with their import and export options.
Upload PKCS12 File – Click Choose a file to select a PKCS12 certificate file.
Password – Enter the password associated with the certificate and key files.
Certificate & Keys – It is useful when users have separated certificates and private keys. And the password is needed if the private key is
encrypted.
Upload File – Click Choose a file to select a local certificate file.
Upload Key – Click Choose a file to select a key file.
Password – Enter the password associated with the certificate and key files.
Cancel| Discards current settings and return to the previous page.
Apply| Save the current settings and exit the page.

After finishing this web page configuration, please click Apply to save the settings.

II-2-7-2 Trusted CA
The user can build RootCA certificates (up to three) if required.
When the local client and remote server are required to make certificate authentication (e.g., Radius EAP-TLS authentication) for wireless connection and avoid the attack of MITM, a trusted root certificate authority (Root CA) will be used to authenticate the digital certificates offered by both ends.
However, the procedure of applying for digital certificates from a trusted root certificate authority is complicated and time-consuming. Therefore, Vigor AP offers a mechanism that allows you to generate root CA to save time and provide convenience for general users. Later, such root CA generated by the DrayTek server can perform the issuing of the local certificate.
Root CA can be deleted but not edited. If you want to modify the settings for a Root CA, please delete the one and create another one by clicking Create Root CA.

Available settings are explained as follows:

To create a new RootCA, click Create to get the following page.

Available settings are explained as follows:

located.
Common Name (CN)| Enter the fully-qualified domain name / WAN IP that will be used to reach your server.
State (ST)| Enter the state or province where your organization is located.
Location (L)| Enter the city where you’re your organization is located.
Organization (O)| Enter the legal name of your organization.
Organization Unit (OU)| Enter the department within your organization that you wish to be associated with this certificate.
Email (E)| Enter the email address of the entry.
Cancel| Discard current settings and return to the previous page.
Apply| Click to submit generate request to the CA server.

After finishing this web page configuration, please click Apply to save the settings.
To upload a certificate, click the +Add link to get the following page.

Available settings are explained as follows:

After finishing this web page configuration, please click Apply to save the settings.
II-2-7-3 Local Services
This page allows you to set different categories and services for the local certificate(s) to prevent security warning messages popped up due to using different browsers.

Available settings are explained as follows:

device) with full key and authentication information.
Certificate without key phrase or CSR (certificate signing request) file cannot be selected as local certificate.
Cancel| Discards the settings and exits the page.
Apply| Click it to save the settings and exit the page.

After finishing this web page configuration, please click Apply to save the settings.

II-2-7-4 Backup & Restore
You can back up or restore the Local and Trusted CA certificates on the access point to a file.

Available settings are explained as follows:

Local Certificates
Trusted Certificate Authorities
Password Protection| Enabled – Switch the toggle to enable or disable the function.
Password – Enter the password with which you wish to encrypt the certificate.
Confirm Password – Enter the password again.
Backup – Click to download the certificate.
Restore|
Restore from Backup File| Click to select the backup file you wish to restore.
Restore – Click to retrieve the certificate.
File has Password Protection| Enabled – Switch the toggle to enable or disable the function.
Password – Enter the password that was used to encrypt the certificates.

II-3 Security
II-3-1 MAC Filtering Profile
Users can create access control policies and set black & white lists.

Available settings are explained as follows:

To add a new MAC filtering profile, click the +Add link to get the following page.

Available settings are explained as follows:

If enabled, set Allow List or Block List.
Allow List – Specify only the name with the MAC address defined in the list can access this VigorAP.
Block List – Specify only the name with the MAC address defined in the list will be blocked to access this VigorAP.
Device List| It is available when Allow List / Block List is selected as the Policy.
+Add – Create a new entry of a device with a specified MAC address.
Cancel| Discard the settings.
Apply| Click it to save the settings and exit the page.

II-3-2 Backup & Restore
This page allows you to save the access control policies and black & white lists as a profile, which can be used for restoration purposes.

Available settings are explained as follows:

profile) you wish to restore.
Restore – Click to retrieve the MAC filtering profile.

II-4 Virtual Controller – Wireless
This feature allows users to establish and manage a network of DrayTek devices connected by Wireless or Wired links.
The network consists of one Root and multiple Nodes. Root controls this network and syncs configurations to Nodes. Normally Root and Nodes use the same Wireless SSID/security, and Wireless clients can connect to any of them.
For Mesh networks, Root is also the outlet to the Internet. All devices of a network are in the same Group. The root can add a new Node to its Group or delete members from its Group. Users can choose VigorMesh or EasyMesh to establish the Mesh network. If Mesh is disabled, a network with wired links alone could still be established as long as AP Management is enabled.

Mesh Root and Mesh Node
Mesh Root indicates that this device would be another device’s uplink connection.
As a Mesh Root, the device must connect to a gateway with an Ethernet cable first to have an Internet connection.
As a Mesh Node, the device can connect to the Mesh Root or Mesh Node within the same Mesh Group via Wireless or Wired links.

VigorMesh
VigorMesh is a DrayTek proprietary Mesh function.
Pleae note that, within VigorMesh network,
 The total number allowed for Group members is 8 (including the Mesh Root).
 The maximum number of hop is 3.
Refer to the following figure:

EasyMesh
EasyMesh is a standard Mesh protocol of Wi-Fi Alliance.

II-4-1 Role Setup
This page can determine the role of the VigorAP connecting to the computer physically. And set up its Mesh function and AP Management function.

Available settings are explained as follows:

the actual situation.
Root – The device is a Root. It controls the network and syncs configurations to the Nodes of its Group.
If Mesh is enabled, the device must connect to a gateway with an Ethernet cable to have an Internet connection.
Node – The device is a Node. It is managed by a Root if it has joined a Group.
If Mesh is enabled, the device can connect to the network through wireless.
Current Device Role| Displays the current role of the device.
Group Admin Account| Set an account for the system administrator to manage the mesh nodes.
The account configured here will replace the account name defined for each node to ensure the mesh node’s account security.
Group Admin Password| Set a password for the system administrator to manage the mesh nodes.
The password configured here will replace the password defined for each node to ensure the mesh node’s account security.
Mesh Setup|
Enable Mesh| Switch the toggle to enable/disable the mesh function.
Mesh Protocol| Select the mesh protocol to manage the mesh network.
 Vigor Mesh – A protocol developed by DrayTek.
 EasyMesh – A protocol defined by WiFi alliance.
Uplink| It is available only when Node / VigorMesh is selected as Device Role /Mesh Protocol.
Set the uplink of the device.
 Auto – If the Ethernet port is connected and the device can access its gateway, use Wired uplink. Otherwise, use the Wireless uplink.
 Wired – Fixed on the Wired uplink.
 Wireless – Fixed on the Wireless uplink.
Current Uplink| It is available only when Auto or Node / VigorMesh is selected as Device Role / Mesh Protocol.
Displays the current uplink.
Group Name| Displays the name of the current Mesh Group. It is available only when Auto or Root / VigorMesh is selected as Device Role / Mesh Protocol.
If required, change the name.
Mesh Onboarding Mode| It is available only when EasyMesh is selected as Mesh Protocol.
 PBC – Means the push-button configuration.
Start PBC Onboarding| It is available only when EasyMesh is selected as Mesh Protocol and PBC is selected as Mesh Onboarding Mode.
 Start PBC – Triggers the WPS connection to build network between node backhaul and the root fronthaul.
AP Management Setup|
Enable AP Management| Switch the toggle to enable/disable the AP Management.
Default AP Profile| Follow Root – Click to synchronize the same configuration to the nodes managed by root AP.
Advanced Mode: On|
Wireless Uplink Band| It is available only when Auto or Node / VigorMesh is selected as Device Role / Mesh Protocol.
Select available Wireless bands for connecting with uplink
Wireless Downlink Band| It is available only when VigorMesh is selected as Mesh Protocol.
Select available Wireless bands for connecting with downlink.
Preferred Wireless Uplink Device| It is available only when Auto or Node / VigorMesh is selected as Device Role / Mesh Protocol.
Select a Mesh member as the first priority when choosing Wireless uplink.
Preferred Wireless
Uplink Timeout(min)| It is available only when Auto or Node / VigorMesh is selected as Device Role / Mesh Protocol.
Set the time period (1 to 10 minutes) to wait for the Preferred Wireless Uplink Device.
Auto Wireless Uplinks Optimization| It is available only when Auto or Root / VigorMesh is selected as Device Role / Mesh Protocol.
It is selected in default.
If enabled, after changing the environment of the Mesh network, Root will perform reselect to reconstruct the Mesh network.
Log Level| It is available only when VigorMesh is selected as Mesh Protocol.
Select Basic or Detailed. Related information will be shown on Syslog.
Cancel| Discard the settings.
Apply| Click it to save the settings.

II-4-2 Device
II-4-2-1 Device List
This page displays general information about the belonging group.

Available settings are explained as follows:

the APs are slightly different based on the role of the Root and Node.
Settings for the AP (as the Root):Settings for the AP (as the Node):

II-4-2-2 Mesh Status
Displays general information of the Mesh network.
This page is available only when Mesh is enabled (Virtual Controller>>Role Setup).

Available settings are explained as follows:

“0” means the device is using a Wired uplink.
Uplink Device| Displays the MAC address of the device that this device connects to.
Uplink Interface| Displays the interface which the device is using to connect to uplink.
Signal Strength| Displays the signal strength of the device to its uplink.
Uplink Rate(Tx/RX)| It is available only when VigorMesh is selected as Mesh Protocol.
Displays the link rate of the device to its uplink.
Uplink Uptime| It is available only when VigorMesh is selected as Mesh Protocol.
Displays how long the device is online.
Option| Click View to modify the selected mesh device.Optimize All Mesh Links – It is available only when VigorMesh is selected as Mesh Protocol and the device is a Root.
Press the Optimize button to perform reselect to reconstruct the Mesh network.
Optimize Uplink – It is available only when VigorMesh is selected as Mesh Protocol and the device is a Wireless Node.
Press the Optimize button to disconnect the device from Mesh network.
The device might connect to a better uplink later.
Preferred Wireless Uplink Device – It is available only when VigorMesh is selected as Mesh Protocol and the device is a Node.
Displays the Preferred Wireless Uplink of the device.
Set Preferred Wireless Uplink Device – It is available only when VigorMesh is selected as Mesh Protocol and the device is a Node.
Select a Mesh member and press the Set button to set the Preferred Wireless Uplink Device of the device.

II-4-2-3 AP Adoption
Search and add new Nodes to the device’s Group.
This page is available when Current Device Role is Root.
It is also available when Device Role is Auto and Device List contains only the device itself.

Available settings are explained as follows:

Adopt AP – Select the checkbox if you want to add the device into a Group.
MAC – Displays the MAC address of the device.
Model – Displays the model of the device.
Signal Strength – Displays the signal strength of the device if it was found through the Wireless.
Device Name – Insert the name of the device for identification.
Cancel| Discard current settings.
Apply| Click to add the selected device(s) into the Group.

Tips for VigorMesh Network Setup

• VigorMesh supports auto uplink. If a device could not access its gateway, it becomes a Wireless Node automatically.
  A Mesh Root or a Wired Mesh Node should be able to ping its gateway through Ethernet.

• VigorMesh can add new Mesh Nodes into Mesh Group through both Wireless and Wired.
  However, we recommend to connect new Nodes to the Root by Ethernet cables and add them into Mesh Group first.
  Wait until the configuration sync finishes. And then move the Nodes to their destinations.

• VigorMesh supports up to 3 hops. However, it is suggested to connect the Mesh network with less than or equal to 2 hops.

• It is suggested to make the Uplink Signal Strengths of all Wireless Mesh Nodes be larger than -65 dBm.

• A Wireless Mesh Node with an Ethernet cable should not loop to another Node.

• If the Mesh Root disappears and there are online Wired Mesh Nodes with Device Role Auto, one of the Wired Mesh Nodes will become a Mesh Root automatically.

• A VigorMesh Group can be reset by the “Reset” button on Virtual Controller >> Wireless >> Device >> Device List.

• If resetting a Mesh Root,

• All online Mesh Nodes will be informed to reset.

• For those Mesh Nodes unable to reset, reset them manually.

• If resetting a Mesh Node,

• The device will become a New Node again.

• The Wireless SSID settings of the device will be reset, too.

Troubleshooting:

• Check the country code and Wireless channels.
• Check the firmware version. Please make sure all Mesh members are in the newest firmware version.
• Check the Current Device Role and Current Uplink of the device.
• Please make sure that the device is not in DFS CAC detection.
• Check the channel load. Make sure it is not over 70%.

Tips for EasyMesh Network Setup

• Set up multiple mesh devices with uplink RSSI larger than -65dBm.
• Setup is recommended to use wired connection and device list to add devices.
• EasyMesh network supports up to 3 hops of devices. However, it is suggested to connect with less than or equal to 2 hops.
• EasyMesh is not suggested to join existing VigorMesh Environment.
• The maximum of devices number is (ssid_num * device_num <= 56) -> device_num is the max device number

How to set up a VigorMesh group?
The following steps will guide you how to setup a VigorMesh Group.
Please access the web of the device which you want to use it as the Root.

1. (Optional) Open Virtual Controller>>Wireless>>Role Setup.
   Set Group Admin Password. This value will be the Administrator Password of the Nodes after they join the Mesh Group and complete configuration sync.

2. Open Virtual Controller>>Wireless>>Device>>AP Adoption. Click the Scan button.

3. Wait until the searching result appears.
   Choose the device(s) you want to add to the Group and set the names for identification.
   Click the Apply button and wait for it to finish the procedure.

4. Refer to Virtual Controller>>Wireless>>Device>>Device List and Virtual Controller >> Wireless >> Device >>Mesh Status for viewing the result.

Chapter III Management

III-1 System Maintenance
For the system setup, there are several items that you have to know the way of configuration: Device Settings, Management, Firmware, Backup & Restore, Accounts & Permission, System Reboot, and Registration & Services.

III-1-1 Device Settings
The user can modify the time, device name, and Syslog for the device.
III-1-1-1 Time
Open System Maintenance>>Device Settings and click the Time tab.
It allows you to specify where the time of Vigor device should be inquired from.

Available parameters are explained as follows:

Automatically with Time Server – Set the system time by retrieving time information from the specified network time server using the
Network Time Protocol (NTP).
Manually – Set the system time using the time reported by the web browser.
When Automatically with Time Server is selected as Set Time| Time Server – Enter the web site of the primary time server.
Time Zone – Select the time zone where the access point is located.
Interface – Renew the time through the interface selected by VigorAP automatically.
Daylight Saving – Enable Daylight Saving Time (DST) if it is applicable to your location.
Update Time – Force to renew current time setting.
Connection Status – Displays last update time status.
More Settings – Click to open advanced settings for the time server.
 Auto Update Interval – Select the time interval (30min or 60min) at which the AP updates the system time periodically.
 Secondary Server – For having a backup time server, please enter the URL/IP address in the field of Secondary Server.
 Secondary Interface – Backup interface for renewing the time automatically.
 Daylight Saving Period – It is available when Daylight Saving is enabled. Enter a custom schedule to enable the DST – Default, by Week and by Date.
When Manually is selected as Set Time| Time Zone – Select the time zone where the AP is located.
Date – Use the drop-down calendar to specify correct date. Time – Set the time by specifying hours, minutes, and seconds.
Synchronize with Browse – Click Sync now to sync the time setting with the browser.
Apply| Save the current settings and renew the system time.
Cancel| Discard current settings and return to the previous page.

After finishing this web page configuration, please click Apply to renew the system time.

III-1-1-2 Device Name
Display the device name. Change the name if you want.
Open System Maintenance>>Device Settings and click the Device Name tab.

III-1-1-3 Syslog
SysLog function is provided for users to monitor the device.
Open System Maintenance>>Device Settings and click the Syslog tab.

Available parameters are explained as follows:

Servers for detailed configuration.
Log Message| Select to send the corresponding message of user access, interface, and system information to Syslog.
Syslog Servers|
+Add| Click to display new entry boxes for creating a new Syslog server profile.
The maximum number of Syslog servers to be added is “3”.
Server IP| Enter the IP address of the Syslog Server.
Port| Enter the port number of the Syslog Server.
Option| Delete – Click it to remove the selected server profile.
Apply| Save the current settings and exit the page.

After finishing this web page configuration, please click Apply to save the settings.

III-1-1-4 SNMP
This section allows you to configure settings for SNMP services.
The SNMPv3 is more secure than SNMP through the use of encryption (supports AES and DES) and authentication (supports MD5 and SHA) for the management needs.

Available parameters are explained as follows:

If enabled, Manager, Query, Agent and Trap settings will be valid for you to configure.
Manager|
Manager Host| Any – Any IP can be set as the manager host.
Specific Host – Specify a host (IPv4 or IPv6) or hosts (both IPv4 and IPv6).
Enter the IPv4 address with subnet mask / IPv6 address with specified prefix length of hosts that are allowed to issue SNMP commands. If these field are left blank, any IPv4/IPv6 LAN host is allowed to issue SNMP commands.
Query|
Get Community| Enter the Get Community string. The default setting is public. Devices that send requests to retrieve information using get commands must pass the correct Get Community string.
The maximum allowed length is 23 characters.
Set Community| Enter the Set Community string. The default setting is private. Devices that send requests to change settings using set commands must pass the correct Set Community string.
The maximum length of the text is 23 characters.
Query Port| Displays the port number used by the query server.
Agent|
SNMPv3 Agent Enabled| Switch the toggle to enable/disable the SNMPv3 function.
If enabled, specify corresponding settings.Username(USM) – USM means user-based security mode.
Enter the username to be used for authentication. The maximum allowed length is 23 characters.
Authentication – Select one of the hashing methods to be used with the authentication algorithm.
Authentication Password – Enter a password for authentication. The maximum allowed length is 23 characters.
Privacy – Select an encryption method as the privacy algorithm.
Privacy Password – Enter a password for privacy. The maximum allowed length is 23 characters.
SNMPv2c Agent Enabled| Switch the toggle to enable/disable the SNMPv2 function.
SNMPv1 Agent Enabled| Switch the toggle to enable/disable the SNMPv1 function.
Trap|
Enabled| Switch the toggle to enable/disable the Trap function.
Trap Version| Select the trap version.
 V1
 V2c
 V3
Trap Community| Enter the Trap Community string. The default setting is public. Devices that send unsolicited messages to the SNMP console must pass the correct Trap Community string.
The maximum length of the text is 23 characters.
Trap Port| Enter the port number used for the Trap server.
Notification Host IP Type| Select the type of the notification host.
 Both
 IPv4
 IPv6
Notification| +Add – Enter the IPv4 address of hosts that are allowed to be sent SNMP
Host(IPv4)| traps.
Notification Host(IPv6)| +Add – Enter the IPv6 address of hosts that are allowed to be sent SNMP traps.
Trap Events| Select the event(s) to apply the settings configured in this page.
Apply| Save the current settings and exit the page.

After finishing this web page configuration, please click Apply to save the settings.

III-1-2 Management
III-1-2-1 Service Control
This page allows you to manage the general settings, management services, and TLS/SSL Encryption setup.

Available settings are explained as follows:

user interface will be disabled.
The web user interface will be open until you click the Logout icon manually.
Enforce HTTPS Access| Enable the checkbox to allow system administrators to login Vigor device via HTTPS.
Allow PING from LAN| Allow all PING packets from LAN.
Port| Specify user-defined port numbers for the HTTP, HTTPS, SSH, Telnet and SNMP servers.
LAN Access| Select the checkbox to allow system administrators to login from LAN interface.
TLS/SSL Encryption|
TLS 1.3/TLS 1.2| Switch the toggle to enable the function of TLS 1.3/1.2 if required.
Cancel| Discard current settings and return to the previous page.
Apply| Save the current settings and exit the page.

After finishing this web page configuration, please click Apply to save the settings.

Note:
Switch these two icons by click the mouse cursor on them.
– means “Enable”.
– means “Disable”.

III-1-2-2 TR-069
Vigor device supports the TR-069 standard for remote management of customer- premises equipment (CPE) through an Auto Configuration Server, such as VigorACS.

Available settings are explained as follows:

If enabled, settings available for TR-069 will be shown below.
ACS Server|
ACS Server On| Choose the interface for connecting the AP to the Auto Configuration Server.
URL| Enter the URL for connecting to the ACS.
Wizard – Click it to enter the IP address of VigorACS server, port number and the handler.
Username/Password| Enter the credentials required to connect to the ACS server.
Event Code| Use the drop down menu to specify an event to perform the test.
Test With Inform – Click it to send a message based on the event code selection to test if such CPE is able to communicate with VigorACS server.
Last Inform Response
Time| Display the time that VigorACS server made a response while receiving Inform message from CPE last time.
More settings|
CPE Client| This section specifies the settings of the CPE Client.
Protocol – Select Https if the connection is encrypted; otherwise select Http.
Port – In the event of port conflicts, change the port number of the CPE.
Username / Password – Enter the username and password that the VigorACS will use to connect to the CPE.
Periodic Inform Settings| Enable / Disable – Switch the toggle to enable or disable the function.
The default setting is Enable, which means the CPE Client will periodically connect to the ACS Server to update its connection parameters at intervals specified in the Interval Time field.
Time Interval – Set interval time or schedule time for the device to send notification to CPE.
STUN Settings| Enable / Disable – Switch the toggle to enable or disable the function.
The default is Disable. If select Enable, please enter the relational settings listed below:
Server Address – Enter the IP address of the STUN server.
Server STUN Port – Enter the port number of the STUN server.
Minimum Keep Alive Period – If STUN is enabled, the CPE must send binding request to the server for the purpose of maintaining the binding in the Gateway. Please type a number as the minimum period. The default setting is “60 seconds”.
Maximum Keep Alive Period – If STUN is enabled, the CPE must send binding request to the server for the purpose of maintaining the binding in the Gateway. Please type a number as the maximum period. A value of “-1” indicates that no maximum period is specified.
Apply| Save the current settings and exit the page.
Cancel| Discard current settings and return to the previous page.

After finishing this web page configuration, please click Apply to save the settings.

III-1-2-3 System Information
The System Information displays basic information(e.g., device name, LAN MAC, firmware version, build date/time, ACS server and etc.) of Vigor device.

III-1-3 Firmware
Before firmware upgrade, please download the newest firmware from the DrayTeks website or FTP site first. The DrayTek website is www.draytek.com (or local DrayTeks website) and the FTP site is ftp.draytek.com.
Open System Maintenance>>Firmware. The following web page will guide you to upgrade firmware by using an example. Note that this example is running over Windows OS (Operating System).

Then click Upload and wait for a few seconds.

When the upload is finished, please click the Restart button.

Wait for a while until the system finishes the rebooting.

III-1-4 Backup and Restore
This function can be used to backup/restore the VigorAP settings.

Available settings are explained as follows:

access point can be encrypted.
Switch the toggle to enable or disable the function.
Password| Enter several characters as the password for encrypting the configuration file.
Download| Click it to backup the configuration file.
Restore from a Configuration Backup|
Restore from Backup File| – Click to locate the file for restoring.
Restore – Click to execute the restoration.
Restore except the login password| Switch the toggle to enable or disable the function.
File has Password Protection| Switch the toggle to enable or disable the function. If enabled, a password will be required for restoring the configuration.
Restore Password| Enter a password for configuration restoration.

Note:
Switch these two icons by click the mouse cursor on them.
– means “Enable”.
– means “Disable”.

III-1-5 Accounts & Permission
This page allows you to modify current administration account and password.
III-1-5-1 Local Admin Account

Available settings are explained as follows:

To modify an existing profile, select the one and click the +Edit link to open the setting page.
To add a new profile, Click +Add.

Available settings are explained as follows:

is limited to 83 characters.
Confirm New Password| Enter the new password again.
Role| Specify the role of the account.
 Administrator
 Guest
 User-defined role (created on the Role & Permission page)
Status| Active – Enable the selected account profile.
Inactive – Disable the selected account profile.
Cancel| Discard current settings and return to the previous page.
Apply| Save the current settings and exit the page.

Click Apply to save the settings.

III-1-5-2 Role & Permission
This page allows to create new roles which can be applied to local admin account.
The default roles are Administrator and Guest.

Available settings are explained as follows:

To create a new role profile, click +Add. A new role will be added on to the page.

Available settings are explained as follows:

To modify the name, simply click the name and enter a new string (e.g., Role_MKT).
Left Menu Path| Lists all of the features that a role can have.
The role of Administrator have the highest authority for accessing VigorAP.
The role of Guest have the lowest authority for accessing VigorAP.
The authority of the user-defined roles must be based on the conditions selected respectively.
Delete| Remove the selected user-defined role profile.
| Specify the permission for each menu item for the user-defined role.
Deny – The permission for the menu item on the left side is not allowed for the user-defined role profile.
Read-only – The permission for the menu item on the left side allowed for the user-defined role profile to be read-only.
Read-write – The permission for the menu item on the left side allowed for the user-defined role profile to be both read-only and written.
Apply| Save the current settings and exit the page.

After finished the settings, click Apply. The new role can be seen and selected on System Maintenance>>Account & Permission>>Local Admin Account.

III-1-6 System Reboot
The Web user interface may be used to restart your VigorAP. Open System Maintenance >> System Reboot to get the following page.

Available settings are explained as follows:

to reboot the VigorAP.
Current Configuration – Select this option to reboot the VigorAP. using the current configuration.
Factory Default – Select this option to reset the VigorAP’s configuration to the factory defaults before rebooting.
Reboot| Reboot the device immediately.

Chapter IV Others

IV-1 Monitoring
IV-1-1 DHCP Table
This page provides information on IP address assignments. This information is helpful in diagnosing network problems, such as IP address conflicts, etc.
Click Refresh to reload this page with the most up-to-date information.
IV-1-1-1 IPv4 DHCP Subnet

IV-1-1-2 IPv4 DHCP Lease

IV-1-2 ARP Table
The table shows the contents of the ARP (Address Resolution Protocol) cache held in the router and shows the mappings between Ethernet hardware addresses (MAC Addresses) and IP addresses. Click Refresh to reload this page with the most up-to-date information.

IV-1-3 Web Syslog
Log related to setting configuration and/or actions performed by this device can be stored on web Syslog.

Available settings are explained as follows:

If enabled, Loop Logging Option will be shown as follows.
Loop Logging Option| Override Oldest Logs – Vigor router system will backup all existed information on the flash onto the host and clean up the information from the flash. Later, it will start a new record.
Stop when Full – Vigor router system will stop to record the user information onto the flash.
Export| Click it to export the log records as a file (.json).
Clear All| Click it to clear all log records on this page.
Filter| Select the type of log to display on this page.
Cancel| Discard current settings and return to the previous page.
Apply| Save the current settings and exit the page.

Click Apply to save the settings.

IV-1-4 Clients List
It provides the information related to the wireless clients connecting to the VigorAP 1062C.

IV-2 Utility
IV-2-1 Ping Tool
The user can perform the ping job for specified IP (host) to diagnose if the data transmission via the Vigor system is well or not.

Available settings are explained as follows:

ping the IP address specified above.
Clear| Remove the settings and return to the factory settings.
Run| Perform the ping job.

IV-2-2 Trace Tool
The user can perform the traceroute job for specified IP (host) to diagnose if the data transmission via the Vigor system is well or not.

Available settings are explained as follows:

selection.
Trace Through| Trace through specific interface. Only Auto is available for selection.
Protocol| Select ICMP or UDP protocol.
Host/IP Address| Enter the host / IP address that you want to traceroute.
Trace Count| Select the max hops for traceroute, select none for unlimited.
Max Hop| Set the maximum number of hops to search for the target.
Clear| Remove the settings and return to the factory settings.
Run| Perform the ping job.

IV-2-3 Web CLI

It is not necessary to use the telnet command via DOS prompt. The changes made by using web console have the same effects as modified through web user interface. The functions/settings modified under Web Console also can be reviewed on the web user interface.
Click the Web Console icon on the top of the main screen to open the following screen.
Open the page of Utility>>Web CLI.

Chapter V Mobile APP, DrayTek Wireless

V-1 Introduction of DrayTek Wireless
VigorAP 1062C supports Android/iOS APP : DrayTek Wireless. The mobile user can find the APP through Apple App Store / Google Play Store.
After downloading the APP, a mobile user is able to access and login the configuration page of VigorAP.

Note:
Before using the DrayTek Wireless APP, please ENABLE your Wi-Fi feature first. Then, select the Wi-Fi network with Vigor access point(s) connected physically.
It is not necessary to connect to VigorAP physically. The mobile user must connect to one network with the same subnet as the VigorAP.

V-2 Create a New Network

1. Run DrayTek Wireless APP.

2. The system will open the NETWORK page to ask you create a new network first.

3. There are two methods for creating a new network. Click “+” or press the search button
   A: Click “+” to enter the next page. Enter the required information for the device that you want to create a network.B: Press the search button. Later, the system will show the device searched. Select the one you want and click the name to get the detailed information.

4. After clicking Create Network, a new network will be shown on the screen.

V-3 Wizard
The wizard can assist to configure mesh root and mesh node(s).

1. Click and hold the network item till available actions (Wizard, Edit and Delete) shown on the screen. Select and click Wizard.
2. On the next page, enter the SSID and the password for VigorAP and click Connect. When a summary page appears, click the Next button.
3. Enter the username and the password of VigorAP, click OK. On the WiFi Name & Password page, define the WiFi Name and the Password. Then click the Next button.
4. On the Password Setting page, enter the admin password and confirm the password. Then click Next for the APP to verify the password. If successful, the Finish button will appear.

V-4 Login
Run DrayTek Wireless APP.

Available settings are explained as follows:

Support| Display a list of models supported by this APP.
About| Display the version information of this APP.

V-4-1 Setup
For checking the general information of certain device, click the existing item under the Network list to open the Dashboard of the selected device.Click Setup to access into the web user interface of VigorAP 1062C. On the following page, enter the username and the password. Click Login to get the dashboard of the access point.

Chapter VI Troubleshooting

VI-1 Checking the Hardware Status
Follow the steps below to verify the hardware status.

1. Check the power line and cable connections. Refer to “I-1-1 LED Indicators and Connectors” for details.
2. Power on the device. Make sure the POWER LED, ACT LED and LAN LED are bright.
3. If not, it means that there is something wrong with the hardware status. Simply back to “I-2 Hardware Installation” to execute the hardware installation again. And then, try again.

VI-2 Checking the Network Connection Settings
Sometimes the link failure occurs due to the wrong network connection settings. After trying the above section, if the link is stilled failed, please do the steps listed below to make sure the network connection settings is OK.
VI-3-1 For Windows
Note:
The example is based on Windows 7 (Professional Edition). As to the examples for other operation systems, please refer to the similar steps or find support notes in www.draytek.com.

1. Open All Programs>>Getting Started>>Control Panel. Click Network and Sharing Center.
2. In the following window, click Change adapter settings.
3. Icons of network connection will be shown on the window. Right-click on Local Area Connection and click on Properties.
4. Select Internet Protocol Version 4 (TCP/IP) and then click Properties.
5. Select Obtain an IP address automatically and Obtain DNS server address automatically. Finally, click OK.

VI-3-2 For Mac Os

1. Double click on the current used Mac Os on the desktop.
2. Open the Application folder and get into Network.
3. On the Network screen, select Using DHCP from the drop down list of Configure IPv4.

VI-3 Pinging the Device
The default gateway IP address of the device is 192.168.1.2. For some reason, you might need to use “ping” command to check the link status of the device. The most important thing is that the computer will receive a reply from 192.168.1.2. If not, please check the IP address of your computer. We suggest you setting the network connection as get IP automatically. (Please refer to the section V-2)
Please follow the steps below to ping the device correctly.
VI-3-1 For Windows

1. Open the Command Prompt window (from Start menu> Run).
2. Type command (for Windows 95/98/ME) or cmd (for Windows NT/2000/XP/Vista/7). The DOS command dialog will appear.
3. Type ping 192.168.1.2 and press [Enter]. If the link is OK, the line of “Reply from 192.168.1.2:bytes=32 time<1ms TTL=255” will appear.
4. If the line does not appear, please check the IP address setting of your computer.

VI-3-2 For Mac Os (Terminal)

1. Double click on the current used Mac Os on the desktop.
2. Open the Application folder and get into Utilities.
3. Double click Terminal. The Terminal window will appear.
4. Type ping 192.168.1.2 and press [Enter]. If the link is OK, the line of “64 bytes from 192.168.1.2: icmp_seq=0 ttl=255 time=xxxx ms” will appear.

VI-4 Backing to Factory Default Setting
Sometimes, a wrong connection can be improved by returning to the default settings. Try to reset the device by software or hardware.
Warning:
After pressing factory default setting, you will loose all settings you did before. Make sure you have recorded all useful settings before you pressing. The password of factory default is null.
VI-4-1 Software Reset
You can reset the device to factory default via Web page.
Go to System Maintenance and choose Reboot System on the web page. The following screen will appear. Choose Using factory default configuration and click OK. After few seconds, the device will return all the settings to the factory settings. VI-4-2 Hardware Reset
While the AP is running, press the Factory Reset button and hold for more than 5 seconds. When you see the ACT LED blinks rapidly, please release the button. Then, the AP will restart with the default configuration. After restore the factory default setting, you can configure the settings for the AP again to fit your personal request.
VI-5 Contacting DrayTek
If the AP still cannot work correctly after trying many efforts, please contact your dealer for further help right away. For any questions, please feel free to send e-mail to support@draytek.com.

References

• Home | DrayTek
• Home | DrayTek
• Home | DrayTek

Read User Manual Online (PDF format)

Download This Manual (PDF format)

Download this manual  >>