Advanced Options

The following options exist to help you tune up a wide variety of factors that can enhance wireless network performance and connectivity.

• BSS Priority - Select High or Low. The BSS priority determines the traffic transmit preference of one WLAN compared to another in the same AP, for the same QoS category (background, best effort, video, voice). Traffic for high priority WLANs is always sent before the low priority WLANs. High is selected by default during the WLAN creation.
• User Traffic Profile - User Traffic Profiles (UTP) are sets of policies applied to wireless clients based on user information returned by an authentication server. These profiles help manage and control network traffic by defining specific rules and actions for different types of traffic. For more information, refer to the topic User Traffic Profiles.
• OS Policy - The Operating System Policy (OS Policy) helps to manage and enforce rules for Access Points. The OS Policy allows administrators to control and maintain firmware consistency across APs managed by the SmartZone controller.
• Wi-Fi Calling - Toggle the switch to ON to apply Wi-Fi Calling profiles to this WLAN. Wi-Fi Calling profiles identify Wi-Fi Calling traffic and mark it with specific priorities that you configure. Refer to Wi-Fi Calling.
• Client Fingerprinting - Enable this feature to identify and classify client devices on the WLAN using their unique characteristics, such as device type, operating system (OS), and OS version. This is done by parsing HTTP user-agent strings to gather granular data, especially when DHCP packets provide limited information.
  Added the below note as per email from Cui, Herman.
  Note: DHCP is not always accurate in device identification, as different operating systems or device types can share the same DHCP signature, making it difficult for the AP to distinguish them. HTTP provides more accurate identification through the User-Agent field, but many devices either do not send HTTP packets or include incomplete User-Agent data, delaying passive detection by the AP.
• Access VLAN - Specify the VLAN ID to assign to client traffic on this WLAN. By default, it is set to VLAN 1, meaning traffic is untagged and sent into the AP management VLAN. Customize this to a VLAN ID from 2 through 4094 to tag client traffic accordingly. Ensure the switch port connected to the AP accepts the specified VLAN ID as tagged for local bridging. For tunneling, the traffic will be tagged with the specified VLAN ID when exiting the Data Plane port.

  Toggle the switch Enable VLAN Pooling to ON to enable VLAN pooling. When enabled, a VLAN pooling drop-down menu appears, allowing you to select an existing profile or use + to create a new profile. This setup helps manage and segregate network traffic efficiently. For more information, refer to the RUCKUS SmartZone AP & Switch Management Guide.

• Broadcast SSID - Toggle the switch to ON to enable broadcasting of the SSID. When disabled, the AP will not announce the SSID, which is also known as hidden SSID. Client devices can still connect if they are manually configured with the SSID.
• Client Load Balancing - Enabling Client Load Balancing improves the WLAN performance by balancing the number of clients per radio on adjacent APs. APs maintain self-configured client limits based on load and capacity and enforce them after they reach the limits by withholding probe responses and authentication. For more details, refer to the RUCKUS SmartZone AP & Switch Management Guide.
  Attention: Enable Load Balancing in the zone level for Client Load Balancing to work in the WLAN. For instructions to enable Load Balancing in the zone level, refer to the RUCKUS SmartZone AP & Switch Management Guide.
• Proxy ARP - When proxy ARP is enabled on a WLAN, the AP provides ARP services for stations and acts on behalf of the station in delivering ARP replies. When the AP receives a broadcast ARP/Neighbor Solicit request for a known host, the AP replies on behalf of the host. If the AP receives a request for an unknown host, it forwards the request.
• ND Proxy - Enables Neighbor Discovery proxy. When ND proxy is enabled on a WLAN, the AP provides Neighbor Advertisement service for stations. When the AP receives a Neighbor solicitation request for a known host, it replies with a Neighbor Advertisement on behalf of the host. If the AP receives a request for an unknown host, it forwards the request.
  Note: This feature is available only on IPv6 and Dual zone and is enabled by default.
• RA Proxy - When RA proxy is enabled on a WLAN, the AP provides Router Advertisement service for wireless stations. When the AP receives a Router solicitation request on a WLAN, it replies with a Router Advertisement on behalf of the routers available on the network learned by the AP. If the router entries are not found in the cache, the AP forwards the request.
  Note: This feature is available only on IPv6 and Dual zone and is enabled by default.
• Max Clients - Limits the number of clients that can associate with this WLAN per AP radio (default is 100). Every connection attempt after this maximum value will not be permitted to connect.
• 802.11d - Adds additional regulatory information to AP beacons and probe responses. This compliance information provides country-specific guidance such as permitted channels and transmit power, to ensure that the devices operate within the legal boundaries of the country. IEEE 802.11d is helpful for many devices that cannot independently determine their operating country.
• AMB (Agile Multi Band) - AMB (Multi-Band Operation) is designed to optimize the use of multiple frequency bands available to Access Points (APs) and wireless user devices. For more information, refer to the AMB (Agile Multi Band).
• 802.11k Neighbor Report - Enhances roaming by providing a list of neighbor APs to the client device. APs build a neighbor AP list via background scanning, and when the client plans to roam, it will request this list from the AP. This list is then used to perform efficient scanning to find a roaming candidate.
• Anti-spoofing - Prevents attacks on genuine clients from rogue clients that could lead to service disruption, data loss, and so on. This is achieved by matching the MAC address or IP address (IPv4) of the client with the address in the RUCKUS database. Enable the toggle to ON and subsequently configure the following limits:
  • ARP request rate limit: Configure a limit of packets per second, when the limit is exceeded, the packets are dropped in the AP.
  • DHCP request rate limit: Configure a limit of packets per second, when the limit is exceeded, the packets are dropped in the AP.
    Note: Force-DHCP will be enabled by default when anti-spoofing is enabled, and it cannot be changed.
• Force DHCP - This option requires wireless clients to obtain a valid IP address from a DHCP server within a specified number of seconds, and prevents clients configured with a static IP address from connecting to the WLAN. Additionally, the Force DHCP mechanism optimizes the L3 roaming experience by forcing clients to request a new IP address.
  Note: Force-DHCP will be enabled by default when anti-spoofing is enabled, and it cannot be changed.
• DHCP Option 82 - Enables an AP to encapsulate additional information (such as VLAN ID, AP name, SSID, and MAC address) into the DHCP request packets before forwarding them to the DHCP server. The DHCP server can then use this information to allocate an IP address to the client from a particular DHCP pool based on these parameters.

  After you enable this option, the following DHCP Option 82 sub options display. Enable the toggle for the sup options you require and specify the format in which the AP will send them to the DHCP server:

  • Suboption-1 (Circuit ID): This sub-option is used to identify the circuit or port from which the DHCP request was received. It typically includes information such as the VLAN ID and port number, helping the DHCP server to allocate IP addresses based on the specific circuit.
  • Suboption-2 (Remote ID): This sub-option provides a unique identifier for the remote host or relay agent. It can include information such as the MAC address or a user-defined string, allowing the DHCP server to distinguish between different relay agents or clients.
  • Suboption-150: This sub-option is often used to specify the TFTP server address for IP phones. It helps in providing the necessary configuration files to the devices during the boot process.
  • Suboption-151: This sub-option is used to specify the configuration server address for IP phones, similar to Suboption-150, but it may be used for different types of configuration servers or additional settings.
• DTIM Interval - Indicates the frequency (in Beacon intervals) at which the Delivery Traffic Indication Message (DTIM) is included in Beacon frames. This helps in managing power-saving features for wireless clients by informing them when to wake up to receive broadcast and multicast messages. A good value is typically 1 or 2, balancing power saving and timely delivery of broadcast/multicast traffic.
• Directed MC/BC Threshold - Defines the per-radio-client count at which an AP stops converting group-addressed data traffic to unicast. Directed Multicast is enabled by default, and it is only configurable via AP CLI. For configuring Directed Multicast, refer to the RUCKUS SmartZone Troubleshooting and Diagnostics Guide.

  When Directed Multicast is enabled, the AP checks if a multicast packet is well-known (e.g., Bonjour, uPNP, most IPv6 link- and node-local, and Spectralink) and takes one of the following decisions:

  • For well-known packets, the AP applies the Directed Threshold for unicast conversion.
  • For non-well-known multicast types, the AP uses IGMP and MLD to monitor client subscriptions.
  • If clients are subscribed, the AP converts packets to unicast regardless of the Directed Threshold.
  • If no clients are subscribed, the AP drops the packets.

  When Directed Multicast is disabled:

  • The AP solely uses the Directed Threshold to determine whether to transmit a multicast packet as unicast.
• Client TX/RX Statistics - Switch the toggle to ON to collect statistics from unauthorized clients. Unauthorized clients are those connected to a portal-based WLAN who have not yet completed the authentication process. These clients can only browse the internet on whitelisted websites.
• Inactivity Timeout - Indicates the duration after which idle clients will be disconnected and the session information will be cleared. This helps in freeing up resources and maintaining network performance by ensuring that inactive sessions do not consume bandwidth or other resources.
• GTK Rekey - It ensures that the Group Temporal Key (GTK) used for encrypting broadcast and multicast traffic is periodically refreshed. This enhances network security by reducing the risk of key compromise.
• WiFi 6/7 - By default, this feature is enabled, allowing Wi-Fi 6/7 and legacy Wi-Fi 5 client devices to interoperate whie Wi-Fi 6/7 APs can utilize advanced features like OFDMA, TWT, 6GHz operation, Preamble Puncturing, 320MHz bandwidth, and MLO. When disabled, the APs are downgraded to support Wi-Fi 4/5 capabilities only, allowing interoperation with Wi-Fi 6/7 and legacy clients but without the advanced features. Disabling is recommended if client drivers are outdated or have bugs.
• Multi Link Operation (MLO) - Introduced in the Wi-Fi 7 (802.11be) standard. It allows a Wi-Fi client and Access Point (AP) to simultaneously use multiple radio links—typically across different frequency bands (2.4 GHz, 5 GHz, and 6 GHz)—as part of a single connection. It also minimizes latency due to increased channel access opportunities through these multiple links. The MLO option is available only with the following encryption methods - WPA3. WPA2/WPA3-Mixed, OWE.
  • MLO with Client Connection Decision (CCD) - When MLO-capable clients attempt to associate, CCD evaluates the available APs and links (e.g., 5 GHz, 6 GHz) and assists in steering the client to an AP that supports MLO. CCD ensures that the client establishes its initial link with an optimal band, considering both current load and expected performance across multiple bands.
  • MLO with Heurisitic Client Connection Decision (HCCD) - For MLO-capable clients, HCCD further refines steering decisions by predicting which combination of links (bands) will yield the best performance.
  Need content.
• OFDM Only - Disconnects 802.11b devices from the WLAN and all devices are forced to use higher data rates for more efficient airtime usage. This setting only affects the 2.4-GHz radio. OFDM is used by 802.11a, g, n, and ac, but is not supported by 802.11b.
• BSS Min Rate - Forces client devices to both be closer to the AP and to use higher, more efficient rates when you increase the BSS minimum rate above the default (all rates) setting. The BSS minimum rate is the lowest data rate supported on the WLAN. When choosing the BSS minimum rate, best practices suggest setting it based on your network's density and client capabilities. For high-density environments with modern devices, higher rates like 12 or 24 Mbps are recommended to improve overall performance and reduce airtime consumption. For mixed environments with legacy devices, lower rates like 1, 2, or 5.5 Mbps may be necessary to ensure compatibility.
• Mgmt Tx Rate - Sets the transmit rate for management frame types such as beacon and probes, impacting the efficiency and reliability of network management tasks. Options range from 1 to 54 Mbps. Lower rates (1-6 Mbps) are suitable for environments with legacy devices or where extended range is needed. Moderate rates (12-24 Mbps) are ideal for most modern networks, balancing performance, and compatibility. Higher rates (36-54 Mbps) are best for high-density environments with modern devices, ensuring faster transmission but with reduced range.
• Time Schedule - Controls when the WLAN service is active. The purpose of this setting is to automatically enable or disable a WLAN based on a predetermined schedule. By default, the service is Always On. Always Off can be checked in order to create a WLAN and apply it but prevent it from advertising until ready. Selecting Specific allows a configurable schedule based on time of day and days of the week. Select a Schedule Profile from the drop-down menu or use + to create a new one. For instructions about creating a Time-based Access Table, refer to Time Based Acces.
  Note: When a service schedule is created, it is saved by the controller and AP using the time zone of the browser. When it is enforced by the AP, the AP will enforce it according to the time zone of the browser when it was configured.
• Allow Band Balancing - Balances the client load on radios by distributing clients between the 2.4-GHz and 5-GHz radios. APs manage band distribution by withholding probe responses and authentication. Band balancing is enabled by default.
  Attention: Enable Band Balancing in the zone level for Allow Band Balancing to work in the WLAN. For instructions to enable Band Balancing in the zone level, refer to the RUCKUS SmartZone AP & Switch Management Guide.
• QoS Map Set - Enable this field to allow the AP to map the DSCP marking of each packet to the user priority TID automatically before sending the packet to the wireless client. Once the toggle is switched to ON, a table with 8 rows will appear, showing the preconfigured QoS mappings. When an AP receives a downlink packet, it checks the existing DSCP (Layer 3 QoS) marking, compares it to this map set, and then changes the user priority (Layer 2 QoS) values for transmission by the AP.

  To configure a row, click on it, and then click Configure. Optionally, double-click on the row you want to edit. The Edit QoS Map Set window opens, where you can set the following values:

  • Enable: Toggle the switch to ON or OFF.
  • Priority: Each row has a predefined priority and cannot be modified.
  • DSCP Range: Define the range of DSCP values.
  • Exception DSCP Values: Specify an exception value and click Add. Add additional exception values as required.

    Assign higher priorities (TID values 6-7) to critical traffic such as voice and video, which typically use specific DSCP values (e.g., DSCP 46 for voice and DSCP 34 for video). For less critical traffic, such as best effort or background tasks, use lower priorities (TID values 0-3) and map them to corresponding DSCP values (e.g., DSCP 0 for best effort). Additionally, use the DSCP Exception Value to specify any exceptions where the original DSCP and UP tagging should be preserved.

• Multicast Filter - Toggle the switch to ON to enable multicast and broadcast traffic filtering. When enabled, the AP will drop all unknown IPv4 and IPv6 multicast/broadcast traffic from associated wireless clients, except for specific packets such as ARP requests, DHCP requests, IPv6 Neighbor Solicitation (NS), Neighbor Advertisement (NA), Router Solicitation (RS), IGMP, MLD, and all unicast packets. This feature helps prevent multicast and broadcast storms, conserving wireless bandwidth and AP resources. The downstream multicast traffic from the network to wireless clients remains unaffected.
• SSID Rate Limiting - Switch the toggle to ON for uplink and downlink traffic separately and provide the rate limiting in Mbps. This feature allows you to limit the total bandwidth for all clients connected to a specific SSID, rather than per client. This is useful for managing network resources and ensuring fair usage among multiple virtual operators or different user groups. The rate limit applies across both 2.4GHz and 5GHz radios, dynamically adjusting based on the number of clients connected to each band.
  Note: Per SSID rate limiting and per user rate limiting cannot be enabled simultaneously. If uplink per SSID rate limiting is enabled, uplink per user rate limiting will not take effect, and vice versa for downlink. This ensures that the total bandwidth usage for the SSID is controlled effectively.
• Multicast Rate Limiting - Switch the toggle to ON to enable multicast rate limiting for uplink and downlink traffic, configurable in Mbps. This feature allows you to set an absolute rate limit for multicast traffic at the WLAN level, ensuring efficient use of network resources and preventing multicast traffic from overwhelming the network. The rate limit can be applied separately for uplink and downlink directions and supports IPv6 traffic. When enabled, the AP will enforce the specified rate limits, maintaining a uniform token bucket for both directions. This feature is particularly useful for managing known multicast traffic types such as IGMP, MLD, mDNS, and IPv6 multicast.
  Note: Multicast Filter and Multicast Rate Limiting are mutually exclusive and the SSID Rate Limit will always take precedence if both are configured.
• DNS Server Profile - Allows the AP to inspect DHCP messages and overwrite the DNS servers with the DNS server configured in this profile. This allows for policy-based DNS application in which unique users/ roles should use a different DNS server than others.
• DNS Spoofing - When an AP receives a DNS packet, all fields in the packet are validated. If the packet passes validation, the AP forwards it to the intended DNS server. However, if any field fails validation, the packet is discarded to prevent potential spoofing attacks. Only A (Address) and AAAA (Quad-A) DNS query packets are considered. An A record maps a domain name to an IPv4 address, while an AAAA record maps a domain name to an IPv6 address.
  Note:
  • If the same domain name is present in both the DNS spoofing profile and the walled garden table in a WISPr WLAN, the AP DNS cache is updated with the IP address from the DNS spoofing profile.
  • If both DNS spoofing and URL filtering with safe search are enabled, URL filtering (safe search) takes precedence for domain names like "Google," "YouTube," and "Bing." If safe search is not enabled, DNS spoofing takes precedence. Additionally, if safe search is not enabled but URL filtering is, DNS spoofing still takes precedence.
• Precedence Profile - Defines the priority order for VLAN and Rate Limiting policy assignments. It determines which policy takes precedence when multiple policies apply to a single scenario. For instance, if different policies like a WLAN configuration, an AAA role policy, and a device OS policy each assign different VLANs, the precedence profile will dictate which VLAN is ultimately assigned based on the priority of each policy.
• Client Flow Data Logging - Sends a log message with source MAC, destination MAC, source IP, destination IP, source port, destination port, L4 protocol, and AP MAC of each packet session to the external syslog server. This function is provided by the AP syslog client (not the controller syslog client), which must be enabled at the zone level to support this client flow logging. For instructions to configure AP Syslog client, refer to the RUCKUS SmartZone AP & Switch Management Guide.
• Airtime Decongestion - Optimizes Wi-Fi management traffic in a network. It reduces the amount of management traffic which can consume a significant portion of airtime, thereby increasing the time available for actual data traffic. This feature controls the Received Signal Strength Indicator (RSSI) threshold setting for Transient Client Management. When you enable Airtime Decongestion, it disables the RSSI threshold configuration in Transient Client Management.
  Note: Before enabling Airtime Decongestion, you must enable Background Scan.
• Join RSSI Threshold - Indicates the signal strength threshold that a client device must meet to connect to the WLAN. If the signal strength of a client device is below this threshold, the AP will not allow the client device to join the network. Configure a threshold within the range of -60 dBm to -90 dBm.
  Note: If you enable Airtime Decongestion, the Join RSSI Threshold setting will be automatically disabled.
• Transient Client Management - Ensures that only clients staying within the AP's coverage for a configured period can associate and use the network, preventing transient devices from disrupting service. Switch the toggle to ON to enable the feature for the WLAN and configure the following settings:
  • Join wait time: The wait time before the AP permits a client to join. Range: 1 through 60 secs.
  • Join expire time: The time during which the AP accepts a rejoin request without delay. Range: 1 through 300 secs.
  • Join wait threshold: The number of join attempts after which the AP permits a client to join even before the join wait time expires.
    Note: TCM is particularly useful in high-traffic areas like train stations, where devices may constantly roam between networks, affecting connected users. By using statistical methods to delay transient client associations, TCM optimizes airtime utilization and reduces unnecessary handoffs and roaming.
• Optimized Connectivity Experience (OCE) - Enhances network performance by incorporating features like Reduced Neighbor Report and AP Channel Report, which provide more detailed information in beacon and probe responses, reducing probe requests in dense environments. Additionally, FILS (Fast Initial Link Setup) streamlines the authentication and connection process by combining authentication, authorization, and DHCP steps, minimizing EAP frames and bypassing the EAPOL 4-way handshake during reconnections or roaming. Switch the toggle to ON to enable the feature for the WLAN and configure the following settings:
  • Broadcast Probe Response Delay: Indicates the time delay to transmit probe response frames in milliseconds.
  • RSSI-based Association Rejection Threshold: Indicates the minimum threshold value to connect to the network (in dBm). If the value entered is less than the minimum threshold value, then any RSSI-based association is rejected.
  • Reduced Neighbor Report: Toggle the switch to ON to enable this feature.
  • AP Channel Report: Toggle the switch to ON to enable this feature.
• AP Host Name Advertisement in Beacon - The AP includes its host name in beacon. Including the AP host name in the beacon helps with easier network identification, simplified troubleshooting, enhanced user experience, and improved network management.
• QoS Mirroring - QoS Mirroring enables the access point AP to appropriately prioritize downlink traffic into the correct user priority queues by observing how the wireless client sets priority on the uplink traffic. For more information, refer to the QoS Mirroring.