Applies To: WatchGuard Cloud-managed Access Points (AP130, AP230W, AP330, AP332CR, AP430CR, AP432)
To view the specific details of a wireless client currently associated to a WatchGuard access point in WatchGuard Cloud:
- Select Monitor > Devices.
- Select an access point or folder that contains your access points.
- From the Devices menu, select Live Status > Clients.
- To pause auto-refresh for the displayed data, click
. To restart auto-refresh, click 
. - In the Search text box, type a search query to search all columns in the client list.
- Select a client.
The Clients page opens.
Client Details
The wireless client details page includes this data:
Client Basic Information
Shows this basic information about the client:
- User Name — The name of the authenticated user of the wireless client. This field will not show any value if the authenticated name of the client is not available.
- MAC Address — The MAC address of the wireless client.
- IP Address — The IP address of the wireless client.
- Current RSSI — The current received signal strength indicator (RSSI) of the wireless client connection. Strong signal strength results in more reliable connections and higher speeds. Signal strength is represented in -dBm format (0 to -100). This is the power ratio in decibels (dB) of the measured power referenced to one milliwatt. The closer the value is to 0, the stronger the signal. For example, -40 dBm is better signal strength than -60 dBm.
- Current Data Rate — The current data rate of the wireless client connection (in Mbps).
- Security — The security protocol of the SSID that the wireless client connected to, such as WPA3 Personal.
- Wireless Mode — The current wireless mode in use by the client connection, such as Wi-Fi 6 (802.11ax).
- SSID — The SSID name that the wireless client is connected to.
Client Traffic Volume
The Client Traffic Volume widget shows the total amount of data uploaded and downloaded (in MB) by the wireless client over the last 24 hours.
Client Connection Events
This Client Connection Events table shows a list of recent client events.
- Status — The type of event, such as a successful connection or disconnection, password issue, or inactivity timeout event. For more information, go to Client Connection Event Status Types.
- Access Point — The access point to which the client is associated.
- Disconnect Reason — Indicates the reason for a disconnection status, such as an incorrect password. For more information, go to Client Connection Event Status Types.
- Radio — The radio frequency band (2.4 GHz or 5 GHz) to which the wireless client is connected.
- Channel — The wireless channel in use by the client.
- Wireless Mode — The wireless mode in use by the client, such as Wi-Fi 6 (802.11ax).
- Wireless Modes Supported — The wireless modes supported by the client, such as Wi-Fi 4 (802.11n), Wi-Fi 5 (802.11ac), or Wi-Fi 6 (802.11ax).
The supported wireless modes listed for the client are based on the wireless mode of the client’s current connection to the access point. For example, if the wireless mode of the access point radio is configured for 802.11ax, the client will show supported wireless modes for 802.11ax, 802.11ac, and 802.11n. If the wireless mode of the radio is configured for 802.11ac, the connected client will show supported wireless modes for 802.11ac and 802.11n.
- Channel Width — The channel width in use by the client.
- BSSID — The MAC address of the access point radio to which the wireless client is associated.
- SSID — The name of the wireless network to which the wireless client is associated.
- Date — The date and time of the event.
- Security — The security protocol of the SSID that the wireless client connected to.
Client Connection Event Status Types
| Event | Reason | Troubleshooting |
|---|---|---|
| AP busy | The CPU load on the access point is too high to access the wireless client connection. | There might be a high number of concurrent client connections to the access point. Consider adding additional access points for appropriate sizing for your environment. |
| AP disconnect |
The access point has disconnected the client.
|
Check the Fast Handover and minimum RSSI transition settings in the access point radio settings. Check the Client Limit Per Radio settings in the advanced access point radio settings for each radio to check if the feature is enabled or if the limits are set too low. |
| Failed EAP Authentication | The user has failed to authenticate with WPA2 or WPA3 Enterprise authentication to a RADIUS server. | The user did not correctly authenticate to a RADIUS server. Check the user's credentials on the RADIUS server. Too many incorrect attempts might indicate unauthorized attempts to connect to the wireless network. |
| Disobey ACL policy | The wireless client's address is blocked by a MAC address Access Control List | Check the MAC address access control feature in the SSID settings to determine if a client's MAC address appears in the list. |
| Exceeds client connection limits | The access point has exceeded the maximum number of wireless client associations |
Check the Client Limit Per Radio settings in the advanced access point radio settings for each radio to check if the feature is enabled or if the limits are set too low. Consider adding additional access points to support the requirements of your environment and share the wireless client load. |
| Inactive station timeout | The client signal strength is too weak, or the client has moved out of the access point's signal range. | Check the client signal strength and access point coverage area to make sure you have enough access points and they are optimally placed for your environment. |
| Incorrect password | The user has typed an incorrect SSID security passphrase for WPA2 or WPA3 Personal encryption. |
Make sure the client is using the correct SSID passphrase. Too many incorrect passphrase attempts might indicate unauthorized attempts to connect to the wireless network. |
| Network Access Enforcement failure |
Network Access Enforcements is enabled and the wireless client does not have any WatchGuard Endpoint Security products installed, or the Endpoint Security agent is not running on the client, or there is a UUID or authentication key mismatch.
|
If you enable Network Access Enforcement on an SSID, a wireless client must have a WatchGuard Endpoint Security product installed to be able to connect to the network. Install one of these products on the wireless client (WatchGuard Advanced EPDR, EPDR, EDR, EDR Core, or EPP). Make sure the Endpoint Security agent is running on the client. For more information, go to Access Point Network Access Enforcement. The Endpoint Security configuration for Network Access Enforcement requires the correct Account UUID and Authentication Key of the WatchGuard Cloud account that manages your devices. This information is available on the Administration > My Account page in WatchGuard Cloud. |
| Station disconnect |
The wireless client has disconnected from the access point. Incorrect password: The user has typed an incorrect SSID security passphrase for WPA2 or WPA3 Personal security mode. MAC address blocked: Client MAC address was blocked by an access point access control list. Failed EAP authentication: Access point rejected connection because of failed EAP authentication with the client. |
|
| Successful connection | The wireless client successfully connected to the access point SSID. |
Client Performance
Select the Performance tab to view the performance details for the client's connections to access points.
The chart shows the time periods when the client was impacted by low RSSI or low data rate.
- Low RSSI — An RSSI less than -75 dBm is considered a low signal strength for a client. The closer the value is to 0 dBm, the stronger the signal. For example, -60 dBm is a better signal strength than -75 dBm.
- Low Data Rate — A data rate of less than 25 Mbps is considered a low data rate for a client.
You can hover over specific areas of the chart to view details of the RSSI and data rate performance over time. The green dots indicate the start and end of the client's connection to the access point.
The Access Point Connections table includes this data:
- Access Point — The access point to which the client was connected. Click the access point name to go to the Performance Issues report page for the device. A client might connect to multiple access points if the client roams from one access point to another access point.
- Total Time Connected — The amount of time a wireless client was connected to the access point.
- Low RSSI % — The percentage of time when the client was impacted by low RSSI while connected to the access point.
- Low Data Rate % — The percentage of time when the client was impacted by a low data rate while connected to the access point.
- Average RSSI — The average RSSI of the client's connection to the access point.
- Average Data Rate — The average data rate of the client's connection to the access point.
- Lowest RSSI — The lowest RSSI of the client's connection to the access point.
Access Point Network Usage Report
Access Point Top Clients Report
Access Point Performance Issues Report