version 8.9.0.0-8.9.0
virtual-controller-country 
virtual-controller-key 
name IAP
terminal-access
ntp-server time.windows.com
rf-band 5.0

allow-new-aps

allowed-ap 



arm
 wide-bands 5ghz
 80mhz-support
 min-tx-power 9
 max-tx-power 127
 band-steering-mode prefer-higher-band
 air-time-fairness-mode preferred-access
 channel-quality-aware-arm-disable
 client-aware
 scanning

rf dot11g-radio-profile
 max-distance 0
 max-tx-power 9
 min-tx-power 6
 disable-arm-wids-functions off
 free-channel-index 40

rf dot11a-radio-profile
 max-distance 0
 max-tx-power 18
 min-tx-power 12
 disable-arm-wids-functions off


syslog-level warn ap-debug 
syslog-level warn network 
syslog-level warn security 
syslog-level warn system 
syslog-level warn user 
syslog-level warn user-debug 
syslog-level warn wireless 



web-server
 ssl-protocol tlsv1_2















hash-mgmt-password
hash-mgmt-user admin password hash 


wlan access-rule default_wired_port_profile
 index 0
 rule any any match any any any permit

wlan access-rule wired-SetMeUp
 index 1
 rule masterip 0.0.0.0 match tcp 80 80 permit
 rule masterip 0.0.0.0 match tcp 4343 4343 permit
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit

wlan access-rule xxxx
 index 2
 rule any any match any any any permit

wlan access-rule Ethxxxx
 index 3
 rule any any match any any any permit

wlan ssid-profile xxxx
 enable
 index 0
 type employee
 essid xxxx
 wpa-passphrase 
 opmode wpa3-sae-aes
 max-authentication-failures 0
 vlan 1
 rf-band 5.0
 captive-portal disable
 dtim-period 1
 broadcast-filter none
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

auth-survivability cache-time-out 24






wlan external-captive-portal
 server localhost
 port 80
 url "/"
 auth-text "Authenticated"
 auto-whitelist-disable
 https


blacklist-time 3600
auth-failure-blacklist-time 3600



ids
 wireless-containment none



wired-port-profile wired-SetMeUp
 switchport-mode access
 allowed-vlan all
 native-vlan guest
 no shutdown
 access-rule-name wired-SetMeUp
 speed auto
 duplex auto
 no poe
 type guest
 captive-portal disable
 no dot1x

wired-port-profile default_wired_port_profile
 switchport-mode trunk
 allowed-vlan all
 native-vlan 1
 shutdown
 access-rule-name default_wired_port_profile
 speed auto
 duplex full
 no poe
 type employee
 captive-portal disable
 no dot1x

wired-port-profile Ethxxxx
 switchport-mode access
 allowed-vlan all
 native-vlan 1
 trusted
 no shutdown
 spanning-tree
 access-rule-name Ethxxxx
 speed auto
 duplex auto
 loop-protect
 no poe
 type employee
 auth-server InternalServer
 captive-portal disable
 no dot1x


enet0-port-profile Ethxxxx
enet1-port-profile Ethxxxx
enet2-port-profile default_wired_port_profile

wlan sta-profile
 essid xxxx
 cipher-suite wpa2-ccmp-psk
 wpa-passphrase 
 uplink-band dot11a

uplink
 preemption
 enforce wifi
 failover-internet-pkt-lost-cnt 10
 failover-internet-pkt-send-freq 30
 failover-vpn-timeout 180
 uplink-priority wifi 1



airgroup
 disable

airgroupservice airplay
 disable

airgroupservice airprint
 disable






cluster-security
 allow-low-assurance-devices