Orbi Pro WiFi 6 SXR50 - Wi-Fi NETGEAR - Free user manual and instructions

Type of Product	WiFi 6 Tri-band Mesh Router (Model SXR50)
Dimensions (H x W x D)	170 x 75.6 x 224.5 mm (6.7 x 2.9 x 8.8 in)
Weight	Approx. 0.72 kg (1.6 lb)
Power Adapter	Input: 100-240V AC, 50-60Hz; Output: 12V DC, 3.5A
WiFi Standards	IEEE 802.11ax (WiFi 6) tri-band: 2.4 GHz (600 Mbps), 5 GHz low (2400 Mbps), 5 GHz high (2400 Mbps)
Ethernet Ports	1 WAN (Gigabit, yellow), 3 LAN Gigabit (ports 1-2 support link aggregation)
Maximum Devices in Network	Up to 512 devices (75 concurrent recommended)
Mesh Support	Supports up to 6 Orbi Pro WiFi 6 satellites (model SXS50)
Security	WPA2-PSK, WPA3-Personal, WPA2-Enterprise, WPA3-Enterprise, MAC ACL, Network ACL, VPN (OpenVPN, Insight Business VPN)
VLAN Capabilities	Up to 5 LANs with custom VLAN profiles, VLAN tag group for IPTV, port-based VLAN assignment
Management	Web interface (orbilogin.com), NETGEAR Insight remote management, Cloud VPN
Advanced Features	Dynamic DNS, DMZ, port forwarding/triggering, traffic meter, link aggregation, multicast DNS gateway
Operating Temperature	0°C to 40°C (32°F to 104°F)
Humidity	Up to 90% relative humidity (noncondensing)
Maintenance & Cleaning	Wipe with dry cloth; do not use liquids or aerosols. Factory reset via reset button (hold 7+ seconds).
Compliance	FCC Part 15 Class B, CE, RCM, etc. (see manual for full list)
Package Contents	Orbi Pro WiFi 6 Router (SXR50), power adapter, Ethernet cable, quick start guide

Frequently Asked Questions - Orbi Pro WiFi 6 SXR50 NETGEAR

How do I set up the Orbi Pro WiFi 6 SXR50 router for the first time?

Connect the router to your modem via the yellow WAN port, power it on, then use a browser to go to orbilogin.com. Follow the interactive setup wizard to configure your Internet connection and WiFi settings.

Can I add more satellites to expand my mesh network?

Yes, you can add up to six Orbi Pro WiFi 6 AX5400 satellites (model SXS50). Sync them by pressing the Sync button on both the router and satellite within two minutes, or via the router web interface under 'Add Orbi Pro Satellite'.

What is the default login for the router web interface?

The default user name is admin and the default password is password (case-sensitive). You will be prompted to change the password during initial setup.

How do I set up separate VLANs for admin, employee, and guest networks?

You can create VLAN profiles under ADVANCED > Advanced Setup > VLAN. Assign VLANs to specific WiFi networks (SSIDs) and LAN ports. The router supports up to 5 LANs with preset VLANs (e.g., Default VLAN 1, Employee VLAN 20, IoT VLAN 30, Guest VLAN 40).

How do I enable WPA3 security on my WiFi network?

Go to the router web interface, select the WiFi network you want to modify (e.g., Wireless 1), and under Security Options, choose WPA3-Personal or WPA2-Personal [AES] + WPA3-Personal mixed mode.

Can I use a wired Ethernet backhaul for better satellite performance?

Yes, you can connect the satellite to the router via an Ethernet cable. The satellite will automatically use the wired connection for backhaul if available. This is recommended for highest performance.

How do I set up a guest WiFi network with a captive portal?

Under the WiFi settings, enable the Guest WiFi network and choose 'Captive Portal' as authentication method. You can customize the login page and set open access or require password.

What is NETGEAR Insight Business VPN and how do I use it?

Insight Business VPN provides site-to-site VPN connectivity between Orbi Pro routers. It requires a NETGEAR Insight Premium or Pro subscription. Configuration is done through the Insight app, not the router web interface. It allows remote employees to securely access the office network.

How do I factory reset the Orbi Pro SXR50 router?

Use a paperclip or similar object to press and hold the Reset button on the back of the router for at least 7 seconds. The router will reboot and all settings will return to factory defaults.

What does the LED bar indicate on the router?

The bar LED shows system status: Pulsing white (booting), Solid white (factory reset in progress), Solid magenta (no Internet connection), or Off (normal operation). For satellites, blue/green indicates good connection, amber fair, magenta failed sync.

USER MANUAL Orbi Pro WiFi 6 SXR50 NETGEAR

350 E. Plumeria DriveJuly 2022

San Jose, CA 95134, USA202-12551

Support and Community

Visit_netgear.com/support to get your questions answered and access the latest downloads.

You can also check out our NETGEAR Community for helpful advice at community.netgear.com.

Regulatory and Legal

(If this product is sold in Canada, you can access this document in Canadian https://www.netgear.com/support/download/)

For regulatory compliance information including the EU Declaration of Conformity, https://www.netgear.com/about/regulatory/.

See the regulatory compliance document before connecting the power supply.

For NETGEAR's Privacy Policy, visit https://www.netgear.com/about/privacy-policy.

By using this device, you are agreeing to NETGEAR's Terms and Conditions at https://www.netgear.com/about/terms-and-conditions. If you do not agree, return the device to your place of purchase within your return period.

Do not use this device outdoors.

Applicable to 6 GHz devices only: Only use the device indoors. The operation devices is prohibited on oil platforms, cars, trains, boats, and aircraft, except that operation of this device is permitted in large aircraft while ying above 10,000. Operation of transmitters in the 5.925-7.125 GHz band is prohibited for control communications with unmanned aircraft systems.

Trademarks

© NETGEAR, Inc., NETGEAR, and the NETGEAR Logo are trademarks of NETGEA. Any non-NETGEAR trademarks are used for reference purposes only.

Revision History

Number		CommentsPublish DatePublication Part
		We added the following new sections:July 2022202-12551-04
			Multicast DNS gateway on page 134, Enable the multicast DNS gateway and add a policy on page 134, and Change or remove a multicast DN policy on page 136VLAN tag group as a bridge for an IPTV device on page 84
		We revised the sections in the chapter Manage the WiFi Networks on page 88. These sections now document that the router supports WPA2-Personal [AES] + WPA3-Personal security for the Wireless 1, Wireless 2, and Wireless 3 networks, OWE security for the Guest Portal, and WLAN scheduling for a WiFi networks.
		We made minor changes, corrections, and improvements, including to the information in the appendix Supplemental Information on page 234.
		We added NETGEAR Insight Business VPN on page 23.April 2022202-12551-03
	March 2022202-12551-02ade minor corrections to Technical specifications for Orbi Pro WiFi 6 AX5400 router model SXR50 on page 239 and Technical specifications for Orbi Pro WiFi 6 AX5400 satellite model SXS50 on page 240.
		First publication.February 2022202-12551-01

Contents

Chapter 1 Overview and Setup

Supported Orbi Pro WiFi 6 AX5400 models....12

Orbi Pro WiFi 6 AX5400 router and satellite hardware overviews.12

Orbi Pro WiFi 6 AX5400 router model SXR50 hardware.....12

Orbi Pro WiFi 6 AX5400 satellite model SXS50 hardware.....13

LED behavior....14

Orbi Pro WiFi 6 AX5400 System LEDs....14

Add-on Orbi Pro WiFi 6 AX5400 satellite LEDs....15

Orbi Pro WiFi 6 AX5400 router and satellite labels....15

Connect your Orbi Pro WiFi 6 AX5400 router....16

Place your Orbi Pro WiFi 6 AX5400 satellite....17

Sync your Orbi Pro WiFi 6 AX5400 satellite....18

Sync a satellite from an Orbi Pro WiFi 6 AX5400 system......18

Sync an add-on Orbi Pro WiFi 6 AX5400 satellite....19

Add satellites to your network using the router web interface.20

Set up your satellite with a wired connection to your router.....21

Set up and sync an Orbi Pro satellite over a wired connection.21

Ethernet backhaul connections for multiple satellites......22

Manage and monitor your Orbi Pro network with NETGEAR

Insight....23

NETGEAR Insight Business VPN 23

Chapter 2 Connect to the Orbi Pro WiFi 6 AX5400 Network and Access the Router

Connect to the Orbi Pro network for initial conguration.....26

Wired connection....26

WiFi connection....26

WiFi connection using WPS....27

Types of logins....27

Use a web browser to access the router......27

Use the interactive Internet setup process....28

Log in to the Orbi router web interface....29

Change the language....30

What to do if you get a browser security warning......30

Chapter 3 Specify Your Internet Settings

Setup Wizard....33

Manually set up the Internet connection....33

Set up an Internet connection without a login....34

Set up an Internet connection with a login....35

IPv6 Internet connections....37

Requirements for entering IPv6 addresses....37

Set up IPv6 Internet connections....37

Use auto detection for an IPv6 Internet connection....38

Use auto conguration for an IPv6 Internet connection......40

Set up an IPv6 6to4 tunnel Internet connection....41

Set up an IPv6 6rd tunnel Internet connection....43

Set up an IPv6 pass-through Internet connection....45

Set up an IPv6 xed Internet connection....46

Set up an IPv6 DHCP Internet connection....47

Set up an IPv6 PPPoE Internet connection....49

MTU size....51

Chapter 4 Control Access to the Internet

MAC access control lists....54

Enable a MAC ACL for a specific network....55

Add automatically detected devices to a MAC ACL....56

Manually add, remove, or change the information for a device on a MAC ACL....57

Disable a MAC ACL for a specific network....58

Network access control list....59

Enable the network access control list and specify the access rule....60

Manage the allowed devices on the network access control list....62

Manage the blocked devices on the network access control list....63

Block Internet sites by using keywords....64

Delete keywords that are used to block Internet sites......66

Trusted computer....66

Block services from the Internet....67

Schedule when to block Internet sites and services....69

Email notifications for security events....70

Chapter 5 Manage the VLANs

About VLANs in general....73

About VLANs on the router....73

How the router organizes LANs, VLANs, and WLANs......74

VLAN proles....75

Add a new VLAN prole....75

Add a new VLAN prole directly to a LAN....77

Change the client isolation or network isolation for a VLAN profile....79

Delete a VLAN prole....80

VLAN membership for a LAN, WiFi network, or port......81

Change the VLAN prole for a LAN....81

Enable, change, or disable the VLAN prole for a WiFi network....82

Change the VLAN prole for an Ethernet port....83

VLAN tag group as a bridge for an IPTV device....84

Port mode: Trunk mode or Access mode....86

Chapter 6 Manage the WiFi Networks

About the WiFi networks....89

admin (default) WiFi network....90

Change the admin WiFi network name, channel, or VLAN or add a WLAN schedule....90

Change the admin WiFi password or security level....92

Employee WiFi network....95

Enable the employee WiFi network and manage the settings.95

Change the employee WiFi password or security level.....97

Internet of things WiFi network....100

Enable the IoT WiFi network and manage the settings......100

Change the IoT WiFi password or security level....102

Guest WiFi network and captive portal....105

Set up a guest WiFi network with open access or password authentication....106

Set up Facebook Wi-Fi for the guest WiFi network....109

Set up a guest WiFi network with a captive portal....112

Chapter 7 Manage the LANs

About the LANs....117

LAN settings....118

Change the default LAN 1 settings....118

Change the employee LAN 2 settings....120

Change the IoT LAN 3 settings....121

Change the guest LAN 4 settings....122

Set custom settings for LAN 5....123

DHCP servers....124

Set up a DHCP server for the default LAN 1....125

Set up a DHCP server for the employee LAN 2....126

Set up a DHCP server for the IoT LAN 3....127

Set up a DHCP server for the guest LAN 4....128

Set up a DHCP server for the custom LAN 5....129

Disable the DHCP server for a LAN....131

Reserved LAN IP addresses....131

Reserve a LAN IP address....132

Edit a reserved LAN IP address....133

Delete a reserved LAN IP address entry....133

Multicast DNS gateway....134

Enable the multicast DNS gateway and add a policy.....134

Change or remove a multicast DNS policy....136

Chapter 8 Manage the WAN and other Network Settings

WAN settings....139

Dynamic DNS....140

Set up a new Dynamic DNS account....141

Specify a DNS account that you already created....142

Change the Dynamic DNS settings....143

DMZ server....143

Static routes....144

Set up a static route....145

Change a static route....147

Delete a static route....147

Universal Plug and Play....148

Link aggregation....149

Add a link aggregation group....150

Remove a link aggregation group....151

Set up a LAG connection between an Orbi Pro WiFi 6 AX5400

satellite and router....152

Chapter 9 Manage and Monitor Your Orbi Pro System

Firmware for the router and satellite....155

Enable the automatic rmware update feature....155

Check for rmware updates....155

Manually update rmware....156

Manually update satellite rmware....157

Manually update router rmware....158

admin password....159

Change the admin password....159

Enable admin password reset....160

Reset the admin password....161

Monitor the router, satellite, and Orbi Pro network....162

View router status and usage information....162

View the satellite status in the satellite web interface......162

View satellites, WiFi devices, and wired devices connected to the

Orbi Pro network....163

Check the Internet connection status or renew the connection....165

Display port and radio statistics....166

View and manage logs of router activity....167

Syslog server....168

Trafc meter....169

Start the trafc meter without trafc restrictions....170

Restrict Internet trafc by volume....171

Restrict Internet trafc by connection time....172

View the Internet traffic volume and statistics....173

Unblock the trafc meter after the trafc limit is reached.....174

NTP server....175

Time zone....175

Conguration le....176

Back up settings....176

Manage the automatic backup options....177

Erase the current conguration settings....178

Restore conguration settings....178

Remote management....179

Remote access....180

AP mode....180

Router mode....182

Sync button security....183

Manage the Sync button on the router....183

Manage the Sync button on the satellite....184

Chapter 10 Manage the Advanced WiFi Settings

Download bandwidth per SSID....186

Region of operation....187

SSID broadcast for a radio....188

20/40 MHz coexistence for the 2.4 GHz radio....189

Wi-Fi multimedia for a radio....190

CTS/RTS threshold and preamble mode for a radio....191

Transmission output power for a radio....192

Backhaul password....193

MU-MIMO....194

Protected Management Frames....195

Chapter 11 Customize Internet Trafc Rules for Ports

Port forwarding to a local server....198

Set up port forwarding to a local server....198

Add a custom port forwarding service....199

Edit a port forwarding service....200

Delete a port forwarding entry....201

Application example: Make a local web server public......201

How the router implements the port forwarding rule......202

Port triggering....203

Add a port triggering service....203

Enable port triggering....204

Application example: Port triggering for Internet Relay Chat.205

Chapter 12 Use OpenVPN to Access Your Network

About VPN connections....208

LAN IP addressing in VPN networks....208

Enable OpenVPN service in the router.....209

Install OpenVPN software on a VPN client....210

Install OpenVPN software on a Windows-based computer....211

Install OpenVPN software on a Mac computer......212

Install OpenVPN software on an iOS device....213

Install OpenVPN software on an Android device....214

Use VPN to access your Internet service at your business......215

Allow VPN client Internet access in the router......216

Block VPN client Internet access in the router......216

Chapter 13 Troubleshooting

Quick tips....219

Sequence to restart your network....219

WiFi settings....219

Network settings....219

The router and satellite do not sync....219

You cannot log in to the router....221

You cannot access the Internet....221

Troubleshoot Internet browsing....222

Troubleshoot PPPoE....223

Troubleshoot WiFi connectivity....224

Troubleshoot your network using the ping utility....224

Test the LAN path to your router....224

Test the path from your computer to a remote device......225

Appendix A How to Use VLANs in Your Network

VLAN use case 1: Orbi Pro WiFi 6 router in a home environment.22

VLAN use case 2: Orbi Pro WiFi 6 router in a business

environment....230

Appendix B Supplemental Information

Factory settings....235

Factory settings for Orbi Pro WiFi 6 AX5400 router model

SXR50....235

Factory settings for Orbi Pro WiFi 6 AX5400 satellite model

SXS50....238

Technical specifications....239

Technical specifications for Orbi Pro WiFi 6 AX5400 router model

SXR50....239

Technical specifications for Orbi Pro WiFi 6 AX5400 satellite

model SXS50....240

1

Overview and Setup

The Orbi Pro WiFi 6 AX5400 Tri-band Mesh System (SXK50) creates dedicated high-speed WiFi connections to your Internet service. The Orbi Pro WiFi 6 AX5400 router (model SXR50) connects to your modem or gateway. You can use the router alone or let it support up to six Orbi Pro WiFi 6 AX5400 satellites (model SXR50) can extend the WiFi signal throughout your business, ofce, or home.

This chapter contains the following sections:

• Supported Orbi Pro WiFi 6 AX5400 models
- Orbi Pro WiFi 6 AX5400 router and satellite hardware overviews
- LED behavior
- Orbi Pro WiFi 6 AX5400 router and satellite labels
- Connect your Orbi Pro WiFi 6 AX5400 router
- Place your Orbi Pro WiFi 6 AX5400 satellite
- Sync your Orbi Pro WiFi 6 AX5400 satellite
- Set up your satellite with a wired connection to your router
- Manage and monitor your Orbi Pro network with NETGEAR Insight
• NETGEAR Insight Business VPN

For more information about the topics covered in this manual, visit the support at netgear.com/support.

Note: This manual refers to the Orb Pro WiFi 6 AX5400 router as the router and refers to the Orbi Pro WiFi 6 AX5400 satellite as the satellite.

Note: The Orbi Pro WiFi 6 AX5400 router does not pair with satellites from a Orbi and Orbi Pro systems. The Orbi Pro WiFi 6 AX5400 satellite does not p router from any other Orbi and Orbi Pro system.

Supported Orbi Pro WiFi 6 AX5400 mod

This user manual describes the following Orbi Pro WiFi 6 AX5400 models:

• Orbi Pro WiFi 6 AX5400 Router (Model SXR50)
• Orbi Pro WiFi 6 AX5400 Satellite (Model SXS50)

Note: To manage your Orbi Pro WiFi 6 AX5400 router and any Orbi Pro WiFi satellites that are connected to your Orbi Pro WiFi 6 network, you must manage from your Orbi Pro WiFi 6 AX5400 router web interface.

Orbi Pro WiFi 6 AX5400 router and sat hardware overviews

The following sections display and describe the hardware features of the Orbi Pr AX5400 router (model SXR50) and Orbi Pro WiFi 6 AX5400 satellite (model SXS

Orbi Pro WiFi 6 AX5400 router model SXR50 hardwar

White cylindrical device with a blue vertical line and number 14 at the base (no text or symbols on the device itself)

Figure 1. Orbi Pro WiFi 6 AX5400 router model SXR50, front and back views

1. Bar LED

2. Sync button (also used for WPS connection)

3. LAN Gigabit Ethernet ports 1-3. LAN ports 1 and 2 support link aggregation

4. WAN Gigabit Ethernet port (with a yellow label). Use this port for your Internet connection.
5. DC Power connector
6. Reset button
7. Power LED

Orbi Pro WiFi 6 AX5400 satellite model SXS50 hardw

White cylindrical device with a blue vertical line and number 12 at the bottom (no text or symbols on the device itself)

Figure 2. Orbi Pro WiFi 6 AX5400 satellite model SXS50, front and back views

1. Bar LED
2. Sync button (also used for WPS connection)
3. LAN Gigabit Ethernet ports 1-4. LAN ports 1 and 2 support link aggregation
4. DC Power connector
5. Reset button
6. Power LED

LED behavior

When you sync an Orbi Pro WiFi 6 AX5400 satellite to the Orbi Pro WiFi 6 router, the LED behavior for a satellite that comes in an Orbi Pro WiFi 6 AX is different from the LED behavior for add-on Orbi Pro WiFi 6 AX5400 satellite

Orbi Pro WiFi 6 AX5400 System LEDs

The following table describes the LED behavior for an Orbi Pro WiFi 6 AX5400 (model SXR50) and Orbi Pro WiFi 6 AX5400 satellite (model SXS50) that are p together and come in the same package.

Table 1. Orbi Pro WiFi 6 AX5400 System router and satellite LED descriptions

	LED BehaviorLED
Power LED	The Power LED is located adjacent to the power connector on the rear panel.Solid green: Power is on.Solid amber: The router or satellite is booting.Blinking amber: The router or satellite is resetting to factory default settings.Blinking red: The rmware is corrupted.Off: Power is not supplied.
Router bar LED	The bar LED is located on the front.Pulsing white: The router is booting or someone pressed the Sync button.Off: The router nished booting and is working normally.Solid white: The router is resetting to factory default settings.Solid magenta: The router cannot connect to the Internet. See You cannot access the Internet on page 221.
Satellite bar LED	This satellite is included when you buy an Orbi router. The bar LED is located on the fiPulsing white: The satellite is booting.Blue for three minutes: The connection between the satellite and the router is good.Amber for three minutes: The connection between the satellite and the router is fair.Magenta: The satellite failed to sync to the router. See The router and satellite do not sync on page 219.Off: The satellite synced to the router and is working normally.

Add-on Orbi Pro WiFi 6 AX5400 satellite LEDs

The following table describes the LED behavior for an add-on Orbi Pro WiFi 6 satellite (model SXS50) that was purchased separately from the Orbi Pro WiFi 6 System kit.

Table 2. Orbi Pro WiFi 6 AX5400 add-on satellite (model SXS50) LED description

	LED BehaviorLED
Power LED	The Power LED is located adjacent to the power port on the rear panel.Solid green: Power is on.Solid amber: The satellite is rebooting.Blinking amber: The satellite is resetting to factory default settings.Blinking red: The rmware is corrupted.Off: Power is not supplied.
Add-on satellite bar LED	Optional add-on satellites are sold separately and can be added to your Orbi Pro netwoThe bar LED is located on the front.Pulsing white: The satellite is booting.Solid white: The satellite is ready to sync to the router (press the Sync button).Blue for three minutes: The connection between the satellite and the router is good.Amber for three minutes: The connection between the satellite and the router is fair.Magenta: The satellite is not connected to the router or is not getting an IP addressOff: The satellite synced to the router and is working normally.

Orbi Pro WiFi 6 AX5400 router and sat labels

The Orbi Pro WiFi 6 AX5400 router label shows the login information, the WiFi name and password, the router's MAC address, and the router's serial number. following is an example of what the router label might look like:

Figure 3. Orbi Pro WiFi 6 AX5400 Model SXR50 router label

The Orbi Pro WiFi 6 AX5400 satellite label shows the WiFi network name and the satellite's MAC address, and the satellite's serial number. The following is an of what the satellite label might look like:

Figure 4. Orbi Pro WiFi 6 AX5400 SXS50 satellite label

Connect your Orbi Pro WiFi 6 AX5400

The back of the router has one yellow WAN port and three LAN ports. The router displays model SXR50, and the preset WiFi network name (SSID) and pas

To cable your Orbi Pro router:

1. Connect your Orbi Pro router to a modem or gateway that provides Interne

- If you use a modem, unplug the modem, remove and then reinsert the battery if it uses one, and plug the modem back in.

- If you use a WiFi gateway, we recommend that you turn off your gateway

1. Use an Ethernet cable to connect your modem or gateway to the yellow V on the back of your router.

2. Connect the power adapter to your router and plug the power adapter into The Power LED on the back of the router lights green.

When the bar LED on the front of the router lights solid white, the router' WiFi network is ready for setup.

The router's bar LED turns off after about three minutes.

Diagram of a network device with power outlets, connectors, and a central router (no text or symbols visible)

Place your Orbi Pro WiFi 6 AX5400 sat

Your satellite must be within range of your router's WiFi signal in order for it the router.

For the sync process, we recommend that you place the satellite approximately away from the router, facing the router, with a direct line of sight.

Use the satellite's bar LED to help you determine where to place your satellite

Sync your Orbi Pro WiFi 6 AX5400 sate

The sync process for your Orbi Pro WiFi 6 AX5400 satellite depends on whether satellite came with your Orbi Pro WiFi 6 AX5400 system, or if your satellite is satellite.

Sync a satellite from an Orbi Pro WiFi 6 AX5400 sy

The Orbi Pro WiFi 6 AX5400 system includes an Orbi Pro WiFi 6 AX5400 router. Orbi Pro WiFi 6 AX5400 satellite. The Orbi Pro WiFi 6 AX5400 satellite that is with an Orbi Pro WiFi 6 AX5400 router is preset to automatically nd and sync router's WiFi signal.

To sync your Orbi Pro WiFi 6 AX5400 satellite:

1. Place your satellite.

For more information, see Place your Orbi Pro WiFi 6 AX5400 satellite on p

1. Connect the satellite to a power source.

The Power LED on the back of the satellite lights green.

The satellite bar LED pulses white. The satellite automatically nds the router's signal and attempts to sync to the Orbi Pro WiFi 6 AX5400 router.

Note: The rst time that you sync the satellite and the router, the sync pro-take up to ve minutes because the router might automatically update the sat- rmware.

The satellite bar LED lights one of the following colors for about three minutes then turns off:

• Blue: The router and satellite successfully synced, and the connection between the router and satellite is good.
• Amber: The router and satellite successfully synced, and the connection betv the router and satellite is fair. Consider moving the satellite closer to the

• Magenta: The router and satellite failed to sync.

• If the satellite bar LED is magenta, move the satellite closer to the router sync the satellite to the router:

a. Press the Sync button on the back of the router.
b. Within two minutes, press the Sync button on the back of the satellite. The satellite attempts to sync to the router. The satellite bar LED lights amber, or magenta as described in Step 2 of this procedure and then to

Sync an add-on Orbi Pro WiFi 6 AX5400 satellite

If you already set up an Orbi Pro WiFi 6 AX5400 router and satellite and you an optional add-on Orbi Pro WiFi 6 AX5400 satellite (sold separately), follow the in this section.

Note: When you purchase an Orbi Pro WiFi 6 AX5400 satellite separately from Orbi Pro WiFi 6 AX5400 router, the satellite has a different WiFi network name password. However, after syncing the add-on satellite with the router, the satellite the same WiFi network name and password as the router.

To sync your add-on Orbi Pro WiFi 6 AX5400 satellite:

1. Place your satellite.
   For more information, see Place your Orbi Pro WiFi 6 AX5400 satellite on p
2. Connect the satellite to a power source.
   The power LED on the back of the satellite lights green.
3. Wait about two minutes for the satellite bar LED to light solid white.
4. Press the Sync button on the back of the satellite and within two minutes, Sync button on the back of your Orbi WiFi 6 AX5400 router.

The satellite bar LED pulses white, then lights one of the following colors for three minutes, and then turns off:

• Blue: The router and satellite successfully synced, and the connection between the router and satellite is good.
• Amber: The router and satellite successfully synced, and the connection betv the router and satellite is fair. Consider moving the satellite closer to the
• Magenta: The router and satellite failed to sync. Move the satellite closer router and try again.

Note: The rst time that you sync the satellite and the router, the sync pro take up to ve minutes because the router might automatically update the sat rmware.

Add satellites to your network using the router web ir

You can use the Orbi Pro WiFi 6 AX5400 router web interface to add a sate Orbi Pro network.

To add a satellite to your Orbi Pro network using the router web interface

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Add Orbi Pro Satellite.

The Place Your Satellite page displays.

1. Follow the instructions about where to place your satellite at your location.
2. Connect the satellite to a power source.
3. Click the NEXT button.
4. Wait about two minutes for the satellite's bar LED to light solid white.
5. Press the Sync button on the satellite.

The satellite's bar LED pulses white.

1. Click the SYNC button in the router web interface.

The router attempts to sync with the satellite.

The satellite's bar LED lights one of the following colors for about three mi then turns off:

• Blue: The router and satellite successfully synced, and the connection between the router and satellite is good.
• Amber: The router and satellite successfully synced, and the connection betv the router and satellite is fair. Consider moving the satellite closer to the
• Magenta: The router and satellite failed to sync. Move the satellite closer router and try again.

Note: The rst time that you sync the satellite and the router, the sync pro take up to ve minutes because the router might automatically update the sat rmware.

Set up your satellite with a wired connection to your router

Instead of using a WiFi backhaul connection between the router and the satellite can use a wired connection.

Set up and sync an Orbi Pro satellite over a wired connection

In some situations, you might prefer to set up your Orbi Pro satellite with an cable directly connected to your Orbi Pro router.

If your business has built-in Ethernet outlets in the ofce rooms and the cables the same physical network, you can also connect both your Orbi Pro router an Pro satellite to the Ethernet outlets and let them sync.

To set up and sync your Orbi Pro satellite over a wired connection:

1. Place your satellite in the room where you want WiFi service.
2. Connect an Ethernet cable to one of the LAN ports.
3. Connect the other end of the Ethernet cable to a LAN port on the router.
4. Connect the satellite to a power source.

The Power LED on the back of the satellite lights green.

The satellite bar LED pulses white. The satellite automatically syncs to the On router.

Note: The rst time that you sync the satellite and the router, the sync pro take up to ve minutes because the router might automatically update the sat rmware.

After the sync process is complete, the satellite bar LED lights blue for abo minutes and then turns off. Blue indicates that the router and satellite success synced, and the wired connection between the router and satellite is good.

Ethernet backhaul connections for multiple satellites

Your Orbi Pro WiFi 6 satellite automatically connects over WiFi to your Orbi Pro or another Orbi Pro satellite to create a WiFi backhaul connection, or you can Ethernet cable to connect your satellite to your router or another satellite to wired backhaul connection.

Before you set up an Ethernet backhaul connection, make sure that you update rmware on all your Orbi Pro WiFi 6 devices.

Note: The products shown in the following diagrams do not represent any part Orbi Pro models, but the topologies and setups in the diagrams do apply to y

The following gure shows how to connect your Orbi Pro WiFi 6 satellites to y Pro WiFi 6 router using a star topology to create an Ethernet backhaul connec

graph LR
    A["Internet"] --> B["Modem"]
    B --> C["Router"]
    C --> D["Satellite 1 Satellite 2"]
    C --> E["Satellite 1 Satellite 3"]

Figure 5. Star topology: Satellites connected to the router's Ethernet ports

The following gure shows another way to connect your Orbi Pro WiFi 6 satellite your Orbi Pro WiFi 6 router using a daisy chain topology to create an Ethern connection.

graph LR
    A["Internet"] --> B["Modem"]
    B --> C["Router"]
    C --> D["Satellite 1 Satellite 2"]
    C --> E["Satellite 2"]
    style A fill:#f9f,stroke:#333
    style B fill:#ccf,stroke:#333
    style C fill:#cfc,stroke:#333
    style D fill:#fcc,stroke:#333
    style E fill:#cff,stroke:#333

Figure 6. Daisy chain topology: Satellite 1 connected to router and satellite 2 connected to sat

The following gure shows how to connect your Orbi Pro WiFi 6 satellites to y Pro WiFi 6 router through an Ethernet switch.

graph LR
    A["Internet"] --> B["Modem"]
    B --> C["Router"]
    C --> D["Switch"]
    D --> E["Satellite 1 Satellite 2"]
    E --> F["Satellite 1 Satellite 2"]

Figure 7. Ethernet backhaul connection using a switch

Manage and monitor your Orbi Pro netv with NETGEAR Insight

If you are a NETGEAR Insight Premium or Pro subscriber, after you use the ro interface to set up your Orbi system, you can use NETGEAR Insight to manage monitor your Orbi Pro network remotely.

For more information about NETGEAR Insight, visit https://www.netgear.com/insight/.

Purple square icon with a white network diagram and the text 'NETGEAR' below it (no additional symbols or text)

NETGEAR Insight Business VPN

NETGEAR Insight Business VPN enables Orbi Pro routers to support a virtual pr network (VPN) tunnel between a main site and remote sites. A VPN tunnel allo data traffic with encryption for work-from-home employees or between business branches. Insight Business VPN requires an Orbi Pro router at each end of the tunnel.

After Insight Business VPN is configured, the end user does not need to use a log in, or use two-factor authentication (2FA): They connect to the existing ofce and they are on the VPN. VPN access is also supported for wired clients and devices that are cabled to the LAN ports of a router at a remote site.

Insight Business VPN features include site-to-site VPN connectivity, creating and deleting VPN groups for easy group management per main site, user management to create authentication and manage VPN access for users, business sites, information and systems and many more features.

Note: You cannot congregate Insight Business VPN with the router web interface. must use NETGEAR Insight.

If you are a NETGEAR Insight Premium or Pro subscriber, you can purchase a VPN subscription. Each remote site requires a subscription. A main site does not a subscription. For more information about subscriptions, visit netgear.com/business/services/insight/services/.

For more information about Insight Business VPN, visit https://kb.netgear.com/000063726.

2

Connect to the Orbi Pro WiFi AX5400 Network and Access the Router

To manage your Orbi Pro WiFi 6 AX5400 router and any Orbi Pro WiFi 6 AX! that are connected to your Orbi Pro Wi 6 network, you must manage them from Orbi Pro WiFi 6 AX5400 router web interface.

This chapter contains the following sections:

• Connect to the Orbi Pro network for initial conguration
• Types of logins
• Use a web browser to access the router
• Change the language
  • What to do if you get a browser security warning

Connect to the Orbi Pro network for in conguration

You can connect to the Orbi Pro network through a wired or WiFi connection.

Note: If you set up your computer to use a static IP address, change the se that it uses Dynamic Host Conguration Protocol (DHCP).

Wired connection

You can connect your computer to the router using an Ethernet cable and join router's local area network (LAN).

To connect your computer to the router with an Ethernet cable:

1. Make sure that the router is receiving power (its Power LED is lit).
2. Connect an Ethernet cable to an Ethernet port on your computer.
3. Connect the other end of the Ethernet cable to one of the router's Etherne Your computer connects to the LAN.

WiFi connection

When you install your Orbi router for the rst time, you can connect to the rd network by scanning the QR code on your router with the camera app on your device. To scan the QR code with your camera app, your mobile device must version 11 or later, or Android version 10 or later.

You can also manually nd and select the Orbi router's WiFi network from your WiFi-enabled computer or mobile device.

To nd and select the WiFi network:

1. Make sure that the router is receiving power (its Power LED is lit).
2. On your WiFi-enabled computer or mobile device, nd and select the WiFi net. The WiFi network name is on the router label.
3. Join the WiFi network and enter the WiFi password.
   The password is on the router or satellite label.
   Your WiFi-enabled computer or mobile device connects to the WiFi network.

WiFi connection using WPS

You can connect to the router's WiFi network with Wi-Fi Protected Setup (WPS) can nd and select the WiFi network.

To use WPS to connect to the WiFi network:

1. Make sure that the router is receiving power (its Power LED is lit).
2. Check the WPS instructions for your computer or WiFi device.
3. Press the Sync button on the router.
4. Within two minutes, on your WiFi-enabled computer or mobile device, press its WPS button or follow its instructions for WPS connections.
   Your computer or mobile device connects to the WiFi network.

Types of logins

You must use different logins for different types of tasks:

• Internet service login: The login information that your Internet service provide (ISP) gave you lets your router connect to your Internet service. Your service gave you this login information in a letter or some other way. If you cannot login information, contact your ISP.
• WiFi network login: Your router uses a preset WiFi network name (SSID) and password for WiFi access. This information is on the router label. During setup can change the WiFi network name (SSID) and password for increased securit
• Orbi Pro router login: The password that logs you in to the router interface web browser as the admin. The default password for initial login is password setup or at initial login, you must specify a new password for increased sec

Use a web browser to access the route

When you connect to the network (either through WiFi or through an Ethernet you can use a web browser to access the router to view or change the setti router and the satellites that you synced with the router.

The rst time you log in to the router web interface, use the interactive Internet process to connect your router to your Internet service. You can also set up y manually.

Use the interactive Internet setup process

Before you start the interactive Internet setup process, get your ISP information make sure that the computers and devices in the network use the settings des here.

When your Internet service starts, your Internet service provider (ISP) typically give all the information needed to connect to the Internet.

For DSL service, you might need the following information to set up your route

• The ISP congruration information for your DSL account
• ISP login name and password
• Fixed or static IP address settings (special deployment by ISP; this setting is

If you cannot locate this information, ask your ISP to provide it.

The interactive Internet setup process takes about 10 minutes to complete.

To use the interactive Internet setup process:

1. Power on your router.
2. Make sure that your WiFi-enabled computer or mobile device is connected to router with an Ethernet cable (wired) or wirelessly with the preset security set listed on the label.

Note: If you want to change the router's WiFi settings, use a wired connect the WiFi device that you are using for setup is not disconnected when the settings take effect.

1. Launch a web browser.

If your browser displays a security message, see What to do if you get a security warning on page 30.

The page that displays depends on whether you accessed the router before:

• The rst time that you set up the Internet connection for your router, the goes to orbilogin.com, and the Orbi login page displays.

• If you already set up the Internet connection, enter orbilogin.com in the eld for your browser to start the installation process.

• Follow the onscreen instructions.

The router connects to the Internet.

If your browser does not display the web page or your router does not cc the Internet, see the following troubleshooting suggestions.

	Your router does not connect to the InternetYour brows
through one of the LAN Ethernet ports, or is through WiFi.	Review your settings.Make sure that the computer is connected
Make sure that the router is receiving power, its Power LED is lit	Make there that you selected the correct options and typed everything correctly.
Close and reopen your browser or clear the cache.	Bovart your ISP to verify that you are using the corre conguration information.
Browse toorbilogin.com.	Read the information inTroubleshooting on page 218.
If your computer is set to a static or xed (this setting is uncommon), change its settings to and obteointact an IP address automatically from the router.	IPIf addresms persist, register your NETGEAR product

Log in to the Orbi router web interface

When you log in to the Orbi, the browser displays the router web interface. Use the router web interface to change the router or satellite settings.

To log in to your Orbi:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

Change the language

By default, the language is set as Auto.

To change the language:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. In the upper right corner, select a language from the menu.
2. When prompted, click the OK button to conrm this change.

The page refreshes with the language that you selected.

What to do if you get a browser secu warning

Access to the router web interface is encrypted through the Hyper Text Transfer Secure (HTTPS) protocol, instead of the Hyper Text Transfer Protocol (HTTP). The security of HTTPS requires your browser to verify that orbilogin.com (which is t as 192.168.1.1) is safe. As a result, a security warning can display in your bro you try to access that domain. This is expected behavior. You can proceed, or exception for the security warning.

To proceed with a security warning or add an exception for a security warning

• Google Chrome: Click the ADVANCED link. Then, click the Proceed to x.x.x.x (unsafe) link, in which x.x.x.x represents the domain name or IP address of t
• Apple Safari: Click the Show Details button. Then, click the visit this website link. If a warning pop-up window displays, click the Visit Website button. If another

pop-up window displays to let you conrm changes to your certificate trust set enter your Mac user name and password and click the Update Setting button

• Mozilla Firefox: Click the ADVANCED button. Then, click the Add Exception button.
  In the pop-up window that displays, click the Conrm Security Exception butt
• Microsoft Edge: Select Details > Go on to the webpage.
• Microsoft Internet Explorer: Click the Continue to this website (not recommended) link.

3

Specify Your Internet Settings

Usually, the quickest way to set up the router to use your Internet connection Orbi to detect the Internet connection when you rst access the router with a browser. You can also customize or specify your Internet settings.

This chapter contains the following sections:

• Setup Wizard
  • Manually set up the Internet connection
  • IPv6 Internet connections
• MTU size

Setup Wizard

You can use the Setup Wizard to detect your Internet settings and automatically your router.

To use the Setup Wizard:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup Wizard.

The Setup Wizard page displays.

1. Select the Yes radio button.

If you select No, you are taken to the Internet Setup page (see Manually's Internet connection on page 33).

1. Click the Next button.

The Setup Wizard searches your Internet connection for servers and protocols determine your ISP conguration and checks your operation mode.

Manually set up the Internet connection

You can set up, view, or change the router's Internet connection settings.

The type of Internet connection (with or without login) depends on your ISP.

Set up an Internet connection without a login

To set up an Internet connection that does not use a login:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Internet.

The Internet Setup page.

1. Leave the Does your Internet connection require a login No radio button se
2. If your Internet connection requires an account name or host name, do the

a. Next to the Account Name (If Required) eld, click the Edit button.

The Device Name page displays.

b. Type the name in the Device Name eld.
c. Click the Apply button.

The Internet Setup page displays again.

1. If your Internet connection requires a domain name, type it in the Domain Required) eld.

For the other sections in this page, the default settings usually work, but you change them.

1. Select an Internet IP Address radio button:

2. Get Dynamically from ISP: Your ISP uses DHCP to assign your IP address. ISP automatically assigns these addresses.

3. Use Static IP Address: Enter the IP address, IP subnet mask, and the gate address that your ISP assigned. The gateway is the ISP router to which y connects.

4. Select a Domain Name Server (DNS) Address radio button:

- Get Automatically from ISP: Your ISP uses DHCP to assign your DNS se Your ISP automatically assigns this address.

- Use These DNS Servers: If you know that your ISP requires specific server this option. Enter the IP address of your ISP's primary DNS server. If a DNS server address and a third DNS server address are available, enter t also.

1. Select a Router MAC Address radio button:

- Use Default Address: Use the default MAC address.

- Use Computer MAC Address: The router captures and uses the MAC adc of the computer that you are now using. If your ISP allows a single MA only, you must use the one computer that the ISP allows.

- Use This MAC Address: Enter the MAC address that you want to use.

1. Click the Apply button.

Your settings are saved.

1. Click the Test button to test your Internet connection.

Set up an Internet connection with a login

To set up an Internet connection that uses a login:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Internet.

The Internet Setup page displays.

1. Select the Does your Internet connection require a login Yes radio button.

The page adjusts.

1. From the Internet Service Provider menu, select the encapsulation method: The selections are PPPoE, L2TP, and PPTP.
2. In the Login eld, enter the login name your ISP gave you. This login name is often an email address.
3. In the Password eld, type the password that you use to log in to your lr service.
4. If your ISP requires a service name, type it in the Service Name (if Requi
5. From the Connection Mode menu, select Always On, Dial on Demand, or Manually Connect.
6. To change the number of minutes until the Internet login time out, in the Ic (In minutes) eld, type the number of minutes.

This is how long the router keeps the Internet connection active when no network is using the Internet connection. A value of 0 (zero) means never to The default value is 5.

1. Select an Internet IP Address radio button:

2. Get Dynamically from ISP: Your ISP uses DHCP to assign your IP address. ISP automatically assigns these addresses.

3. Use Static IP Address: Enter the IP address, IP subnet mask, and gateway address that your ISP assigned. The gateway is the ISP router to which y connects.

4. Select a Domain Name Server (DNS) radio button:

5. Get Automatically from ISP: Your ISP uses DHCP to assign your DNS se Your ISP automatically assigns this address.

6. Use These DNS Servers: If you know that your ISP requires specific server this option. Enter the IP address of your ISP's primary DNS server. If a DNS server address and a third DNS server address are available, enter t also.

7. Select a Router MAC Address radio button:

8. Use Default Address: Use the default MAC address.

9. Use Computer MAC Address: The router captures and uses the MAC adc of the computer that you are now using. If your ISP allows a single MA only, you must use the one computer that the ISP allows.

10. Use This MAC Address: Enter the MAC address that you want to use.

11. Click the Apply button.

Your settings are saved.

1. Click the Test button to test your Internet connection.

IPv6 Internet connections

The router supports many different types of IPv6 Internet connections for which set the settings manually.

Requirements for entering IPv6 addresses

IPv6 addresses are denoted by eight groups of hexadecimal quartets that are set by colons. You can reduce any four-digit group of zeros within an IPv6 address single zero or omit it. The following errors invalidate an IPv6 address:

• More than eight groups of hexadecimal quartets
- More than four hexadecimal characters in a quartet
• More than two colons in a row

Set up IPv6 Internet connections

You can set up an IPv6 Internet connection if the router does not detect it a

To set up an IPv6 Internet connection:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. From the Internet Connection Type menu, select the IPv6 connection type:

2. If you are not sure, select Auto Detect so that the router detects the ll that is in use.

3. If your Internet connection does not use PPPoE, DHCP, or xed, but is IP Auto Cong.

Your Internet service provider (ISP) can provide this information. For more information about IPv6 Internet connection, see the following sections:

• Use auto detection for an IPv6 Internet connection on page 38
• Use auto conguration for an IPv6 Internet connection on page 40
- Set up an IPv6 6to4 tunnel Internet connection on page 41
- Set up an IPv6 6rd tunnel Internet connection on page 43
- Set up an IPv6 pass-through Internet connection on page 45
- Set up an IPv6 xed Internet connection on page 46
- Set up an IPv6 DHCP Internet connection on page 47
- Set up an IPv6 PPPoE Internet connection on page 49

1. Click the Apply button.

Your settings are saved.

Use auto detection for an IPv6 Internet connection

To set up an IPv6 Internet connection through auto detection:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. From the Internet Connection Type menu, select Auto Detect.

The page adjusts.

The router automatically detects the information in the following elds:

- Connection Type: This eld indicates the connection type that is detected.

- Router's IPv6 Address on WAN: This field shows the IPv6 address that is for the router's WAN (or Internet) interface. The number after the slash (/) length of the prex, which is also indicated by the underline (_) under the address. If no address is acquired, the eld displays Not Available.

- Router's IPv6 Address on LAN: This field shows the IPv6 address that is for the router's LAN interface. The number after the slash (/) is the length prex, which is also indicated by the underline (_) under the IPv6 address. address is acquired, the eld displays Not Available.

1. In the LAN Setup section, select an IP Address Assignment radio button:

- Use DHCP Server: This method passes more information to LAN devices, some IPv6 systems might not support the DHCPv6 client function.

• Auto Cong: This is the default setting.

This setting species how the router assigns IPv6 addresses to the devices on business network (the LAN).

1. (Optional) Select the Use This Interface ID check box and specify the interface to be used for the IPv6 address of the router's LAN interface.

If you do not specify an ID here, the router generates one automatically from address.

1. Select an IPv6 Filtering radio button:

- Secured: In secured mode, which is the default mode, the router inspects TCP and UDP packets.

- Open: In open mode, the router inspects UDP packets only.

1. Click the Apply button.

Your settings are saved.

Use auto congruration for an IPv6 Internet connection

To set up an IPv6 Internet connection through auto conguration:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. From the Internet Connection Type menu, select Auto Cong.

The page adjusts.

The router automatically detects the information in the following elds:

• Router's IPv6 Address on WAN: This field shows the IPv6 address that is for the router's WAN (or Internet) interface. The number after the slash (/) length of the prex, which is also indicated by the underline (_) under the address. If no address is acquired, the eld displays Not Available.

• Router's IPv6 Address on LAN: This field shows the IPv6 address that is for the router's LAN interface. The number after the slash (/) is the length prex, which is also indicated by the underline (_) under the IPv6 address. address is acquired, the eld displays Not Available.

• (Optional) In the DHCP User Class (If Required) eld, enter a host name.

If your ISP gave you a specific host name, enter it here. Otherwise, leave the blank.

1. (Optional) In the DHCP Domain Name (If Required) eld, enter a domain na

You can type the domain name of your IPv6 ISP. Do not enter the domain the IPv4 ISP here. For example, if your ISP's mail server is mail.xxx.yyy.zzz, t xxx.yyy.zzz as the domain name. If your ISP provided a domain name, type

field. For example, Earthlink Cable might require a host name of home, and sometimes supplies a domain name.

1. In the IPv6 Domain Name Server (DNS) Address section, select a radio button

2. Get Automatically from ISP. Your ISP uses DHCP to assign your DNS se Your ISP automatically assigns these addresses.

3. Use These DNS Servers. If you know that your ISP requires specific server this option. Enter the IP address of your ISP's primary DNS server. If a DNS server address is available, enter it also.

4. In the LAN Setup section, select an IP Address Assignment radio button:

5. Use DHCP Server: This method passes more information to LAN devices, some IPv6 systems might not support the DHCPv6 client function.
   • Auto Cong: This is the default setting.

6. (Optional) Select the Use This Interface ID check box and specify the interface that you want to be used for the IPv6 address of the router's LAN interface. If you do not specify an ID here, the router generates one automatically from address.

7. Select an IPv6 Filtering radio button:

- Secured: In secured mode, which is the default mode, the router inspects TCP and UDP packets.

- Open: In open mode, the router inspects UDP packets only.

1. Click the Apply button.

Your settings are saved.

Set up an IPv6 6to4 tunnel Internet connection

The remote relay router is the router to which your router creates a 6to4 tune sure that the IPv4 Internet connection is working before you apply the 6to4 tune settings for the IPv6 connection.

To set up an IPv6 Internet connection by using a 6to4 tunnel:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. From the Internet Connection Type menu, select 6to4 Tunnel.

The page adjusts.

The router automatically detects the information in the Router's IPv6 Address LAN eld. This eld shows the IPv6 address that is acquired for the router's interface. The number after the slash (/) is the length of the prex, which is indicated by the underline (_) under the IPv6 address. If no address is acquired displays Not Available.

1. Select a Remote 6to4 Relay Router radio button:

2. Auto: Your router uses any remote relay router that is available on the I This is the default setting.

3. Static IP Address: Enter the static IPv4 address of the remote relay route IPv6 ISP usually provides this address.

4. In the IPv6 Domain Name Server (DNS Address), select a radio button:

5. Get Automatically from ISP: Your ISP uses DHCP to assign your DNS se Your ISP automatically assigns this address.

6. Use These DNS Servers: If you know that your ISP requires specific server this option. Enter the IP address of your ISP's primary DNS server. If a DNS server address is available, enter it also.

7. In the LAN Setup section, select an IP Address Assignment radio button:

8. Use DHCP Server: This method passes more information to LAN devices, some IPv6 systems might not support the DHCPv6 client function.
   • Auto Cong: This is the default setting.

This setting species how the router assigns IPv6 addresses to the devices on business network (the LAN).

1. (Optional) Select the Use This Interface ID check box and specify the interface that you want to be used for the IPv6 address of the router's LAN interface. If you do not specify an ID here, the router generates one automatically from address.

2. Select an IPv6 Filtering radio button:

3. Secured: In secured mode, which is the default mode, the router inspects TCP and UDP packets.

4. Open: In open mode, the router inspects UDP packets only.

5. Click the Apply button.

Your settings are saved.

Set up an IPv6 6rd tunnel Internet connection

The 6rd protocol makes it possible to deploy IPv6 to sites using a service proIPv4 network. 6rd uses the service provider's own IPv6 address prex. This limits operational domain of 6rd to the service provider's network and is under direct of the service provider. The IPv6 service provided is equivalent to native IPv6. mechanism relies on an algorithmic mapping between the IPv6 and IPv4 address are assigned for use within the service provider's network. This mapping allows automatic determination of IPv4 tunnel endpoints from IPv6 prexes, allowing statel operation of 6rd.

With a 6rd Tunnel conguration, the router follows the RFC5969 standard, support two ways to establish a 6rd tunnel IPv6 WAN connection:

• Auto Detect Mode: In IPv6 Auto Detect mode, when the router receives op from the DHCPv4 option, auto detect selects the IPv6 as 6rd Tunnel setting. router uses the 6rd option information to establish the 6rd connection.
• Manual Mode: Select 6rd. If the router receives option 212, the elds are automatically completed. Otherwise, you must enter the 6rd settings.

To set up an IPv6 6rd Tunnel Internet connection:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. In the Internet Connection Type menu, select 6rd.

The page adjusts.

The router can automatically detect the information in the following sections:

• 6rd (IPv6 Rapid Deployment) Conguration: The router detects the service provider's IPv4 network and attempts to establish an IPv6 6rd Tunnel conn If the IPv4 network returns 6rd parameters to the router, the page adjusts display the correct settings in this section.

• Router's IPv6 Address on LAN: This field shows the IPv6 address that is for the router's LAN interface. The number after the slash (/) is the length prex, which is also indicated by the underline (_) under the IPv6 address. address is acquired, the eld displays Not Available.

• If the router does not automatically detect the information in the 6rd (IPv6 Development) Conguration section, specify the 6rd prex, 6rd prex length, 6rd IPv4 border relay address, and 6rd IPv4 address mask length that the router use.

• In the IPv6 Domain Name Server (DNS) Address section, select a radio button

- Get Automatically from ISP: Your ISP uses DHCP to assign your DNS se Your ISP automatically assigns this address.

- Use These DNS Servers: If you know that your ISP requires specific server this option. Enter the IP address of your ISP's primary DNS server. If a DNS server address is available, enter it also.

1. In the LAN Setup section, select an IP Address Assignment radio button:

2. Use DHCP Server: This method passes more information to LAN devices, some IPv6 systems might not support the DHCPv6 client function.
   • Auto Cong: This is the default setting.

This setting species how the router assigns IPv6 addresses to the devices on business network (the LAN).

1. (Optional) Select the Use This Interface ID check box and specify the interface that you want to be used for the IPv6 address of the router's LAN interface. If you do not specify an ID here, the router generates one automatically from address.

2. Select an IPv6 Filtering radio button:

3. Secured: In secured mode, which is the default mode, the router inspects TCP and UDP packets.

4. Open: In open mode, the router inspects UDP packets only.

5. Click the Apply button.

Your settings are saved.

Set up an IPv6 pass-through Internet connection

In pass-through mode, the router works as a Layer 2 Ethernet switch with two and WAN Ethernet ports) for IPv6 packets. The router does not process any IP packets.

To set up a pass-through IPv6 Internet connection:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. From the Internet Connection Type menu, select Pass Through.

The page adjusts, but no additional elds display.

1. Click the Apply button.

Your settings are saved.

Set up an IPv6 xed Internet connection

To set up a xed IPv6 Internet connection:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. From the Internet Connection Type menu, select Fixed.

The page adjusts.

1. In the WAN Setup section, congregate the xed IPv6 addresses for the WAN connection:

2. IPv6 Address/Prex Length: The IPv6 address and prex length of the route WAN interface.

3. Default IPv6 Gateway: The IPv6 address of the default IPv6 gateway for router's WAN interface.
4. Primary DNS Server: The primary DNS server that resolves IPv6 domain records for the router.
5. Secondary DNS Server: The secondary DNS server that resolves IPv6 domain name records for the router.

Note: If you do not specify the DNS servers, the router uses the DNS server are congured for the IPv4 Internet connection on the Internet Setup page. (S Manually set up the Internet connection on page 33.)

1. In the LAN Setup section, select an IP Address Assignment radio button:

2. Use DHCP Server: This method passes more information to LAN devices, some IPv6 systems might not support the DHCPv6 client function.
   • Auto Cong: This is the default setting.

This setting species how the router assigns IPv6 addresses to the devices on business network (the LAN).

1. In the IPv6 Address/Prex Length elds, specify the static IPv6 address and p length of the router's LAN interface.

If you do not specify an ID here, the router generates one automatically from address.

1. Select an IPv6 Filtering radio button:

2. Secured: In secured mode, which is the default mode, the router inspects TCP and UDP packets.

3. Open: In open mode, the router inspects UDP packets only.

4. Click the Apply button.

Your settings are saved.

Set up an IPv6 DHCP Internet connection

To set up an IPv6 Internet connection with a DHCP server:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. From the Internet Connection Type menu, select DHCP.

The page adjusts.

The router automatically detects the information in the following elds:

• Router's IPv6 Address on WAN: This field shows the IPv6 address that is for the router's WAN (or Internet) interface. The number after the slash (/) length of the prex, which is also indicated by the underline (_) under the address. If no address is acquired, the eld displays Not Available.

• Router's IPv6 Address on LAN: This field shows the IPv6 address that is for the router's LAN interface. The number after the slash (/) is the length prex, which is also indicated by the underline (_) under the IPv6 address. address is acquired, the eld displays Not Available.

• (Optional) In the User Class (If Required) eld, enter a host name.

Most people can leave this eld blank, but if your ISP gave you a speci h enter it here.

1. (Optional) In the Domain Name (If Required) eld, enter a domain name.

You can type the domain name of your IPv6 ISP. Do not enter the domain the IPv4 ISP here. For example, if your ISP's mail server is mail.xxx.yyy.zzz, t xxx.yyy.zzz as the domain name. If your ISP provided a domain name, type field. For example, Earthlink Cable might require a host name of home, and sometimes supplies a domain name.

1. In the IPv6 Domain Name Server (DNS Address), select a radio button:

2. Get Automatically from ISP: Your ISP uses DHCP to assign your DNS se Your ISP automatically assigns this address.

3. Use These DNS Servers: If you know that your ISP requires specific server this option. Enter the IP address of your ISP's primary DNS server. If a DNS server address is available, enter it also.

4. In the LAN Setup section, select an IP Address Assignment radio button:

- Use DHCP Server: This method passes more information to LAN devices, some IPv6 systems might not support the DHCPv6 client function.

• Auto Cong: This is the default setting.

This setting species how the router assigns IPv6 addresses to the devices on business network (the LAN).

1. (Optional) Select the Use This Interface ID check box and specify the interface that you want to be used for the IPv6 address of the router's LAN interface

If you do not specify an ID here, the router generates one automatically from address.

1. Select an IPv6 Filtering radio button:

2. Secured: In secured mode, which is the default mode, the router inspects TCP and UDP packets.

3. Open: In open mode, the router inspects UDP packets only.

4. Click the Apply button.

Your settings are saved.

Set up an IPv6 PPPoE Internet connection

To set up a PPPoE IPv6 Internet connection:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > IPv6.

The IPv6 page displays.

1. From the Internet Connection Type menu, select PPPoE.

The page adjusts.

The router automatically detects the information in the following elds:

- Router's IPv6 Address on WAN: This field shows the IPv6 address that is for the router's WAN (or Internet) interface. The number after the slash (/) length of the prex, which is also indicated by the underline (_) under the address. If no address is acquired, the eld displays Not Available.

- Router's IPv6 Address on LAN: This field shows the IPv6 address that is for the router's LAN interface. The number after the slash (/) is the length

prex, which is also indicated by the underline (_) under the IPv6 address. address is acquired, the eld displays Not Available.

1. If already you set up your IPv4 ISP connection for PPPoE and want to use login information for IPv6, select the Use the same Login information as IP PPPoE check box.

To manually congregate the PPPoE settings for IPv6, specify the following setting

• Login: Enter the login name that your ISP gave you. This is usually the you use in your email address. For example, if your main mail account is [e-mail], you would type JerAB in this eld. Some ISPs (like Earthlink) require that you use your full email address when you log in. If your ISP your full email address, type it in this eld.
• Password. Enter the password for the ISP connection.
• Service Name (if Required). Enter a service name. If your ISP did not p service name, leave this eld blank.

Note: The default setting of the Connection Mode eld is Always On to provide a steady IPv6 connection. The router never terminates the connection. If the conn is terminated, for example, when the modem is turned off, the router attempt reestablish the connection immediately after the PPPoE connection becomes available again.

1. In the IPv6 Domain Name Server (DNS Address), select a radio button

2. Get Automatically from ISP: Your ISP uses DHCP to assign your DNS se Your ISP automatically assigns this address.

3. Use These DNS Servers: If you know that your ISP requires specific server this option. Enter the IP address of your ISP's primary DNS server. If a DNS server address is available, enter it also.

4. In the LAN Setup section, select an IP Address Assignment radio button:

5. Use DHCP Server: This method passes more information to LAN devices, some IPv6 systems might not support the DHCPv6 client function.
   • Auto Cong: This is the default setting.

This setting species how the router assigns IPv6 addresses to the devices on business network (the LAN).

1. (Optional) Select the Use This Interface ID check box and specify the interface that you want to be used for the IPv6 address of the router's LAN interface

If you do not specify an ID here, the router generates one automatically from address.

1. Select an IPv6 Filtering radio button:

2. Secured: In secured mode, which is the default mode, the router inspects TCP and UDP packets.

3. Open: In open mode, the router inspects UDP packets only.

4. Click the Apply button.

Your settings are saved.

MTU size

The maximum transmission unit (MTU) is the largest data packet a network device transmits. When one network device communicates across the Internet with another the data packets travel through many devices along the way. If a device in that uses a lower MTU setting than the other devices, the data packets must be so "fragmented" to accommodate the device with the smallest MTU.

The best MTU setting for NETGEAR equipment is often the default value. In sc situations, changing the value xes one problem but causes another. Leave the M unchanged unless one of these situations occurs:

- You experience problems connecting to your ISP or other Internet service, and technical support of either the ISP or NETGEAR recommends changing the MTU setting. These web-based applications might require an MTU change:

• A secure website that does not open, or displays only part of a web p
• Yahoo email

• MSN portal

• You use VPN and experience severe performance problems.

• You used a program to optimize MTU for performance reasons, and now yo experiencing connectivity or performance problems.

Note: An incorrect MTU setting can cause Internet communication problems. For example, you might not be able to access certain websites, frames within website secure login pages, or FTP or POP servers.

To change the MTU size:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > WAN Setup.

The WAN Setup page displays.

1. In the MTU Size eld, enter a value from 616 to 1500.
2. Click the Apply button.

Your settings are saved.

If you suspect an MTU problem, a common solution is to change the MTU. If you are willing to experiment, you can gradually reduce the MTU from the value of 1500 until the problem goes away. The following table describes cc MTU sizes and applications.

Table 3. Common MTU sizes

	ApplicationMTU
1500	The largest Ethernet packet size. This setting is typical for connections that do not PPPoE or VPN, and is the default value for NETGEAR routers, adapters, and switche
	Used in PPPoE environments.1492
	Maximum size to use for pinging. (Larger packets are fragmented.)1472
	Used in some DHCP environments.1468
	Used in PPTP environments or with VPN.1436

4

Control Access to the Internet

The router comes with a built-in rewall that helps protect your business network unwanted intrusions from the Internet.

This chapter includes the following sections:

• MAC access control lists
• Network access control list
• Block Internet sites by using keywords
- Delete keywords that are used to block Internet sites
- Trusted computer
• Block services from the Internet
- Schedule when to block Internet sites and services
- Email notifications for security events

MAC access control lists

A MAC access control list (ACL) for a WiFi network (that is, an SSID) or the (that is, the LAN) allows or denies a device access to the network based only MAC address of the device. If you block a device for one WiFi network or f network, the device is blocked only for that WiFi network or for the wired ne can set up an independent MAC ACL for each WiFi network and for the wire (The router supports multiple MAC ACLs.) With a MAC ACL, you can allow or access to a device on a speci WiFi network or the wired network.

Note: A MAC ACL differs from the network access control list (see Network ac control list on page 59). The network access control list is not specific to a p WiFi network or to the wired network but is based on both WiFi and wired the router detects on the entire Orbi Pro network. To allow or deny access to on a specific WiFi network or the wired network, use a MAC ACL. MAC ACLs network access control list are mutually exclusive. Use either MAC ACLs or the access control list.

If you set up a MAC ACL with a policy that allows access to a specific network on the MAC ACL are an exception to the default policy:

• A device for which you place the MAC address on the MAC ACL is denied that network.
• All other devices are allowed access to that network.

If you set up a MAC ACL with a policy that denies access to a specific network on the MAC ACL are an exception to the default policy:

• A device for which you place the MAC address on the MAC ACL is allowed to that work.
• All other devices are denied access to that network.

A blocked device can still get an IP address from the router but cannot commit with other devices on the network or connect to the Internet.

Note: Each network device owns a MAC address, which is a unique 12-character address, containing the hexadecimal characters 0-9, a-f, or A-F (uppercase or lower only, and separated by colons (for example, 00:09:AB:CD:EF:01). Typically, the MAC address is on the label of a device. If you cannot see the label, you can disaddress using the network congruration utilities of a computer. You might also in MAC addresses on Attached Devices page of the router (see View satellites, WiFi and wired devices connected to the Orbi Pro network on page 163).

Enable a MAC ACL for a specific network

When you enable a MAC ACL for a specific network, you must specify the def for that network. The default policy determines whether devices that you add to MAC ACL are allowed or denied access to that specific network.

You can set up an independent MAC ACL for each of the WiFi networks and wired network. That is, the router supports multiple MAC ACLs.

To enable a MAC ACL for a specific network:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > MAC ACL.

The MAC ACL page displays.

1. Go to the section for the network for which you want to set up a MAC

Note: Each section name corresponds to the SSID (WiFi network name) of a network, but the section for the Ethernet network is called Wired. If you did change the SSIDs (see Manage the WiFi Networks on page 88), the unique SSIDs for your product are displayed.

1. For the specific network, click the Enable MAC Access Control Disabled button. The button changes to the green Enabled button.

Note: If you enabled the network access control list (see Enable the network control list and specify the access rule on page 60), you cannot enable any ACLs. The network access control list and MAC ACLs are mutually exclusive. either the network access control list or MAC ACLs.

1. From the Default Policy menu, select one of the following options:

2. Allow: The policy is to allow all devices access except for the devices that add to the MAC ACL. Devices on the MAC ACL are denied access to the network.

3. Deny: The policy is to deny all devices access except for the devices that add to the MAC ACL. Devices on the MAC ACL are allowed access to network.

You can now add and manage devices on the MAC ACL. For more information following sections:

• Add automatically detected devices to a MAC ACL on page 56
• Manually add, remove, or change the information for a device on a MAC A page 57

Add automatically detected devices to a MAC ACL

After you set up a MAC ACL for a network and specify the default policy fo ACL, the router automatically detects devices that are connected or were connec the network for which you set up the MAC ACL.

You can select one or multiple devices from the detected list and add them ACL.

To add automatically detected devices to a MAC ACL:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > MAC ACL.

The MAC ACL page displays.

1. Go to the section for the network for which you want to manage the MAC

2. If the Enable MAC Access Control Disabled button displays for the specific next click the Disabled button.

The button changes to the green Enabled button.

1. Click the Add Device button.

The Manual Access Management pop-up window opens.

1. Select the check boxes for the devices that you want to add to the MAC

2. Click the Add button.

The devices are added to the MAC ACL on the MAC ACL page. Devices ACL are an exception to the default policy:

- If the default policy of the MAC ACL is to allow access, the added dev denied access.

- If the default policy of the MAC ACL is to deny access, the added dev allowed access.

Manually add, remove, or change the information for device on a MAC ACL

After you set up a MAC ACL for a network and specify the default policy for ACL, you can manually add a device, remove a device, or change the name (the MAC address) for a device on the MAC ACL.

By manually adding a device, you can proactively control access for a device t or not yet detected, or that was not detected by the router.

To manually add, remove, or change the name for a device on a MAC ACL:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > MAC ACL.

The MAC ACL page displays.

1. Go to the section for the network for which you want to manage the MAC

2. To manually add a device to the MAC ACL, do the following:

a. Click the Manual button.

The Manual Access Management pop-up window opens.

b. Enter the MAC address and device name for the device that you want to

c. In the Manual Access Management pop-up window, click the Add button.

The device is added to the MAC ACL on the MAC ACL page. Devices MAC ACL are an exception to the default policy:

- If the default policy of the MAC ACL is to allow access, the added or denied access.

- If the default policy of the MAC ACL is to deny access, the added allowed access.

1. To remove a device from the MAC ACL, do the following:

a. Select the check box for the device.

b. Click the Remove Device button.

The device is removed from the MAC ACL.

1. To change the name for a device on the MAC ACL, do the following:

a. Next to the device in the table, click the Edit button.

The Manual Access Management pop-up window opens.

b. Change the device name.

c. In the Manual Access Management pop-up window, click the Edit button.

The device name is changed in the MAC ACL on the MAC ACL page.

Disable a MAC ACL for a specific network

You can disable a MAC ACL that you already set up. The devices are not re the MAC ACL, but all devices on the MAC ACL can connect to the network you setup the MAC ACL, even if the default policy of the MAC ACL is to c the devices.

To disable a MAC ACL for a specific network:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > MAC ACL.

The MAC ACL page displays.

1. Go to the section for the network for which you want to disable the MAC
2. For the specific network, click the Enable MAC Access Control Enabled button The button changes to the gray Disabled button. The MAC ACL is disabled.

Network access control list

You can use the network access control list (ACL) to block or allow access to Orbi Pro network. An ACL functions with the MAC addresses of WiFi and wire that the router detects on the Orbi Pro network and that you can either allow your network or deny access to your network. That is, the router can detect t addresses of devices that are or were connected to the Orbi Pro network and MAC addresses of these devices.

Note: The network access control list differs from a MAC ACL (see MAC access lists on page 54). A MAC ACL is specific to a particular WiFi network or to a network but is not based on devices that the router detects on the entire ORI network. With a MAC ACL, you can allow or deny access to a device on a network or the wired network. The network access control list and MAC ACLs are exclusive. Use either the network access control list or MAC ACLs.

If you set up a network ACL with an access rule that allows access to the O devices on the network ACL are an exception to the access rule:

• A device for which you place the MAC address on the network ACL is de. to the Orbi Pro network.
• All other devices are allowed access to the Orbi Pro network.

If you set up a network ACL with an access rule that denies access to the network, devices on the network ACL are an exception to the access rule:

- A device for which you place the MAC address on the network ACL is allowed to the Orbi Pro network.

- All other devices are denied access to the Orbi Pro network.

Note: Each network device owns a MAC address, which is a unique 12-character address, containing the hexadecimal characters 0-9, a-f, or A-F (uppercase or lower only, and separated by colons (for example, 00:09:AB:CD:EF:01). Typically, the MAC address is on the label of a device. If you cannot see the label, you can disaddress using the network congruration utilities of a computer. You might also in MAC addresses on Attached Devices page of the router (see View satellites, WiFi and wired devices connected to the Orbi Pro network on page 163).

Enable the network access control list and specify the rule

When you enable network access control, you must select whether new devices allowed to access the Orbi Pro network or are blocked from accessing the net default, connected devices are allowed access to the Orbi Pro network, but you also block these devices from accessing the Orbi Pro network.

To enable and manage the network access control list for the entire Orbi network:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > Access Control.

The Access Control page displays.

1. Select the Turn on Access Control check box.

You must select this check box before you can specify an access rule and Allow and Block buttons. When the Turn on Access Control check box is cleared, all devices are allowed to connect, even if a device is in the list of block

Note: If you enabled one or more MAC ACLs (see Enable a MAC ACL for network on page 55), you cannot use the Allow and Block buttons. MAC ACLs and the network access control list are mutually exclusive. Use either MAC ACLs network access control list.

1. Click the Apply button.

Your settings are saved.

1. Select an access rule for new devices:

- Allow all new devices to connect: With this setting, if you add a new can access the Orbi Pro network. You do not need to enter its MAC ad this page. We recommend that you leave this radio button selected.

- Block all new devices from connecting: With this setting, if you add a device, before it can access the Orbi Pro network, you must enter its MA for an Ethernet connection and its MAC address for a WiFi connection in allowed list. For more information, see .

The access rule does not affect previously blocked or allowed devices. It appears only to devices joining the Orbi Pro network in the future after you apply settings.

1. To manage access for devices that are connected or were connected to the Pro network, do the following:

- If you blocked all new devices from connecting, to allow the device that currently using to continue to access the Orbi Pro network, select the che next to your computer or device in the table, and click the Allow button

- To either continue to allow or to block other computers and devices that connected or were connected, select the check box next to the device in and click either the Allow button or the Block button.

1. Click the Apply button.

Your settings are saved.

Manage the allowed devices on the network access of list

If you set up an access list that blocks all new devices from accessing the C network, you must specify which devices are allowed to access the Orbi Pro n You can add a device, remove a device, or edit the information for a device.

To manage devices that are allowed to access to Orbi Pro network:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > Access Control.

The Access Control page displays.

1. Click the View list of allowed devices not currently connected to the net link.

A table displays the detected device name, MAC address, and connection type the devices that are not connected but allowed to access the Orbi Pro netv

1. To add a device to the allowed list, do the following:

a. Click the Add button.

The Add Allowed Device page displays.

b. Enter the MAC address and device name for the device that you want to

c. On the Add Allowed Device page, click the Apply button.

The device is added to the allowed list on the Access Control page.

1. To remove a device from the allowed list, do the following:

a. Select the check box for the device.

b. Click the Remove from the list button.

The device is removed from the allowed list.

1. To change the information for a device on the allowed list, do the following

a. Select the check box for the device.

b. Click the Edit button.

The Edit Allowed Device page displays.

c. Change the access rule, MAC address, or device name.

d. On the Edit Allowed Device page, click the Apply button.

The device is changed on the allowed list on the Access Control page.

1. Click the Apply button.

Your settings are saved.

Manage the blocked devices on the network access co list

If you set up an access list that allows all new devices to access the Orbi F but you want to block some devices from accessing the Orbi Pro network, you specify the devices that you want to block.

You can add a device, remove a device, or change the information for a dev

To manage devices that are blocked from accessing the Orbi Pro network:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > Access Control.

The Access Control page displays.

1. Click the View list of blocked devices not currently connected to the net link.

The Access Control page displays.

A table displays the detected device name, MAC address, and connection type the devices that are not connected and are blocked from accessing the Orb network.

1. To add a device to the blocked list, do the following:

a. Click the Add button.

The Add Blocked Device page displays.

b. Enter the MAC address and device name for the device that you want to

c. On the Add Blocked Device page, click the Apply button.

The device is added to the blocked list on the Access Control page.

1. To remove a device from the blocked list, do the following:

a. Select the check box for the device.

b. Click the Remove from the list button.

The device is removed from the blocked list.

1. To change the information for a device on the blocked list, do the following

a. Select the check box for the device.

b. Click the Edit button.

The Edit Blocked Device page displays.

c. Change the access rule, MAC address, or device name.

d. On the Edit Blocked Device page, click the Apply button.

The device is changed on the blocked list on the Access Control page.

1. Click the Apply button.

Your settings are saved.

Block Internet sites by using keywords

You can use keywords to block certain Internet sites from your network. You c blocking all the time or based on a schedule.

To block Internet sites:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > Block Sites.

The Block Sites page displays.

1. Select a keyword blocking option:

2. Per Schedule: To block the keywords based on a schedule, select the Per Schedule radio button. For information about how to set the schedule, see Schedule when to block Internet sites and services on page 69.

3. Always: To block the keywords all the time, select the Always radio button..

4. In the Type keyword or domain name here eld, enter a keyword or domain you want to block.

For example:

• Specify XXX to block http://www.badstuff.com/xxx.html.
• Specify .com if you want to allow only sites with domain sufxes such as .gov.

• Enter a period (.) to block all Internet browsing access.

• Click the Add Keyword button.

The keyword is added to the keyword list. The keyword list supports up to

1. Click the Apply button.

Keyword blocking takes effect.

Delete keywords that are used to block Internet sites

To delete keywords that are used to block Internet sites:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > Block Sites.

The Block Sites page displays.

1. Do one of the following:

2. To delete a single word, select it and click the Delete Keyword button. The keyword is removed from the list.

3. To delete all keywords on the list, click the Clear List button.

All keywords are removed from the list.

1. Click the Apply button.

Your settings are saved.

Trusted computer

You can exempt one trusted computer from blocking. The computer that you exist must be assigned a xed IP address. You can use the reserved IP address feature specify the IP address. See Reserved LAN IP addresses on page 131.

To specify a trusted computer:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > Block Sites.

The Block Sites page displays.

1. Scroll down and select the Allow trusted IP address to visit blocked sites box.
2. In the Trusted IP Address eld, enter the IP address of the trusted compute
3. Click the Apply button.

Your settings are saved.

Block services from the Internet

You can block Internet services on your network based on the type of service. block the services all the time or based on a schedule.

To block services:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > Block Services.

The Block Services page displays.

1. Specify when to block the services:

- Per Schedule: To block the services based on a schedule, select the Per radio button. For information about how to set the _schedule,_ see Schedule to _block_ Internet sites and _services on page 69.

- Always: To block the services all the time, select the Always radio button.

1. Click the Add button.

The Block Services Setup page displays.

1. To add a service that is in the Service Type list, select the application or The settings for this service automatically display in the elds.

2. To add a service or application that is not the list, select User Dened.

a. If you know that the application uses either TCP or UDP, select the appr protocol.

Otherwise, select TCP/UDP (both).

b. Enter the starting port and ending port numbers.

If the service uses a single port number, enter that number in both elds. To nd out which port numbers the service or application uses, you can the publisher of the application, ask user groups or newsgroups, or search the Internet.

c. In the Service Type/User Dened eld, enter a name for the service.

1. To specify how to liter the services, select one of the following radio button

- Only This IP Address: Block services for a single device.

- IP Address Range: Block services for a range of devices with consecutive addresses on your network.

- All IP Addresses: Block services for all devices on your network.

1. Click the Add button.

Your settings are saved. The Block Services page displays again and the adc service displays in the table.

1. Click the Apply button.

Your settings are saved.

Schedule when to block Internet sites and services

When you schedule blocking, the same schedule is used to block sites and to services. For information about how to specify what you want the router to block Block Internet sites by using keywords on page 64 and Block services from the on page 67.

To schedule blocking:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > Schedule.

The Schedule page displays.

1. Specify when to block keywords and services:

2. Days to Block: Select the check box for each day that you want to block keywords or select the Every Day check box, which automatically selects the check boxes for all days.

3. Time of Day to Block: Select a start and end time in 24-hour format, All Day for 24-hour blocking.

4. Click the Apply button.

Your settings are saved.

Email notifications for security events

The router can email you its logs of router activity. The log records router access security events such as attempts to access blocked sites or services.

To set up email notifications:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Security > E-mail.

The E-mail page displays.

1. Select the Turn E-mail Notification On check box.
2. In the Primary E-mail Address field, enter the email address to which logs are sent.

This email address is also used for the From address. If this eld is blank, alert messages are not sent.

1. In the Your Outgoing Mail Server eld, enter the name of your ISP outgoir mail server (such as mail.myISP.com).

You might be able to nd this information in the conguration window of you program. If you leave this eld blank, log and alert messages are not sent.

1. In the Outgoing Mail Server Port Number eld, enter your mail server's por number.

You might be able to nd this information in the conguration window of you program.

1. If your outgoing email server requires authentication, select the My Mail Serv requires authentication check box and do the following:

• In the User Name eld, type the user name for the outgoing email serve
- In the Password eld, type the password for the outgoing email server.

1. To send alerts immediately, select the Send Alerts Immediately check box.

Email alerts are sent immediately when someone attempts to visit a blocked

1. To send logs based on a schedule, specify these settings:

2. From Send logs according to this schedule menu, select the schedule ty
   • From the Day menu, select the day.

3. From the Time menu, select the time, and select the a.m. or p.m. radio button.

4. Click the Apply button.

Your settings are saved.

Logs are sent automatically. If the log lls before the specied time, it is set the log is sent, it is cleared from the router memory. If the router cannot log and the log buffer lls, the router overwrites the log.

5

Manage the VLANs

This chapter includes the following sections:

• About VLANs in general
• About VLANs on the router
  • How the router organizes LANs, VLANs, and WLANs
• VLAN proles
  • VLAN membership for a LAN, WiFi network, or port
  • VLAN tag group as a bridge for an IPTV device
• Port mode: Trunk mode or Access mode

Note: The router comes with a preset VLAN congruration that you can use with making any changes. If your network setup is simple, or does not require you trafc into different VLANs, you might be able to use the preset VLAN congruration. We recommend that you read How the router organizes LANs, VLANs, and WLAN page 74.

For information about how to use VLANs in your network, including examples of cases, see How to Use VLANs in Your Network on page 227.

About VLANs in general

A local area network (LAN) maps network devices together based on physical or geographic location. A virtual local area network (VLAN) maps network devices to on a basis other than physical or geographic location, for example, by department of user, level of security clearance, or primary application. Traffic flowing between must go through a router, such as an Orbi Pro router, just as if the VLANs separate LANs.

A VLAN groups computers, servers, and other network devices so that they behave if they are all connected to the same network segment. For example, marketing might work in different rooms in an office building, or even in an adjacent building, they can use the same marketing-only VLAN, allowing them to share resources on a network bandwidth as if they were connected to the same LAN. The resources of departments might be invisible to the users of the marketing VLAN, accessible for or accessible only to specified individuals, depending on how you congregate the V

VLANs have a number of advantages:

• Facilitate network segmentation: Devices for users who communicate most frequently with each other can be grouped into common VLANs, regardless of physical location. Each group's network traffic is contained largely within the VL which reduces traffic that is not relevant to the group and improves the efci across the whole network.
• Facilitate management: Changes such as adding or moving network devices be dealt with quickly and conveniently from a management interface rather than from the wiring closet.
• Provide increased performance: VLANs free up bandwidth by limiting device-to-device and broadcast traffic throughout the network.
• Ensure enhanced network security: VLANs create virtual boundaries that can traversed only through a router, allowing router-based security measures to be to restrict access to each VLAN.

About VLANs on the router

The router supports virtual local area network (VLAN) management. VLAN manager enables you to limit user access by network and increase security through data separation. You can further increase security through client isolation and network isolation.

The following table shows the four preset VLAN proles on the router.

Table 4. Preset VLAN proles on the router

	VLAN Prole NameVLAN ID
	Default1
	Employee20
	IoT30
	Guest40

Note: The router also supports a special VLAN with the prole name *IPTV and VLAN

ID 1 (the same VLAN ID as the Default VLAN prole). The IPTV VLAN can fur bridge between the router's WAN interface and an IPTV device in your network more information, see VLAN tag group as a bridge for an IPTV device on page

If you do not require specific VLAN congrurations, we recommend that you keep router's default VLAN congruration.

If your network environment does require you to use custom-congured VLANs, you can either change the VLANs on the router to match the VLANs that are already in your network, or denote the router's preset VLANs on your other network con (for example, switches and access points). For more information, see VLAN proteas page 75 and VLAN membership for a LAN, WiFi network, or port on page 8.

How the router organizes LANs, VLANs, WLANs

You do not need to use the VLANs in order to use the router and any sate if your network environment is not complex or does not require you to separate types of traffic, you could just connect your wired devices to LAN 1 and your to the Wireless 1 network.

The router comes with four preset LANs, VLANs, and WLANs, as shown in the table. A fth LAN is disabled, but you can congure and enable it if your network environment requires an additional LAN.

With the preset modes, your administrative trafc, employee trafc, Internet of Thin (IoT) trafc, and guest trafc can be separated entirely without the need to set other VLANs on the router.

Table 5. Default organization of the LANs, VLANs, and WLANs

LAN ID	Ethernet Ports*	VLAN ID				WLAN UsageWLAN NameVLAN Proc
LAN 1	the WAN port					admin accessWireless 1Default1All
			Employee20NoneLAN 2	**	Employee accessWireless 2
			IoT30NoneLAN 3	**	IoT accessWireless 3
			Guest40NoneLAN 4	**	Guest accessGuest Portal
LAN 5**	--	--	--	--	--

* LANs (networks) and LAN ports are two different concepts. By default, all LAN ports and the WAN port router, and all LAN ports on any connected satellites, are Ethernet ports in the same physical network segment (LAN 1), and members of VLAN 1. However, you can assign a LAN port to a different VLAN (see Change the VLAN prole for an Ethernet port on page 83).
** Disabled by default, but you can enable it.

Except for LAN 1, you can change the VLAN prole assignments for the LANs (see Change the VLAN prole for a LAN on page 81). For more information about LANs in general, see Manage the LANs on page 116.

By default, VLAN 1 is enabled for the Wireless 1 network. For any other WLA enable, you can change the VLAN prole assignments for the WLANs (see Enable, change, or disable the VLAN prole for a WiFi network on page 82). For information about the WLANs in general, see Manage the WiFi Networks on page 88.

VLAN proles

A VLAN prole consists of a VLAN ID, VLAN name, the client isolation settings, and the network isolation setting.

You can change the preset VLAN profiles, add custom VLAN profiles, and delete VLAN proles.

Add a new VLAN prole

You can add a new VLAN prole, which consists of a VLAN name, VLAN ID, the client isolation settings, and the network isolation setting.

If your router is part of a network with switches and access points, VLAN traffic segregation works only if the VLAN is denied on all other network components, excluding end devices such as computers and WiFi clients.

Note: If you want to add a new VLAN prole directly to a LAN on a LAN : see Add a new VLAN prole directly to a LAN on page 77.

To add a new VLAN prole:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays.

The existing VLAN proles display in a table at the bottom of the page. If a VLAN prole directly to a LAN on a LAN Setup page, the VLAN prole a in the table.

1. Click the Add button.

A new row is added to added to the VLAN table.

1. Specify the VLAN settings (that is, the VLAN prole) as described in the following table.

DescriptionField

Enter a name for the VLAN.Name

Enter an ID from 1 to 4094.VLAN ID

(Continued)

	DescriptionField
Client Isolation	Client isolation prevents hosts and clients in the VLAN from reaching ports, hosts, clients in the same VLAN, thereby increasing security.Select the check box to enable this option.
Network Isolation	Network isolation, also referred to as network segmentation, prevents hosts and clie in the VLAN from reaching ports, hosts, and clients in other VLANs, thereby increase security.Select the check box to enable this option.

Note: The multicast DNS (mDNS) settings override client isolation and network isolation settings (see Multicast DNS gateway on page 134).

7. Click the Apply button.

Your settings are saved and the VLAN prole is added to the table.

You can now assign a LAN, WiFi network, port, or combination of these as of the new VLAN. For more information, see VLAN membership for a LAN, network, or port on page 81.

Add a new VLAN prole directly to a LAN

You can add a new VLAN prole directly to a LAN. A VLAN prole consists of name, VLAN ID, the client isolation settings, and the network isolation setting.

If your router is part of a network with switches and access points, VLAN traffic segregation works only if the VLAN is denied on all other network components, excluding end devices such as computers and WiFi clients.

In the router web interface, you can add a new VLAN prole for LAN 2, LAN and LAN 5 on the associated LAN page.

Note: If you want to add a new VLAN prole on the VLAN / Bridge Settings Add a new VLAN prole on page 75. On the VLAN / Bridge Settings page, y manage the VLAN settings.

To add a new VLAN prole directly to a LAN:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup.

The LAN Setup page for LAN 1 displays.

1. Select the tab (LAN 2, LAN 3, LAN 4, or LAN 5) for the LAN for which you want to add a new VLAN prole.

You cannot add a VLAN prole for LAN 1.

The page for the selected LAN displays.

1. If you selected LAN 5 and this is the rst time that you congure LAN 5, Enable LAN Setup 5 check box.

2. From the VLAN Prole menu, select New VLAN Prole+.

The VLAN Prole Management window displays.

1. Specify the VLAN settings (that is, the VLAN prole) as described in the follc table.

	DescriptionField
	Enter a name for the VLAN.Name
	Enter an ID from 1 to 4094.VLAN ID
Client Isolation	Client isolation prevents hosts and clients in the VLAN from reaching ports, hosts, clients in the same VLAN, thereby increasing security.Select the check box to enable this option.
Network Isolation	Network isolation, also referred to as network segmentation, prevents hosts and clie in the VLAN from reaching ports, hosts, and clients in other VLANs, thereby increase security.Select the check box to enable this option.

Note: The multicast DNS (mDNS) settings override client isolation and network isolation settings (see Multicast DNS gateway on page 134).

1. Click the Add button.

The VLAN prole is added.

1. To assign the new VLAN prole to the LAN, select it from VLAN Prole mer

2. Click the Apply button.

Your settings are saved.

You can now also assign a WiFi network, port, or combination of these as of the new VLAN. For more information, see VLAN membership for a LAN, network, or port on page 81.

Change the client isolation or network isolation for a prole

For a preset or custom VLAN, you cannot change the prole name or VLAN ID can change the client isolation or network isolation settings. Note that the multic (mDNS) settings override client isolation and network isolation settings (see Multica DNS gateway on page 134).

Note: If you want to change the prole name or VLAN ID for an existing VLAN a new VLAN with the prole name or VLAN ID that you require (see Add a prole on page 75), move the members of the existing VLAN to the new VLAN VLAN membership for a LAN, WiFi network, or port on page 81), and then d existing VLAN (see Delete a VLAN prole on page 80).

To change the client isolation or network isolation settings for a VLAN prol

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays.

1. Select the radio button next to the VLAN.

2. To change the client isolation settings, select or clear the check box in the Isolation column.

Selecting the check box enables client isolation, which prevents hosts and clients the VLAN from reaching ports, hosts, and clients in the same VLAN, thereby ensuring security.

1. To change the network isolation settings, select or clear the check box in the Isolation column.

Selecting the check box enables network isolation, also referred to as network segmentation, which prevents hosts and clients in the VLAN from reaching po hosts, and clients in other VLANs, thereby increasing security.

1. Click the Apply button.

Your settings are saved.

Delete a VLAN prole

Note the following about deleting VLANs:

- You cannot delete a VLAN prole that still has a LAN, WLAN, or interface a member. You can delete a VLAN only if no members are assigned to the

- You cannot delete the preset VLAN 1 prole with the name Default. However, if you want, you can delete one or more of the other preset VLAN proles the Employee VLAN; VLAN 30, the IoT VLAN; or VLAN 40, the Guest VLAN members are assigned to the VLAN.

To delete a VLAN prole:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays.

1. Select the radio button next to the custom VLAN you want to delete.
2. Click the DELETE button.

The VLAN prole is removed from the table.

1. Click the Apply button.

Your settings are saved.

VLAN membership for a LAN, WiFi network or port

By default, each LAN and each WiFi network is a member of a preset VLAN the router organizes LANs, VLANs, and WLANs on page 74). By default, each member of VLAN 1, the Default VLAN.

You can change the VLAN membership for a LAN, WiFi network, or port.

CAUTION: Be sure that you fully understand the consequences of changing a membership. Incorrect conguration might cause network problems, such as traffic being discarded.

Change the VLAN prole for a LAN

You can change the VLAN prole for a LAN. Note the following:

• The VLAN prole for LAN 1 is set and you cannot change it.
• If a LAN is assigned to a VLAN prole, you cannot assign another LAN to VLAN prole.

This also means that you cannot change the preset VLAN prole for LAN 2, and LAN 4 until you add a new VLAN prole (that is, a custom VLAN prol assign LAN 2, LAN 3, or LAN 4 to it. Doing so releases the preset VLAN that you can assign a different LAN to it.

- If an Ethernet port and a LAN are assigned to same VLAN prole, you can the VLAN prole for the LAN until you assign the Ethernet port to a different prole.

To change the VLAN prole for a LAN:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup.

The LAN Setup page for LAN 1 displays.

1. Select the tab (LAN 2, LAN 3, LAN 4, or LAN 5) for the LAN for which you want to change the VLAN prole.

You cannot change the VLAN prole for LAN 1.

The page for the selected LAN displays.

1. From the VLAN Prole menu, select another VLAN prole.

You cannot change the preset VLAN prole for LAN 2, LAN 3, or LAN 4 to a new VLAN prole (that is, a custom VLAN prole) and assign LAN 2, LAN 4 to it. Doing so releases the preset VLAN prole so that you can assign a LAN to it.

1. Click the Apply button.

Your settings are saved.

Enable, change, or disable the VLAN prole for a WiF network

By default, the VLANs are not enabled for any WiFi network, except for VLAN is enabled for the Guest Portal. (However, the Guest Poral itself is disabled by

To enable, change, or disable the VLAN prole for a WiFi network:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > Wireless Setup.

The Advanced Wireless Settings page displays.

1. Select the tab (Wireless 1, Wireless 2, Wireless 3, or Guest Portal) for which you want to change the VLAN prole.

The page for the selected WiFi network displays.

1. Do one of the following:

- Enable: To enable the VLAN prole, select the VLAN Prole check box.

- Change: To change the VLAN profile, from the VLAN Profile menu, select another VLAN prole.

- Disable: To disable the VLAN prole, clear the VLAN Prole check box.

1. Click the Apply button.

Your settings are saved.

Change the VLAN prole for an Ethernet port

By default, all Ethernet ports (that is, the WAN port and the LAN ports) are the Default VLAN prole, VLAN 1. In most situations, you do not need to change assignments. However, if your network environment or router setup requires you change an assignment, you can do so.

Note the following:

- If two LAN ports form a link aggregation group (LAG), they must be assign same VLAN prole.

- You can assign the WAN port to any VLAN prole.

To assign a port to another VLAN prole on the router (also referred to as in this context) or satellite:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays.

For the router (Base) and each satellite, the ports display on the page:

• Blue: The ports are connected to devices that are turned on.

• Gray: The ports are either not connected or are connected to devices that not turned on.

• In either the Base (router) or Satellite section, for the Ethernet port that you change, select a VLAN prole from the VLAN Prole menu.

• Click the Apply button.

Your settings are saved.

VLAN tag group as a bridge for an IP device

If the devices that are connected to the router's Ethernet LAN ports include an device, your ISP might require you to use a VLAN tag group as a bridge be router's WAN interface and the IPTV device. If you are subscribed to IPTV server router might need to use VLAN tags to distinguish between the regular Internet and the IPTV traffic. A bridge with a VLAN tag group prevents packets that are between the IPTV device and the router's WAN port from being processed through router's Network Address Translation (NAT) service.

The router includes a default VLAN tag group, which is a VLAN prole with the *IPTV and VLAN ID 1. You can select this VLAN prole for a LAN port, allowi prole to function as a bridge between the WAN port and the LAN port.

The IPTV prole does not apply to satellite LAN ports.

To assign a LAN port to the IPTV prole:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays.

For the router (Base) and each satellite, the ports display on the page:

• Blue: The ports are connected to devices that are turned on.

• Gray: The ports are either not connected or are connected to devices that not turned on.

• In the Base (router) section, for the Ethernet LAN port to which the IPTV connected, select 1(*IPTV) from the VLAN Prole menu.

The selection from the Mode menu automatically changes to Trunk.

1. Click the Apply button.

Your settings are saved.

Port mode: Trunk mode or Access mode

By default, all Ethernet ports (the WAN port and the LAN ports) on the route satellites function in Trunk mode, but they can also function in Access mode:

• Trunk mode. If a port must forward tagged packets with a specific VLAN tag assign Trunk mode to the port, add a VLAN prole with the VLAN tag (that VLAN ID; see Add a new VLAN prole on page 75), and assign the port to VLAN profile. Packets that include tags other than the specific VLAN tag are by the port.
• Access mode. If a port connects only to a client or end device, you can assign Access mode to the port.

By default, all Ethernet ports are assigned to the Default VLAN prole and func Trunk mode. However, for any port that is assigned to the Default VLAN prole difference exists between Trunk mode and Access mode. You can connect a mo gateway, client device, or end device to such a port. That is, for a port that to the Default VLAN prole, Trunk mode actually functions in a hybrid mode in allows both tagged and untagged trafc:

• If a port receives untagged trafc (that is, without a VLAN tag), the port for trafc to the LAN and the WLAN.
• If a port receives tagged traffic (that is, with a VLAN tag), the port forwards to other ports that function in Trunk mode and that are assigned to the safe role (by default, the Default VLAN prole with VLAN ID 1).

To change a port mode to Trunk mode or Access mode on the router (all to as the Base in this context) or satellite:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays.

For the router (Base) and each satellite, the ports display on the page:

• Blue: The ports are connected to devices that are turned on.

• Gray: The ports are either not connected or are connected to devices that not turned on.

• In either the Base (router) or Satellite section, for the Ethernet port that you change, select Access or Trunk from the Mode menu.

• Click the Apply button.

Your settings are saved.

6

Manage the WiFi Networks

This chapter includes the following sections:

• About the WiFi networks
• admin (default) WiFi network
  • Employee WiFi network
• Internet of things WiFi network
• Guest WiFi network and captive portal

For information about advanced WiFi features, see Manage the Advanced WiFi S on page 185.

IMPORTANT: When you log in to the router and change the WiFi settings, the automatically sends the new settings to any connected satellites.

About the WiFi networks

The router supports four WiFi networks, also referred to as WiFi local area net (WLANs) or wireless networks. These WiFi networks can operate simultaneously, but by default, only the Wireless 1 network is operationally enabled. To use another network, you must rst enable it.

Each WiFi network has an intended usage and is preset to a VLAN prole, as in the following table. (For more information about VLANs, see About VLANs or router on page 73.)

Table 6. WiFi network default settings

					Guest PortalWireless 3Wireless 2W
status					DisabledDisabledDisabledEnabledDefa
Intended WiFi network usage general access					Guest accessIoT accessEmployee i
Preset VLAN ID and VLAN 1 VLAN 20 VLAN 30 VLAN 40 VLAN prole name Default Employee IoT Guest
WiFi network name (SSID) See router label default SSID fDefault SSID appended with -2 appended with -3 Default SSID appended with -GUEST
and encryption None (open)WPA2-PSK [AES]WPA2-
(network key) See router label Default WiFi Wpreasword Settings page for Settings page for Wireless 2 Wireless 3 NoneSee the Wireless
mode LocalDefault authentication Local Other options are captive portal and Facebook Wi-Fi
SSID broadcast Enabled, non-congurable Enabled, congurable Enabled, congurable
SSID separation for 2.4GHz and 5 GHz Disabled, non-congurable Disabled, congurable Disabled, non-congurable

You can congregate the settings and security for each of these four WiFi network described in this chapter.

admin (default) WiFi network

Your Orbi Pro WiFi 6 router and satellite come preset with the same admin V name (SSID) and WiFi network key (password). You can nd the admin SSID and password on the router label and on the satellite label. The preset WiFi setting labels are for your admin WiFi network that you can use to manage and more router, satellite, and network. The admin WiFi network is the default WiFi network. The router web interface calls the admin WiFi network the Wireless 1 network.

Change the admin WiFi network name, channel, or VI or add a WLAN schedule

If you change your WiFi settings, make a note of the new settings and store place where you can easily nd it.

If your computer or mobile device is using a WiFi connection when you change network name (SSID) or other WiFi security settings, you are disconnected when click the Apply button. To avoid this problem, use a computer with a wired to access the router.

The router web interface calls the admin WiFi network the Wireless 1 network.

To change the admin WiFi settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless.

The Wireless settings for the Wireless 1 network display on the page.

1. To change the admin network name (SSID), type a new name in the Name eld.

The name can be up to 32 characters long and it is case-sensitive. If you change the SSID during the setup process, the default SSID is shown. (The SSID is randomly generated and is on the router label.) If you change the make sure to write down the new name and keep it in a safe place.

1. To change a 2.4 GHz or 5 GHz WiFi channel, select a channel from the menu.

The channels that are available depend on your country or region. Do not the channel unless you experience interference (shown by lost connections or data transfers). If this happens, experiment with different channels to see which channel works best for your.

When you use multiple WiFi routers, access points, WiFi gateways, satellites, a extenders in your network, you experience less interference if adjacent devices different channels. For example, for the 2.4 GHz radio band, we recommend channel spacing with a minimum of four channels between adjacent devices (example, use channels 1 and 5, or 6 and 10).

1. Although the preset Default VLAN prole for the Wireless 1 network works we most situations, if you want to change the VLAN prole, select the VLAN Pro check box, and select another VLAN prole from the menu.

The preset VLAN prole name is Default, the VLAN has ID 1, and the comb is shown in the menu as Default(1).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74.

1. A WLAN schedule can turn WiFi broadcast off to block network access during and times when it is not needed and to save energy. To enable and cong WLAN schedule for the admin WiFi network, do the following:

a. Select the Enable WLAN schedule check box.

The page expands and shows the days and times that the WiFi signal is After you enable the WLAN schedule, by default, the WiFi signal is broad every day from 8:30 a.m. to 6:00 p.m.

b. To change if the WiFi signal is broadcast during a day, clear or select box for the day.

If you clear the check box for a day, the WiFi signal is not broadcast

c. To change when the WiFi signal is broadcast during a day, move the room on the blue bar to the desired starting and ending times for the day.

The period that the WiFi signal is broadcast during that day displays to of the blue bar.

1. Click the Apply button.

Your settings are saved. The router sends the new settings to the satellite.

If you are using a WiFi connection and you changed the SSID, you are dis from the network.

1. Make sure that you can connect to the WiFi network with its new settings. If you cannot connect using WiFi, check the following:

- Is your WiFi-enabled computer or mobile device connected to another WiFi network in your area? Some WiFi devices automatically connect to the rst network without WiFi security that they discover.

- Is your computer or WiFi device trying to connect to your network with settings (before you changed the settings)? If so, update the WiFi network selection in your computer or WiFi device to match the current settings for network.

Change the admin WiFi password or security level

You can change the admin password and security level (authentication and encry settings). The router supports Wi-Fi Protected Access 3 (WPA3), WPA2, mixed WI + WPA3, and mixed WPA + WPA2. The router also supports enterprise level V enterprise level WPA2.

CAUTION: We recommend that you do not disable security for your admin WiFi

The router web interface calls the admin WiFi network the Wireless 1 network.

To change the admin WiFi password or security level:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless.

The Wireless settings for the Wireless 1 network display on the page.

1. Under Security Options, select a WiFi security option:

- WPA2-PSK [AES]: The WPA2 option uses AES encryption. This type of sec allows only WiFi devices that support WPA2 or WPA3 to join the network When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA-PSK [TKIP] + WPA2-PSK [AES]: If your network includes legacy device (devices that support only WPA), select this radio button. This option, which AES and TKIP encryption, allows WiFi devices that support WPA, WPA2, or to join the network.

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA2 Enterprise: If your network is connected to a RADIUS server that provides authentication and your network includes WPA2 and WPA3 devices, select this radio button. WPA2 Enterprise can provide a high level of security allows WPA2 and WPA3 devices to connect to the network. (WPA devices connect.) Before a WiFi client can connect to the network, the WiFi client be configured on the RADIUS server and authenticated against the RADIUS device. The router functions as the authenticator between the WiFi client and the server, which provides the actual authentication.

When you select this option, additional elds display so that you can spec RADIUS server. Do the following:

a. In the IP address eld, enter the IP address of the RADIUS server to the router must connect.

b. In the Port eld, enter the port number that the router must use to communicate with the RADIUS server.

By default, the port number is 1812.

c. In the Shared Secret eld, enter the password that the router must use communicate with the RADIUS server.

This password must be congured on the RADIUS server. This password used to authenticate the router (not a WiFi client) against the RADIUS

- WPA3-Personal [SAE]: This is the most secure personal authentication option WPA3 uses SAE encryption and allows only WiFi devices that support WPA connect to the network. WiFi devices that support WPA or WPA2 cannot to the network.

When you select this option, additional elds display so that you can add Do the following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 127 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA3 Enterprise: If your network is connected to a RADIUS server that provides authentication and your network includes WPA3 devices only, select radio button. WPA3 Enterprise can provide the highest level of security but and WPA2 devices cannot connect. Before a WiFi client can connect to the network, the WiFi client must be congured on the RADIUS server and authenticated against the RADIUS server. The router functions as the authentic between the WiFi client and the RADIUS server, which provides the actual authentication.

When you select this option, additional elds display so that you can spec RADIUS server. Do the following:

a. In the IP address eld, enter the IP address of the RADIUS server to the router must connect.

b. In the Port eld, enter the port number that the router must use to communicate with the RADIUS server.

By default, the port number is 1812.

c. In the Shared Secret eld, enter the password that the router must use communicate with the RADIUS server.

This password must be congured on the RADIUS server. This password used to authenticate the router (not a WiFi client) against the RADIUS

- WPA2-Personal [AES] + WPA3-Personal: This option allows WiFi devices that support WPA2 (which is the same as WPA2-PSK) or WPA3 to join the new WiFi devices that support WPA cannot connect to the network. This option SAE and AES encryption. WPA3 (which uses SAE) is more secure than WiFi (which uses AES).

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

1. Click the Apply button.

Your settings are saved.

Employee WiFi network

When employee devices connect to the employee WiFi network, they cannot see devices that are connected to the network and cannot access the local area net (LAN).

The router web interface calls the employee WiFi network the Wireless 2 netwo

Enable the employee WiFi network and manage the se

Before you can set up the employee WiFi network, you must enable it. You are connected to the admin network to enable the employee WiFi network and cha settings.

The router web interface calls the employee WiFi network the Wireless 2 netwo

To enable the employee WiFi network and manage the WiFi settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless > Wireless 2.

The WiFi settings for the Wireless 2 network display on the page.

1. To enable the Wireless 2 network, select the Enable Wireless 2 network c By default, the Wireless 2 network is disabled.

2. To broadcast the Wireless 2 network SSID, select the Enable SSID Broadcast box.

By default, the broadcast is enabled.

1. To separate the single SSID for the Wireless 2 network in an SSID for the band and another SSID for the 5 GHz band, select the Enable SSID separa 2.4G/5GHz check box.

For each band, a Wireless 2 Network Name (SSID) eld displays. The SSID for 5 GHz band is appended with _5G, but you can also type another name.

By default, the Wireless 2 network provides a single SSID for both bands.

1. To change the Wireless 2 network name (SSID), type a new name in the Network Name (SSID) eld.

The name can be up to 32 characters long and it is case-sensitive. The de is derived from the randomly generated SSID that is on the router's label. I change the name, make sure to write down the new name and keep it in

1. Although the preset Employee VLAN prole for the Wireless 2 network works for most situations, if you want to change the VLAN prole, select the VLAN check box, and select another VLAN prole from the menu.

The preset VLAN profile name is Employee, the VLAN has ID 20, and the c is shown in the menu as Employee(20).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74.

1. A WLAN schedule can turn WiFi broadcast off to block network access during and times when it is not needed and to save energy. To enable and cong WLAN schedule for the admin WiFi network, do the following:

a. Select the Enable WLAN schedule check box.

The page expands and shows the days and times that the WiFi signal is After you enable the WLAN schedule, by default, the WiFi signal is broad every day from 8:30 a.m. to 6:00 p.m.

b. To change if the WiFi signal is broadcast during a day, clear or select box for the day.

If you clear the check box for a day, the WiFi signal is not broadcast

c. To change when the WiFi signal is broadcast during a day, move the red on the blue bar to the desired starting and ending times for the day. The period that the WiFi signal is broadcast during that day displays to of the blue bar.

1. Click the Apply button.

Your settings are saved. The router sends the new settings to the satellite.

1. Make sure that a user can connect to the WiFi network with its new setti If you cannot connect using WiFi, check the following:

- Is your WiFi-enabled computer or mobile device connected to another WiFi network in your area? Some WiFi devices automatically connect to the rst network without WiFi security that they discover.

- Is your computer or mobile device trying to connect to your network with settings (before you changed the settings)? If so, update the WiFi network selection in your computer or WiFi device to match the current settings for network.

Change the employee WiFi password or security level

You must be connected to the admin network to change the employee password security level (authentication and encryption settings). The router supports Wi-Fi Protected Access 3 (WPA3), WPA2, mixed WPA2 + WPA3, and mixed WPA + 'The router also supports enterprise level WPA3 and enterprise level WPA2.

The router web interface calls the employee WiFi network the Wireless 2 netwo

To change the employee WiFi network password or security level:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security war does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

4. Select Wireless > Wireless 2.

The WiFi settings for the wireless 2 network display on the page.

1. Under Security Options, select a WiFi security option:

- WPA2-PSK [AES]: The WPA2 option uses AES encryption. This type of sec allows only WiFi devices that support WPA2 or WPA3 to join the network When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA-PSK [TKIP] + WPA2-PSK [AES]: If your network includes legacy device (devices that support only WPA), select this radio button. This option, which AES and TKIP encryption, allows WiFi devices that support WPA, WPA2, or to join the network.

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA2 Enterprise: If your network is connected to a RADIUS server that provides authentication and your network includes WPA2 and WPA3 devices, select this radio button. WPA2 Enterprise can provide a high level of security allows WPA2 and WPA3 devices to connect to the network. (WPA devices connect.) Before a WiFi client can connect to the network, the WiFi client be configured on the RADIUS server and authenticated against the RADIUS device. The router functions as the authenticator between the WiFi client and the server, which provides the actual authentication.

When you select this option, additional elds display so that you can spec RADIUS server. Do the following:

a. In the IP address eld, enter the IP address of the RADIUS server to the router must connect.

b. In the Port eld, enter the port number that the router must use to communicate with the RADIUS server.

By default, the port number is 1812.

c. In the Shared Secret eld, enter the password that the router must use communicate with the RADIUS server.
This password must be congured on the RADIUS server. This password used to authenticate the router (not a WiFi client) against the RADIUS

- WPA3-Personal [SAE]: This is the most secure personal authentication option. WPA3 uses SAE encryption and allows only WiFi devices that support WPA connect to the network. WiFi devices that support WPA or WPA2 cannot to the network.

When you select this option, additional elds display so that you can add Do the following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 127 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA3 Enterprise: If your network is connected to a RADIUS server that provides authentication and your network includes WPA3 devices only, select radio button. WPA3 Enterprise can provide the highest level of security but and WPA2 devices cannot connect. Before a WiFi client can connect to the network, the WiFi client must be congured on the RADIUS server and authenticated against the RADIUS server. The router functions as the authentic between the WiFi client and the RADIUS server, which provides the actual authentication.

When you select this option, additional elds display so that you can spec RADIUS server. Do the following:

a. In the IP address eld, enter the IP address of the RADIUS server to the router must connect.

b. In the Port eld, enter the port number that the router must use to communicate with the RADIUS server.

By default, the port number is 1812.

c. In the Shared Secret eld, enter the password that the router must use communicate with the RADIUS server.

This password must be congured on the RADIUS server. This password used to authenticate the router (not a WiFi client) against the RADIUS

- WPA2-Personal [AES] + WPA3-Personal: This option allows WiFi devices that support WPA2 (which is the same as WPA2-PSK) or WPA3 to join the next WiFi devices that support WPA cannot connect to the network. This option SAE and AES encryption. WPA3 (which uses SAE) is more secure than WiFi (which uses AES).

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

1. Click the Apply button.

Your settings are saved.

Internet of things WiFi network

The Internet of things (IoT) network is intended for WiFi-enabled smart devices range from light bulbs to appliances to inventory trackers. The possibilities for s devices are endless.

When you connect IoT devices to the IoT WiFi network, the devices cannot de devices that are connected to the network and cannot access the local area net (LAN).

The router web interface calls the IoT WiFi network the Wireless 3 network.

Enable the IoT WiFi network and manage the settings

Before you can set up the Internet of things (IoT) WiFi network, you must enable to be connected to the admin network to enable the IoT WiFi network and the settings.

The router web interface calls the IoT WiFi network the Wireless 3 network.

To enable the IoT WiFi network and manage the WiFi settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security war does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless > Wireless 3.

The WiFi settings for the Wireless 3 network display on the page.

1. To enable the Wireless 3 network, select the Enable Wireless 3 network c By default, the Wireless 3 network is disabled.

2. To broadcast the Wireless 3 network SSID, select the Enable SSID Broadcast box.

By default, the broadcast is enabled.

1. To separate the single SSID for the Wireless 3 network in an SSID for the band and another SSID for the 5 GHz band, select the Enable SSID separa 2.4G/5GHz check box.

For each band, a Wireless 3 Network Name (SSID) eld displays. The SSID for 5 GHz band is appended with _5G, but you can also type another name.

By default, the Wireless 3 network provides a single SSID for both bands.

1. To change the Wireless 3 network name (SSID), type a new name in the Network Name (SSID) eld.

The name can be up to 32 characters long and it is case-sensitive. The de is derived from the randomly generated SSID that is on the router's label . change the name, make sure to write down the new name and keep it in

1. Although the preset IoT VLAN prole for the Wireless 3 network works well situations, if you want to change the VLAN prole, select the VLAN Prole ch box, and select another VLAN prole from the menu.

The preset VLAN prole name is IoT, the VLAN has ID 30, and the combination shown in the menu as IoT(30).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74.

1. A WLAN schedule can turn WiFi broadcast off to block network access during and times when it is not needed and to save energy. To enable and cong WLAN schedule for the admin WiFi network, do the following:

a. Select the Enable WLAN schedule check box.

The page expands and shows the days and times that the WiFi signal is After you enable the WLAN schedule, by default, the WiFi signal is broad every day from 8:30 a.m. to 6:00 p.m.

b. To change if the WiFi signal is broadcast during a day, clear or select box for the day.

If you clear the check box for a day, the WiFi signal is not broadcast

c. To change when the WiFi signal is broadcast during a day, move the room on the blue bar to the desired starting and ending times for the day.

The period that the WiFi signal is broadcast during that day displays to of the blue bar.

1. Click the Apply button.

Your settings are saved. The router sends the new settings to the satellite.

1. Make sure that an IoT device can connect to the WiFi network with its nIf you cannot connect using WiFi, check the following:

- Is your WiFi-enabled computer or mobile device connected to another WiFi network in your area? Some WiFi devices automatically connect to the rst network without WiFi security that they discover.

- Is your computer or mobile device trying to connect to your network with settings (before you changed the settings)? If so, update the WiFi network selection in your computer or WiFi device to match the current settings for network.

Change the IoT WiFi password or security level

You must be connected to the admin network to change the IoT password and level (authentication and encryption settings). The router supports Wi-Fi Protected Access 3 (WPA3), WPA2, mixed WPA2 + WPA3, and mixed WPA + WPA2. The also supports enterprise level WPA3 and enterprise level WPA2.

The router web interface calls the IoT WiFi network the Wireless 3 network.

To change the IoT WiFi network password or security level:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless > Wireless 3.

The WiFi settings for the wireless 3 network display on the page.

1. Under Security Options, select a WiFi security option:

- WPA2-PSK [AES]: The WPA2 option uses AES encryption. This type of sec allows only WiFi devices that support WPA2 or WPA3 to join the network When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use. It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA-PSK [TKIP] + WPA2-PSK [AES]: If your network includes legacy device (devices that support only WPA), select this radio button. This option, which AES and TKIP encryption, allows WiFi devices that support WPA, WPA2, or to join the network.

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use. It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA2 Enterprise: If your network is connected to a RADIUS server that provides authentication and your network includes WPA2 and WPA3 devices, select this radio button. WPA2 Enterprise can provide a high level of security allows WPA2 and WPA3 devices to connect to the network. (WPA devices connect.) Before a WiFi client can connect to the network, the WiFi client

be configured on the RADIUS server and authenticated against the RADIUS. The router functions as the authenticator between the WiFi client and the server, which provides the actual authentication.

When you select this option, additional elds display so that you can spec RADIUS server. Do the following:

a. In the IP address eld, enter the IP address of the RADIUS server to the router must connect.
b. In the Port eld, enter the port number that the router must use to communicate with the RADIUS server.
By default, the port number is 1812.
c. In the Shared Secret eld, enter the password that the router must use communicate with the RADIUS server.
This password must be congured on the RADIUS server. This password used to authenticate the router (not a WiFi client) against the RADIUS

- WPA3-Personal [SAE]: This is the most secure personal authentication option. WPA3 uses SAE encryption and allows only WiFi devices that support WPA connect to the network. WiFi devices that support WPA or WPA2 cannot to the network.

When you select this option, additional elds display so that you can add Do the following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 127 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA3 Enterprise: If your network is connected to a RADIUS server that provides authentication and your network includes WPA3 devices only, select radio button. WPA3 Enterprise can provide the highest level of security but and WPA2 devices cannot connect. Before a WiFi client can connect to the network, the WiFi client must be congured on the RADIUS server and authenticated against the RADIUS server. The router functions as the authentic between the WiFi client and the RADIUS server, which provides the actual authentication.

When you select this option, additional elds display so that you can spec RADIUS server. Do the following:

a. In the IP address eld, enter the IP address of the RADIUS server to the router must connect.

b. In the Port eld, enter the port number that the router must use to communicate with the RADIUS server.

By default, the port number is 1812.

c. In the Shared Secret eld, enter the password that the router must use communicate with the RADIUS server.

This password must be congured on the RADIUS server. This password used to authenticate the router (not a WiFi client) against the RADIUS

- WPA2-Personal [AES] + WPA3-Personal: This option allows WiFi devices that support WPA2 (which is the same as WPA2-PSK) or WPA3 to join the next WiFi devices that support WPA cannot connect to the network. This option SAE and AES encryption. WPA3 (which uses SAE) is more secure than WiFi (which uses AES).

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

1. Click the Apply button.

Your settings are saved.

Guest WiFi network and captive portal

You can set up a guest WiFi network (guest portal), which allows visitors to a Internet using a dedicated SSID. You can also set up a captive portal for the With a captive portal, when visitors connect to the guest portal and open a b access the Internet, they are redirected to a splash page where they must agree Terms of Conditions before they can access Internet.

By default, visitors do not need to enter a password to connect to the guest data is not encrypted. Open access without security might be a good option for shop. For situations in which authentication and encryption is required, you can password for WiFi access and you can use Facebook Wi-Fi or set a password portal or captive portal access.

When visitors use the guest portal, they cannot see other devices that are con to the guest portal (or any other WiFi network on the router) and they canno the local area network (LAN).

The router web interface calls the guest WiFi network the Guest Portal network.

Set up a guest WiFi network with open access or authentication

The router web interface calls the guest WiFi network the Guest Portal network.

To set up a guest WiFi network with open access or local password auth

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless > Guest Portal.

The WiFi settings for guest access display on the page.

1. To enable the guest portal, select the Enable Guest Portal Network check By default, the guest portal is disabled.
2. Leave the Enable SSID Broadcast check box selected.

Allowing the router to broadcast its WiFi network name (SSID) makes it easier your network and connect to it. If you clear this check box, that creates a network.

1. To change the network name, type a new name in the Guest Portal Netw (SSID) eld.

The name can be up to 32 characters long and it is case-sensitive. The de is the randomly generated SSID that is on the router's label, but appended -GUEST. If you change the name, make sure to write down the new name it in a safe place.

1. Although the preset Guest VLAN prole for the Guest Portal WiFi network wo well for most situations, if you want to change the VLAN prole, select the Prole check box, and select another VLAN prole from the menu.

The preset VLAN prole name is Guest, the VLAN has ID 40, and the comb is shown in the menu as Guest(40).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74.

1. Under Security Options, select a WiFi security option:

2. None: No authentication and encryption is required. This is the default set which might be appropriate for some public WiFi networks and WiFi hotsp. However, for many such environments, opportunistic wireless encryption (OWE see further down in this section) might be a better choice.

3. WPA2-PSK [AES]: The WPA2 option uses AES encryption. This type of sec allows only WiFi devices that support WPA2 or WPA3 to join the network. When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA-PSK [TKIP] + WPA2-PSK [AES]: If your network includes legacy device (devices that support only WPA), select this radio button. This option, which AES and TKIP encryption, allows WiFi devices that support WPA, WPA2, or to join the network.

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- OWE: For many public WiFi networks and WiFi hotspots, opportunistic wire encryption (OWE) might be a good choice because it offers CCM mode (CCMP) as encryption without authentication for access to the WiFi network. Protected Management Frames (PMF) is automatically set to mandatory. (For more information about PMF, see Protected Management Frames on page 1). The WiFi network can accept both clients that support OWE and clients that not. For clients that do not support OWE, trafc is not encrypted.

1. A WLAN schedule can turn WiFi broadcast off to block network access during and times when it is not needed and to save energy. To enable and cong WLAN schedule for the admin WiFi network, do the following:

a. Select the Enable WLAN schedule check box.

The page expands and shows the days and times that the WiFi signal is After you enable the WLAN schedule, by default, the WiFi signal is broad every day from 8:30 a.m. to 6:00 p.m.

b. To change if the WiFi signal is broadcast during a day, clear or select box for the day.

If you clear the check box for a day, the WiFi signal is not broadcast

c. To change when the WiFi signal is broadcast during a day, move the room on the blue bar to the desired starting and ending times for the day.

The period that the WiFi signal is broadcast during that day displays to of the blue bar.

1. Scroll down to the Authentication Mode section and make sure that the Local radio button is selected.

2. In the Authentication Options section, either specify an open network or set authentication password by doing one of the following:

- None: To specify an open network without authentication, select the None radio button.

- Password Authentication: To set an authentication password, select the Password Authentication radio button and specify a password in the eld. password must be a minimum of 8 characters and can be a maximum c characters (or 64 hexadecimal digits).

Note: In order for guests to access the Internet through the Orbi Pro net they must enter this password in the guest portal.

1. To set an expiration time for how long guests can access the Internet, select from the Expiration menu. After guests are authenticated, they can access the Internet for that period of time.

If you select Never from the menu, guest access time is not restricted to a

1. Click the Apply button.

Your settings are saved. The router sends the new settings to the satellite.

Set up Facebook Wi-Fi for the guest WiFi network

You can set up Facebook Wi-Fi on your Orbi WiFi network to offer your cust WiFi access if they check in to your existing Facebook business page.

Note: If a user attempts to access a website over HTTP (by default, over port user is directed to the Facebook Login page. If a user attempts to access a so over HTTPS (by default, over port 443), a Security Warning window opens in the browser. The user must click the Allow button on the Security Warning window the Facebook Login page.

The router web interface calls the guest WiFi network the Guest Portal network.

To set up Facebook Wi-Fi for the guest WiFi network:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless > Guest Portal.

The WiFi settings for guest access display on the page.

1. Select the Enable Guest Portal Network check box.

2. Select the Enable SSID Broadcast check box.

By default, this check box is selected. Allowing the router to broadcast its \ network name (SSID) makes it easier to nd your network and connect to it. clear this check box, that creates a hidden network.

1. To change the network name, type a new name in the Guest Portal Netw (SSID) eld.

The name can be up to 32 characters long and it is case-sensitive. If you name, make sure to write down the new name and keep it in a safe place

1. Although the preset Guest VLAN prole for the Guest Portal WiFi network wo well for most situations, if you want to change the VLAN prole, select the Prole check box, and select another VLAN prole from the menu.

The preset VLAN prole name is Guest, the VLAN has ID 40, and the comb is shown in the menu as Guest(40).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74.

1. Under Security Options, select a WiFi security option:

2. None: No authentication and encryption is required. This is the default set which might be appropriate for some public WiFi networks and WiFi hotsp. However, for many such environments, opportunistic wireless encryption (OWE see further down in this section) might be a better choice.

3. WPA2-PSK [AES]: The WPA2 option uses AES encryption. This type of sec allows only WiFi devices that support WPA2 or WPA3 to join the network. When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA-PSK [TKIP] + WPA2-PSK [AES]: If your network includes legacy device (devices that support only WPA), select this radio button. This option, which AES and TKIP encryption, allows WiFi devices that support WPA, WPA2, or to join the network.

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- OWE: For many public WiFi networks and WiFi hotspots, opportunistic wire encryption (OWE) might be a good choice because it offers CCM mode | (CCMP) as encryption without authentication for access to the WiFi network. Protected Management Frames (PMF) is automatically set to mandatory. (For more information about PMF, see Protected Management Frames on page 1

The WiFi network can accept both clients that support OWE and clients to not. For clients that do not support OWE, trafc is not encrypted.

1. A WLAN schedule can turn WiFi broadcast off to block network access during and times when it is not needed and to save energy. To enable and cong WLAN schedule for the admin WiFi network, do the following:

a. Select the Enable WLAN schedule check box.

The page expands and shows the days and times that the WiFi signal is After you enable the WLAN schedule, by default, the WiFi signal is broad every day from 8:30 a.m. to 6:00 p.m.

b. To change if the WiFi signal is broadcast during a day, clear or select box for the day.

If you clear the check box for a day, the WiFi signal is not broadcast

c. To change when the WiFi signal is broadcast during a day, move the room on the blue bar to the desired starting and ending times for the day.

The period that the WiFi signal is broadcast during that day displays to of the blue bar.

1. Scroll down to the Authentication Mode section and select the Facebook Wi-Fi radio button.

The page adjust and displays the Add Page button, which is masked out up click the Apply button.

1. Click the Apply button.

Your settings are saved.

1. Click the Add Page button.

The Facebook Wi-Fi settings page displays.

1. On the Facebook Wi-Fi settings page, do the following:

a. Click the Connect button.

The Facebook Page menu displays.

b. From the Facebook Page menu, select an existing Facebook business pag You must be an admin for the page, and the page must be associated address.

c. To allow users to skip checking in to Facebook, click the Skip check-in. As an option, you can require users to enter a WiFi code before they use WiFi access. You can set the WiFi code. If you enable this option, users must check in to Facebook, but they must enter the WiFi code.

d. To select the period after which users are automatically logged out, click Session length icon, and select a period.

e. To add terms of service to the Facebook check-in page, select the option terms of service and type or copy your terms of service.

f. Click the Save Settings button.

The Facebook Wi-Fi settings are saved.

The name of the selected Facebook business page displays in the Facebook Page eld in the router web interface along with the Change Page button lets you replace the selected Facebook business page with another one.

g. Return to the Guest Portal page in the router web interface.

1. On the page with the WiFi settings for guest access, click the Apply button. Your settings are saved.

Set up a guest WiFi network with a captive portal

A captive portal is an entry to a guest network that requires guests to view and agree to terms and conditions before using the network. When you use a portal on the router, guests cannot see other devices that are connected and the access the local area network (LAN).

The router web interface calls the guest WiFi network the Guest Portal network.

To set up a guest WiFi network with a captive portal:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless > Guest Portal.

The WiFi settings for guest access display on the page.

1. Select the Enable Guest Portal Network check box.

2. Leave the Enable SSID Broadcast check box selected.

Allowing the router to broadcast its WiFi network name (SSID) makes it easier your network and connect to it. If you clear this check box, that creates a network.

1. To change the network name, type a new name in the Guest Portal Netw (SSID) eld.

The name can be up to 32 characters long and it is case-sensitive. The de is the randomly generated SSID that is on the router's label, but appended -GUEST. If you change the name, make sure to write down the new name it in a safe place.

1. Although the preset Guest VLAN prole for the Guest Portal WiFi network wo well for most situations, if you want to change the VLAN prole, select the Prole check box, and select another VLAN prole from the menu.

The preset VLAN prole name is Guest, the VLAN has ID 40, and the comk is shown in the menu as Guest(40).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74.

1. Under Security Options, select a WiFi security option:

- None: No authentication and encryption is required. This is the default set which might be appropriate for some public WiFi networks and WiFi hotsp. However, for many such environments, opportunistic wireless encryption (OWE see further down in this section) might be a better choice.

- WPA2-PSK [AES]: The WPA2 option uses AES encryption. This type of sec allows only WiFi devices that support WPA2 or WPA3 to join the network. When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- WPA-PSK [TKIP] + WPA2-PSK [AES]: If your network includes legacy device (devices that support only WPA), select this radio button. This option, which AES and TKIP encryption, allows WiFi devices that support WPA, WPA2, or to join the network.

When you select this option, the Password (Network Key) eld displays. D following:

a. In the Password (Network Key) eld, enter the network key (password) you want to use.

It is a text string from 8 to 63 characters.

b. Write down the new password and keep it in a secure place for future reference.

- OWE: For many public WiFi networks and WiFi hotspots, opportunistic wire encryption (OWE) might be a good choice because it offers CCM mode (CCMP) as encryption without authentication for access to the WiFi network. Protected Management Frames (PMF) is automatically set to mandatory. (For more information about PMF, see Protected Management Frames on page 1). The WiFi network can accept both clients that support OWE and clients that not. For clients that do not support OWE, trafc is not encrypted.

1. A WLAN schedule can turn WiFi broadcast off to block network access during and times when it is not needed and to save energy. To enable and cong WLAN schedule for the admin WiFi network, do the following:

a. Select the Enable WLAN schedule check box.

The page expands and shows the days and times that the WiFi signal is After you enable the WLAN schedule, by default, the WiFi signal is broad every day from 8:30 a.m. to 6:00 p.m.

b. To change if the WiFi signal is broadcast during a day, clear or select box for the day.

If you clear the check box for a day, the WiFi signal is not broadcast

c. To change when the WiFi signal is broadcast during a day, move the room on the blue bar to the desired starting and ending times for the day.

The period that the WiFi signal is broadcast during that day displays to of the blue bar.

1. Scroll down to the Authentication Mode section and make sure that the Local radio button is selected.

2. In the Authentication Options section, set a guest portal password by select Password Authentication radio button and entering a password in the eld.

The password must be a minimum of 8 characters and can be a maximum characters (or 64 hexadecimal digits).

Note: In order for guests to access the Internet, they must enter this passw the guest portal and click the AGREE button to accept terms and conditions

1. To set an expiration time for how long users can access the Internet, select from the Expiration menu.

After guests are authenticated, they can access the Internet for that period o After the period expires, guests are redirected to the Terms and Conditions

1. In the Portal Customization section, congure the following settings:

2. To include a custom Terms and Conditions page, do the following: .
   a. On the Terms and Conditions subsection, click the Browse button.
   b. Locate and select the terms and conditions le on your computer.
   The le must be a .txt le, encoded in UTF8 format, and can be up

- To include a custom logo le, do the following:

a. In the Logo subsection, click the Browse button.

b. Locate and select the logo le on your computer.

The le must be a .jpg, .jpeg, .gif, or .png le. The le size can be up to

10 MB and the dimensions must be 200 x 200 pixels.

1. To preview the guest portal, click the Preview button.

To preview the Terms and Conditions page, either the terms and conditions logo les must both be set to Default or you must upload new les for bot cannot preview the Terms and Conditions page if one le is set to Default.

1. To set up a redirect URL, select the URL radio button and enter the URL to which you want to redirect guests to in the eld.

After guests agree to the terms and conditions, they are redirected to this

1. Click the Apply button.

Your settings are saved.

7

Manage the LANs

This chapter includes the following sections:

• About the LANs
  • LAN settings
• DHCP servers
  • Reserved LAN IP addresses
  • Multicast DNS gateway

About the LANs

A local area network (LAN) can generally be dened as a broadcast domain. Hu bridges, or switches in the same physical segment or segments connect all end Endpoints can communicate with each other without the need for a router such Orbi Pro router. Routers connect LANs together, routing the traffic to the appropriate port.

The router supports five local area networks (LANs): LAN 1 through LAN 5, each functions with a different default IP address and supports a different DHCP IP range.

Each LAN is preset to a VLAN prole. For many network environments, the pres congregations on the router work ne. If your network requires differents settings, can change the LAN settings on the router.

Note: LANs (networks) and LAN ports are two different concepts. By default, all LAN ports and the WAN port on the router and all LAN ports on any connected Ethernet ports in the same physical network segment (LAN 1) and members of 1. However, you can assign a LAN port to a different VLAN (see Change the for an Ethernet port on page 83).

Table 7. LANs and their associated IP addresses and VLANs

LAN Name	Address	DHCP IP Address	Range ID	Default VLAN	WLAN Name	Prole
	192.168.1.1LAN 1	192.168.1.254			Default1192.168.1.2 -
	192.168.20.1LAN 2	192.168.20.254			Employee20192.168.20.2 -
	192.168.30.1LAN 3	192.168.30.254			IoT30192.168.30.2 -
	192.168.40.1LAN 4	192.168.40.254			Guest40192.168.40.1 -
*		LAN 5	--		----

* Disabled by default, but you can enable it.

For more information about VLANs, see Manage the VLANs on page 72.

LAN settings

Although the default LAN settings work well for most situations, you can change settings for each of the ve LANs on the router.

Change the default LAN 1 settings

LAN 1 is the default LAN that is assigned to the default VLAN prole with the Default and ID 1. You cannot change the VLAN prole for LAN 1.

By default, the router uses private IP addresses on the LAN side and functions server. The router's default LAN IP conguration is as follows:

• LAN IP address: 192.168.1.1
- Subnet mask: 255.255.255.0

These addresses are part of the designated private address range for use in p networks and are suitable for most applications. If your network requires a diffe addressing scheme, you can change these settings.

You might want to change these settings if you need a specific IP subnet that more devices on the network uses, or if you use competing subnets with the scheme.

Note: The IP settings for LAN 1 can be automatically changed if the Orbi Pro router detects a double NAT condition. (For more information about double NAT https://kb.netgear.com/30186/What-is-double-NAT-and-why-is-it-bad.) The router can detect this condition during the setup process if you select router mode even another router is already present in your network. If your Orbi Pro WiFi 6 router connected to another router that is already operating with the 192.168.1.x LAN: the LAN scheme of the Orbi Pro WiFi 6 router is automatically changed to 10 the DHCP address range is changed to 10.0.0.2-10.0.0.254.

To change the settings for the default LAN 1:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 1.

The LAN Setup page displays.

1. In the IP Address eld, type the IP address.

The default IP address is 192.168.1.1.

1. In the IP Subnet Mask, type the subnet mask of the router.

The IP address and subnet mask identities which addresses are local to a sp device and which must be reached through a gateway or router.

The default IP subnet mask is 255.255.255.0.

1. Change the RIP settings.

Router Information Protocol (RIP) allows a router to exchange routing information with other routers.

a. Select a setting from the RIP Direction menu:

• Both: The router broadcasts its routing table periodically and incorporates information that it receives.
• Out Only: The router broadcasts its routing table periodically.
• In Only: The router incorporates the RIP information that it receives.

b. Select a setting from the RIP Version menu:

• Disabled: This is the default setting.
• RIP-1: This format is universally supported. It is adequate for most network unless you are using an unusual network setup.

• RIP-2: This format carries more information. Both RIP-2B and RIP-2M sen the routing data in RIP-2 format. RIP-2B uses subnet broadcasting. RIP-2M uses multicasting.

• Click the Apply button.

Your settings are saved.

If you changed the LAN IP address of the router, you are disconnected when change takes effect.

1. To reconnect, close your browser, relaunch it, and log in to the router.

Change the employee LAN 2 settings

By default, LAN 2 is assigned to the Employee VLAN prole with ID 20. If you LAN and associated VLAN, you can separate employee traffic from other types of on your router. The default IP address of LAN 2 is 192.168.20.1.

In most situations, you do not need to change the settings for LAN 2, but y so to customize the IP address or VLAN. You can also disable LAN 2.

To change the employee LAN 2 settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 2.

The LAN Setup page displays.

1. If you previously disabled the LAN setup for LAN 2, select the Enable LAN check box.
2. In the IP Address eld, type the IP address.

The default IP address is 192.168.20.1.

1. In the IP Subnet Mask, type the subnet mask of the router.

The IP address and subnet mask identities which addresses are local to a sp device and which must be reached through a gateway or router.

The default IP subnet mask is 255.255.255.0.

1. Although the preset Employee VLAN prole for the LAN 2 works well for most situations, if you want to change the VLAN prole, select the VLAN Prole ch box, and select another VLAN prole from the menu.

The preset VLAN profile name is Employee, the VLAN has ID 20, and the c is shown in the menu as Employee(20).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74. For inform about adding a new VLAN to a LAN, see Add a new VLAN prole directly on page 77.

1. Click the Apply button.

Your settings are saved.

If you changed the LAN IP address of the router, you are disconnected when change takes effect.

1. To reconnect, close your browser, relaunch it, and log in to the router.

Change the IoT LAN 3 settings

By default, LAN 3 is assigned to the IoT VLAN prole with ID 30. If you use associated VLAN, you can separate Internet of things (IoT) traffic from other types: traffic on your router. The default IP address of LAN 2 is 192.168.30.1.

In most situations, you do not need to change the settings for LAN 3, but y so to customize the IP address or VLAN. You can also disable LAN 3.

To change the IoT LAN 3 settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 3.

The LAN Setup page displays.

1. If you previously disabled the LAN setup for LAN 3, select the Enable LAN check box.
2. In the IP Address eld, type the IP address.

The default IP address is 192.168.30.1.

1. In the IP Subnet Mask, type the subnet mask of the router.

The IP address and subnet mask identities which addresses are local to a sp device and which must be reached through a gateway or router.

The default IP subnet mask is 255.255.255.0.

1. Although the preset IoT VLAN prole for LAN 3 works well for most situations want to change the VLAN prole, select the VLAN Prole check box, and select another VLAN prole from the menu.

The preset VLAN prole name is IoT, the VLAN has ID 30, and the combination shown in the menu as IoT(30).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74. For inform about adding a new VLAN to a LAN, see Add a new VLAN prole directly on page 77.

1. Click the Apply button.

Your settings are saved.

If you changed the LAN IP address of the router, you are disconnected when change takes effect.

1. To reconnect, close your browser, relaunch it, and log in to the router.

Change the guest LAN 4 settings

By default, LAN 4 is assigned to the Guest VLAN prole with ID 40. If you use and associated VLAN, you can separate guest traffic from other types of traffic or router. The default IP address of LAN 2 is 192.168.40.1.

In most situations, you do not need to change the settings for LAN 4, but y so to customize the IP address or VLAN. You can also disable LAN 4.

To change the guest LAN setting:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 4.

The LAN Setup page displays.

1. If you previously disabled the LAN setup for LAN 4, select the Enable LAN check box.
2. In the IP Address eld, type the IP address.

The default IP address is 192.168.40.1.

1. In the IP Subnet Mask, type the subnet mask of the router.

The IP address and subnet mask identities which addresses are local to a sp device and which must be reached through a gateway or router.

The default IP subnet mask is 255.255.255.0.

1. Although the preset Guest VLAN prole for the Guest Portal WiFi network wo well for most situations, if you want to change the VLAN prole, select the Prole check box, and select another VLAN prole from the menu.

The preset VLAN prole name is Guest, the VLAN has ID 40, and the comb is shown in the menu as Guest(40).

For more information about VLANs, see Manage the VLANs on page 72, incl How the router organizes LANs, VLANs, and WLANs on page 74. For inform about adding a new VLAN to a LAN, see Add a new VLAN prole directly on page 77.

1. Click the Apply button.

Your settings are saved.

If you changed the LAN IP address of the router, you are disconnected when change takes effect.

1. To reconnect, close your browser, relaunch it, and log in to the router.

Set custom settings for LAN 5

You can set a custom VLAN prole for LAN 5.

To set up LAN 5:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 5.

2. Select the Enable LAN5 Setup check box.

By default, LAN 5 is disabled.

1. In the IP Address eld, type the IP address.

The default IP address is 192.168.50.1.

1. In the IP Subnet Mask, type the subnet mask of the router.

The IP address and subnet mask identities which addresses are local to a sp device and which must be reached through a gateway or router.

The default IP subnet mask is 255.255.255.0.

1. From the VLAN Prole menu, select a custom VLAN prole.

For more information about how to add a new VLAN prole, see Add a ne prole directly to a LAN on page 77.

1. Click the Apply button.

Your settings are saved.

If you changed the LAN IP address of the router, you are disconnected when change takes effect.

1. To reconnect, close your browser, relaunch it, and log in to the router.

DHCP servers

You can set a Dynamic Host Conguration Protocol (DHCP) server for each LAN. By default, the router acts as a DHCP server. The router assigns IP, DNS service default gateway addresses to all computers connected to the LAN.

Set up a DHCP server for the default LAN 1

The DHCP IP addresses for the default LAN 1 must be part of the same IP as the router's default LAN IP address. Using the default addressing scheme, de range between 192.168.1.2 and 192.168.1.254.

To set up the DHCP server for the default LAN 1:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 1.

The LAN Setup page displays.

1. If you previously disabled the DHCP server feature, select the Use Router as Server check box.
2. Specify the range of IP addresses that the router assigns:

a. In the Starting IP Address eld, enter the lowest number in the range. This IP address must be in the same subnet as the router. The default address is 192.168.1.2.
b. In the Ending IP Address eld, enter the number at the end of the range addresses.

This IP address must be in the same subnet as the router. The default address is 192.168.1.254.

1. In the lease time hour(s) eld, set the duration of the IP address lease in By default, the lease expires after one day (24 hours), after which the WiFi renew the lease.
2. Click the Apply button.

Your settings are saved.

The router delivers the following parameters to any LAN device that requests

• An IP address from the range that you dened
• Subnet mask
• Gateway IP address (the router's LAN IP address)
• DNS server IP address (the router's LAN IP address)

Set up a DHCP server for the employee LAN 2

The DHCP IP addresses for the employee LAN 2 must be part of the same subnet as the router's default LAN IP address. Using the default addressing scheme a range between 192.168.20.2 and 192.168.20.254, although you can save of the range for devices with xed addresses.

To set up the DHCP server for the employee LAN 2:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 2.

The LAN Setup page displays.

1. If you previously disabled the DHCP server feature, select the Use Router as Server check box.
2. Specify the range of IP addresses that the router assigns:

a. In the Starting IP Address eld, enter the lowest number in the range. This IP address must be in the same subnet as the router. The default address is 192.168.20.2.

b. In the Ending IP Address eld, enter the number at the end of the range addresses.

This IP address must be in the same subnet as the router. The default address is 192.168.20.254.

1. In the lease time hour(s) eld, set the duration of the IP address lease in By default, the lease expires after one day (24 hours), after which the WiFi renew the lease.

2. Click the Apply button.

Your settings are saved.

The router delivers the following parameters to any LAN device that requests

• An IP address from the range that you dened
• Subnet mask
• Gateway IP address (the router's LAN IP address)
• DNS server IP address (the router's LAN IP address)

Set up a DHCP server for the IoT LAN 3

The DHCP IP addresses for the IoT LAN 3 must be part of the same IP ad as the router's default LAN IP address. Using the default addressing scheme, de range between 192.168.30.2 and 192.168.30.254, although you can save part of range for devices with xed addresses.

To set up the DHCP server for the IoT LAN 3:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 3.

The LAN Setup page displays.

1. If you previously disabled the DHCP server feature, select the Use Router as Server check box.
2. Specify the range of IP addresses that the router assigns:

a. In the Starting IP Address eld, enter the lowest number in the range. This IP address must be in the same subnet as the router. The default address is 192.168.30.2.
b. In the Ending IP Address eld, enter the number at the end of the range addresses.

This IP address must be in the same subnet as the router. The default address is 192.168.30.254.

1. In the lease time hour(s) eld, set the duration of the IP address lease in By default, the lease expires after one day (24 hours), after which the WiFi renew the lease.
2. Click the Apply button.

Your settings are saved.

The router delivers the following parameters to any LAN device that requests

• An IP address from the range that you dened
• Subnet mask
• Gateway IP address (the router's LAN IP address)
• DNS server IP address (the router's LAN IP address)

Set up a DHCP server for the guest LAN 4

The DHCP IP addresses for the guest LAN 4 must be part of the same IP as the router's default LAN IP address. Using the default addressing scheme, de range between 192.168.40.2 and 192.168.40.254, although you can save part of range for devices with xed addresses.

To set up the DHCP server for the guest LAN 4:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security war does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 4.

The LAN Setup page displays.

1. If you previously disabled the DHCP server feature, select the Use Router as Server check box.

2. Specify the range of IP addresses that the router assigns:

a. In the Starting IP Address eld, enter the lowest number in the range. This IP address must be in the same subnet as the router. The default address is 192.168.40.2.

b. In the Ending IP Address eld, enter the number at the end of the range addresses.

This IP address must be in the same subnet as the router. The default address is 192.168.40.254.

1. In the lease time hour(s) eld, set the duration of the IP address lease in By default, the lease expires after one day (24 hours), after which the WiFi renew the lease.

2. Click the Apply button.

Your settings are saved.

The router delivers the following parameters to any LAN device that requests

• An IP address from the range that you dened
• Subnet mask
• Gateway IP address (the router's LAN IP address)
• DNS server IP address (the router's LAN IP address)

Set up a DHCP server for the custom LAN 5

The DHCP IP addresses for the custom LAN 5 must be part of the same IP as the router's default LAN IP address. Using the default addressing scheme, de range between 192.168.50.2 and 192.168.50.254, although you can save part of range for devices with xed addresses.

To set up the DHCP server for the custom LAN 5:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup > LAN 5.

The LAN Setup page displays.

1. If you previously disabled the DHCP server feature, select the Use Router as Server check box.
2. Specify the range of IP addresses that the router assigns:

a. In the Starting IP Address eld, enter the lowest number in the range. This IP address must be in the same subnet as the router. The default address is 192.168.50.2.
b. In the Ending IP Address eld, enter the number at the end of the range addresses.

This IP address must be in the same subnet as the router. The default address is 192.168.50.254.

1. In the lease time hour(s) eld, set the duration of the IP address lease in By default, the lease expires after one day (24 hours), after which the WiFi renew the lease.
2. Click the Apply button.

Your settings are saved.

The router delivers the following parameters to any LAN device that requests

• An IP address from the range that you dened
• Subnet mask
• Gateway IP address (the router's LAN IP address)
• DNS server IP address (the router's LAN IP address)

Disable the DHCP server for a LAN

By default, the router acts as a DHCP server. The router assigns IP, DNS service default gateway addresses to all computers connected to the LAN. The assigned gateway address is the LAN address of the router.

You can use another device on your network as the DHCP server, or specify settings of all your computers.

To disable a DHCP server feature in the router:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup.
2. Select the LAN tab for the LAN for which you want to disable the DHCP s LAN 2, LAN 3, LAN 4, or LAN 5.

The LAN Setup page displays.

1. Clear the Use Router as DHCP Server check box.
2. Click the Apply button.
3. (Optional) If this service is disabled and no other DHCP server is on your set your computer IP addresses manually so that they can access the router.

Reserved LAN IP addresses

When you specify a reserved IP address for a computer on a LAN, that compares the same LAN IP address each time it accesses the router's DHCP service reserved IP addresses to devices (such as servers) that require permanent IP set

Reserve a LAN IP address

To reserve an IP address:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup.
2. Select the LAN tab for the LAN for which you want to reserve an IP addr LAN 2, LAN 3, LAN 4, or LAN 5.

The LAN Setup page displays.

1. In the Address Reservation section of the page, click the Add button.
   The LAN Address Reservation page displays. Any detected devices display in Address Reservation Table.
2. To reserve an IP address for a detected device, select the radio button in the Reservation Table.
3. To manually reserve an IP address for a device that is not connected or d do the following:

a. In the IP Address eld, type the IP address to assign to the device.
b. In the MAC Address eld, type or copy the MAC address of the device.
c. In the Device Name eld, type a name.

1. Click the Apply button.

The reserved address is entered into the table.

The reserved address is not assigned until the next time the computer conta router's DHCP server. Reboot the computer, or access its IP conguration and a DHCP release and renew.

Edit a reserved LAN IP address

To edit a reserved address entry:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup.
2. Select the LAN tab for the LAN for which you want to edit a reserved IP LAN 1, LAN 2, LAN 3, LAN 4, or LAN 5.

The LAN Setup page displays.

1. Select the radio button next to the reserved address.
2. Click the Edit button.

The LAN Address Reservation page displays.

1. Change the settings.
2. Click the Apply button.

Your settings are saved.

Delete a reserved LAN IP address entry

To delete a reserved address entry:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > LAN Setup.

2. Select the LAN tab for the LAN for which you want to delete a reserved entry: LAN 1, LAN 2, LAN 3, LAN 4, or LAN 5.

The LAN Setup page displays.

1. Select the radio button next to the reserved address.

2. Click the Delete button.

The reserved IP address entry is removed.

Multicast DNS gateway

The router can function as a multicast DNS (mDNS) gateway to allow devices and to be shared across different VLANs and subnets on the LAN.

Shared devices can include printers and scanners, and services can include Airpla Chromecast, and Apple Filing Protocol (AFP).

For example, if a group of wired computers are on VLAN 20 and a printer in an mDNS gateway policy can make the printer available to the computers. Or, meeting participant wants to use a phone connected to a WiFi network on VLAN cast a presentation to a large-screen device connected to a WiFi network on V another mDNS gateway policy can make this possible. The mDNS settings override client isolation and network isolation settings (see Change the client isolation or isolation for a VLAN prole on page 79).

Note: For the mDNS feature, the router and satellites are considered a single satellite cannot forward mDNS packets if the packets do not pass through the mDNS packets must pass through the router, which functions as the mDNS

Enable the multicast DNS gateway and add a policy

After you enable the multicast DNS (mDNS) gateway and add a policy, the rou automatically discover devices and services that can be shared. The policy forms bridge between the following two VLANs:

- Source VLAN: The VLAN that includes shared devices or services as members, example, the type of shared device can be printer and can apply to all pr

the source VLAN. Or, the type of shared service can be Chromecast and ca to all devices that can receive Chromecast transmissions on the source VLAN.

- Destination VLAN: The VLAN that includes as members the wired and WiFi that must be able to use the shared devices or service.

To enable the multicast DNS gateway and add a policy:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security war does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > mDNS Gateway.

The mDNS Gateway page displays.

1. Select the Enable mDNS Gateway check box.

By default, the mDNS gateway is disabled and the check box is cleared.

1. To change the query interval, move the icon on the query interval line.

The query interval is the interval between the queries that the router sends participants in the mDNS policy. By default, this interval is 20 minutes. The interval that you can set is 120 minutes.

1. Click the Add button.

A row is added to the table the with mDNS gateway policies. (You can ac rows for multiple policies.)

1. Dene the mDNS gateway policy by specifying the following:

• Policy Name: A name that lets you identify the policy.
- Shared Services: From the Shared Services menu, select the type of devices (for example, printers) or service (for example, Chromecast) that must be s

- Source VLAN: From the Source VLAN menu, select the VLAN that includes as members the type of shared devices or service that you select from the VLAN menu.

- Destination VLAN: From the Destination VLAN menu, select the VLAN that includes as members the wired devices, WiFi devices, or both that must be to use the type of shared devices or service.

1. Click the Refresh button.

The page displays the individual devices that the router discovers on the soil VLAN and displays the type of each device or the service that each device is the associated MAC and IP addresses, and if the devices are online. For example, depending on the policies that you set up, the page can display all printers, devices that can receive Chromecast transmissions, their MAC and IP addresses and if they are online.

1. Click the Apply button.

Your settings are saved.

Change or remove a multicast DNS policy

You can change or remove a multicast DNS (mDNS) policy.

To change or remove an mDNS policy:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > mDNS Gateway.

The mDNS Gateway page displays.

1. Do one of the following:

2. To change a policy, change the name, shared service, source VLAN, or de: VLAN, or a combination of these.

3. To remove a policy, click the Remove button to the right of the policy.

4. Click the Apply button.

Your settings are saved.

8

Manage the WAN and other Network Settings

This chapter includes the following sections:

• WAN settings
• Dynamic DNS
• DMZ server
• Static routes
  • Universal Plug and Play
• Link aggregation

WAN settings

You can view or conjure wide area network (WAN) settings for the Internet port can set up a DMZ (demilitarized zone) server, change the maximum transmit unsize, and enable the router to respond to a ping to its WAN (Internet) port.

To view the WAN settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > WAN Setup

The WAN Setup page displays.

1. View or change the following settings:

2. Disable Port Scan and DoS Protection. DoS protection protects your LAN a denial of service attacks such as Syn ood, Smurf Attack, Ping of Death, a others. Select this check box only in special circumstances.

3. Default DMZ Server. This feature is sometimes helpful when you are play online games or videoconferencing, but it makes the firewall security less eff See DMZ server on page 143.
4. Respond to Ping on Internet Port. This feature allows your router to be discovered. Use this feature only as a diagnostic tool or if you have a s reason.
5. Disable IGMP Proxying. IGMP proxying allows a client on a LAN or WiFi to receive the multicast traffic it is interested in from the Internet. By defa

proxying is disabled. If you clear the check box, IGMP proxying is enable you can select which type of IGMP messages are forwarded by the router

• Auto: The router automatically detects the supported protocol (IGMPv3 or IGMPv2) and forwards the message accordingly. This is the default settin which we recommend.
• IGMPv3: The router forwards IGMPv3 messages but can also forward IGM messages. (IGMPv3 is backward compatible with IGMPv2.).
• IGMPv2: The router forwards IGMPv2 messages only and ignores IGMPv3 messages.

If you do not need this feature, select the check box to disable it.

• MTU Size (in bytes). The normal MTU (maximum transmit unit) value for Ethernet networks is 1500 bytes, or 1492 bytes for PPPoE connections. Check the MTU only if you are sure that it is necessary for your ISP connection size on page 51.
• NAT Filtering. Network Address Translation (NAT) determines how the router processes inbound traffic. Secured NAT protects computers on the LAN from attacks from the Internet, but might prevent some Internet games, point-to-p applications, or multimedia applications from working. Open NAT provides a much less secured rewall, but allows almost all Internet applications to work

• Disable SIP ALG. The application-level gateway (ALG) for the Session Initiat Protocol (SIP) is enabled by default for enhanced address and port translation. However, some types of VoIP and video traffic might not work well when ALG is enabled. For this reason, the router provides the option to disable ALG.

• Click the Apply button.

Your settings are saved.

Dynamic DNS

Internet service providers (ISPs) assign IP addresses to identify each Internet access. Most ISPs use dynamically assigned IP addresses, which means that the IP address change at any time. If you know your IP address, you can use it to access network remotely. However, because the IP address is assigned dynamically, it can change.

To make it easier to connect, you can get a free account with a Dynamic DI that lets you use a domain name instead of an IP address to access your busi To use this account, you must set up the router to use Dynamic DNS. The r

noties the Dynamic DNS service provider whenever its IP address changes. When access your Dynamic DNS account, the service nds the current IP address of y business network and automatically connects you.

If your ISP assigns a private WAN IP address, the Dynamic DNS service does because private addresses are not routed on the Internet.

Set up a new Dynamic DNS account

NETGEAR offers you the opportunity to set up and register for a free Dynamic account.

To set up Dynamic DNS and register for a free NETGEAR account:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Dynamic DNS.

The Dynamic DNS page displays.

1. Select the Use a Dynamic DNS Service check box.
2. In the Service Provider list, select NETGEAR.
3. Select the No radio button.
4. In the Host Name eld, type the name that you want to use for your URL Your free URL includes the host name that you specify, and ends with mynet For example, if you set myname as the host name, the URL (domain name) myname.mynetgear.com.
5. In the Email eld, type the email address that you want to use for your ad
6. In the Password (6-32 characters) eld, type the password for your account.
7. Select the check box to agree to the terms of service and privacy policy.

8. Click the Register button.

9. Follow the onscreen instructions to register for your NETGEAR Dynamic DNS s

10. To check that Dynamic DNS is enabled in the router, click the Show Status button.

A message displays the Dynamic DNS status.

Specify a DNS account that you already created

If you already own a Dynamic DNS account with NETGEAR, no-IP, or Dyn, you up the router to use your account.

To set up Dynamic DNS if you already created an account:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Dynamic DNS.

The Dynamic DNS page displays.

1. Select the Use a Dynamic DNS Service check box.
2. In the Service Provider list, select your provider.
3. Select the Yes radio button.

The page adjusts and displays the Show Status, Cancel, and Apply buttons.

1. In the Host Name eld, type the host name for your account.

2. Depending on the type of account, specify your user name or email address

3. For a No-IP or Dyn account, in the User Name eld, enter the user name account.

4. For a NETGEAR account, in the Email eld, enter the email address for your account.

5. Depending on the type of account, in either the Password (6-32 characters)

or the Password eld, type the password for your DDNS account.

1. Click the Apply button.

Your settings are saved.

1. To verify that your Dynamic DNS service is enabled in the router, click the Status button.

A message displays the Dynamic DNS status.

Change the Dynamic DNS settings

To change your settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Dynamic DNS.

The Dynamic DNS page displays.

1. Change your DDNS account settings as necessary.
2. Click the Apply button.

Your settings are saved.

DMZ server

The default DMZ (demilitarized zone) server feature is helpful when you are using online games and videoconferencing applications that are incompatible with Netwo Address Translation (NAT). The router is programmed to recognize some of these applications and to work correctly with them, but other applications might not fit well. In some cases, one local computer can run the application correctly if the for that computer is entered as the default DMZ server.

The router usually detects and discards incoming trafc from the Internet that is response to one of your local computers or a service that you congured on the Forwarding/Port Triggering page of the router web interface (see Customize Interr Traffic Rules for Ports on page 197). Instead of discarding this traffic, you can the router forwards the trafc to one computer on your network. This computer the default DMZ server.

CAUTION: DMZ servers pose a security risk. A computer designated as the def DMZ server loses much of the protection of the rewall and is exposed to exp the Internet. If compromised, the DMZ server computer can be used to attack computers on your network.

To set up a default DMZ server:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Setup > WAN Setup.

The WAN Setup page displays.

1. Select the Default DMZ Server check box.
2. Type the IP address.
3. Click the Apply button.

Your settings are saved.

Static routes

For almost all Internet traffic, routes are automatically and dynamically selected. You can also set up a xed, static route. Typically, you only need to add static route you have more than one router or multiple IP subnets on your network.

As an example of when a static route is needed, consider the following case:

• Your main Internet access is through a cable modem to your ISP. The cable is connected to your Orbi Pro WiFi 6 router.
• Your business network also includes an ADSL router that you use to access office site. This ADSL router is connected to a DSL modem, which is used only.
• Your LAN subnet is 192.168.1.0, and the ADSL router's address on your LAN 192.168.1.100.
• The public IP address range at the remote ofce site is 134.177.0.0.

When you set up your Orbi Pro WiFi 6 router, two implicit static routes were

1. A default route was created between your Orbi Pro WiFi 6 router and the modem that connects to your ISP.
2. A second static route was created between your Orbi Pro WiFi 6 router and LAN for all 192.168.1.0 addresses.

With this conguration, if you try to access a device on the 134.177.0.0 network remote ofce site, your Orbi Pro WiFi 6 router forwards your request to your I the ISP forwards your request to the remote ofce site, where the rewall will d request.

In this situation, you must dene a static route, telling your Orbi Pro WiFi 6 r access 134.177.0.0 addresses through your ADSL router at its LAN address of 192.168.1.100.

Here is an example static route setting for this conguration:

• Destination IP address and subnet mask settings: The route applies to all ad at the remote site, so set the destination IP address to 134.177.0.0 and the mask to 255.255.255.0.
• Gateway IP address: Trafc for addresses in the 134.177.0.0 network must be forwarded to the ADSL router, so set the gateway IP address to 192.168.1.1(ADSL router's address on your LAN).
• Private route: Make the static route private as a security precaution in case Information Protocol (RIP) is activated. A private route is not reported in RIP

Set up a static route

To set up a static route:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Static Routes.

The Static Routes page displays.

1. Click the Add button.

The page adjusts.

1. In the Route Name eld, type a name for this static route (for identification only.)

2. To limit access to the LAN only, select the Private check box.

If Private is selected, the static route is not reported in RIP.

1. Select the Active check box to make this route take effect.

2. Type the IP address of the nal destination.

3. Type the IP subnet mask for this destination.

If the destination is a single host, type 255.255.255.255.

1. Type the gateway IP address.

This address must be on the same LAN segment as the router.

1. Type a number from 2 through 15 as the metric value.

This value represents the number of routers between your network and the destination. Usually, a setting of 2 or 3 works.

1. Click the Apply button.

The static route is added.

Change a static route

To edit a static route:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Static Routes.

The Static Routes page displays.

1. In the table, select the radio button for the route.
2. Click the Edit button.

The Static Routes page adjusts.

1. Edit the route information.
2. Click the Apply button.

Your settings are saved.

Delete a static route

To delete a static route:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Static Routes.

The Static Routes page displays.

1. In the table, select the radio button for the route.

2. Click the Delete button.

The route is removed from the table.

Universal Plug and Play

Universal Plug and Play (UPnP) helps devices, such as Internet appliances and core access the network and connect to other devices as needed. UPnP devices can automatically discover the services from other registered UPnP devices on the next. If you use applications such as multiplayer gaming, peer-to-peer connections, or real communications such as instant messaging or remote assistance, enable UPnP.

To enable Universal Plug and Play:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > UPnP.

The UPnP page displays.

1. Select the Turn UPnP On check box.

By default, this check box is selected. UPnP for automatic device conguration be enabled or disabled. If the Turn UPnP On check box is cleared, the rc

not allow any device to automatically control router resources, such as port forwarding.

1. Type the advertisement period in minutes.

The advertisement period species how often the router broadcasts its UPnP information. This value can range from 1 to 1440 minutes. The default period minutes. Shorter durations ensure that control points receive current device status at the expense of more network traffic. Longer durations can compromise the freshness of the device status but can significantly reduce network traffic.

1. Type the advertisement time to live in hops.

The time to live for the advertisement is measured in hops (steps) for each packet sent. Hops are the steps a packet takes between routers. The number can range from 1 to 255. The default value for the advertisement time to hops, which should be ne for most networks. If you notice that some device not being updated or reached correctly, it might be necessary to increase th

1. Click the Apply button.

The UPnP Portmap Table displays the IP address of each UPnP device that is the router and which ports (internal and external) that device opened. The U Portmap Table also displays what type of port is open and whether that pc active for each IP address.

1. To refresh the information in the UPnP Portmap Table, click the Refresh but

Link aggregation

Both the Orbi Pro router and satellite support link aggregation, which lets you link aggregation group (LAG) between the router and a satellite, between two s between the router and a switch, or between the satellite and a switch. The s support 802.3ad link aggregation for static LAGs.

A LAG connection allows you to group two 1 Gbps LAN ports into either a connection for increased throughput or a 1 Gbps connection for redundancy.

Link aggregation is enabled by default on the router and the satellite, but you the ports before you connect the cables. If you use a switch, you must congr aggregation on the switch before you make the cable connections to the switch

CAUTION: If you congregate link aggregation incorrectly, a network loop can occur. Follow the right order for congruration and cable connections, as described in tl procedures.

Add a link aggregation group

You can add a link aggregation group (LAG) between the router and a satellite two satellites, between the router and a switch, or between the satellite and a The switch must support 802.3ad link aggregation for static LAGs.

To add a LAG:

1. If you want to add a LAG between the router and a switch or between a switch, rst do the following on the switch:

Congure static link aggregation on the two Ethernet ports that you plan to the LAG connection to the router or the satellite.

To prevent a network loop, congregate the switch ports before connecting them the router or satellite LAN ports.

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays.

For the router (Base) and each satellite, the ports display on the page:

- Blue: The ports are connected to devices that are turned on.

- Gray: The ports are either not connected or are connected to devices that not turned on.

1. In either the Base (router) or Satellite section, click an Ethernet port that you become part of a LAG.

The Bind button displays between the selected Ethernet port and the adjacent Ethernet port. (If the port does not support link aggregation, the Bind button not display.)

1. Click the Bind button.

The ports are bound in a LAG. The ports now share a single VLAN Prole Mode menu, that is, they share the same VLAN and port mode.

1. Click the Apply button.

Your settings are saved.

Remove a link aggregation group

You can remove a link aggregation group (LAG). First remove the LAG, and the cables.

To remove a LAG:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays.

For the router (Base) and each satellite, the ports display on the page:

• Blue: The ports are connected to devices that are turned on.

• Gray: The ports are either not connected or are connected to devices that not turned on.

• In either the Base (router) or Satellite section, click an Ethernet port that is the LAG.

The Unbind button displays.

1. Click the Unbind button.

The ports are unbound.

1. Click the Apply button.

Your settings are saved.

Set up a LAG connection between an Orbi Pro WiFi AX5400 satellite and router

You can connect the Orbi Pro WiFi 6 AX5400 satellite over a LAG connection Orbi Pro WiFi 6 AX5400 router.

CAUTION: Be sure to follow the steps in the right order and to connect the ports for a LAG connection, as described in the following procedure. If you do conjure the LAG connection in the right order, a network loop can occur. If other LAN ports, the LAG connection will fail.

To set up your Orbi Pro WiFi 6 AX5400 satellite over a LAG connection router:

1. Place your satellite in the room where you want WiFi service.
2. Connect an Ethernet cable to LAN port 1 on the satellite.
3. Connect the other end of the Ethernet cable to LAN port 1 on the router.

CAUTION: Do not yet connect the LAN 2 port on the satellite to the LAN the router or to any other port on the router. You will do so at the end procedure, as described in the last two steps.

1. Connect the satellite to a power source.

The Power LED on the back of the satellite lights green.

The satellite bar LED pulses white. The satellite automatically syncs to the On WiFi 6 AX5400 router.

Note: The rst time that you sync the satellite and the router, the sync pro take up to ve minutes because the router might automatically update the sat rmware.

After the sync process is complete, the satellite bar LED lights blue for abo minutes and then turns off. Blue indicates that the router and satellite success synced, and the wired connection between the router and satellite is good.

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VLAN / Bridge Settings.

The VLAN / Bridge Settings page displays. Note the following:

- Base section: This is the section for the router (base). The rightmost port WAN port. The leftmost port is the LAN 1 port, which displays blue. To of it, the LAN 2 port displays gray because it does not yet have a cak

- Satellite section: The leftmost port is the LAN 1 port, which displays blue the right of it, the LAN 2 port displays gray because it does not yet be attached.

1. In the Base (router) section, do the following:

a. Click LAN port 1. The Bind button displays between the LAN 1 and LAN 2 ports.

b. Click the Bind button. The LAN 1 and LAN 2 ports are bound in a LAG on the router. We recommend that you leave the default selection from the Mode menu Trunk.

1. In the Satellite section, do the following:

a. Click LAN port 1. The Bind button displays between the LAN 1 and LAN 2 ports.

b. Click the Bind button. The LAN 1 and LAN 2 ports are bound in a LAG on the satellite. For the satellite too, we recommend that you leave the default selection to Mode menu as Trunk.

1. Click the Apply button.

Your settings are saved.

1. Connect an Ethernet cable to LAN port 2 on the satellite.

2. Connect the other end of the Ethernet cable to LAN port 2 on the router. The satellite and the router establish a LAG connection.

9

Manage and Monitor Your Orbi System

This chapter describes the router settings for administering, maintaining, and monitoring your Orbi Pro system

The chapter includes the following sections:

• Firmware for the router and satellite
• admin password
  • Monitor the router, satellite, and Orbi Pro network
• Syslog server
• Trafc meter
• NTP server
• Time zone
• Conguration le
• Remote management
• Remote access
• AP mode
• Router mode
• Sync button security

Firmware for the router and satellite

You can use the router web interface to check if new rmware is available and your router and satellite, or you can manually update the rmware for your rout satellite.

Enable the automatic rmware update feature

You can let the router automatically update its rmware and the rmware for any satellites on the network.

To enable the automatic rmware update feature:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Firmware Update.

The Firmware Update page displays.

1. In the Orbi Router Auto Firmware Update section, select the Enable radio k
2. Click the Apply button.

Your settings are saved.

Check for rmware updates

To check for new rmware and update your router and satellite:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Firmware Update.

The Firmware Update page displays.

1. Click the Check button.

The router checks to see if new rmware is available for the router and sat

1. If new rmware is available, click the Update All button.

The router locates and downloads the firmware for the router and satellite and the update.

CAUTION: To avoid the risk of corrupting the rmware, do not interrupt the For example, do not close the browser, click a link, or load a new page. off the router or satellite.

When the upload is complete, your router and satellite restart. The update p typically takes about one minute. Read the new rmware release notes to nd you must recongure the router after updating.

Manually update rmware

If a satellite is connected to your router, you can log in to the router to make the rmware on your satellite.

CAUTION: Update rmware in the correct order by following these rmware updat guidelines:

• Update the rmware on your satellite rst, and then update your router.
• Do not update the rmware on your satellite and router at the same time.
• Do not update more than one Orbi device (router or satellite) at a time. If to update more than one Orbi device, wait for the rst Orbi device to nish before updating your next Orbi device.

To manually update the rmware on your Orbi router and satellite, follow the high level steps:

1. Visit_netgear.com/support and download the rmware for both your Orbi router satellite.
2. Update the rmware on your Orbi satellite.

For more information, see Manually update satellite rmware on page 157.

1. Update the rmware on your Orbi router.

For more information, see Manually update router rmware on page 158.

Manually update satellite rmware

We recommend that you update your satellite's firmware before you update the rmware.

To manually update your satellite's rmware:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Firmware Update > Manual Update.

The Firmware Update page displays.

1. Select the check box next to your satellite's model name.

If you have more than one satellite, only update one satellite at a time. You for the rst satellite to nish updating before updating the next satellite.

1. Click the Update button.

The Orbi satellite Firmware Update window opens.

1. If the browser ask you for the admin password, enter the same password that entered for the router.

2. Click the Browse button.

3. Locate and select the satellite rmware le that you downloaded.

The rmware le name ends in .img or .chk.

1. Click the Upload button.

It takes a few minutes to complete the process.

CAUTION: To avoid the risk of corrupting the rmware, do not interrupt the For example, do not close the browser, click a link, or load a new page. off the router or satellite.

1. After the Orbi satellite finishes updating, check the firmware version on the F Update page.

The rmware on your Orbi satellite is updated.

Manually update router rmware

We recommend that you update your router's rmware after you update the sate rmware.

CAUTION: Be sure that your satellite completes its rmware update before you use your router's rmware.

To manually update your router's rmware:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Firmware Update > Manual Update.

The Firmware Update page displays.

1. Click the Browse button.
2. Locate and select the router rmware le you downloaded.

The rmware le name ends in .img or .chk.

1. Click the Upload button.

It takes a few minutes to complete the process.

CAUTION: To avoid the risk of corrupting the rmware, do not interrupt the For example, do not close the browser, click a link, or load a new page. off the router.

1. After the router nishes updating, check the rmware version in the Router Information pane on the ADVANCED home page.

The rmware on your Orbi router is updated.

admin password

The admin password is the password that you need to log in to the router, and satellite web interface. You can change this password, and you can enable a password reset feature so that you can reset the password if it is forgotten.

Change the admin password

This feature let you change the default password that is used to log in to the user name admin. This password is not the one that you use to access a network.

Note: Be sure to change the password for the user name admin to a secure The ideal password contains no dictionary words from any language and contain uppercase and lowercase letters, numbers, and symbols. It can be up to 30 ch

To set the password for the user name admin:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Set Password.

The Set Password page displays.

1. Type the old password, and type the new password twice.

2. To be able to reset the password, select the Enable Password Reset check We recommend that you enable password reset.

3. Click the Apply button.

Your settings are saved.

Enable admin password reset

The router admin password is used to log in to your router web interface. We that you enable password reset so that you can reset the password if you for reset process is supported in Chrome, Safari, Firefox, Edge, and Internet Explorer

To enable password reset:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Set Password.

The Set Password page displays.

1. Select the Enable Password Reset check box.

2. Select two security questions and provide answers to them.

3. Click the Apply button.

Your settings are saved.

Reset the admin password

If you set up the password reset feature, you can reset your router admin pass you forgot it. This reset process is supported in Chrome, Safari, Firefox, Edge, Internet Explorer.

To reset your admin password:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Click the Cancel button.

If password reset is enabled, you are prompted to enter the serial number router.

The serial number is on the router label.

1. Enter the router's serial number in the eld.
2. Click the Continue button.

The Router Password Reset page displays.

1. Enter the answers to your security questions.
2. Click the Continue button.

The page adjusts.

1. Type a new admin password, conrm your new password, and set new securi questions and answers.
2. Click the Next button.

The page displays a conrmation.

1. Click the Login Again button.

A login window opens.

1. With your new admin password, log in to the router.

Monitor the router, satellite, and Orbi Pr network

You can monitor the behavior and many of the features of your router, satellite Orbi Pro network

View router status and usage information

To view router status and usage information:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Click the ADVANCED tab.

The ADVANCED Home page displays the router status.

View the satellite status in the satellite web interface

The satellite web interface lets you view satellite status information that you can from the router web interface. You can nd the IP address of the satellite in web interface. You can then launch a new web browser window, enter the satellite address, and access the satellite web interface.

To view your satellite's status, it must be connected to your Orbi Pro network.

To view your satellite's status:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Attached Devices.

The Attached Devices page displays.

1. In the Wireless Devices section, nd your satellite's IP address.

2. Launch a new web browser window and enter your satellite's IP address in browser's address bar.

A login window opens.

1. Enter the same admin user name and password that you entered for the rc The satellite status displays. The page displays information about the satellite connections, hardware and rmware versions, and the WiFi networks in the 2.4 and 5 GHz bands.

2. To view detailed information about devices that are connected to the satellite networks, select Connected Devices.

The Connected Devices page displays. For each device, the page displays the address, device name, MAC address, and connection type.

View satellites, WiFi devices, and wired devices connect to the Orbi Pro network

You can view all satellites, WiFi devices, and wired devices that are connected Orbi Pro network.

To view devices connected to your network:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Attached Devices.

The Attached Devices page displays.

The Wired Devices table displays the following information:

• Status: Displays only if a MAC ACL (see MAC access control lists on page network access control (see Network access control list on page 59) is en The eld displays if a device is allowed or blocked. (For satellites, N/A is
  • Device Name: The device model, name, type, and IP address.
• IP Address: The device IP address. The device's IP address can change k the router assigns an IP address to each device when it joins the network
• MAC Address: The device MAC address. The unique MAC address for each device does not change.
• Connection Type: The device is connected to the Orbi Pro network through wired Ethernet connection.
• Connected Orbi: The Orbi router or satellite that the device is connected Orbi router's or satellite's MAC address also displays.

The Wireless Devices table displays the following information:

• Status: Displays only if a MAC ACL (see MAC access control lists on page network access control (see Network access control list on page 59) is en The eld displays if a device is allowed or blocked. (For satellites, N/A is
  • Device Name: The device model, name, type, and IP address.
• IP Address: The device IP address. The device's IP address can change k the router assigns an IP address to each device when it joins the network
• MAC Address: The device MAC address. The unique MAC address for each device does not change.
  • Channel: The channel on which the device is connected to the WiFi netw
• SSID: The radio band of the WiFi network to which the device is connected
• Connected Orbi: The Orbi router or satellite that the device is connected Orbi router's or satellite's MAC address also displays.

• TX/RX Rate (Mbps): The average rate in Mbps at which the device trans and receives (RX) trafc.

• Association Time: The period in hours, minutes, and seconds that the dev connected to the WiFi network.

• Link Status: The quality and strength in dBm of the WiFi connection of t

• To update the page with the most recent information, click the Refresh butt

Check the Internet connection status or renew the connection

To check the Internet connection status:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Click the ADVANCED tab.
2. In the Internet Port pane, click the Connection Status button.

The Connection Status window displays.

The information that displays depends on the type of Internet connection. Wh router receives an IP address dynamically (which is the most common type c connection), the following information displays:

• IP Address: The IP address that is assigned to the router.
• Subnet Mask: The subnet mask that is assigned to the router.
• Default Gateway: The IP address for the default gateway that the router communicates with.
• DHCP Server: The IP address for the Dynamic Host Configuration Protocol that provides the TCP/IP conguration for all the computers that are connected to the router.

• DNS Server: The IP address of the Domain Name Service server that pro translation of network names to IP addresses.

• Lease Obtained: The date and time when the lease was obtained.

• Lease Expires: The date and time that the lease expires.

• When the router receives an IP address dynamically, you can perform the fol actions:

• Release: Click the Release button to terminate the DHCP IP address, that is, terminate the Internet connection.

• Renew: Click the Renew button to renew the DHCP IP address, that is, renew the Internet connection.

• To close the window, click the Close Window button.

Display port and radio statistics

To display port and radio statistics:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Click the ADVANCED tab.
2. In the Internet Port pane, click the Show Statistics button.

The Show Statistics window displays and shows following information:

• System Up Time: The time elapsed since the router was last restarted.
• Port: The statistics for the WAN (Internet) and LAN (Ethernet) ports, the V radios (indicated as WLANs in the window), and the WiFi backhaul connec (indicated as the WLAN Backhaul in the window) between the router and

satellite. For each port and radio, and for the backhaul connection, the w displays the following information:

• Status: The link status of the port.
• TxPkts: The number of packets transmitted on this port since reset or clear.
• RxPkts: The number of packets received on this port since reset or m clear.
• Collisions: The number of collisions on this port since reset or manual
• Tx B/s: The current transmission (outbound) bandwidth used on the WA and LAN ports.
• Rx B/s: The current reception (inbound) bandwidth used on the WAN a LAN ports.
• Up Time: The time elapsed since this port acquired the link.

• Poll Interval: The interval at which the statistics are updated in this pa

• To change the polling frequency, enter a time in seconds in the Poll Interv and click the Set Interval button.

• To stop the polling entirely, click the Stop button.

View and manage logs of router activity

The log is a detailed record of the websites users accessed or attempted to many other router actions. You can specify which actions are logged. Up to 25 can be stored in the log.

To view and manage logs:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

4. Select ADVANCED > Administration > Logs.

The Logs page displays the following information:

• Date and time: The date and time the log entry was recorded.
• Source IP: The IP address of the initiating device for this log entry.
• Target address: The name or IP address of the website or news group or to which access was attempted.

• Action: The action that occurred, such as whether Internet access was blocked or allowed.

• To manage the actions that the router logs, check or clear the check boxes following actions:

• Attempted access to allowed sites: Selected by default.

• Attempted access to blocked sites and services: Selected by default.
• Connections to the Web-based interface of this Router: Selected by defa
• Router operation (startup, get time etc): Selected by default.
• Known DoS attacks and Port Scans: Selected by default.
• Port Forwarding / Port Triggering: Selected by default.

• Wireless access: Selected by default.
  • VPN Service: Selected by default.
  • Insight: Cleared by default.

• To refresh the log page, click the Refresh button.

• To email the log immediately, click the Send Log button.

If you cannot email the logs, set up email notifications (see Email notifications security events on page 70).

1. To clear the log entries, click the Clear Log button.

Syslog server

If a syslog server is present on your network, you can congregate the router to system logs to the syslog server.

To enable the syslog function and specify the syslog server:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Advanced > Administration > Logs.

The Logs page displays.

1. At the bottom of the page, in the Syslog Server section, select the Enable radio button.

The Syslog elds become available.

1. Specify the IP address and port number for the syslog server:

2. Syslog Server IP Address: Enter the IP address of the syslog server on network.

3. Syslog Port: Enter the port number through with the router can reach the server. By default, the port number is 514.

4. Click the Apply button.

Your settings are saved. The router send its logs to the syslog server.

Trafc meter

You can enable trafc metering to monitor the volume of Internet trafc that pass through the router's WAN (Internet) port. With the trafc meter utility, you can set for trafc volume, set a monthly limit, and get a live udate of trafc usage.

Start the trafc meter without trafc restrictions

You can monitor the traffic volume without setting a limit on the volume or co time.

To start or restart the traffic meter without configuring traffic volume or con time restrictions:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Trafc Meter.

The Trafc Meter page displays.

1. Select the Enable Trafc Meter check box.
   By default, no traffic limit is specified and the traffic volume or connection time not controlled.
2. In the Trafc Counter section, set the trafc counter to begin at a specific time date.
3. To start the traffic counter immediately, click the Restart Counter Now button.
4. Click the Apply button.

Your settings are saved.

The Internet Trafc Statistics section helps you to monitor the data trafc. For information, see View the Internet trafc volume and statistics on page 173.

Restrict Internet trafc by volume

You can record and restrict the trafc by volume in MB. This is useful when y measures your trafc volume.

To record and restrict the Internet trafc by volume:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Trafc Meter.

The Trafc Meter page displays.

1. Select the Enable Trafc Meter check box.
2. Select the Trafc volume control by radio button.

3. From the corresponding menu, select an option:

4. Download only. The restriction is applied to incoming traffic only.

5. Both Directions. The restriction is applied to both incoming and outgoing

6. In the Monthly Limit eld, enter how many MBytes (MB) per month are allo

7. If your ISP charges you for extra data volume when you make a new conn enter the extra data volume in MB in the Round up data volume for each by eld.
8. In the Trafc Counter section, set the trafc counter to begin at a specific time date.
9. In the Trafc Control section, enter a value in MB to specify when the route a warning message before the monthly limit in MB is reached.

This setting is optional. The router issues a warning when the balance falls the number of MB that you enter. By default, the value is 0 and no warn is issued.

1. To enable the router to disconnect and disable the Internet connection when limit is reached, select the Disconnect and disable the Internet connection b

2. Click the Apply button.

Your settings are saved.

The Internet Trafc Statistics section helps you to monitor the data trafc. For information, see View the Internet trafc volume and statistics on page 173.

Restrict Internet trafc by connection time

You can record and restrict the traffic by connection time. This is useful when measures your connection time.

To record and restrict the Internet traffic by connection time:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Trafc Meter.

The Trafc Meter page displays.

1. Select the Enable Trafc Meter check box.

2. Select the Connection time control radio button.

The router must be connected to the Internet for you to be able to select Connection time control radio button.

1. In the Monthly Limit eld, enter how many hours per month are allowed.

The router must be connected to the Internet for you to be able to enter in the Monthly Limit eld.

1. In the Trafc Counter section, set the trafc counter to begin at a specific time date.

2. In the Trafc Control section, enter a period in minutes to specify when the issues a warning message before the monthly limit in hours is reached.

This setting is optional. The router issues a warning when the balance falls number of minutes that you enter. By default, the value is 0 and no warni is issued.

1. To enable the router to disconnect and disable the Internet connection when limit is reached, select the Disconnect and disable the Internet connection b

2. Click the Apply button.

Your settings are saved.

The Internet Trafc Statistics section helps you to monitor the data trafc. For information, see View the Internet trafc volume and statistics on page 173.

View the Internet traffic volume and statistics

If you enabled the trafc meter (see Start the trafc meter without trafc restriction page 170), you can view the Internet trafc volume and statistics.

To view the Internet trafc volume and statistics shown by the trafc meter:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Trafc Meter.

The Trafc Meter page displays.

1. Scroll down to the Internet Trafc Statistics section.

The Internet Trafc Statistics section displays when the trafc counter was started and what the trafc balance is. The table displays information about the conn time and trafc volume in MB.

1. To refresh the information onscreen, click the Refresh button.

The information is updated.

1. To display more information about the data traffic and to change the polling click the Trafc Status button.

The Trafc Status pop-up windows displays.

Unblock the trafc meter after the trafc limit is reache

If you congured the trafc meter to disconnect and disable the Internet connection after the trafc limit is reached, you cannot access the Internet until you unblock trafc meter.

CAUTION: If your ISP set a traffic limit, your ISP might charge you for the overage traffic.

To unblock the trafc meter:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Trafc Meter.

The Trafc Meter page displays.

1. In the Trafc Control section, clear the Disconnect and disable the Internet connection check box.
2. Click the Apply button.

Your settings are saved.

NTP server

By default, the router uses the NETGEAR Network Time Protocol (NTP) server to the network time. You can change the NTP server to your preferred NTP serve

To change the NTP server to your preferred NTP server:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > NTP Settings.

The NTP Settings page displays.

1. Select the Set your preferred NTP server radio button.
2. Enter the NTP server domain name or IP address in the NTP server eld.
3. Click the Apply button.

Your settings are saved.

Time zone

To set your time zone manually:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > NTP Settings.

The NTP Settings page displays.

1. Select your time zone from the menu.

2. If you live in a region that observes daylight saving time, select the Automat adjust for daylight savings time check box.

3. Click the Apply button.

Your settings are saved.

Conguration le

The congruration settings of the router are stored within the router in a congrurable. You can back up (save) this le to your computer, restore it, or reset it to default settings.

Back up settings

To back up the router's conguration settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Backup Settings.

The Backup Settings page displays.

1. Click the Back Up button.
2. Specify a location on your network.

A copy of the current settings is saved in the location you specied.

Manage the automatic backup options

You can let the router automatically back up conguration settings before a rmw upgrade.

You can also schedule an automatic backup at a regular interval.

To manage the automatic backup options:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Backup Settings.

The Backup Settings page displays.

1. To let the router automatically back up conguration settings before a rmware upgrade, select the Backup before upgrade check box.
2. To schedule automatic backups, next to Back up periodically, enter the a nu from 1 to 365 in the Day(s) eld.

If you enter 1, the backup occurs daily, if you enter 2, the backup occurs day, and so on. By default, the entry is 0 and no automatic backup occurs

1. Click the Apply button.

Your settings are saved.

Erase the current conguration settings

You can erase the current conguration and restore the factory default settings. ' might want to do this if you move the router to a different network.

To erase the conguration settings:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Backup Settings.

The Backup Settings page displays.

1. Click the ERASE button.

The factory default settings are restored. The user name is admin, the passw password, and the LAN IP address is 192.168.1.1. DHCP is enabled.

Restore conguration settings

To restore conguration settings that you backed up:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Administration > Backup Settings.

The Backup Settings page displays.

1. Click the Browse button to nd and select the .cfg le.

2. Click the Restore button.

The le is uploaded to the router and the router reboots.

CAUTION: Do not interrupt the reboot process.

Remote management

You can access your router over the Internet to view or change its settings. Y know the router's WAN IP address to use this feature. For information about D DNS, see Dynamic DNS on page 140.

Note: Be sure to change the password for the user name admin to a secure. The ideal password contains no dictionary words from any language and contain uppercase and lowercase letters, numbers, and symbols. It can be up to 30 ch. See Change the admin password on page 159.

To set up remote management:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Remote Management.

The Remote Management page displays.

1. Select the Turn Remote Management On check box.

2. In the Allow Remote Access By section, specify the external IP addresses to access the router's remote management.

Note: For enhanced security, restrict access to as few external IP addresses practical.

Select one of the following:

• To allow access from a single IP address on the Internet, select the Only Computer radio button. Enter the IP address to be allowed access.
• To allow access from a range of IP addresses on the Internet, select the Range radio button. Enter a beginning and ending IP address to denote that allowed range.

• To allow access from any IP address on the Internet, select the Everyone button.

• Specify the port number for accessing the router.

The default port for secure HTTP (HTTPS) access is 8443. You can enter a port number for the remote router access. Choose a number from 1024 to but do not use the number of any common service port.

1. Click the Apply button.

Your settings are saved.

Remote access

To use remote access:

1. Launch a web browser on a computer that is not on your business network
2. Type your router's WAN IP address into your browser's address or location e followed by a colon (:) and the custom port number.
   For example, if your external address is 134.177.0.123 and you use port nun 8080, enter https://134.177.0.123:8080 in your browser.

AP mode

You can set up the Orbi Pro router to function as an access point (AP) on network as another router or gateway. When the Orbi Pro router functions as

router features are disabled to prevent any conict with the other router or gate the network.

For example, you can use the Orbi router as a WiFi access point that connects gateway or modem router that you already use for your Internet service. In this, you do not need to change the settings for the gateway or modem router.

Note: If your network includes two or more Orbi Pro routers, we recommend use router mode (the default operation mode) on all Orbi Pro routers.

To set up the Orbi router as an AP after you set up your Internet conn

1. Use an Ethernet cable to connect the Internet port of this router to a LAN your existing router or gateway.
2. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
3. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Router/AP Mode.

The Router/AP Mode page displays.

1. Select the AP Mode radio button.

The page adjusts.

1. Select the IP address setting:

2. Get dynamically from existing router: The other router on the network a an IP address to the Orbi Prorouter while the Orbi Pro router is in AP

3. Use xed IP Address (not recommended): Use this setting if you want to manually assign a specific IP address to the Orbi Pro router while the Orl router is in AP mode. Using this option effectively requires advanced network experience.

Note: To prevent interference with other WiFi routers or WiFi gateways in your network, we recommend that you use different WiFi settings on each WiFi router or WiFi gateway. You can also turn off the WiFi radio on the other router and use the Orbi Pro router and satellite only for WiFi client access.

1. Click the Apply button.

The IP address of the router changes, and you are disconnected.

1. To reconnect, close and restart your browser and enter orbilogin.com.

Router mode

If you set up your Orbi Pro router as an access point, you can change it b

Note: If your network includes two or more Orbi Pro routers, we recommend use router mode (the default operation mode) on all Orbi Pro routers.

To set up the Orbi Pro router as a router:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Router/AP Mode.

The Router/AP Mode page displays.

1. Select the Router Mode radio button.

The page adjusts.

1. Click the Apply button.

Your settings are saved.

1. Log back in to the router to go through the interactive Internet setup proc Use the interactive Internet setup process on page 28).

Sync button security

You can disable the physical Sync button on the router, satellite, or both. If y the physical Sync button, you can still use the Sync button in the router web to sync the connection between the router and a satellite. However, the WPS f of the Sync button (see WiFi connection using WPS on page 27) is disabled.

Manage the Sync button on the router

By default, the physical Sync button on the router is enabled. You can disable for security reasons.

If you press the Sync button and the router's LED bar pulses magenta, this Li indicates that the Sync button is disabled.

To manage your router's Sync button using the router web interface:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Sync Button.

The Sync Button page displays.

1. Do one of the following:

2. Disable the Sync button: Click the Enabled button.

3. Enable the Sync button: Click the Disabled button.

4. Click the Apply button.

Your settings are saved.

Manage the Sync button on the satellite

By default, the physical Sync button on the satellite is enabled. You can disabl button for security reasons.

If you press the Sync button and the satellite's LED bar pulses magenta, this Li indicates that the Sync button is disabled.

To manage your satellite's Sync button using the router web interface:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Attached Devices.

The Attached Devices page displays.

1. In the Wireless Devices table, click in the Device Name eld for the satellite The Edit Device page displays.

2. In the SYNC section, do one of the following:

3. Disable the Sync button: Click the Enabled button.

4. Enable the Sync button: Click the Disabled button.

5. Click the Apply button.

Your settings are saved.

10

Manage the Advanced WiFi Settings

This chapter includes the following sections:

• Download bandwidth per SSID
• Region of operation
• SSID broadcast for a radio
• 20/40 MHz coexistence for the 2.4 GHz radio
• Wi-Fi multimedia for a radio
• CTS/RTS threshold and preamble mode for a radio
• Transmission output power for a radio
- Backhaul password
MU-MIMO
• Protected Management Frames

Depending on the type of advanced WiFi setting, the setting applies either to networks on one radio or to all WiFi networks on the router. That is, these are not apply to one individual WiFi network only.

For information about the individual WiFi networks, see Manage the WiFi Network page 88.

IMPORTANT: When you log in to the router and change the WiFi settings, the automatically sends the new settings to any connected satellites.

Download bandwidth per SSID

You can set up four WiFi networks for your Orbi Pro WiFi 6 network: one for administrative access, one for employee access, one for Internet of things (IoT) and one for guest access. You can manage the download bandwidth per WiFi (SSID) by assigning a percentage of the total bandwidth (100 percent) to each. The available download bandwidth on an SSID determines the network priority for devices connected to the SSID.

If the download bandwidth usage on an SSID exceeds the assigned bandwidth SSID, the router limits the bandwidth on the SSID, which might affect the down speed for devices connected to the SSID.

In setting the download bandwidth ratio for an SSID, consider the number and devices that connect to the SSID and the typical download bandwidth usage for devices. For example, more devices might connect to the IoT WiFi network than employee network, but the typical bandwidth usage for IoT devices might be lo than for employee devices.

Note: The router does not control the uplink bandwidth, that is, the bandwidth devices to the router.

To set the download bandwidth ratios for the SSIDs:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select Wireless.

The Wireless Settings page displays the admin WiFi settings.

Note: Even though this is the page for the admin WiFi settings, the bandwidth that you specify on this page apply to the admin WiFi network, employee \ network, IoT WiFi network, and guest WiFi network. (All bandwidth ratios together must add up to 100 percent.) Similarly, if you specify bandwidth ratios on the employee WiFi settings page, IoT WiFi settings page, or the guest WiFi netw page, they also apply to all other WiFi networks.

1. Select the Enable Bandwidth per SSID check box.

In the Bandwidth per SSID graphic, the colored icons are enabled.

1. Specify the bandwidth ratios by moving the icons on the colored bandwidth The icons represent the following WiFi networks:

• Blue: Admin WiFi network (Wireless 1).
• Green: Employee WiFi network (Wireless 2).
• Purple: IoT WiFi network (Wireless 3).
- Gray: Guest WiFi network (Guest Portal).

As you move an icon, the bandwidth ratio for the WiFi network changes an percentage displays in the icon.

All bandwidth ratios together add up to 100 percent of the available download bandwidth. If you change one ratio, the ratio for another WiFi network might change.

1. Click the Apply button.

Your settings are saved. The router sends the new settings to the satellite.

Region of operation

You can change the region of operation, which is region in which you operate. For some countries or regions, such as North America, you cannot change the because it is preset.

Note: Make sure the country is set to the location where the device is operational are responsible for complying within the local, regional, and national regulations for channels, power levels, and frequency ranges.

WARNING: It might not be legal to operate the router in a region other than listed in the menu. If your country or region is not listed, check with your local agency.

To change the region of operation:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. From the Region menu, select the region in which the router must operate.
2. Click the Apply button.

Your settings are saved. The router restarts with the settings for the new re

SSID broadcast for a radio

By default, the router broadcasts its WiFi network names (SSIDs) so that WiFi is detect them in their scanned network lists. Turning off the SSID broadcast provides additional WiFi security, but users must know an SSID to be able to join its

For each 2.4 GHz and 5 GHz radio individually, you can enable or disable SSIE which then applies too all WiFi networks that use the radio.

To enable or disable SSID broadcast:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. For a radio, select or clear the Enable SSID Broadcast check box.

When this check box is selected (which it is by default), the router broadca SSIDs on the radio so that they display when you scan for local WiFi netw your computer or WiFi device.

1. Click the Apply button.

Your settings are saved.

20/40 MHz coexistence for the 2.4 GHz

20/40 coexistence allows a 20 MHz and 40 MHz channel width to be supported simultaneously. By default, 20/40 MHz coexistence is enabled on the 2.4 GHz range prevent interference between WiFi networks in your environment at the expense of WiFi speed. If no other WiFi networks are present in your environment, you can 20/40 MHz coexistence to increase the WiFi speed on the 2.4 GHz radio to the supported speed for the WiFi mode.

20/40 MHz coexistence does not apply to a 5 GHz radio.

To enable or disable 20/40 MHz coexistence for the 2.4 GHz radio:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. Select or clear the Enable 20/40 MHz Coexistence check box.

Selecting this check box enables 20/40 MHz coexistence and clearing this che box disables 20/40 MHz coexistence.

By default, 20/40 MHz coexistence is enabled and the check box is selected.

1. Click the Apply button.

Your settings are saved. The 2.4 GHz radio restarts and WiFi clients might reconnect.

Wi-Fi multimedia for a radio

Wi-Fi multimedia (WMM) prioritizes WiFi voice and video traffic over the WiFi link default, WMM is enabled for all radios on the router.

WMM prioritizes WiFi data packets from different applications based on four access categories: voice, video, best effort, and background. For an application to receive benefits of WMM, WMM must be enabled for both the application and the client that application. Legacy applications that do not support WMM and applications do not require WMM are assigned to the best effort category, which receives a priority than voice and video.

For each 2.4 GHz and 5 GHz radio individually, you can enable or disable W then applies too all WiFi networks that use the radio.

Note: We recommend that you do not disable the WMM settings. If you disable WMM settings for a radio, the maximum link rate that your router can reach it is 54 Mbps.

To enable or disable WMM:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. For a radio, select or clear the Enable WMM (Wi-Fi multimedia) settings (box.

When this check box is selected (which it is by default), WMM is enabled.

1. Click the Apply button.

Your settings are saved.

CTS/RTS threshold and preamble mode for a radio

For most WiFi networks, the clear to send/request to send (CTS/RTS) threshold preamble mode work ne and we recommend that you do not change the sett general, these settings are intended for WiFi testing.)

CAUTION: Do not change these settings unless directed by NETGEAR support o unless you are sure what the consequences are. Incorrect settings might disable WiFi function of a radio unexpectedly.

To change the CTS/RTS threshold and preamble mode for a radio:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. In the CTS/RTS Threshold (1-2347) eld for a radio, enter a value from 1. The default value is 2347.

CAUTION: Incorrect settings might disable the WiFi function for the selected unexpectedly.

1. From the Preamble Mode menu for a radio, select Automatic, Long Preamble, or Short Preamble.

2. Long Preamble: A long transmit preamble might provide a more reliable connection or a slightly longer range.

3. Short Preamble: A short transmit preamble might give better performance.
4. Automatic: The automatic option (which is the default option) lets the route process both long and short preambles.

CAUTION: Incorrect settings might disable the WiFi function for the selected unexpectedly.

1. Click the Apply button.

Your settings are saved.

Transmission output power for a radio

By default, the transmission output power of the router is set at the maximum. more WiFi routers, access points, WiFi gateways, or combination of these WiFi c are operating in the same area and on the same channel, interference can occur such a situation, you might want to decrease the transmission output power for both radios.

Make sure that you comply with the regulatory requirements for total radio freq (RF) output power in your country.

To change the transmission output power for a radio:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. From the Transmit Power Control menu, select 100%, 50%, or 25%.

The default setting is 100%.

1. Click the Apply button.

Your settings are saved. The radio restarts and WiFi clients might need to r

Backhaul password

The backhaul password is a security key that is used in WiFi communication by the router and the satellite. You can generate a new backhaul password. After generate a new backhaul password, you must use the Sync button to build a backhaul connection so that the router and satellite can communicate with each using WiFi.

To generate a new backhaul password:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. In the Backhaul Password section, click the Generate button.

The router generates a new backhaul password.

Generating a new password might cause the Orbi satellite to lose connection the Orbi router. To reconnect, use the Sync button.

MU-MIMO

Multiuser multiple input, multiple output (MU-MIMO) improves performance when multiple MU-MIMO-capable WiFi clients transfer data at the same time. With MU-I the router can transmit to multiple clients simultaneously using the same channel MU-MIMO is used in the downstream direction and requires the WiFi clients to capable of 802.11ac or 802.11ax.

To enable or disable MU-MIMO:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. Select or clear the Enable MU-MIMO check box.

By default, the check box is selected, and MU-MIMO is enabled.

1. Click the Apply button.

Your settings are saved. WiFi clients might need to reconnect.

Protected Management Frames

Protected Management Frames (PMF), according to the 802.11w standard, is a set feature that protects unicast and multicast management frames from being interce and changed for malicious purposes.

The PMF feature is disabled by default, but you can enable it as a require management frames. However, some legacy devices might not be capable of supp PMF and might not be able to connect. As a solution, you can enable PMF which lets the router activate PMF based on whether devices can support PMF.

Make sure that you understand the technology before enabling this feature.

Note: If you enable PMF, some incompatible client devices might disconnect. If use the combined WPA-PSK [TKIP] + WPA2-PSK [AES] security option and congu PMF as a requirement, PMF might not take effect.

To enable or disable PMF:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Wireless Settings.

The Advanced Wireless Settings page displays.

1. At the bottom of the page, make one of the following selections from the Management Frames (802.11w) menu:

2. Disabled: PMF is disabled. This is the default settings.

3. Optional: PMF is optional for all WiFi networks.
   • Required: PMF is required.

Your selection applies to all WiFi networks on the router and satellites.

1. Click the Apply button.

Your settings are saved.

11

Customize Internet Trafc Rules for Ports

You can use port forwarding and port triggering to set up rules for Internet t need networking knowledge to set up these features.

This chapter includes the following sections:

• Port forwarding to a local server
- Port triggering

Port forwarding to a local server

If your business network includes a server, you can allow certain types of income to reach the server. For example, you might want to make a local web server or game server visible and available to the Internet.

The router can forward incoming traffic with specific protocols to computers on your local network. You can specify the servers for applications and you can also specify default DMZ server to which the router forwards all other incoming protocols.

Set up port forwarding to a local server

To forward specific incoming protocols:

1. Decide which type of service, application, or game you want to provide.
2. Find the local IP address of the computer on your network that will provide service.
   The server computer must always use the same IP address. To specify this: use the reserved IP address feature. See Reserved LAN IP addresses on page

3. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.

4. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Port Forwarding/Port Triggering.

The Port Forwarding/Port Triggering page displays.

1. Leave the Port Forwarding radio button selected as the service type.

2. In the Service Name menu, select the service name.

If the service that you want to add is not in the list, create a custom sell a custom port forwarding service on page 199.

1. In the Server IP Address eld, enter the IP address of the computer that v the service.
2. Click the Add button.

The service displays in the list.

Add a custom port forwarding service

To add a custom service:

1. Find out which port number or range of numbers the application uses. You can usually nd this information by contacting the publisher of the applic or user groups or news groups.
2. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
3. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Port Forwarding/Port Triggering.

The Port Forwarding/Port Triggering page displays.

1. Leave the Port Forwarding radio button selected as the service type.
2. Click the Add Custom Service button.

The Ports - Custom Services page displays.

1. In the Service Name eld, enter a descriptive name.
2. In the Protocol menu, select the protocol.

If you are unsure, select TCP/UDP.

1. In the External Port range eld, enter the port numbers.

2. Specify the internal ports by one of these methods:

3. Leave the Use the same port range for Internal port check box selected

4. Type the port numbers in the Internal port range eld.

5. Type the IP address in the Internal IP address elds or select the radio but an attached device listed in the table.

6. Click the Apply button.

The service is now in the list on the Port Forwarding/Port Triggering page.

Edit a port forwarding service

To edit a port forwarding entry:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Port Forwarding/Port Triggering.

The Port Forwarding/Port Triggering page displays.

1. Leave the Port Forwarding radio button selected as the service type.
2. In the table, select the radio button next to the service name.
3. Click the Edit Service button.

The Ports - Custom Services page displays.

1. Specify changes to any of the following settings:

• Service Name: Type the service name.
- Protocol: If you are unsure, select TCP/UDP.
• External port range.

• For the internal ports, leave the Use the same port range for Internal p box selected or enter the ports in the Internal port range eld.

• Internal IP address. Type the IP address in the Internal IP address elds, or select the radio button for an attached device listed in the table.

• Click the Apply button.

Your settings are saved.

Delete a port forwarding entry

To delete a port forwarding entry:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Port Forwarding/Port Triggering.

The Port Forwarding/Port Triggering page displays.

1. Select the Port Forwarding radio button as the service type.
2. In the table, select the radio button next to the service name.
3. Click the Delete Service button.

Application example: Make a local web server public

If you host a web server on your local network, you can use port forwarding web requests from anyone on the Internet to reach your web server.

To make a local web server public:

1. Assign your web server either a xed IP address or a dynamic IP address u address reservation. In this example, your router always gives your web server an IP address of 192.168.1.33.

2. In the Port Forwarding/Port Triggering page, congregate the router to forward HTTP service to the local address of your web server at 192.168.1.33. HTTP (port 80) is the standard protocol for web servers.

3. (Optional) Register a host name with a Dynamic DNS service, and specify that on the Dynamic DNS page of the router. Dynamic DNS makes it much easier to access a server from the Internet be can type the name in the Internet browser. Otherwise, you must know the I that the ISP assigned, which typically changes.

How the router implements the port forwarding rule

The following sequence shows the effects of a port forwarding rule:

1. When you type the URL www.example.com in your browser, the browser send web page request message with the following destination information:

2. Destination address: The IP address of www.example.com, which is the ad of your router.

3. Destination port number: 80, which is the standard port number for a w server process.

4. Your router receives the message and nds your port forwarding rule for incc port 80 trafc.

5. The router changes the destination in the message to IP address 192.168.1.3 sends the message to that computer.
6. Your web server at IP address 192.168.1.33 receives the request and sends message to your router.
7. Your router performs Network Address Translation (NAT) on the source IP add and sends the reply through the Internet to the computer or WiFi device that the web page request.

Port triggering

Port triggering is a dynamic extension of port forwarding that is useful in these

• An application must use port forwarding to more than one local computer (k simultaneously).
• An application must open incoming ports that are different from the outgoing

With port triggering, the router monitors traffic to the Internet from an outbound port that you specify. For outbound traffic from that port, the router saves the of the computer that sent the traffic. The router temporarily opens the incoming or ports that you specify in your rule and forwards that incoming traffic to that

Port forwarding creates a static mapping of a port number or range of ports local computer. Port triggering can dynamically open ports to any computer when needed and close the ports when they are no longer needed.

Add a port triggering service

To add a port triggering service:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Port Forwarding/Port Triggering.

The Port Forwarding/Port Triggering page displays.

1. Select the Port Triggering radio button.

The page adjusts.

1. Click the Add Service button.

The Port Triggering - Services page displays.

1. In the Service Name eld, type a descriptive service name.
2. In the Service User menu, select Any, or select Single address and enter the IP address of one computer:

- Any (the default) allows any computer on the Internet to use this service.

- Single address restricts the service to a particular computer.

1. Select the service type, either TCP or UDP.
2. In the Triggering Port eld, enter the number of the outbound trafc port th open the inbound ports.
3. Select the inbound connection type, either TCP or UDP, or TCP/UDP (both).

If you are not sure, select TCP/UDP.

1. Enter the inbound connection port information in the Starting Port and Ending Port elds.
2. Click the Apply button.

The service is now in the Portmap Table. You must enable port triggering by the router used port triggering for the service that you added. See Enable triggering on page 204.

Enable port triggering

To enable port triggering:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > Port Forwarding/Port Triggering.

The Port Forwarding/Port Triggering page displays.

1. Select the Port Triggering radio button.

The page adjusts.

1. Clear the Disable Port Triggering check box.

If this check box is selected, the router does not use port triggering even specied port triggering settings.

1. In the Port Triggering Timeout eld, enter a value up to 9999 minutes.

This value controls how long the inbound ports stay open when the router no activity. This value is required because the router cannot detect when the application terminates.

1. Click the Apply button.

Your settings are saved.

Application example: Port triggering for Internet Relay C

Some application servers, such as FTP and IRC servers, send replies to multiple numbers. Using port triggering, you can tell the router to open more incoming when a particular outgoing port starts a session.

An example is Internet Relay Chat (IRC). Your computer connects to an IRC seed destination port 6667. The IRC server not only responds to your originating source but also sends an "identify" message to your computer on port 113. Using port you can tell the router, "When you initiate a session with destination port 6667 also allow incoming traffic on port 113 to reach the originating computer." The sequence shows the effects of the port triggering rule you done:

1. You open an IRC client program to start a chat session on your computer.
2. Your IRC client composes a request message to an IRC server using a des port number of 6667, the standard port number for an IRC server process. computer then sends this request message to your router.
3. Your router creates an entry in its internal session table describing this comm session between your computer and the IRC server. Your router stores the information, performs Network Address Translation (NAT) on the source address and port, and sends this request message through the Internet to the IRC s
4. Noting your port triggering rule and observing the destination port number of your router creates another session entry to send any incoming port 113 traffic your computer.

5. The IRC server sends a return message to your router using the NAT-assigne port (for example, port 33333) as the destination port. The IRC server also "identify" message to your router with destination port 113.

6. When your router receives the incoming message to destination port 33333, it its session table to see if a session is active for port number 33333. Findir session, the router restores the original address information replaced by NAT sends this reply message to your computer.

7. When your router receives the incoming message to destination port 113, it its session table and nds an active session for port 113 associated with you computer. The router replaces the message's destination IP address with your computer's IP address and forwards the message to your computer.
8. When you finish your chat session, your router eventually senses a period of in the communications. The router then removes the session information from session table, and incoming traffic is no longer accepted on port numbers 33113.

12

Use OpenVPN to Access Your Network

You can use OpenVPN software to remotely access your router with virtual private networking (VPN). This chapter explains how to install and use OpenVPN software set up a VPN tunnel.

This chapter includes the following sections:

• About VPN connections
  • LAN IP addressing in VPN networks
• Enable OpenVPN service in the router
  • Install OpenVPN software on a VPN client
  • Use VPN to access your Internet service at your business

Note: If you are a NETGEAR Insight Premium or Pro subscriber, you can enable conjure another VPN feature on your router: Business VPN. You cannot enable conjure this feature in the router web interface; You must use the NETGEAR I app or Insight Cloud Portal. For more information about NETGEAR Insight, visit https://www.netgear.com/insight/.

About VPN connections

A virtual private network (VPN) lets you use the Internet to securely access you when you are away from your business.

This type of VPN access is called a client-to-gateway tunnel. The computer is t and the router is the gateway. To use the VPN feature, you must do the foll

• Log in to the router to enable and configure OpenVPN (see Enable OpenVPN in the router on page 209).
• Install OpenVPN client software and conguration les on your device from which you want to use VPN (see Install OpenVPN software on a VPN client on pa
• Run the OpenVPN client software on your device when you want to use a connection.

Enabling OpenVPN on your router allows VPN connections between the router and client, for example your laptop when you are away from your business. The ro provides the VPN service and the laptop is the VPN client. Trafc between the and the laptop is encrypted.

Note: The router itself does not function as a VPN client to an external VPN provider, so it does not encrypt traffic passing between your business network and Internet.

VPN can use either Dynamic DNS (DDNS) or a static IP address to connect w router:

• To use a DDNS service, register for a DDNS account with a host name. You host name to access your business network. The router supports these DDNS accounts: NETGEAR, No-IP, and Dyn. For more information, see Dynamic DNS page 140.
• If your Internet service provider (ISP) assigned a static WAN IP address that changes, the VPN can use that IP address to connect to your business network

LAN IP addressing in VPN networks

For the VPN connection to work, your computer or device (the VPN client) mu connected to a network that uses a different LAN IP address scheme than you. The default LAN IP address scheme for the router is 192.168.1.x. (The most cc schemes are 192.168.x.x, 172.x.x.x, and 10.x.x.x.) If you experience a conict, chan the IP scheme either for your business network or for the network where your device is connected.

If both networks use the same LAN IP scheme, when the VPN tunnel is estab cannot access your business router or your business network with the OpenVPN s For information about changing the LAN settings on the router, see Manage the on page 116.

Enable OpenVPN service in the router

You must enable the OpenVPN service settings in the router before you can use connection.

To enable the OpenVPN service:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VPN Service.

The VPN Service page displays.

Note: The OpenVPN congruration software packages that you can download or the page are for the VPN client devices (see Install OpenVPN software on a client on page 210).

1. Select the Enable VPN Service check box.

We recommend that you use the default TUN mode and TAP mode settings (settings determine how VPN information is transferred.) If you know that you other settings, you can change the TUN mode and TAP mode settings, but do so before you download and install the OpenVPN configuration software page on client devices (see Install OpenVPN software on a VPN client on page 2).

1. To change the TUN mode settings, do the following:

- To change the TUN mode service type, select the UDP or TCP radio button.

The default protocol for TUN mode is UDP.

- To change the TUN mode service port, type the port number that you v use in the eld.

The default port number for TUN mode is 12973. The TUN port number in the .ovpn le of the OpenVPN congruration software package for Mac and non-Windows clients.

1. To change the TAP mode settings, do the following:

2. To change the TAP mode service type, select the UDP or TCP radio button. The default protocol for TAP mode is UDP.

3. To change the TAP mode service port, type the port number that you use in the eld.

The default port number for TAP mode is 12974. The TAP port number in the .ovpn le of the OpenVPN conguration software package for Window clients.

1. Click the Apply button.

Your changes are saved. VPN is enabled in the router, but you must install up OpenVPN software on your device before you can use a VPN connection

Install OpenVPN software on a VPN client

You must install OpenVPN software on each Windows-based computer, Mac comp iOS device, and Android device that you plan to use for VPN connections to Each computer or device is called a VPN client.

The software consists of the application software and the conguration les:

• Download and install the application software from the link that is provided client-specific section.
• Download and install the conguration les from the router as described in each client-specific section. The configuration files provide the correct router configuration information for the client utility. You must download the conguration les after enable and conjure OpenVPN service in the router (see Enable OpenVPN server in the router on page 209).

Note: If you later change the OpenVPN conguration in the router (for example, you change the TUN or TAP port number), you must download and install a conguration le again on each client, depending on its operating system. If you change the TUN port number in the router, the .ovpn conguration le for M non-Windows clients changes. If you change the TAP port number in the router, .ovpn conguration le for Windows clients changes.

Install OpenVPN software on a Windows-based compute

You must install both the OpenVPN client utility and OpenVPN congruration les each Windows-based computer where you want to use a VPN connection to you

To download and install the OpenVPN client utility and OpenVPN conguration les on a Windows-based computer:

1. To download the OpenVPN client utility on your Windows-based computer, vis openvpn.net/community-downloads/.
2. Select the Windows package with the installer les.

In most situations, you can download the Windows 32-bit or Windows 64-bit les, depending on your Windows operating system.

1. Download and install the OpenVPN client utility on your computer.

You need to have administrative privileges.

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VPN Service.

The VPN Service page displays.

1. Make sure that the Enable VPN Service check box is selected.

For more information about the VPN congruration for the router, see Enable OpenVPN service in the router on page 209.

1. Click the FOR WINDOWS button to download the OpenVPN congruration les your Windows-based computer.
2. Unzip the OpenVPN congruration les and copy them to the folder in which installed the OpenVPN client utility.
3. Modify the VPN interface name to NETGEAR-VPN:

a. If your computer is running Windows 10, select Control Panel > Network Sharing Center > Change adapter settings.

If your computer is running another Windows version, nd the page that let change the adapter settings.

b. In the local area connection list, nd the local area connection with the d name TAP-Windows Adapter.
c. Select the local area connection and change its name (not its device nam NETGEAR-VPN.

If you do not change the VPN interface name, the VPN tunnel connection

You can now open a VPN tunnel to the router.

For more information about installing and using OpenVPN on your Windows-based computer, visit https://openvpn.net/community-resources/how-to/#quick.

Install OpenVPN software on a Mac computer

You must install both the Tunnelblick OpenVPN client utility and OpenVPN config les on each Mac computer where you want to use a VPN connection to your

To download and install the Tunnelblick OpenVPN client utility and OpenVPN conguration les on a Mac computer:

1. To download the Tunnelblick OpenVPN client utility on your Mac computer, https://tunnelblick.net/downloads.html.
2. Download and install the Tunnelblick OpenVPN client utility on your Mac con You need to have administrative privileges.
3. Launch a web browser from the Mac computer, which must be connected to Orbi Pro network.
4. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VPN Service.

The VPN Service page displays.

1. Make sure that the Enable VPN Service check box is selected.

For more information about the VPN congruration for the router, see Enable OpenVPN service in the router on page 209.

1. Click the FOR MAC OS X button to download the OpenVPN conguration less your Mac computer.

2. Unzip the OpenVPN congruration les and copy them to the folder in which installed the Tunnelblick OpenVPN client utility.

You can now open a VPN tunnel to the router.

For more information about installing and using OpenVPN on your Mac compute https://openvpn.net/vpn-server-resources/installation-guide-for-openvpn-connect-client-on-macos/.

Install OpenVPN software on an iOS device

You must install both the OpenVPN Connect app and OpenVPN congruration les each iOS device where you want to use a VPN connection to your router.

To download and install the OpenVPN Connect app and OpenVPN congruration les on an iOS device:

1. On your iOS device, download and install the OpenVPN Connect app from the app store.

2. Launch a web browser from a computer or your iOS device that is connect router network.

3. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wait, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VPN Service.

The VPN Service page displays.

1. Make sure that the Enable VPN Service check box is selected.

For more information about the VPN congruration for the router, see Enable OpenVPN service in the router on page 209.

1. Click the FOR SMART PHONE button to download the router's OpenVPN congruration les to your computer or iOS device.

If you download the conguration les to your computer, unzip the les, and s them your iOS device.

1. On your iOS device, do the following:

a. Open the .ovpn le.

b. If the OpenVPN Connect app does not start automatically, a list of apps display: Select the OpenVPN Connect app.

c. Install the .ovpn le.

You can now open a VPN tunnel to the router.

For more information about installing and using OpenVPN on your iOS device, https://www.vpngate.net/en/howto_openvpn.aspx#ios.

Install OpenVPN software on an Android device

You must install both the OpenVPN Connect app and OpenVPN congruration les each Android device where you want to use a VPN connection to your router.

To download and install the OpenVPN Connect app and OpenVPN congruration les on an Android device:

1. On your Android device, download and install the OpenVPN Connect app fro Google Play Store.

2. Launch a web browser from a computer or your Android device that is con to the router network.

3. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VPN Service.

The VPN Service page displays.

1. Make sure that the Enable VPN Service check box is selected.

For more information about the VPN congruration for the router, see Enable OpenVPN service in the router on page 209.

1. Click the FOR SMART PHONE button to download the router's OpenVPN congruration les to your computer or Android device.

If you download the conguration les to your computer, unzip the les, and s them your Android device.

1. On your Android device, open the .ovpn file and import it into the OpenVPN app.

You can now open a VPN tunnel to the router.

For more information about using OpenVPN on your Android device, visit https://www.vpngate.net/en/howto_openvpn.aspx#android.

Use VPN to access your Internet service your business

When you are away from your business and you access the Internet, you usual local Internet service provider. For example, in a hotel you might be given a lets you use the hotel's Internet service account to access the web.

Orbi Pro lets you use a VPN connection to access your own Internet service when we are away from your business. You might want to do this if you travel to a specific location that does not support all the Internet services that you use at your base. For example, you might have Internet subscriptions to applications that work at a different rate of business location but not in a different country.

Allow VPN client Internet access in the router

By default, the router is set up to allow VPN connections only to your business (referred as the home network in the following procedure), but you can change settings to allow Internet access. Accessing the Internet remotely through a VPN be slower than accessing the Internet directly.

To allow VPN clients to use your business Internet service:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VPN Service.

The VPN Service page displays.

1. Make sure that the Enable VPN Service check box is selected.

For more information about the VPN congruration for the router, see Enable OpenVPN service in the router on page 209.

1. Scroll down to the Clients will use this VPN connection to access section, a the All sites on the Internet & Home Network radio button.

When you access the Internet with the VPN connection, instead of using a Internet service, you use the Internet service from your business network.

1. Click the Apply button.

Your settings are saved.

Block VPN client Internet access in the router

By default, the router is set up to allow VPN connections only to your business (referred as the home network in the following procedure), not to the Internet for your business network. If you changed this setting to allow Internet access, change it back.

To allow VPN clients to access only your business network and block them using your business Internet service:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Select ADVANCED > Advanced Setup > VPN Service.

The VPN Service page displays.

1. Make sure that the Enable VPN Service check box is selected.

For more information about the VPN congruration for the router, see Enable OpenVPN service in the router on page 209.

1. Scroll down to the Clients will use this VPN connection to access section, a the Home Network only radio button.

This is the default setting. The VPN connection is only to your business net to the Internet service for your business network.

1. Click the Apply button.

Your settings are saved.

13

Troubleshooting

This chapter provides information to help you diagnose and solve problems you experience with your Orbi router or satellite. If you do not nd the solution he the NETGEAR support site at support.netgear.com for product and contact informa This chapter includes the following sections:

• Quick tips
  • The router and satellite do not sync
• You cannot log in to the router
  • You cannot access the Internet
• Troubleshoot Internet browsing
• Troubleshoot PPPoE
• Troubleshoot WiFi connectivity
• Troubleshoot your network using the ping utility

Quick tips

This section describes tips for troubleshooting some common problems.

Sequence to restart your network

When you restart your network, follow this sequence:

1. Turn off and unplug the modem.
2. Turn off the router.
3. Plug in the modem and turn it on. Wait two minutes.
4. Turn on the router and wait two minutes.

WiFi settings

Make sure that the WiFi settings in the WiFi-enabled computer or mobile device the router match.

The WiFi network name (SSID) and WiFi security settings must match exactly.

If you set up an access list, you must add each WiFi-enabled computer or mol MAC address to the router's access list.

Network settings

Make sure that the network settings of the computer are correct. Wired and w connected computers must use network (IP) addresses on the same network as router. The simplest way to do this is to configure each computer to obtain a automatically using DHCP.

Some cable modem service providers require you to use the MAC address of computer initially registered on the account. You can view the MAC address on Attached Devices page.

The router and satellite do not sync

If you experience difficulty syncing the router and the satellite, we recommend that move the satellite into the same room as the router during the sync. Then me satellite to a different location.

To sync the router and the satellite:

1. Place the satellite in the same room as the Orbi Prorouter. Use this satellite location only during the sync process.

2. Connect the satellite to a power source.

3. If the Power LED on the back of the satellite does not light and your sat a Power On/Off button, press the button.

Some models provide a Power On/Off button.

1. Wait for the satellite's bar LED to light solid white or magenta.

2. Press the Sync button on the router and then within two minutes, press the Sync button on the satellite.

3. Wait for the satellite to sync with the router.

The satellite's bar LED pulses white while it attempts to sync with the route the LED bar pulses white, it lights one of the following colors for about th and then turns off:

• Blue: The Orbi router and satellite successfully synced, and the connection between the router and satellite is good.
• Amber: The Orbi router and satellite successfully synced, but the connection between the router and satellite is only fair. Consider moving the Orbi sa closer to the Orbi router.

• Magenta: The Orbi router and satellite did not sync.

• Do one of the following:

- The sync failed: If the sync failed, try to sync again by repeating Step 6. If the sync keeps failing, try a different location or position.

- The sync is successful: If the sync is successful, move the satellite to th where you want to install it and continue with Step 8.

1. At the new location, connect the satellite to a power source.

2. At the new location, resync the satellite with the router by repeating Step 6.

If the satellite's bar LED lights blue or amber, the satellite synced successfully satellite's bar LED lights blue, the connection is good. If the satellite's bar L lights amber, consider moving the satellite closer to the router so that you a good connection instead of a fair connection.

1. If the satellite's bar LED lights magenta, the satellite did not resync with the if they successfully synced when they were placed in the same room, do or following:

2. Move the satellite closer to the router and try again. The router must be the satellite's WiFi coverage area for a good or fair connection to the sa

3. Place another satellite between the router and the satellite that you are tr sync. Then try to sync between the two satellites. With daisy chain network your satellites can connect to each other or to the router, depending on connection is best.

You cannot log in to the router

Make sure that your computer or mobile device is connected to the Orbi WiFi. If you do not want to use a WiFi connection, you can connect your computer router with an Ethernet cable.

If you changed the admin password and you forgot what it is, see Reset the password on page 161.

You cannot access the Internet

Check your network and Internet connections:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tin logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Click the ADVANCED tab.

The ADVANCED Home page displays.

1. Check that an IP address is shown for the Internet port.

If 0.0.0.0 is shown, your router did not obtain an IP address from your Internet provider (ISP).

If your router cannot obtain an IP address from the ISP, you can force your modem to recognize your new router by restarting your network. For more info see Sequence to restart your network on page 219.

If your router is still unable to obtain an IP address from the ISP, the problem one of the following:

• Your Internet service provider (ISP) might require a login program. Ask your whether they require PPP over Ethernet (PPPoE) or some other type of login
• If your ISP requires a login, the login name and password might be set in
• Your ISP might check for your computer's host name. Assign the computer h name of your ISP account as the account name on the Internet Setup page
• If your ISP allows only one Ethernet MAC address to connect to Internet an for your computer's MAC address, do one of the following:

- Inform your ISP that you bought a new network device and ask them to router's MAC address.

- Congure your router to clone your computer's MAC address.

Troubleshoot Internet browsing

If your router can obtain an IP address but your computer is unable to load pages from the Internet, it might be for one of the following reasons:

• The trafc meter is enabled, and the limit was reached.
  By conguring the trafc meter not to block Internet access when the trafc line reached, you can resume Internet access (see Unblock the trafc meter after the trafc limit is reached on page 174). If your ISP sets a usage limit, they may you for the overage.
• Your computer might not recognize any DNS server addresses. A DNS server host on the Internet that translates Internet names (such as www addresses) to IP addresses.
  Typically, your ISP provides the addresses of one or two DNS servers for you. If you entered a DNS address during the router's configuration, restart your cc Alternatively, you can congregate your computer manually with a DNS address, as explained in the documentation for your computer.
• The router might not be congured as the default gateway on your computer

Reboot the computer and verify that the router address (orbilogin.com) is listed your computer as the default gateway address.

- You might be running login software that is no longer needed. If your ISP a program to log you in to the Internet, you no longer need to run that installing your router.

Troubleshoot PPPoE

If you are using PPPoE, try troubleshooting your Internet connection.

To troubleshoot a PPPoE connection:

1. Launch a web browser from a computer or mobile device that is connected Orbi Pro network.
2. Enter orbilogin.com.

A login window displays.

If your browser does not display a login window but displays a security wall, does not let you proceed, see What to do if you get a browser security page 30.

1. Enter the admin user name and password.

The user name is admin. The password is the one that you set the rst tir logged in. The user name and password are case-sensitive.

The BASIC Home page displays.

1. Click the ADVANCED tab.

The ADVANCED Home page displays.

1. In the Internet Port pane, click the Connection Status button.

The Connection Status window opens.

1. Check the Connection Status window to see if your PPPoE connection is acti working.

If the router is not connected, click the Connect button.

The router continues to attempt to connect indenitely.

1. If you cannot connect after several minutes, the router might be set up with incorrect service name, user name, or password, or your ISP might be exper a provisioning problem.

Unless you connect manually, the router does not authenticate using PPPoE u data is transmitted to the network.

Troubleshoot WiFi connectivity

If you are experiencing trouble connecting to the Orbi WiFi network, try to iso problem:

• Does the WiFi-enabled computer or mobile device that you are using nd your network?
  If you disabled the router's SSID broadcast, then your WiFi network is hidden does not display in the list of networks that your computer or WiFi device default, SSID broadcast is enabled.)
• Does your WiFi-capable device support the security that you are using for your network (WPA2 or WPA3)?
• To view the WiFi settings for the router, use an Ethernet cable to connect to a LAN port on the router. Then log in to the router, and select BASIC

Note: Be sure to click the Apply button if you change settings.

- If you are trying to connect to the 5 GHz band, does your WiFi-enabled c or mobile device support this standard?

- Did your computer or WiFi device automatically connect to a different WiFi in your area, such as a WiFi hotspot?

Troubleshoot your network using the ping utility

Most network devices and routers contain a ping utility that sends an echo rec packet to the designated device. The device then responds with an echo reply. easily troubleshoot a network using the ping utility in your computer or worksta

Test the LAN path to your router

You can ping the router from your computer to verify that the LAN path to is set up correctly.

To ping the router from a Windows-based computer:

1. From the Windows toolbar, click the Start button and select Run.

2. In the eld provided, type ping followed by the IP address of the router, a example:

ping orbilogin.com

1. Click the OK button.

You should see a message like this one:

Pinging with 32 bytes of data

If the path is working, you see this message:

Reply from < IP address>: bytes=32 time=NN ms TTL=xxx

If the path is not working, you see this message:

Request timed out

If the path is not functioning correctly, you might be experiencing one of the problems:

• Wrong physical connections
  For a wired connection, make sure that the numbered LAN port LED is lit to which you are connected.
  Check that the appropriate LEDs are on for your network devices. If your ro computer are connected to a separate Ethernet switch, make sure that the li LEDs are lit for the switch ports that are connected to your computer and
• Wrong network conguration
  Verify that the IP address for your router and your computer are correct an the addresses are on the same subnet.

Test the path from your computer to a remote device

After verifying that the LAN path works correctly, test the path from your comp a remote device.

To test the path from a Windows-based computer to a remote device:

1. From the Windows toolbar, click the Start button and select Run.
2. In the Windows Run window, type:

ping -n 10

where is the IP address of a remote device such as your ISP [If the path is functioning correctly, messages display that are similar to those s Test the LAN path to your router on page 224.

If you do not receive replies, check the following:

• Check to see that the IP address of your router is listed as the default gate your computer. If DHCP assigns the IP congruration of your computers, this information is not visible in your computer Network Control Panel. Verify that address of the router is listed as the default gateway.
• Check to see that the network address of your computer (the portion of the specified by the subnet mask) is different from the network address of the re device.
• Check to see that your cable or DSL modem is connected and functioning.
• If your ISP assigned a host name to your computer, enter that host name account name on the Internet Setup page.
• Your ISP might be rejecting the Ethernet MAC addresses of all but one of computers.

Many broadband ISPs restrict access by allowing traffic only from the MAC address your broadband modem. Some ISPs additionally restrict access to the MAC address a single computer connected to that modem. If your ISP does this, congregate you to "clone" or "spoof" the MAC address from the authorized computer.

A

How to Use VLANs in Your Ne

On an Orbi Pro WiFi 6 router, you can manually congregate a VLAN by creating a prole (basically, and VLAN ID with a VLAN name) and assigning the VLAN to more network interfaces, such as WiFi networks (also referred to as WLAN or S and Ethernet ports. Or, you can use an Orbi Pro WiFi 6 preset VLAN for which edit the settings to suit your network needs.

The following table shows the preset VLANs and their designates uses.

Table 8. Preset VLAN proles and their designated uses

					WLAN UsageWLAN NameEthernet
		LAN 1Default1the WAN port			admin accessWireless 1All LAN pc
					Employee accessWireless 2None as IoT accessWireless 3None assigned
40	Guest	LAN 4	None assigned	Guest Portal	Guest access

If you need a different type of VLAN, you can create your own VLAN prole to your requirements.

This appendix includes two use cases for VLAN conguration:

• VLAN use case 1: Orbi Pro WiFi 6 router in a home environment
• VLAN use case 2: Orbi Pro WiFi 6 router in a business environment

VLAN use case 1: Orbi Pro WiFi 6 rou a home environment

This use case describes how to congregate the VLANs on an Orbi Pro WiFi 6 r satellite in a home environment. Almost all settings that you need for this congr are already preset on the Orbi Pro WiFi 6 router and satellite. The satellite is to the router over a WiFi backhaul.

graph TD
    A["Internet"] --> B["Modem"]
    B --> C["Orbi Pro 6 Router"]
    C --> D["Orbi Pro 6 Satellite"]
    D --> E["Admin network"]
    E --> F["Admin network LAN 1: 192.168.1.0/24\nDefault VLAN 1\nWireless 1 WLAN"]
    D --> G["Admin network LAN port 1\nVLAN 1\nAccess mode"]
    D --> H["Admin network LAN port 2\nVLAN 40\nAccess mode"]
    D --> I["Admin network Guest network"]
    J["Guest network"] --> K["Guest Portal (Guest network)"]
    L["Host"] --> M["Host Portal (Guest network)"]
    N["Host"] --> O["Host Portal (Guest network)"]

Figure 8. Orbi Pro WiFi 6 router as a router in a home environment

The procedure in this section does the following:

• Uses the LAN 1, preset Default VLAN 1, Wireless 1 WLAN, and the satellite port for the Admin network.
• Sets the LAN 4, preset Guest VLAN 40, Guest Portal WLAN, and the satellite port for the Guest network.
• Sets the port mode for the following LAN ports to Access mode:

- Satellite's LAN port 1. This port is cabled to a desktop that is used for tasks such accessing the router web interface.

- Satellite's LAN port 2. This port is cabled to a desktop that is available

Note: LANs (networks) and LAN ports are two different concepts. By default, all LAN ports and the WAN port on the router and all LAN ports on any connected Ethernet ports in the same physical network segment (LAN 1) and members of However, you can assign a LAN port to a different VLAN.

To congregate your Orbi Pro WiFi 6 router and satellite with a guest network separate from your admin network:

1. Congure the VLANs on the router.

If you use the preset VLANs, you do not need to congregate any VLANs. This congruration uses the Default VLAN with ID 1 and the Guest VLAN with ID of which are preset VLANs.

If you prefer to use custom VLANs, create the VLANs on the router (see A VLAN prole on page 75).

1. Congure the WiFi networks on the router.

If you use the preset WiFi networks, you do not need to congregate any WiFi. This sample congruration uses the Wireless 1 WLAN (assigned to VLAN 1) an Guest Portal WLAN (assigned to VLAN 40), both of which are default WLANs

If you prefer to use other WLAN names or assign WLANs to other VLANs, the conguration for one or more existing WLANs (see Manage the WiFi Netw on page 88).

Note: The router and satellite share the same WiFi settings. After you congu change these settings on the router, the settings are automatically synced with satellite.

1. Change the VLAN for the LAN 2 port on the satellite.

In this sample congruration, the satellite's LAN 2 port is cabled to a desktop used for guest access. For the LAN port 2, change the VLAN to the Guest ID 40 (see Change the VLAN prole for an Ethernet port on page 83).

By default, all LAN ports are assigned to VLAN 1, the default VLAN. That you do not need to change the VLAN for the satellite's LAN 1 port. In the conguration, this port is part of the Admin network.

1. Change the port mode for the satellite's LAN 1 and LAN 2 ports.

By default, the port mode for any LAN port is Trunk mode. In this sample congruration, the satellite's LAN 1 and LAN 2 ports are cabled to end devic (desktops). Therefore, change the port mode for these ports to Access mode Port mode: Trunk mode or Access mode on page 86).

VLAN use case 2: Orbi Pro WiFi 6 rou a business environment

This use case describes how to congregate the VLANs on an Orbi Pro WiFi 6 r satellite in a business environment. Many of the settings that you need for this congruration are already preset on the Orbi Pro WiFi 6 router and satellite, but your network router and switch. In this use case, the Orbi Pro 6 satellite is c the Orbi Pro WiFi 6 router over an Ethernet cable, but you could also use a

graph TD
    A["BR500 Router"] -->|Router port 2 Trunk mode| B["Internet"]
    B --> C["Switch port 1 Trunk mode"]
    C --> D["MS510TXM Switch"]
    D --> E["Switch port 2 Trunk mode"]
    E --> F["Orbi Pro 6 Router"]
    F --> G["Admin network"]
    F --> H["Admin network"]
    F --> I["Admin network"]
    F --> J["Admin network"]
    F --> K["Admin network"]
    F --> L["Admin network"]
    F --> M["Admin network"]
    F --> N["Admin network"]
    F --> O["Admin network"]
    F --> P["Admin network"]
    F --> Q["Admin network"]
    F --> R["Admin network"]
    F --> S["Admin network"]
    F --> T["Admin network"]
    F --> U["Admin network"]
    F --> V["Admin network"]
    F --> W["Admin network"]
    F --> X["Admin network"]
    F --> Y["Admin network"]
    F --> Z["Admin network"]
    F --> AA["Admin network"]
    F --> AB["Admin network"]
    F --> AC["Admin network"]
    F --> AD["Admin network"]
    F --> AE["Admin network"]
    F --> AF["Admin network"]
    F --> AG["Admin network"]
    F --> AH["Admin network"]
    F --> AI["Admin network"]
    F --> AJ["Admin network"]
    F --> AK["Admin network"]
    F --> AL["Admin network"]
    F --> AM["Admin network"]
    F --> AN["Admin network"]
    F --> AO["Admin network"]
    F --> AP["Admin network"]
    F --> AQ["Admin network"]
    F --> AR["Admin network"]
    F --> AS["Admin network"]
    F --> AT["Admin network"]
    F --> AU["Admin network"]
    F --> AV["Admin network"]
    F --> AW["Admin network"]
    F --> AX["Admin network"]
    F --> AY["Admin network"]
    F --> AZ["Admin network"]
    F --> BA["Admin network"]
    F --> BB["Admin network"]
    F --> BC["Admin network"]
    F --> BD["Admin network"]
    F --> BE["Admin network"]
    F --> BF["Admin network"]
    F --> BG["Admin network"]
    F --> BH["Admin network"]
    F --> BI["Admin network"]
    F --> BJ["Admin network"]
    F --> BK["Admin network"]
    F --> BL["Admin network"]
    F --> BM["Admin network"]
    F --> BN["Admin network"]
    F --> BO["Admin network"]
    F --> BP["Admin network"]
    F --> BQ["Admin network"]
    F --> BR["Admin network"]

Figure 9. Orbi Pro WiFi 6 router in a business environment

The procedure in this section congures the network router and switch with the and LANs that you use on the Orbi Pro WiFi 6 system, and then does the the Orbi Pro WiFi 6 router and satellite:

• Uses the LAN 1, preset Default VLAN 1, Wireless 1 WLAN, the router's LAN and the satellite's LAN 2 port for the Admin network.
• Sets the LAN 2, preset Employee VLAN 20, Wireless 2 WLAN, and the sate LAN 3 port for the Employee network.
• Uses the LAN 3, preset IoT VLAN 30, and Wireless 3 WLAN for the Internet (IoT) network.
• Sets the LAN 4, preset Guest VLAN 40, Guest Portal WLAN, and the satellite port for the Guest network.

- Sets the port mode for the following LAN ports to Access mode:

• Router LAN port 2. This port is cabled to a desktop that is used for such accessing the router web interface.
• Satellite LAN port 2. This port is cabled to a desktop that is also used tasks.
• Satellite LAN port 3. This port is cabled to a desktop that is used by an employee.
• Satellite LAN port 4. This port is cabled to a desktop that is available

Note: LANs (networks) and LAN ports are two different concepts. By default, all LAN ports and the WAN port on the router and all LAN ports on any connected Ethernet ports in the same physical network segment (LAN 1) and members of However, you can assign a LAN port to a different VLAN.

To congregate your network router and switch and your Orbi Pro WiFi 6 router satellite with secure employee, IoT, and guest networks:

1. Create the following VLANs on your network router:

2. Add VLAN 20 with the name Employee, and add all ports as tagged me

3. Add VLAN 30 with the name IoT, and add all ports as tagged members

4. Add VLAN 40 with the name Guest, and add all ports as tagged memb

5. Create the following LAN subnets on your network router:

6. Add LAN 2 with subnet 192.168.20.0/24, make LAN 2 a member of VLAN Employee VLAN), and enable the DHCP server for LAN 2.

7. Add LAN 3 with subnet 192.168.30.0/24, make LAN 3 a member of VLAN IoT VLAN), and enable the DHCP server for LAN 3.

8. Add LAN 4 with subnet 192.168.40.0/24, make LAN 4 a member of VLAN Guest VLAN), and enable the DHCP server for LAN 4.

9. Create the following VLANs on your network switch:

10. Add VLAN 20 with the name Employee. As tagged members of VLAN 20 the switch port (port 1 in the diagram) that is cabled to the network rc trunk port, and do the same for the switch port (port 2 in the diagram) cabled to the Orbi Pro WiFi 6 router.

11. Add VLAN 30 with the name IoT. As tagged members of VLAN 30, add port (port 1 in the diagram) that is cabled to the network router as a and do the same for the switch port (port 2 in the diagram) that is ca Orbi Pro WiFi 6 router.

- Add VLAN 40 with the name Guest. As tagged members of VLAN 40, a switch port (port 1 in the diagram) that is cabled to the network router port, and do the same for the switch port (port 2 in the diagram) that to the Orbi Pro WiFi 6 router.

1. Congure the VLANs on the Orbi Pro WiFi 6 router.

If you use the preset VLANs, you do not need to congregate any VLANs. This congruration uses the Default VLAN with ID 1, the Employee VLAN with ID 2 IoT VLAN with ID 30, and the Guest VLAN with ID 40, all of which are p If you prefer to use custom VLANs, create the VLANs on the router (see A VLAN prole on page 75).

1. Congure the WiFi networks on the Orbi Pro WiFi 6 router.

If you use the preset WiFi networks, you do not need to congregate any WiFi. This sample congruration uses the Wireless 1 WLAN (assigned to VLAN 1), the Wireless 2 WLAN (assigned to VLAN 20), the Wireless 3 WLAN (assigned to and the Guest Portal WLAN (assigned to VLAN 40), all of which are default). If you prefer to use other WLAN names or assign WLANs to other VLANs, the congruration for one or more existing WLANs (see Manage the WiFi Net on page 88).

Note: The router and satellite share the same WiFi settings. After you congu change these settings on the router, the settings are automatically synced with satellite.

1. Change the VLANs for LAN ports on the Orbi Pro WiFi 6 satellite.

In this sample configuration, change the VLANs for the following satellite's LAN

• Satellite LAN 3 port: Assign to the Employee VLAN with ID 20 because is cabled to a desktop that is used for employee access.
• Satellite LAN 4 port: Assign to the Guest VLAN with ID 40 because this cabled to a desktop that is used for guest access.

For more information, see Change the VLAN prole for an Ethernet port on 83.

By default, all LAN ports are assigned to VLAN 1, the default VLAN. That you do not need to change the VLAN for the router's LAN 1 and LAN 2 the satellite's LAN 1 and LAN 2 ports. In this sample conguration, all these are part of the Admin network (the default network):

• Router LAN port 1: Cabled to the satellite's LAN 1 port.

• Router LAN port 2: Cabled to a desktop that is used for admin access.

• Satellite LAN port 1: Cabled to the router's LAN 1 port.

• Satellite LAN port 2: Cabled to a desktop that is used for admin acces

• Change the port mode for LAN ports on the Orbi Pro WiFi 6 router and By default, the port mode for any LAN port is Trunk mode. In this sample conguration, the router's LAN 2 port and the satellite's LAN 2, LAN 3, and ports are cabled to end devices (desktops). Therefore, change the port mode these ports to Access mode (see Port mode: Trunk mode or Access mode 86).

Troubleshooting tips:

• If a WiFi device cannot get an IP address from the Orbi Pro WiFi 6 system the WiFi network is assigned to the correct VLAN.
• If a wired device cannot get an IP address from the Orbi Pro WiFi 6 system that the Ethernet port is assigned to the correct VLAN and that LAN is assigned to the correct VLAN:

Note: If you Orbi Pro WiFi 6 router is in AP mode (the default operation mode), only the LAN 1 settings work. The other LAN subnets do not work. HAP mode, the VLAN settings still apply to the WLANs, you can still can assign port to another VLAN, and you can still change the port mode for an Ethernet

B

Supplemental Information

This appendix covers the following topics:

• Factory settings
  • Technical specifications

Factory settings

The following factory settings information are for the Orbi Pro WiFi 6 AX5400 (model SXR50) and the Orbi Pro WiFi 6 AX5400 satellite (model SXS50).

You can return the Orbi Pro WiFi 6 AX5400 router or satellite to its factory, the end of a paper clip or a similar object to press and hold the Reset but back of the router or satellite for at least seven seconds. The router or satellite and returns to the factory settings.

Factory settings for Orbi Pro WiFi 6 AX5400 router r SXR50

The following table shows the factory default settings for the Orbi Pro WiFi 6 router.

Table 9. Factory default settings for the router

	Default SettingFeature
Router web interface login
	orbilogin.comLogin URL
	adminLoign user name (case-sensitive)
	passwordDefault login password (case-sensitive)
Internet connection
	Use default hardware addressWAN MAC address
	1500WAN MTU size
	AutoSensingPort speed
	DisabledDMZ
Time zone	GMT for worldwide, except for North America and Greece:Greece: GMT+1North America: GMT-8
	DisabledTime zone adjusted for daylight saving time
Local network 1 (LAN 1)
	192.168.1.1LAN 1 IP
	255.255.255.0LAN 1 subnet mask

Table 9. Factory default settings for the router (Continued)

	Default SettingFeature
	EnabledLAN 1 DHCP server
	192.168.1.2 to 192.168.1.254LAN 1 DHCP range
	192.168.1.2LAN 1 DHCP starting IP address
	192.168.1.254LAN 1 DHCP ending IP address
Local network 2 (LAN 2)
	192.168.20.1LAN 2 IP
	255.255.255.0LAN 2 subnet mask
	EnabledLAN 2 DHCP server
	192.168.20.2 to 192.168.20.254LAN 2 DHCP range
	192.168.20.2LAN 2 DHCP starting IP address
	192.168.20.254LAN 2 DHCP ending IP address
Local network 3 (LAN 3)
	192.168.30.1LAN 3 IP
	255.255.255.0LAN 3 subnet mask
	EnabledLAN 3 DHCP server
	192.168.30.2 to 192.168.30.254LAN 3 DHCP range
	192.168.30.2LAN 3 DHCP starting IP address
	192.168.30.254LAN 3 DHCP ending IP address
Local network 4 (LAN 4)
	192.168.40.1LAN 4 IP
	255.255.255.0LAN 4 subnet mask
	EnabledLAN 4 DHCP server
	192.168.40.2 to 192.168.40.254LAN 4 DHCP range
	192.168.40.2LAN 4 DHCP starting IP address
	192.168.40.254LAN 4 DHCP ending IP address
Local network 5 (LAN 5)
	192.168.50.1LAN 5 IP

Table 9. Factory default settings for the router (Continued)

	Default SettingFeature
	255.255.255.0LAN 5 subnet mask
	EnabledLAN 5 DHCP server
	192.168.50.2 to 192.168.50.254LAN 5 DHCP range
	192.168.50.2LAN 5 DHCP starting IP address
	192.168.50.254LAN 5 DHCP ending IP address
Firewall
Internet)	Disabled (except trafc on port 80, the HTTP port)Inbound (commun
Internet)	Enabled (all)Outbound (communications going out to the
	DisabledSource MAC Itering
WiFi
	EnabledWiFi communication
	See router labelSSID name
	WPA2-PSK (AES)Security
	EnabledBroadcast SSID
Transmission speed	Auto^1
Country/region	United States in the US Otherwise, varies by region
		Backhaul channel:Fronthaul channel:RF channel
Worldwide	Auto	Auto
		Backhaul channel:Fronthaul channel:RF channel
North America	48	157
Europa	34	108
Japan	44	100
Australia	36	157
Canada	48	157

Table 9. Factory default settings for the router (Continued)

Default SettingFeature
	10044Hong Kong
	10044Singapore

^1 Maximum wireless signal rate derived from IEEE Standard 802.11 specifications. Actual throughput can vary. Network conditions and environmental factors, including volume of network traffic, building materials and construction, and network overhead, lower actual data throughput rate.

Factory settings for Orbi Pro WiFi 6 AX5400 satellite SXS50

The satellite has the same factory settings as the router. The following table sh default satellite web interface login settings.

Table 10. Factory default settings for the satellite

	Default SettingSatellite Web Interface Login Settings
	192.168.1.250Default IP address (login URL)
	adminLogin user name (case-sensitive)
	passwordDefault login password (case-sensitive)

Technical specifications

The following are the technical specifications for Orbi Pro WiFi 6 AX5400 router SXR50) and Orbi Pro WiFi 6 AX5400 satellite (SXS50).

Technical specifications for Orbi Pro WiFi 6 AX5400 ro model SXR50

The following table shows the technical specifications for the router.

Table 11. Technical specifications for the router

	DescriptionFeature
Data and routing protocols	TCP/IP, RIP-1, RIP-2, DHCP, PPPoE, PPTP, DDNS, and UPnP
Power adapter	North America: 120V, 60 Hz, inputUK, Australia: 240V, 50 Hz, inputEurope: 230V, 50 Hz, inputAll regions (output): 12V, 3.5A DC output
	6.7 x 2.9 x 8.8 in (170 x 75.6 x 224.5 mm)Dimensions
	1.6 lb (0.72 kg)Weight
	0° to 40°C (32° to 104°F)Operating temperature
	90% maximum relative humidity, noncondensingOperating humic
WAN	1 Ethernet WAN port with an RJ-45 receptacle. The port supports 10BASE-T, 100BASE-TX, and 1000BASE-T.
LAN	3 Ethernet LAN ports with RJ-45 receptacles. The ports support 10BASE-T, 100BASE-TX, and 1000BASE-T.
WiFi	Maximum wireless signal rate complies with the IEEE 802.11 standard.
Radio data rates	2.4 GHz: Max. 600 Mbps5 GHz Low band: Max. 2400 Mbps5 GHz High band: Max. 2400 Mbps
Data encoding standards	Simultaneous Tri-band WiFi with QAM support:Radio 1: IEEE 802.11b/g/n/ax 2.4 GHz - 256 QAMRadio 2: IEEE 802.11a/n/ac/ax 5 GHz - 1024 QAMRadio 3: IEEE 802.11a/n/ac/ax 5 GHz - 1024 QAM
	512Maximum number of devices in the Orbi Pro network
network	75Maximum number of concurrent devices in the Orbi Pro
	2.412-2.462Operating frequency range 2.4 GHz (US)
	2.412-2.472 GHzOperating frequency range 2.4 GHz (Europe I
Operating frequency range 5 GHz (US)	5.18 GHz-5.24 GHz5.745 GHz-5.825 GHz
Operating frequency range 5 GHz (EU)	5.18 GHz-5.24 GHz5.26 GHz-5.32 GHz5.5 GHz-5.7 GHz
802.11 security	WPA2-PSK [AES]WPA-PSK [TKIP] + WPA2-PSK [AES]WPA2-EnterpriseWPA3-Personal [SAE]WPA3-EnterpriseWPA2-Personal [AES] + WPA3-Personal
Electromagnetic emissions	FCC Part 15 Class BVCCI Class BEN 55 022 (CISPR 22), Class B C-Tick N10947

^2 Maximum wireless signal rate derived from IEEE Standard 802.11 specifications. Actual throughput can vary. Network conditions and environmental factors, including volume of network traffic, building materials and construction, and network overhead, lower actual data throughput rate.

Technical specifications for Orbi Pro WiFi 6 AX5400 sa model SXS50

The following table shows the technical specifications for the satellite.

Table 12. Technical specifications for the satellite

	DescriptionFeature
Data and routing protocols	TCP/IP, RIP-1, RIP-2, DHCP, PPPoE, PPTP, DDNS, and UPnP
Power adapter	North America: 120V, 60 Hz, inputUK, Australia: 240V, 50 Hz, inputEurope: 230V, 50 Hz, inputAll regions (output): 12V, 3.5A DC output
	6.7 x 2.9 x 8.8 in (170 x 75.6 x 224.5 mm)Dimensions
	1.6 lb (0.72 kg)Weight
	0° to 40°C (32° to 104°F)Operating temperature
	90% maximum relative humidity, noncondensingOperating humic
LAN	4 Ethernet LAN ports with RJ-45 receptacles.The ports support 10BASE-T, 100BASE-TX, and 1000BASE-T.
WiFi	Maximum wireless signal rate complies with the IEEE 802.11 standard.
Radio data rates	2.4 GHz: Max. 600 Mbps5 GHz Low band: Max. 2400 Mbps5 GHz High band: Max. 2400 Mbps
Data encoding standards	Simultaneous Tri-band WiFi with QAM support:Radio 1: IEEE 802.11b/g/n/ax 2.4 GHz - 256 QAMRadio 2: IEEE 802.11a/n/ac/ax 5 GHz - 1024 QAMRadio 3: IEEE 802.11a/n/ac/ax 5 GHz - 1024 QAM
	512Maximum number of devices in the Orbi Pro network
network	75Maximum number of concurrent devices in the Orbi Pro
	2.412-2.462Operating frequency range 2.4 GHz (US)
	2.412-2.472 GHzOperating frequency range 2.4 GHz (Europe I
Operating frequency range 5 GHz (US)	5.18 GHz-5.24 GHz5.745 GHz-5.825 GHz
Operating frequency range 5 GHz (EU)	5.18 GHz-5.24 GHz5.26 GHz-5.32 GHz5.5 GHz-5.7 GHz
802.11 security	WPA2-PSK [AES]WPA-PSK [TKIP] + WPA2-PSK [AES]WPA2-EnterpriseWPA3-Personal [SAE]WPA3-EnterpriseWPA2-Personal [AES] + WPA3-Personal
Electromagnetic emissions	FCC Part 15 Class BVCCI Class BEN 55 022 (CISPR 22), Class B C-Tick N10947

^3 Maximum wireless signal rate derived from IEEE Standard 802.11 specifications. Actual throughput can vary. Network conditions and environmental factors, including volume of network traffic, building materials and construction, and network overhead, lower actual data throughput rate.