What Is DAL OS?

DAL OS is Digi’s standard operating system for enterprise, industrial, and transportation networking products, including Enterprise (EX), Industrial (IX and Connect EZ) and Transportation routers (TX), console servers, and USB-connected devices. Designed for speed and simplicity, DAL OS delivers advanced capabilities for today’s demanding applications.

Core Capabilities

Faster feature development and synchronization across Digi products
Systematic security updates with every mainline Linux kernel release

Supports edge compute functionality and custom applications
Includes continuous driver updates and improvements

DAL OS-Powered Solutions

Explore our complete lineup of cellular routers, console servers, and USB devices powered by DAL OS

Enterprise Routers • High-performance
• Advanced security
• 5G/LTE connectivity
View EX Routers

Industrial Routers • Rugged design
• Extreme temperatures
• DIN-rail mounting
View IX Routers

Transportation Routers • In-vehicle connectivity
• GPS/GNSS tracking
• Ignition sense
View TX Routers

Digi Connect EZ Mini/2/4 • 1-4 serial ports
• Wi-Fi and cellular options
• LifeCycle Assurance
View EZ Devices

Digi Connect EZ 8 • 8 serial ports
• Wi-Fi and cellular options
• LifeCycle Assurance
View EZ Devices

Digi Connect EZ 16/32 • 16 or 32 serial ports
• Cellular connectivity
• LifeCycle Assurance
View EZ Devices

AnywhereUSB Plus • USB over IP connectivity
• Ethernet and Wi-Fi options
• 8-24 USB ports
View AnywhereUSB Plus

Digi Connect IT 4 • 4-port console server
• Out-of-band management
• Mainline data centers
View Digi Connect IT 4

Digi Connect IT 16/48 • 16 and 48-port console servers
• Out-of-band management
• Large branch offices
View Digi Connect IT 16/48

Key Features

Enhanced data security for more peace of mind

DAL OS devices support Xauth client and SCEP security protocols to ensure the integrity and confidentiality of data communications over the network. System administrators also have full control over the firewall configuration on the DAL OS device to ensure it meets their network needs.

Digi SureLink supports persistent connectivity

Remote networks need reliable mobile connectivity. Digi SureLink® automatically recovers any portion of a Digi device’s network, including cellular, wired Ethernet, internal LAN, or VPN tunnel connections — making poor or unstable networks good and good connections great — for always-on connectivity.

Monitor and manage device usage

With Digi intelliFlow™, users can track and manage a fleet of connected devices. Digi intelliFlow monitors data usage by host, server and service over time and displays the data in dynamic charts for more-informed network management.

New LTE/5G cellular mode support

As cellular technology continues to migrate over time to 5G, DAL OS will enable fast synchronization and 5G compatibility across products. Digi ensures you have a migration path forward as technologies and networks advance.

Reliable connectivity with complete IPv6 support

Reliable connectivity with full IPv6 support

As IoT devices continue to proliferate, a full switch to IPv6 connectivity is inevitable. DAL OS provides complete IPv6 support, independent configuration and firewall support.

Full CLI configuration

DAL OS supports full command line interface (CLI) configuration for firmware upgrades, device control and troubleshooting options, as well as automated tasks such as API interactions through Digi Remote Manager® (Digi RM) and custom scripts.

Containers as a service

Digi Containers offer a simplified way to build, deploy, run, monitor, and manage your custom applications on Digi devices running DAL OS, utilizing Digi Remote Manager as the central portal for controlling your containerized applications.

WAN Bonding

Digi WAN Bonding combines multiple connections for seamless and resilient connectivity. This solution provides a valuable addition beyond failover by aggregating multiple connections to maximize speed and throughput, reduce latency and seamlessly optimize performance.

Complete Feature Catalog

Cellular

Feature	Description
5G NSA (non-standalone) and SA (standalone) modes	Options to set the cellular modem to 5G-only (including setting to 5G SA-only, NSA-only, or both NSA/SA-modes).
5G slicing	5G Multi-Slicing allows traffic to be routed through multiple dedicated logical networks — called “slices” — on a single 5G connection. These slices can be tailored for different latency, bandwidth, and priority needs. Available for 5G SA-capable Digi devices.
APN Search	APN lookup/search based on global database/SIM provider/carrier.
Carrier scan	Scan for available carriers the modem and SIM card can connect to and allow manual selection of the carrier.
Carrier/SIM based firmware switching	Change modem firmware to suit SIM/Carrier.
Carrier/SIM locking	Use cases: cellular MVNO/partner SIM cards can connect to multiple carriers in an area. Benefit: users need the SIM to connect to a specific carrier due to better signal strength, performance, or data plan.
Cellular Band Locking	Improve cellular connection reliability at congested sites by locking the modem to a particular set of LTE or 5G bands.
Cellular IP Passthrough Mode	Cellular addressing is passed through to upstream device. IP passthrough can also be done for Wired WAN or Wi-Fi-as-WAN connections.
CLI/WebUI Modem Firmware Update	Apply local firmware update to cellular modem.
Dual APN	Connect to two APNs at the same time and obtain an IP address on each. Typical use is for private APN and public APN simultaneous connections.
eSIM profile management and switching	A SGP.32 compatible eSIM used in the Digi router, provisioned with a bootstrap profile for out-of-box connectivity, and the ability to apply additional SIM profiles over the air via Digi Remote Manager. Digi’s eSIM accessory adds carrier-agnostic, zero-touch connectivity to EX, IX, and TX routers, enabling remote profile switching and simplified lifecycle management with secure, global coverage.
External USB Modems	Support for plug-in USB modems.
OTA/Remote Modem Firmware Update	Manually or automatically trigger remote firmware updates to the cellular modem(s) in the Digi device.
Radio technology locking	Supports locking to specific radio access tech (2G-only, 3G-only, or 4G-only).
SIM PIN	Ability to configure and unlock SIMs with PINs.
SIM survey tool	Initiate a SIM survey for one or multiple devices through Digi Remote Manager, triggering the device to test all available SIM slots and report the connectivity capabilities, signal strength, and health of each SIM installed in the device.
User configurable APN search	Full control over what APNs are utilized to establish a cellular connection.
User Configurable Antenna Control	Main-only, diversity-only, or both.

Recommended Products for Advanced Cellular Features:

Device Configuration

Feature	Description
Binary ".all" file	Flash image for configuration or factory reset function.
Custom factory config file	Ability to define customer's own default config file that will be instigated after a factory reset.
Device Configuration Export/Import	Abilty to export the configuration for (re)configuring other/same router.
Device configuration rollback	When applying configuration updates to the device through Digi Remote Manager, the Digi DAL OS device can automatically rollback its configuration settings if it cannot re-connect to Digi Remote Manager after applying the configuration update.
Local web API	Use cases: users need to setup config automation for devices without Internet access. Benefit: the web UI of the DAL device provides a RESTful API that can perform multiple configuration updates on the device.
Low power mode	Options to adjust the CPU frequency, system performance, Ethernet ports, serial ports, and LED behavior for reduced power consumption.

DNS

Feature	Description
Allow-lists	A list of allowable domains or FQDNs configured so the device itself can act as a DNS filter instead of requiring all of the DNS filtering decisions to be made externally.
Custom DNS entries	Custom IP/name/domain entries via DNS server configuration.
Dynamic DNS	Automated DNS updates for dynamic IP addresses.
Routing - DNS Sel	Route requests for different host/domain names to different DNS servers including wildcard definitions.

Ethernet

Feature	Description
802.1x	Port-based network access control, configurable per network interface.
Arbitrary network plumbing	VLAN bridging, VLANs on Bridged VLANs/Wifi/Ethernet, ...
BOOTP server	Provide a pool of IP address to provide to BOOTP clients. There is no imposed limit to the address range.
DHCP Client	The device can request an IP address for its own interfaces from a DHCP server.
DHCP mac reservations	Reserve IP addresses for user configured MAC addresses.
DHCP Relay	A DHCP relay agent will forward DHCP requests between client and servers.
DHCP Server	Provide a pool of IP address to provide to DHCP clients. There is no imposed limit to the DHCP address range.
DHCP server custom options	List user-definable DHCP option for number of responses.
DHCP server per layer 2 "group"	Define a DHCP server instance for each layer 2 or hub group.
Duplex/speed control	Adjustable Ethernet link duplex and speed.
Ethernet bonding	Bond multiple Ethernet ports together for higher throughput and/or redundancy.
Hybrid Ethernet mode	Ethernet port acts as a WAN (DHCP client) but automatically changes to a LAN DHCP server if there is no WAN connection within 1 minute of boot-up. Available on Digi IX10 and IX15 devices.
Multiple IP's per "LAN"	Router can own multiple IP addresses in the same layer 2 "LAN group".
Network analyzer	Configurable to enable logging of packet analyzer trace for network troubleshooting.
Port Isolation/Grouping	Each Ethernet port is individually configurable.
PPPoE server	Support for running a PPPoE server in IP passthrough mode.
VLANs	Virtual LAN networks.
VLANs inside VLANs	Used by some IP phones, for example.

Failover

Feature	Description
Advanced Watchdog	The Watchdog service can monitor the operation of your device, test the system for problems, and automatically restart the modem(s) in the device or reboot the device itself if it detects a fault or failure.
Cellular to Ethernet	Automatic failback with Digi SureLink tests to validate both connections.
Digi SureLink®	Range of connectivity tests for any type of network interface (WAN, cellular, LAN, VRRP, VPN, bridge, etc.) along with recovery options to ensure the interface automatically re-establishes.
Ethernet to Cellular	Automatic failover with Digi SureLink tests to validate both connections.
In VPN tunnel pings	Interface ping/probe tests can be directed through a VPN tunnel to prove end to end connectivity and disconnect WAN interface when problem detected.
No IPSec SA deact	Detect when there are no IPSec Security Associations on an interface and initiate a recovery procedure; e.g. reconnect module, reboot router etc.
Recovery Pings (firewall)	Routes/interfaces can be brought back into service only after a successful ping / probe test.
SIM prioritization	Allow one SIM to be given priority over the other if both are working. Return to the higher priority SIM after running on lower priority SIM for a period of time.
SIM to SIM failover on failure to connect	Automatically switch between SIM slots if either SIM cannot connect.
SIM to SIM failover on problem with automated ping test probes or similar allowing reconnect attempt.	Failover between SIM cards if an automatic ping test probe or similar fails, allowing a re-connection attempt of the current SIM first. If the re-connection attempt of the current SIM is successful but end to end probe test still fails, then failover to the other SIM.
Support for a second ping or probe target.	Only take action if both the primary and secondary ping/probe targets are failing.
Supports pings and/or other automated probe tests on all interfaces.	Allow recovery or failover action to be initiated if the test fails.
VRRP	Basic hardware redundancy sharing of MAC and IP address between two devices.
VRRP+	Digi patented feature to increase/lower VRRP priority based upon the results of probe tests; allows for intelligent failover.
Wi-Fi to cellular	Wi-Fi-as-WAN client connectivity can be used in addition to cellular or wired Ethernet for Internet connectivity. Each Internet connection can be individually prioritized to control primary vs backup.

Firewall & Security

Feature	Description
2 Factor Authentication	Configurable 2FA user authentication.
Address Translation	NAT support for segmenting networks behind a firewall.
Advanced web filtering - Cisco Umbrella	Full umbrella support.
Basic web content filtering by DNS	Basic web content filtering by DNS redirection.
Certificates with HTTPs	Customizable SSL certificate for HTTPS web UI access.
Custom firewall rules	User may utilize complex low level rules (i.e. IPtables)
FIPS 140-2	FIPS 140-2 is the recognized benchmark for cryptographic hardware. FIPS 140-2 compliance can be enabled with a single configuration setting, which updates the device to only use FIPS 140-2 approved cryptographic algorithms and ciphers.
Firewall Zones	Allow firewall groups of interfaces and access based on usage, etc. Allows user to easily add rules to a number of interfaces/define interaction between different zones etc.
Firmware update notifier	Notification shown in the CLI, web UI, and Digi RM when new firmware is available.
MAC Address filtering	Allow/deny network access based on MAC address of incoming device.
Multi-user role based access	Fine-grained permission control to determine whether a user has admin level access or read-only access.
Port forwarding	Forward incoming traffic on a port to another IP address. Support a range of ports, including 1:1 and many-to-one port mappings.
Stateful packet filtering (basic security)	Per-packet analysis to match with applicable firewall rules for traffic shaping and access restriction.
TLS Version 1.3	Secure HTTPS communication.

Fleet

Feature	Description
Ignition sense delayed power off	Monitor ignition sense input to control power off sequence.

Location

Feature	Description
Enhanced Location Service	Near real-time (as fast as every 10 seconds) location updates to Digi Remote Manager, along with mapping updates with Digi RM for real-time geolocation, historical view of device movement, and route-mapped signal quality insights. Available for devices with GNSS/GPS support.
Geo-fencing	Multiple geo-fences can be defined and multiple actions can be taken when the device enters/leaves any of the geo-fences.
GPS/GNSS	Multiple options for obtaining GPS/GNSS locations, including external USB GNSS modules, internal GNSS module (available on select products), manual lat/lon, or cellular modems with GPS support.
Inbound UDP	Configuration option to accept incoming UDP/TCP packets containing NMEA data.
Outbound UDP	Configuration option to send GPS NMEA stream to server via UDP/TCP with optional filtering.
UDR (untethered dead reckoning)	Ultra-precise positioning and location tracking that takes into account acceleration, speed and angular rate (available on TX-series Digi routers).

Recommended for GPS/GNSS Tracking:

Management

Feature	Description
Access to the Linux shell	Linux shell console available for sysadmin tasks.
Bluetooth scanner	The Bluetooth scanner allows you to configure your router to detect Bluetooth Low Energy-enabled devices that are nearby. It can also be configured to open an SSH port that remote hosts can access to read basic information about those devices.
CLI	Digi command line interface with a large set of commands available for administering the Digi device, including tab auto-completion.
Device event logging	Send system logs to Digi Remote Manager for cloud-based analysis and information aggregation.
Digi AnywhereUSB® Plus debug wizard	Web UI tool for collecting USB debug logs from an AnywhereUSB Plus device.
Digi Remote Manager® (Digi RM)	Digi’s central portal for monitoring, managing, and performing automated interactions with Digi devices, utilizing best-in-class secure connectivity with client-side TLS certificates.
Digi RM CLI	Remote access to the admin CLI on the Digi device through Digi Remote Manager. Benefit: when combined with Digi RM's automations feature, users can perform a series of defined tasks to automate a number of actions on the DAL device.
Digi RM http proxy connection support	Devices in a secure network can connect to an HTTP proxy for all outbound communication to Digi Remote Manager.
Digi RM Profile Manager	Compatible with Digi Remote Manager Profile Manager for fleet management, remote firmware updates, and OTA modem firmware updates.
Digi RM SMS	Digi Remote Manager can configure a device via encrypted SMS messages.
DRM Health	Digi Remote Manager Health Metrics.
Email notifications	Send system event logs via email.
External USB/SD storage management	Web UI and CLI tools to format, initialize, and set up auto-mounting of USB or SD cards.
HTTPS	SSLv3 secure web UI login.
HTTP/s banner	Custom text displayed when user logs into the device.
iPerf bandwidth testing	Ability to act as an iPerf server or client.
Initial config via Bluetooth	Configure the cellular connection settings via Bluetooth.
Digi intelliFlow	Netflow is too data hungry; Digi intelliflow is a tool that provides a graphical way of visualizing your network’s application data. Digi intelliflow, combined with Digi Remote Manager, provides a powerful tool for combating excessive data usage. Digi Remote Manager provides custom alarms that can be set up to notify you when you approach your monthly data limit or exceed your monthly data limit. You can use those alerts to know when an action is needed on your network to address excess usage.
ITxPT	Industry standard implementation of information technology for public transportation systems. ITxPT is available on Digi’s TX router series. This allows the router to function as a Vehicle Communications Gateway module, as well as a GNSS location server, time server, and MQTT broker.
LDAP	LDAP for system admin and authentication.
mDNS	Local device discovery using the mDNS bonjour protocol that resolves host names in small networks that do not have a DNS server.
NetFlow	NetFlow allows for in depth traffic analysis and bandwidth monitoring.
NFS client	Enables the ability to mount an NFS server onto the local filesystem and provides support for logging to an external NFS.
nuttcp bandwidth testing	Provides the ability to act as a nuttcp client.
On-device activation codes for premium features	For devices that can’t contact Digi Remote Manager directly (private networks, firewall restrictions, etc), users can now export licenses for add-on services such as Digi WAN Bonding and Digi Containers from Digi RM, and import locally on the device’s web UI, thereby allowing them to utilize these valuable solutions in air-gapped private networks
Ookla Speedtest tool	Integrated troubleshooting tool within Digi Remote Manager for evaluating WAN connection performance on a Digi device, whether that is a cellular modem, wireless Wi-Fi WAN, or wired WAN connection.
RADIUS	RADIUS for system admin and authentication.
Remote commands	Digi Remote Manager can perform remote actions on the device.
Remote console access	Device can be remotely accessed using the cloud server.
SCP server	Available for the user to transfer config files, scripts and firmware.
SFTP server	Available for the user to transfer config files, scripts and firmware.
SMS cmd execution	Change the configuration or reboot the device via SMS messages, either through Digi Remote Manager or a custom python script.
SNMP server	SNMPv2c/SNMPv3 read-only access. SNMPv1/v2c write-access for serial settings supported on Digi Connect® EZ products.
SNMP traps	Send system event logs via SNMP.
Support for multiple user levels including read-only.	Role-Based Access Control specifically to allow a user to log into a device, view configuration and status but not change it.
Syslog	Can send events to an external syslog server.
TACACS+	TACACS+ for system administration, authorization, authentication, and accounting.
Telnet server	Access to admin CLI, serial port(s), and shell console (available on select products; disabled by default).
Telnet/SSH banner	Custom text displayed when user logs into the device.
USB analyzer trace	Configurable to enable logging of packet analyzer trace to a USB mass storage device (e.g. flash drive).
Web UI to configure tracing	Web UI to configure and view analyzer traces.
Device-initiated registration with Digi Remote Manager

Centralized Fleet Management:

All DAL OS devices integrate with Digi Remote Manager
Manage thousands of devices from a single dashboard
Profile Manager for fleet-wide configuration updates

Learn about Digi Remote Manager

Programmability

Feature	Description
Containers as a Service	Digi Containers provide a containers-as-a-service tool to simplify and centralize the process to build, deploy, run, monitor, and manage your custom applications on Digi devices run DAL OS, utilizing Digi Remote Manager as the central portal for controlling your containerized applications.
Containerized python environment	Add on Python to your Digi device via Digi Remote Manager.
DIA (Device Integration Application)	Compatibility with Digi DIA Python framework.
Execute own Linux cross compiled programs	Ability to run custom-compiled applications natively on the Digi device.
MQTT Client	Report custom metrics and analytics to a customer's infrastructure. Primarily used when integrating with Azure IoT Hub.
Python method to control device LEDs	Customizable LED behavior with automated Python scripts.
Python module to access OS CLI / change configuration	PIP Python module installer.
Python module to post datapoints to Remote Manager	Custom Digi Python modules for automated and custom interactions with Digi Remote Manager.
Python PIP	Dynamically install and add Python modules via Python PIP.
Python support to send data to AWS	Python AWS module support.
Python support to send data to Azure	Python Azure IoT module support.
Python3	Modern Python scripting.
Script/Application Sandboxing	Python and Linux shell scripting run with full access to the device’s system or in a locked-down sandbox environment.
Shell scripts	Linux shell scripting.

Recommended for Edge Computing:

Routing

Feature	Description
BGP	Border Gateway Protocol.
DMVPN	Phase 3 DMVPN spoke support with BGP, OSPF, NHRP, or mGRE routing.
GRE	Generic Routing Encapsulation.
GREtap Tunneling	Generic Routing Encapsulation Terminal Access Point (GRETAP) tunnel operates on OSI level 2 and encapsulates Ethernet traffic in IPv4 packets as described in RFC 2784
IPv6	Independently configurable IPv6 network for all available network interfaces.
IPv6: DHCPv6	IPv6 DHCP client.
IPv6: SLAAC / Prefix Delegation	IPv6 Stateless Address Autoconfiguration.
IPv6: static IP assignment	Assign a specific IPv6 address, subnet, and gateway to network interfaces.
Load balancing between different WANs	Example: load-balance cellular and Ethernet.
mGRE	Multipoint Generic Routing Encapsulation (mGRE) is a VPN technology that creates a single, scalable virtual tunnel for multiple sites to communicate over an IP network
Multicast routes	1-to-many data transmission.
NEMO/DMNR	Verizon Dynamic Mobile Network Routing.
NHRP	Next-hop routing protocol
OSPF	Open Shortest Path First routing protocol.
Policy based routes	Traffic shaping based on 5-tuple packet filtering.
PPPoE	Useful so router can own IP address from an xDSL router.
QoS	DSCP and Priority Queuing.
RIP	Routing Information Protocol.
RSTP	Rapid Spanning Tree Protocol.
Respond to GRE keepalives	Send a reply if a GRE keepalive is received.
Static routing	Static routes to interfaces with metrics.
STP	Spanning Tree Protocol.
WAN Bonding	Digi WAN Bonding combines multiple connections into a seamless and resilient connectivity solution that ensures optimal performance and maximum uptime anywhere around the world, with a maximum bonded bandwidth of 1 Gbps.

Serial

Feature	Description
Accept multiple inbound TCP connections for same serial port concurrently.	Shared serial port access (can be locked for exclusive access if needed).
Automatic serial detection	Query connected serial devices and auto-configure serial port settings in remote access mode.
Autoconnect mode	Stream outbound serial traffic when in remote access mode.
Configurable modes	Login, remote access, Modbus, or custom application.
Digi RealPort	Virtual PC COM port connection to serial port of DAL device.
Inbound SSH to serial	Inbound SSH connection to serial port(s).
Inbound TCP to serial	Inbound TCP socket connection to serial port(s).
Inbound Telnet to serial	Inbound Telnet connection to serial port(s). Disabled by default.
Modbus gateway	Use the Modbus protocol to provide serial-to-Ethernet connectivity to Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), and other industrial devices.
Modbus TCP to RTU conversion	Serial communication and protocol conversion using Modbus.
Multi TX	Sends serial data to multiple destinations (IP and UDP/TCP ports).
Outbound serial-over-UDP	Outbound access to the serial port using UDP.
Serial AT dial-up modem emulator	The Digi device’s serial port acts as a dial-up modem emulator for handling incoming AT dial-ins from a client device. This bridges the gap for dial-up based serial equipment so they can still maintain network connectivity as dial-up POTS lines are being decommissioned.
Serial port tracing	Trace traffic in and out of the serial port for debugging purposes (analyzer trace).
Serial PPP dial-in mode	Answer Point-to-Point Protocol (PPP) connections over serial ports.
Support for external analogue modems via RS232 or USB	Legacy
USB to serial adapters	Support USB to serial adaptors on USB port.
Web based serial access	(Shellinabox or similar).

Recommended Products for Serial Connectivity:

Time

Feature	Description
Cellular modem as time source	Use the cellular module's internal clock as a date/time sync source.
GNSS module as time source	Use the Digi device’s internal or USB GNSS module (if included) as a date/time sync source.
NTP client	Outbound date/time sync with remote NTP server.
NTP server	Act as NTP server for local clients.
SNTP client	Simple NTP protocol support in client mode.
SNTP client wait for WAN to connect	NTP sync automatically occurs after the Digi device obtains a WAN connection.
SNTP daylight saving offset	Wait for WAN to connect before attempting SNTP.
SNTP Server	Simple NTP protocol support in server mode.

VPN

Feature	Description
Accept OpenVPN pushed routes	Routes pushed to the client by the OpenVPN server.
EZY VPN	Cisco IPSec extension to use MODECFG + XAUTH.
Failover IPsec tunnel with same local/remote subnet between two remote VPN concentrators	Simple IPSec VPN failover configuration (back up tunnel IP address or other method that allows the same remote subnet to failover between two IPSec concentrators).
IKEv2	Modern IPsec protocol support.
IPSec Debug Logs	Easy way via the UI for the user to enable and access IPSec + IKE debug logs, i.e. without using CLI.
IPsec tunnel inside of another IPSec tunnel	Network segmentation with tunnels within another IPsec tunnel.
IPSec tunnel follows best WAN interface	Automatic tunnel establishment on WAN failover/failback.
IPv4-over-IPv6	IPv4 networking through an IPv6 tunnel.
IPv6-over-IPv4	IPv6 networking through an IPv4 tunnel.
L2TP	Layer 2 Tunneling Protocol. Includes options for configuring PPP-over-L2TP and L2TP-over-IPsec tunnels.
L2TPv3	Layer 2 Tunneling Protocol Version 3 static unmanaged Ethernet tunnels.
LAN to LAN IPsec	Flat LAN networking setup with multiple remote sites.
MACsec 802.1ae	MACsec (Media Access Control Security) layer 2 VPN tunnel used along with 802.1x authentication for secure LAN communication.
Max IPSec Authentication Level	AES256GCM128
Max IPSec DH Group	DH32
Max IPSec Encryption Level	SHA512
Multiple IPsec remote endpoints	Add multiple endpoints and either round-robin between the endpoint or randomly select an endpoint to establish the tunnel to.
Multiple subnets in single IKEv2 policy	Dynamic networking within IPsec tunnels.
Number of Consecutive tunnels	There is no fixed limit.
OpenVPN Client	Outbound OpenVPN tunnel to an OpenVPN server.
OpenVPN Server	Secure VPN for point-to-point or site-to-site connections. Both clients and servers can be configured simultaneously.
Protocol-based IKE policies	Ability to configure IPsec networks by protocol and/or port instead of a network address range.
SCEP	Connect to a Simple Certificate Enrolment Protocol server to obtain certificates for IPSec.
Support for 0.0.0.0/0 traffic selector	Needed if all the traffic received from the LAN is to be routed down the IPSec VPN tunnel.
Support RSA Signatures	Public-key crypto for IKE authentication.
Support X.509 certs with IPSec	Certificate-based peer authentication.
WireGuard VPN	Simple, fast, lean, and modern VPN that utilizes secure and trusted cryptography for providing client-mode or server-mode tunnels.
XFRM or strict routing IPsec tunnels	Options for configuring route-based XFRM IPsec tunnels or policy-based IPsec tunnels.

Wi-Fi

Feature	Description
Access Control List	Allow or deny clients based upon MAC address.
AP mode	SSID setup for Wi-Fi client devices to connect to.
Background scanning	Ability to regularly scan for a SSID with better coverage and automatically switch to that.
Certificate-based WPA2/WPA2 Enterprise client	PKI certificate-based authentication for WPA2/WPA3 Enterprise Wi-Fi client connections, including options for user-provided certificates or SCEP client integration for automatic certificate generation.
Client + AP concurrently with a single Wi-Fi module	Ability to broadcast a Wi-Fi SSID as an access point while simultaneously running a client-mode connection to another Wi-Fi access point's SSID.
Client isolation	Option to prevent client devices from communicating with each other.
Client mode	Connect to another Wi-Fi device’s SSID.
Coovachilli Hotspot	tive portal access controller.
DFS client	Support 5 GHz DFS Wi-Fi channels in client mode.
Generic Wi-Fi Hotspot	Local captive portal and hotspot.
Multi SSIDs	Up to 8 concurrent SSIDs per radio.
WDS	Wireless distribution system.
WPA2 Enterprise	RADIUS authentication for Wi-Fi connectivity.
WPA3 encryption	WPA2/WPA3 Personal, WPA3 Enhanced Open, WPA3 Personal, and WPA3 Enterprise.
Wi-Fi 2.4/5GHz	Dual-band Wi-Fi support (available on select products).
Wi-Fi Bridged Client	A simple example is bridging a LAN over a Wi-Fi client connection to another LAN.
Wi-Fi scanner	Scan for nearby client devices, including rogue APs, stationary clients, or moving clients, then report the results to one or more remote servers.