GT-AX6000 no Guest wifi menu in AP mode

[Hippo]

HI all,

Been consulting this forum on the sly for a while now but first time poster. Have had a good experience with AI mesh using an ax56U as a router and two ax92U as nodes.

I only have fibre to the cabinet so need to use my ISP router as a modem. It has no bridge mode so have been using the AX56U in AP mode. Only downside to this is that the guest wifi isn't isolated in AP mode. No idea why this is the case but it is. I did use an old modem I had lying around for a bit in bridge mode and using the router in full router mode but I started having internet issues which were solved by plugging in the ISP router and moving the ASUS to AP mode.

My AX56U is now EOL so I've upgraded to a GT-AX6000 hoping that it's VLAN settings mean that guest wifi is isolated, however, it turns out that there is NO guest wifi in AP mode for the GT-AX6000.

This is all I get.

What am I missing? How did the AX56U have guest mode but not this newer one? Any ideas how to set the ASUS up with the ISP router so I'm not creating issues? Can I go back to router mode with the ISP router and disable things like DHCP etc. so I don't get issues e.g. double NAT. I would consider myself reasonably tech literate but I'm a little in the dark as to my options here.

Thanks in advance!

 

[JZSX]

I am probably the last person to help on this issue, having just bought this (and having Buyer's Remorse and feeling like a fool for not scoping out issues like this), but ...

You can restore Guest Wifi in AP mode by Downgrading to the current Asus-Merlin firmware. That is, from stock Asus 3.0.0.6.x to Merlin's current 3.0.0.4.x. Now you may lose some other feature in doing that, like IoT wifi feature, etc.

As an AP, this GT-AX6000 has been a Bust due to issues such as above, which is sad - I've been buying Asus Routers for a couple decades. I was upgrading from RT-68u running Tomato but, save better 5GHz performance, this new Asus has been a bust as an AP. Unless one's needs are very simplistic, Buyer Beware buying this as an AP. Anyone using an upstream router (pfSense in my case) should look else where for an AP. Ditto bust with AIMesh. This unit will recognize as AINode (both via Ethernet and via Wifi) the RT-68u flashed to latest Asus stock, but then just Hangs and eventually times out and can't add it.

For roughly the same price, I'm thinking I should have just bought an 8 port managed switch and Ubiquiti AP. Or on the cheap, would have been better to just get best Home Router that supports OpenWRT (or even Fresh Tomatoes).

 

[glens]

it turns out that there is NO guest wifi in AP mode for the GT-AX6000.

While it doesn't appear to offer such in AP mode, what happens when you try /Guest_network.asp in your browser?

The VLAN stuff is now supposed to be better / more comprehensive than the plainer earlier version as "Guest Network" anyway. I take it that's also excluded from offer in AP mode too?

 

[JZSX]

So actually, I started initially with Merlin (i.e., flashed before first use) but when I realized that Merlin hadn't done AsusWRT 5 (i.e., 3.0.0.6.x), I backup my config and shot a bunch of screenshots. Then I upgraded from Merlin 3.0.0.4 to latest (June 2023) 3.0.0.6 stock firmware.

Basically, the ONLY thing extra I need is the G.D. SIMPLE request of Bridging one measly Wifi radio/VLAN (doesn't have to be Guest) to one measly LAN Port. That LAN Port is then connected/fed to a Second interface/port defined on pfSense box (which then can service it as separate IoT subnet, with one-way access provided to my main LAN). All that easily done on prior Tomato RT-AC68u (né TM-AC1900 - $40 T-Mo box). I took a shot at 3.0.0.6 because the terse blurb on Asus site suggested that its new "IoT wifi" feature in AsusWRT 5 might address my IoT issue. I cannot address it in 3.0.0.4 because there is no easy way (without custom scripting) to Bridge a particular Radio/VLAN (Guest or otherwise) to a particular LAN port.

The GT-AX6000 running current stock 3.0.0.6 firmware in AP Mode would not pick up the existing Guest Network config (that was in NVRAM), nor on any restore. It occurred to me to type said Guest Network URL but unfortunately, I did not shoot a screenshot of that page and my guesses at the time (based on how the other pages were named) were incorrect. However, given that the upgrade to 3.0.0.6 killed the existing defined Guest Networks, I imagine that entering the URL will not help. I think the feature of Guest Networks is Killed in 3.0.0.6, making this Model a VERY unsuitable choice for AP at the present time.

For the time being, I hooked my Tomato router back up as a second access point for 2.4G, connected to pfSense box. I could author a Bridge script for one of the 3.0.0.4 Guest Networks in the GT-AX6000 to solve my problem above, but now I wonder if this firmware is effectively orphaned at 3.0.0.4 for any AP use at all (since NO Guest Networks in 3.0.0.6 AP Mode should be a total deal breaker for most use cases). Not a good situation. Even my $20 travel router (running OpenWRT) provides Guest Network in AP and Repeater Modes, AND you can specify Bridging to the LAN port as desired.

 

[Tech9]

making this Model a VERY unsuitable choice for AP at the present time.

What Asus router model has Guest Network in AP Mode actually separated from the main network?

 

[JZSX]

What Asus router model has Guest Network in AP Mode actually separated from the main network?

[if ur asking a Rhetorical Question, here is the Rhetorical Answer ]

Using Stock AsusWRT Out of the Box, I'm guessing None. However, as pointed out by many others in this Forum, for Asus supporting VLANs - which includes GT-AX6000 by the way - these Guest Networks are each Spawn as a VLAN that is explicitly Bridged (by the default AsusWRT code) to the "main network" (LAN). And thus several posts in this Forum have shown dropping a particular Guest WLAN Bridge to the default LAN, and then re-Bridging that to a Particular Port at a given eth[x]. See, e.g., the base URL referenced in such a post:

LAN port isolation (port-based VLAN) on ASUS RT-AX88U with Asuswrt-Merlin 384.16

Although there is no more robocfg command on HND platform and Asuswrt-Merlin lacks GUI support on creating VLAN, port-based VLANs (or static VLAN) can still be achieved by separating ethernet interfaces into isolated bridges and applying firewall (ebtables or iptables) rules.

wu.renjie.im

For more than a decade with Asus, first with RT-AC66 and then RT-AC68u, I have been Bridging a Radio virtual WLAN to a Particular isolated LAN Port ... in about 5 min of GUI input by of course using Tomato. That my dirt cheap $20 GL.net travel router ALSO provides this functionality out of the box (via OpenWRT) does not surprise me. What does surprise me is that here at end of 2023, a >> $200 Asus Router cannot do this (without jumping thru major scripting hoops).

I'd be the first to agree that my use case may not be applicable to larger target user base for this Router, which I gather is the implicit premise of your post. That's NOT my main criticism of this Router. My main criticism is ZIPPO, ZILCH, NADA Guest Networks available in AP mode ... REGARDLESS of what (eth(s)) it would be ultimately Bridged to. THAT glaring deficiency is applicable to many or most target uses, from Mom & Pop to stoner gamer, and pretty much EVERYONE in between.

 

[Tech9]

My main criticism is ZIPPO, ZILCH, NADA Guest Networks available in AP mode

Perhaps because the term Guest Network in AP Mode was wrong for many years. It was in fact only extra SSIDs available. I'm surprised you play with home routers when multiple business AP options are available with native VLAN support. Why you need an AIO home router for AP? The answer - because it's actually cheap at around $200. You want cheap and then complain it doesn't do what you need. Get the proper hardware for your needs.

 

[JZSX]

Perhaps because the term Guest Network in AP Mode was wrong for many years. It was in fact only extra SSIDs available. I'm surprised you play with home routers when multiple business AP options are available with native VLAN support. Why you need an AIO home router for AP? The answer - because it's actually cheap at around $200. You want cheap and then complain it doesn't do what you need. Get the proper hardware for your needs.

Price for 8-Port Ubiquiti managed switch plus Ubiquiti AP runs about $250 on Amazon - about the same price as GT-AX6000 on Amazon. If one swaps Trendnet, TP-Link, Netgear, etc. for the premium priced Ubiquiti switch, total price for the "expensive" business option drops to $150. With GT-AX6000 weighing in at $100 more, pretty hard to call the Asus router a cheap or even cheaper option.

Nope, no money saved there. I sprung for Asus as I was hoping to re-purpose two existing Asus RTs as aiNodes - hopefully will happen. And I assumed (based on prior purchases) that the Asus wireless signal transmission would be very good to excellent - luckily, so far, so good there.

I don't need or care for VLANs, that is, running VLAN tagged traffic within an existing Net. I have three additional dedicated pfSense OPT Ports available to handle whatever additional separate subnets - No VLAN required (or desired). The whole issue of VLAN comes up SOLELY because that is the technology all these Router firmwares (AsusWRT, Tomato, Open WRT) use INTERNALLY to virtualize their Radio WLANs. My pfSense box (as configured) could care less - all it knows is a given Ethernet connection happened at a particular Interface/Port assigned to a subnet, NO tagged traffic involved.

So I bought Asus because I've been a BIG Asus Fanboy. But I'm not blinded to obvious shortcomings, of which the Feature Regression of dropping [fill in the blank whatever you want to call it Guest Networks, Virtual SSIDs, Whatever - no one cares] in AP Mode from 3.0.0.4 -> 3.0.0.6 is a Biggie. Two other forum members have voiced concern about that, and I echo that concern. Dismissing it as a Nothing Burger might be fine for whatever your particular use case is, but OBVIOUSLY others raising the same concern about this Regression do not support your assessment.

 

[Tech9]

So I bought Asus because I've been a BIG Asus Fanboy.

Consumer market, perpetual beta firmware, it is what it is. You have to deal with the limitations of your hardware choices.

I sprung for Asus as I was hoping to re-purpose two existing Asus RTs as aiNodes - hopefully will happen.

Good luck, especially if the old RTs are AC-class and AC68U variants. You are going to get the best of Ai marketing there.

 

[glens]

But I'm not blinded to obvious shortcomings, of which the Feature Regression of dropping [fill in the blank whatever you want to call it Guest Networks, Virtual SSIDs, Whatever - no one cares] in AP Mode from 3.0.0.4 -> 3.0.0.6 is a Biggie. Two other forum members have voiced concern about that, and I echo that concern. Dismissing it as a Nothing Burger might be fine for whatever your particular use case is, but OBVIOUSLY others raising the same concern about this Regression do not support your assessment.

While so dismissing it /here/ I acknowledge you have a dilemma. First thought about it is that it /may/ be a "regression" only in that the way it's done has /changed/ (don't know). Along with that is the question of whether the functionality, if not removed entirely, has actually been decreased or increased with the new scheme.

Giving it only cursory consideration I see two ways a standalone AP could /create/ /new/ network isolation. First would be via separate network creation. Second would be by using the same network but with VLAN traffic tagging.

For the first case the device is crossing over into /routing/ territory and would seemingly require port isolation on both it and the router proper, with a second feed point - with separate feed - on/to/from each unit. I'm not suggesting that's not doable, only impractical.

For the second case, in order to combine all the traffic to a single feed, well, tagging needs to be set up and understood by both units. In this case separately. But I feel that would be better described as the router being configured to do that and the AP being told to separate/combine the traffic to/from different SSIDs (or "dumbly" using the same SSID broadcasting with the tags intact, which would really be the only way the AP wouldn't be doing any "routing" functions of its own).

Ultimately, I guess, it depends upon the definition of the term "AP". To me those alternate firmwares mentioned use the term in a confusing if not improper way. That's to say I consider "AP mode" to be nothing more than a medium converter and it sounds from what you're saying that's pretty much how Asus is (now?) considering it, too.

 

[VANT]

The surprising fact is that in 2023 your ISP cannot provide you a ONT bridge.

 

[Crimliar]

@VANT it's not at all uncommon for ISP equipment to be as locked down as possible while still being usable. It's more than a decade (UK & EU ISP markets are different to many other locales) since I had an ISP that provided a router that could operate properly in bridged mode.
Give users settings to play with and they will play with them - and then expect support when things break.

 

[glens]

Ha. I took a minute and established a 3.0.0.4 (latest Merlin) AP Guest Network for the first time. The only value I could see in it would be providing temporary access to the full network for a weekend get-together or something. So it could be torn down after thus cutting off further access for the attendees in a simple and easy manner.

 

[VANT]

@VANT it's not at all uncommon for ISP equipment to be as locked down as possible while still being usable. It's more than a decade (UK & EU ISP markets are different to many other locales) since I had an ISP that provided a router that could operate properly in bridged mode.
Give users settings to play with and they will play with them - and then expect support when things break.

I don't want to give anyone anything to play with. I require the supplier to give me a choice.
If I am a conscious user with my own router, I choose ONT bridge, if I have no idea about networks, I choose a router from the provider.
Simple right?