FAQs

By default, Kenstel Access point are configured with the following login credentials:

• Username: user
• Password: password

• Make sure the sim is inserted properly and is in working condition.
• Reboot the device after inserting the SIM.

Ensure the APN configuration is correct. If it is correct, try using the CONNECT/DISCONNECT button. If the issue persists, reboot the device.

This may be because the selected bands are not available in your area, preventing the device from communicating with them. Set the configuration to RESTORE DEFAULT BAND and submit it.

Try it for 2-3 times. If still not working then contact the support team.

It is may be due to:

• The selected operator may not have proper network coverage in your area.
• Your SIM may not be allowed to register on the selected network.
• The network might require additional authentication or roaming permissions.
• Your device may not support the selected operator’s frequency bands.
• The operator may have restrictions on manual selection.

It is may be due to you are connected to 2.4ghz network try to connect 5Ghz.

By default, Kenstel Router are configured with the following login credentials:

• Username: user
• Password: password

To switch ports between LAN and WAN, follow these steps:

• Open a web browser and log in to the cloud management portal.
• Navigate to Configuration → Network → Port Setup.
• In the Port Setup section, you can:
• Enable or disable a port by setting its mode to On or Off.
• Change the service type between LAN and WAN by clicking the respective button.

Checking VLAN on LAN

Checking VLAN on WAN

• Verify the IP address of the client device where the configuration is applied. The IP address might have changed from what you initially intended to configure.
• Check if another rule is conflicting with the current one, as overlapping rules can cause unexpected behavior.
• Make sure you have not set bandwidth limit on interface or any other bandwidth related configuration on desired interface.
• Check both wired and wireless connections, Sometimes conflicts between these two connection methods can cause issues.

To check the Network status, log in to the cloud platform and navigate to Network → Devices. Then, click on the information icon next to your device name and go to the Network section to view detailed information about your device.

SDN provides a more flexible, programmable, and centralized approach to network management, which can lead to better performance, easier management, and the ability to quickly adapt to changing needs.

Members within the policy with a lower metric have precedence over higher metric members and used first.

Members with the same metric will load-balance. Load-balancing members (with same metric) will distribute load based on assigned weights values. Load-balanced members distribute more traffic out those with higher weights.

Example : Member m1(wan1) with metric 1 and weight 3, and member m2(wan2) with metric 1 and weight 2 will load balance and traffic distribution over the members will be 60% on member m1 and 40% on member m2.

To configure SDN, go to cloud and navigate to Configuration --> Network --> SDN --> Add. Now enter a name for identification and Select the Rule Type as either 'By Group' or 'By Name,' then choose the Policy as Load-Balancer based on your network requirements and select the interfaces from the dropdown menu. Next, provide the Metric and Weight for the WANs, up to a maximum of 5. Before configuring SDN Load-Balancer, ensure that the wan ports should be set more than one .

If you lost all the port setup configuration on your router, you need to reconfigure everything from scratch except cellular setting.

To test SDN, start by configuring SDN rules on the device. Then, connect to the device via LAN or network. Run a speed test to check the network performance. With SDN, the network can dynamically adjust based on the traffic patterns, which can potentially improve the speed by optimizing the flow of data. If you have multiple WAN connections, SDN can balance traffic across them, leading to better overall speed by aggregating the bandwidth from different links.

Testing SDN via Traceroute : Navigate to the detailed information section of the network devices, go to the Tools section, and run a traceroute to Google (google.com). The traceroute will display the WANs selected in the load-balancing rules, showing the internet traffic path based on the IPs associated with each WAN.

To check the SDN data, log in to the cloud and navigate to Network → Devices. Then, click on the device name or on the information icon next to your device name and go to the SDN section to view detailed information about SDN.

If your load balancer is not working, follow these debugging/troubleshooting steps to identify and fix the issue:

Verify WAN Connectivity

• Check if all WAN interfaces are active and have an IP addresses.
• Test internet connectivity on each WAN by manually switching between them.
• Ensure that each WAN has a unique gateway IP address.

Check Load Balancing Rules

• Ensure the correct load-balancing policy is configured.
• Verify if the WANs are correctly assigned under the load-balancing rules.
• If using weighted load balancing, check if the weights are properly set and not all set to zero.

Perform a Traceroute

• Run a traceroute to external destinations (e.g., traceroute google.com) to see which WAN is being used.
• If all traffic is going through a single WAN, review the load-balancing rules.

Verify Firewall Rules

• Ensure that firewall rules are not blocking or misdirecting traffic.
• Check if any traffic shaping or QoS rules are interfering with load balancing.

A user group is a feature through which we can control the speed limit ( download/upload) for any client using their mac address. To test User Group follow the steps bellow:

Connect a Client to the Network

• Connect any client device (laptop, phone, etc.) to the Wi-Fi network.
• Log in to the cloud management platform.
• Navigate to Active Clients and copy the MAC address of the connected client.

Create a User Group Rule

• Go to Configuration → Wireless → User Group → Add.
• Create a rule using the copied MAC address.
• Set bandwidth limits (e.g., 40 Mbps Download / 40 Mbps Upload).
• Save the rule.

Apply the User Group Rule to the Network

• Go to Configuration → Wireless → Network Section.
• Click the Edit Network icon.
• Enable User Group and select the rule created in Step 2.
• Click Update to apply the changes.

Reconnect and Perform a Speed Test

• Reconnect the same client device to the network.
• Run a speed test via any test tools.

Verify Results

• If the download/upload speed is limited to 40 Mbps, the test passes.
• If the speed exceeds 40 Mbps, the test fails (indicating a misconfiguration or issue).

Airtime Fairness is a feature in Wi-Fi networks that ensures all connected devices get an equal share of transmission time rather than equal bandwidth. This prevents slower devices from hogging network resources, improving overall network performance.

To test Airtime Fairness follow the steps below:

• To test Airtime Fairness we need two clients ( devices) with similar configurations.
• The 2 clients should connect with the same network and networks should be in 5Ghz or 2.4Ghz. (network should not be in both mode).
• We have to create Airtime Fairness rule. To create the ATF rule go to Configuration --> Wireless --> Airtime Fairness.
• Go to Active Clients and copy the mac addresses of the two clients.
• Now go to ATF and create a rule,
Rule Type- Select as Network
Group- select your network group
Network- Select all the network from the network group.
• Create another rule in ATF
Rule Type- Client
SSID- select the same network where both the clients connected.
Host- Add the 2 client's mac addresses which we have copied from active clients and select the percentage also.

Example Client A - 10%, Client B - 90%. (remember, for this rule sum of all the clients percentage should not excided over 100%) In this case both the clients should connect with same network, and when they starts speed testing on their device. Then client A will get very less speed as the rule has been set for 10% and client B will get competitively very high speed than client A as the rule has been set for 90%.

WMM (Wi-Fi Multimedia) is a feature defined by the Wi-Fi Alliance that provides Quality of Service (QoS) to prioritize certain types of network traffic. It is especially useful for applications that require real-time or low-latency transmission, such as voice, video, and gaming.

To test WMM follow the step below:

• We need Wire shark in our system.
• Go to Configuration --> Wireless --> Network --> Enable WMM and Sets some values. Then update it.
• Now connect with that network and open Wire shark using this command.
Change the mode into monitor mode. "sudo iw phy phy0 interface add mon0 type monitor"
"sudo ifconfig mon0 up" to enable mon0 mode in wireshark.
"sudo wireshark" for permission to open wireshark
Open Wireshark "wlan.fc.type==0 && wlan.fc.type_subtype==8" select the mon0 interface and start capture packets of IEEE80211W.
• After that when the connected network will appear in the screen, double click on that network and right click on it and select on expand all visible item and then copy all.
• Paste it on notepad and search about WMM and check whatever value we have set in the network section.
• Verify, if the selected values are same then the testcase pass else it fails.

Management Frame Protocol (MFP) is a security feature in wireless networks that helps protect management frames from being spoofed or tampered with. It secure communication between a Wi-Fi device and client devices.

To test MFP ( Management Frame Protocol), follow the steps below:

• We need to have Wireshark in our system.
• Go to Configuration --> Wireless --> Network --> Edit the network and enable MFP (there will be three options, a. Enable-Not required, b. Enable-Required and c. Disable).
• For some configuration we need to enable OWE option.
• Now connect with that network and open Wireshark using this command.
• Change the mode into monitor mode using this command "sudo iw phy phy0 interface add mon0 type monitor"
• "sudo ifconfig mon0 up" to enable mon0 mode in wireshark.
• "sudo wireshark" for the permission to open wireshark
• Open Wireshark"wlan.fc.type==0 && wlan.fc.type_subtype==8" select the mon0 interface and start capture packets of IEEE80211W.
• After that when the connected network will appear in the screen, double click on that network and right click on it and select on expand all visible item and then copy all. Paste it on notepad and search about MFP and check whatever options we have set in the network section.
• Verify, if the selected options are same then the testcase pass else it fails.

Rogue AP (Access Point) detection is a security measure used to identify unauthorized or malicious wireless access points in a network. Since rogue APs can be used for MITM (Man-in-the-Middle) attacks, data interception, and unauthorized network access, detecting them is crucial for network security.

To test Rogue AP Detection, follow the steps below:

• Make sure the device must be online and Network must be hosting.
• Suppose you have a network named, Network - 1. Now go Cloud and navigate to Network --> Devices --> click on the edit icon of the device in which yor are working. Now scroll down and enable Rogue AP option and then select ROGUE TYPE - SSID and there will be an option called INTERVAL (Min) - we have to put a value and the VALUE must be greater than 60, default is 60. Then Update the rule.
• Now open any of your device ( phone, laptop, etc.) and enable hotspot with the same network name like Network - 1 (the purpose of enable hotspot here is, hotspot and AP must host same named SSID).
• Now go to cloud --> Configuration --> Wireless --> Rogue AP Detection. In the Rogue AP section there will be showing lot of network is visible in RED, those are the rogue network which are detected. This rogue networks will update after each Interval which we have set in the interval section.

This may happen due to:

• Session timeout – The authentication time limit has expired.
• Traffic limit exceeded – The allowed data usage may have been reached.
• Network instability – Weak signal or network congestion may be causing disconnections.
• IP conflict – Another device may be using the same IP address.
• Captive portal reauthentication – The network requires periodic reauthentication.

This may be because:

• The device is already connected to the internet. ( i.e. , Mobile data is enabled, or any other wired connections etc).
• Authentication may have already been completed.

This happens because mobile phones automatically close the authenticated browser once they connect to the internet.

Navigate to Configuration -> IP Routing -> Basic -> IPv4. You can set the interface IP, subnet mask, and choose DHCP Mode (Server, Relay, or Disable).

SLAAC autonomously generates IPv6 addresses based on router advertisements. Stateless DHCP provides additional parameters like DNS and NTP servers.

VLANs segment a network. Go to Configuration -> Network -> VLAN. Enter the VLAN name, select the Rule Type, assign an IP Address and Subnet Mask, and configure the DHCP server.

SDN allows dynamic routing of traffic across multiple WAN interfaces based on assigned metrics and weights. Navigate to Configuration -> Network -> SDN -> Add, choose Load-Balancer policy, and configure WAN weights.

The gateway supports PPTP, SSTP, Stunnel, Neighbor, IPSec, L2TP, L2TPv3, GRE, OpenVPN, Zerotier, WireGuard, Tinc, VXLAN, and DMVPN.

Navigate to Configuration -> VPN -> Advance -> IPSec. Define the Rule Type, IP Type, Tunnel EndPoint, PSK, and Phase 1/Phase 2 cryptographic proposals (e.g., aes128-sha2).

WireGuard is extremely fast and modern. Go to VPN -> Advance -> WireGuard. Set the IP addresses (CIDR), Listen Port (e.g., 51820), and Add Peers with their Public keys and Allowed IPs.

ZeroTier is an SDN virtualization technology creating secure LANs over public networks. Configure it by adding the 16-character Network ID and enabling global/managed IPs.

DMVPN (Dynamic Multipoint VPN) builds scalable hub-and-spoke VPNs without static tunnels between every branch router. Configure it by defining Hub/Spoke modes and mGRE/NHRP settings.

A Static Route defines a fixed next-hop path. Go to IP Routing -> Basic -> Static Route. Specify Destination, CIDR, Interface, and Route Type (General or ECMP).

OSPF is a Layer 3 link-state dynamic routing protocol. Configure the Router ID, OSPF Area, Area Type (Stub, NSSA), and Network addresses (CIDR).

BGP is an Exterior Gateway Protocol for AS-to-AS routing. Configure the local Autonomous System No. (ASN), Neighbors, AFI/SAFI (IPv4/IPv6 Unicast, VPNv4), and Route-Reflector settings.

PBR allows forwarding packets based on source IP, protocol, or other attributes rather than just destination IP. Configured under IP Routing -> Advance -> PBR.

VRF (Virtual Routing and Forwarding) allows multiple independent routing tables on the same device, enabling network segmentation and overlapping IP spaces.

MPLS uses labels to efficiently direct traffic. VPLS is a Layer 2 VPN service extending an Ethernet LAN across multiple locations over an MPLS network.

Port Forwarding uses DNAT to forward incoming traffic from a WAN interface to an internal private IP and port. Configured under Firewall -> Basic -> Port Forwarding.

NAT44 translates IPv4 to IPv4. NAT64 bridges the gap between IPv6 networks and legacy IPv4 internet resources by embedding IPv4 addresses into IPv6 packets.

NGFW includes advanced features like Intrusion Prevention/Detection (IPS/IDS), Deep Packet Inspection (DPI), Ad Blocking, and Anti-theft protection.

It detects and protects against network flooding and spoofing, including TCP SYN floods, UDP floods, ICMP ping floods, DHCP exhaustion, and ARP spoofing.

Navigate to Configuration -> System -> Basic -> SNTP. Add NTP server URLs or IPs. NTP is enabled by default for background time sync.

Go to System -> Basic -> Access Control. Configure centralized Layer 7 authentication policies by entering the Server IP and Secret for TACACS or RADIUS.

TR-069 is a remote management protocol for automatic configuration and troubleshooting via an Auto Configuration Server (ACS). Configured with ACS URL, username, and password.

VRRP provides high availability by allowing multiple routers to share a virtual IP address. If the master fails, the backup takes over. Supports IPv4/IPv6.

Navigate to Administration -> Configuration Management. From here, you can Create Backup, Upload Backup, or perform a Factory Reset.