EnGenius ECW220S AirGuard Review – A WiFi 6 access point with dedicated security scanning radios

Sharing is caring!

EnGenius ECW220S AirGuard Access Point Review Rating

Summary

The EnGenius ECW220S is a unique and useful access point office active intelligent security analysis that will be a good choice for any business wanting something affordable using the latest WiFi 6 while also providing peace of mind with network security.

Overall
80%
80%
  • Overall - 80%
    80%

Pros

  • Dedicated security radio
  • More affordable than competing security access points
  • WiFi 6

Cons

  • Overall WiFi throughput isn't quite as good as other access points I have tested

I previously reviewed the EnGenius ECW230 access point in 2020. It was a well-specced mid to high-end AP with a 4×4 radio and 2.5GbE. It was one of the first Engenius products I had reviewed that ditched the ezMaster system for the new Engenius Cloud.

The EnGenius ECW220S is a lower specced access point, but it has one unique feature. It is equipped with a dedicated WIPS radio and Zero DFS radio detection interfaces which allows it to actively scan the network for security issues.

Specification

  • WiFi 6 technology for high-performance WiFi in high-density, multi-device environments
  • 2×2 antennas to support up to 1,200 Mbps in 5 GHz & 574 Mbps in 2.4 GHz
    • 2 x 2.4 GHz: 4dBi & 22 dBm
    • 2 x 5 GHz: 5dBi & 22 dBm
  • 1 GbE throughput and 802.3at support for flexible installation over 100 meters (328 feet)
  • Wireless intrusion detection system (WIDS) for threat detection
  • Wireless intrusion protection system (WIPS) for attack remediation
  • Zero-wait DFS to avoid client disruption when radar is detected on DFS channels
  • Dedicated scanning radios for 24/7 wireless AP security monitoring
  • RF spectrum analysis for identifying clean channels and ensuring all SSIDs are legitimate
  • Bluetooth 5 low energy for BLE device detection and location-based extended advertising

Set-Up / Settings

The basic set-up was just like any other EnGenius Cloud product. You can either manually type in the serial number into the inventory management on EnGenius Cloud or you can use EnGenius Cloud To-Go to scan the QR code on the AP.

As I already had an EnGenius Cloud account and had previously set up access points, as soon as I added it to my network, it adopted all the WIFi settings.

I won't go over all the settings again, but I have been happy with the Engenius Cloud system and find it comparable to Zyxel Nebula and Ubiquiti UniFi Cloud.

As a quick reminder, Engenius Cloud has a free basic option and a subscription Pro model. All devices come with one year Pro for free. Engenius say that the basic feature set will cover 80-90% of network needs, and there is nothing from the Pro features that I have found I particularily need.

Engenius Cloud

AirGuard

Most of my reviews are geared towards prosumer and SOHO use, but with the ECW220S and its built-in security features, I think this is definitely touching on more enterprise applications.

In short, EnGenius AirGuard is an intelligent wireless security system that eliminates threats 24/7.

AirGuard security APs use dedicated radio technology to scan the environment non-stop for attacks such as “evil twins,” rogue APs, flood detection, and man-in-the-middle attacks, all without degrading network performance.

There are not too many security concerns with my home office network. However, enabling AirGuard brings up some warnings.

As I ran this alongside my existing access points, if I enabled the same SSIDs on these, AireGiuard flags them as rogue SSIDs because they are not within the Engenius Cloud system. Not an issue for me, but in theory, it could be a malicious user broadcasting a company SSID waiting for employees to connect. You get basic data, including a MAC address, channel and dBm, so you could attepts to physically locate the AP.

On top of the rogue SSIDs, you get a long list of all the other SSIDs the AP has witnessed. The range of this scan seems to be considerably further than what my network cards can see. For example, one SSID is “Blackpool Transport WiFi” which I can only assume is from buses passing down the main road 50m+ away

The AP didn't detect any Evil Twins on my network. Looking at the documentation, an access point would need to both mimic a legitimate AP SSID and also the wireless MAC address, which would fool user devices into connecting on a busy network.

Similarly, nothing was flagged as a malicious attack. These are disruptive techniques against wireless connections similar to denial-of-service attacks.

Lastly, the RF Jamming section had a lot of notifications. In my case, this was signal interference which, as far as I can tell, can come from anything that can cause disruption to the signal and can come from innocent devices such as a microwave.

Obviously, none of the above was of much use for my network, but in a corporate network, it could make a big difference. In particular, Evil Twin SSIDs appear to be an effective way maliciously gain access to users' data.

WiFi Performance

The WiFi specification of this access point is quite basic. It is a 2×2 radio limited to 80Mhz channel with a 1 Gbps POE port.

WiFi performance is a touch below some of the excellent options I have reviewed recently:

  • WiFi 6 :
    • Close Range: 719 Mbits/sec
    • Downstairs:  527 Mbits/sec
  • WiFi 5 :
    • Close Range: 563 Mbits/sec
    • Downstairs: 418 Mbits/sec

In comparison, the Unifi 6 Lite achieved 833 Mbits/sec and 575Mbits/sec at close range

Price and Alternative Options

In the UK, Solwise have the EnGenius ECW220S for £424.48, and in the US, Connection IT has it for $405.74 

The ECW230S, which has a 4×4 radio, is priced at £596.75

WiFi access points with security scanning built-in are a growing niche but still quite a limited market.

Ubiquiti has SHD models with a dedicated network security radio. It doesn't look like they have a WiFi 6 version yet, just the UAP-AC-SHD-EU priced at 600-Euros.

WatchGuard has several security focused access points, including AP130, AP330, AP430CR and AP432. The cheapest WatchGuard AP130 is priced at £250. It doesn't look like this has a dedicated security radio, it just integrates with WatchGuard Cloud, and security is what they specialise in.

Fortinet have various models, including the Fortiap-831F, which has dedicated security scanning radios but a high price point of around $1200

Overall

The EnGenius ECW220S is a unique and useful access point office active intelligent security analysis.

As I write this, on the technology page of the BBC, there are at least three news articles related to hacking and data breaches, including spyware at No10, a $600M crypto heist and the closure of RaidForums, which hosted stolen data. There were also at least 88 publicly disclosed cyber security incidents, accounting for 4 million breached records in March of 2022.

With our growing dependence on WiFi connectivity across all our devices, the importance of a secure WiFI network can't be overstated in a corporate environment.

There does not appear to be a wide range of competing products, and what is out there is either dated, using WiFi 5, or for a high premium price.

Therefore the EnGenius ECW220S looks like it would be a good choice for SMBs wanting a relatively affordable WiFi 6 access point that can help improve the security of a network and minimise data breaches.

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.