Docs
mobileIoT Hardware
Documentation

Wi-Fi interface profiles

⚠ IMPORTANT:
Wi-Fi interface profiles are only active when the Virtual Ethernet-Wi-Fi Bridge is disabled. If bridging is enabled, these profiles will be ignored

Wi-Fi interface profiles define how the CR3171 connects to or hosts a wireless network. You can configure one or more profiles under Network Profiles in the Network Management section.

🎯 TIP :
It is strongly recommended to configure only one Wi-Fi interface profile unless you have advanced networking expertise. Multiple profiles may lead to unpredictable behavior.

Now navigate to one of the Profiles.

General Wi-Fi preferences

These settings apply to all Wi-Fi profiles and help manage automatic connections and prioritization.

Profile name

A unique name for the Wi-Fi connection

  • Default : Wireless connection
Automatically join this network when available

Enables auto-connect when the network is detected. If disabled, the profile remains inactive.

Connection priority

Determines which profile connects first when multiple are eligible.

  • Range: 0–1000
  • Default : 0
Number of connection retries

Number of attempts before switching to the next profile.

  • Default: -1 (retry indefinitely)

Operating mode & Security

The CR3171 supports two Wi-Fi operating modes:

Hotspot Mode (Access Point)

In this mode, the CR3171 acts as a Wi-Fi hotspot, allowing other devices to connect directly to it.

SSID

Name of the broadcasted network

  • Default : CR3171_<LAST 4 DIGITS OF MAC>
Hide SSID

Controls SSID visibility

  • Default : OFF (visible)
Security type

To comply with EU Radio Equipment Directive (EU-RED), the available Wi-Fi security types have been restricted to modern, secure standards. Only the following options are supported:

  • WPA2 + WPA3 Personal
    This hybrid mode allows compatibility with both WPA2 and WPA3-capable clients. It uses Pre-Shared Key (PSK) authentication and ensures a secure baseline while supporting legacy devices.
  • WPA3 Personal only (SAE)
    This mode enforces WPA3 using Simultaneous Authentication of Equals (SAE), offering enhanced protection against dictionary attacks and forward secrecy. It is recommended for environments where all clients support WPA3.
⚠️ Legacy and enterprise security types such as WPA/EAP, OWE, and unencrypted modes are no longer supported. This change ensures compliance with EU-RED requirements and strengthens overall network security.
Password

Depending on the selected security type:

  • For WPA2 + WPA3 Personal , the password is the Pre-Shared Key (PSK) used for authentication.
  • For WPA3 Personal only (SAE) , the password is processed using SAE, which provides mutual authentication and resistance to offline attacks

Client configuration

In client mode, the CR3171 connects to an existing Wi-Fi network as a client.

SSID

Target network name

  • Default: CR3171_<LAST 4 DIGITS OF MAC>
BSSID

Optional identifier for a specific access point

  • Default: empty
Security type

To comply with EU Radio Equipment Directive (EU-RED), the available Wi-Fi security types have been restricted to modern, secure standards. Only the following options are supported:

  • WPA2 + WPA3 Personal
    This hybrid mode allows compatibility with both WPA2 and WPA3-capable clients. It uses Pre-Shared Key (PSK) authentication and ensures a secure baseline while supporting legacy devices.
  • WPA3 Personal only (SAE)
    This mode enforces WPA3 using Simultaneous Authentication of Equals (SAE), offering enhanced protection against dictionary attacks and forward secrecy. It is recommended for environments where all clients support WPA3.
⚠️ Legacy and enterprise security types such as WPA/EAP, OWE, and unencrypted modes are no longer supported. This change ensures compliance with EU-RED requirements and strengthens overall network security.
Password

Depending on the selected security type:

  • For WPA2 + WPA3 Personal , the password is the Pre-Shared Key (PSK) used for authentication.
  • For WPA3 Personal only (SAE) , the password is processed using SAE, which provides mutual authentication and resistance to offline attacks

Band and IP configuration method

Band

This option configures the 802.11 frequency band of the network, i.e. the device will not join the network if the band does not match, even if all other options are compatible.

Options:
  • auto,
  • A (5 GHz),
  • B/G (2.4 GHz)
Channel

Wireless channel to use for this connection, the value of zero means, that the channel will be chosen automatically. Explicitly setting this option will ensure that the device only joins a network on the specified channel.

Options:
  • Band B/G :
    • 1 - 14
  • Band A:
    • As this is regional depended, please visit Wikipedia to select the right channel within your region.
IP configuration method

IP configuration method, by default the interface is set to use link-local, i.e. auto-ip configuration which makes sure that the device does not disrupt an existing network when plugged in.


Options:
  • auto, the interface will be configured as DHCP client and therefore will be assigned a IP address from an external DHCP router. No IPv4 address has to be configured.
  • manual, In manual mode, the IPv4 Address defines the network and mask, the device IP is set through IPv4 Gateway..
  • link-local, a link-local address is a network address that is valid only for communications on a local link, i.e. within a subnetwork that a host is connected to. IPv4 link-local unicast addresses are assigned from address block 169.254.0.0/16 ( 169.254.0.0 through 169.254.255.255 ).
  • shared, In shared or DHCP mode, the device's Network Manager sets up the DHCP server to manage IP addresses. It reserves 10% of the total range (up to 8 addresses) for devices that need fixed IPs, while the rest of the addresses are automatically assigned to devices as needed. Below this is explained through examples.
IPv4 Address

IP address used for either static IP, when method is set to manual or DHCP server configurations when the shared method is selected. The CIRD notation is used to define the subnet mask.

By using e.g. 192.168.82.1/24 the device will be part of the 192.168.82.0 network and will allow access or communication from IPs in the range of 192.168.82.1 - 192.168.82.255

🎯 Tip: As security measure it is advisable to tighten the allowed IPs on the network as possible, for instance to use /29 or 255.255.255.248 subnet to only allow 6 address on the network, as 192.168.82.0 is the network address and 192.168.82.7 is the broadcast address and 192.168.82.1 - 192.168.82.6 remains available.
Example - default setting

192.168.82.1/24 will result in:

  • Network = 192.168.82.0/24
  • Host = 192.168.82.1
  • Static IP range = 192.168.82.2 - 192.168.82.10
  • Dynamic IP range = 192.168.82.11 - 192.168.82.254
  • Broadcast IP = 192.168.82.255
Example 2 - Ready for controller and display & secure

When a network is setup with ifm controllers and displays which are by default respectively configured with 192.168.82.247 and 192.168.82.245 , it make sense to

192.168.82.240/29 will result in:

  • Network = 192.168.82.240/29
  • Host = 192.168.82.241
  • Static IP range = None as only 6 addresses are available (6/10) = 0
  • Dynamic IP range = 192.168.82.242 - 192.168.82.246
  • Broadcast IP = 192.168.82.247
⚠ The Broadcast IP unfortunately collides with the IP address of the controller, for this there are two solutions:
  • more secure: change the (static) IP address of the controller and keep the pool of 6 available IPs.
  • no change needed: set the subnet mask to /28 instead of /29 , this will the increase the available IP range from 6 to 14, which is less secure but no change is needed of the controller IP address.
Example 3 - higher host IP, lower half of range

192.168.82.100/24 will result in:

  • Network = 192.168.82.0/24
  • Host = 192.168.82.100
  • Static IP range = 192.168.82.101 - 192.168.82.108 , but also 192.168.82.1 - 192.168.82.100
  • Dynamic IP range = 192.168.82.109 - 192.168.82.254
  • Broadcast IP = 192.168.82.255
Example 4 - higher host IP, upper half of range

192.168.82.200/24 will result in:

  • Network = 192.168.82.0/24
  • Host = 192.168.82.200
  • Static IP range = 192.168.82.192 - 192.168.82.200 , but also 192.168.82.201 - 192.168.82.254
  • Dynamic IP range = 192.168.82.1 - 192.168.82.191
  • Broadcast IP = 192.168.82.255
IPv4 gateway

If the manual mode is selected one can setup the Static IP address of the gateway. Keep in mind this should be in the given subnet range.

DNS servers

It is possible to setup three additional DNS servers if required.