WatchGuard AP300

From TechInfoDepot
Jump to navigationJump to search
abgn+ac (AC1750)
WatchGuard AP300 Access Point
Homepage Product page
WikiDevi.wi-cat.ru WatchGuard AP300
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
BrandModelRev WatchGuard AP300 v1.0.1
FCC ID (fcc.io) Q6G-AP300, U2M-PCE4553AH
FCC ID (fcc.report) Q6G-AP300, U2M-PCE4553AH
IC ID 4657A-AP300
Board ID 7016A0886008
Type access point
CPU1 checkY Qualcomm Atheros QCA9558
CPU1 Type MIPS 74Kc
CPU1 Speed 720 MHz
Flash1 Chip Spansion S25FL256SAIFR0
Flash1 Size 32 MiB 33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br /> (SPI NOR)
RAM1 Size 256 MiB 268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br /> (DDR2 SDRAM)
RAM1 Chip Nanya NT5TU64M16HG-AC
ETH chip1 Qualcomm Atheros QCA9558
ETH chip2 Atheros AR8035-A
Ethernet Port Count 1-1GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab

802dot11 OUI: 00:90:7F (24 E, 17 W)
Ethernet OUI: 00:90:7F (24 E, 17 W)

Stock bootloader U-Boot 1.1.4
Stock FW OS Linux 2.6.31 OpenWrt Kamikaze r20146
Expansion IF types Mini PCIe
Mini PCIe slots 1
PoE 802.3at, 802.3af, standard
Power 12 VDC, 1.25 A
Connector type barrel
5.5 mm (OD)
2.1 mm (ID)
9.5 mm (LEN)
Serial Port (UART) yes, 4-pin header, populated, J10, 3.3V TTL, (115200 8N1)
JTAG Port yes, 14-pad header, unpopulated, J1

Flags:
PoE in

Additional chips
2.4GHz High-Gain Power Amplifier;Silicon Storage Technology;SST12LP15A;;3;
802.3at PoE Interface and DC/DC Controller;TI;TPS23754;;1;
13A 30V Single N-Channel Logic Level MOSFET;Fairchild;FDS6670A;;2;
1A Schottky Bridge Rectifier;Central Semiconductor;CBRHDSH1-100;;2;
5mA Single Channel Phototransistor OptoCoupler;Vishay Semiconductor;TCMT1107;;3;
3A 28V Step-Down Converter;TI;TPS54331;;1;

Other

Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1353 additional devices
of which 2 are WatchGuard devices

Manuf/OEM/ODM Senao
3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Retail
Availability End of Life
End of Life date 31 December 2019
FCC approval date 01 December 2015
Country of manuf Taiwan
Radio 1
Chip1 Qualcomm Atheros QCA9558
Wireless interface OUI 00:90:7F
Antenna Connector Type U.FL (internal)
MIMO status 3x3:3
Wireless Standard IEEE 802.11b/g/n
802.11n up to 450 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 2
Radio2 module Senao PCE4553AH
Radio2 module IF Mini PCIe
Chip1 Qualcomm Atheros QCA9880
Wireless interface OUI 00:90:7F
Antenna Connector Type U.FL (internal)
MIMO status 3x3:3
Wireless Standard IEEE 802.11a/n/ac
802.11ac up to 1300 Mbps
802.11n up to 450 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz
 FCC ID
Adtran Bluesocket BSAP-2035HDCWLAN193XF1
HDCWLAN203XF1
U2M-PCE3300AN
U2M-PCE4553AH
EnGenius EAP1750HA8J-EAP1750H
U2M-PCE4553AH
EnGenius EPG5000A8JEPG5000
U2M-PCE4553AH
Senao PCE4553AHU2M-PCE4553AH
WatchGuard Firebox T35-W (MS3AE5W)Q6G-MS3AE5W
U2M-PCE4553AH
RYK-WPEA352ACNRB

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented WatchGuard devices with specifications, see WatchGuard.

450 Mbps - 3SS 2.4GHz 802.11n (40MHz chan.),
1300 Mbps - 3SS 5GHz 802.11ac (80MHz chan.) = AC1750 class

Overview

"7016A0886008" and "V1.00" is silkscreened on the board.

Hardware specification

SoC: MIPS 74K @720MHz
  • Memory: 256MB (DDR2) SDRAM
  • Storage: 32MB (SPI NOR) Flash
  • WiFi: Qualcomm Atheros QCA9558 (802.11bgn)
Qualcomm Atheros QCA9880 (802.11an/ac)
  • Network: 1x Gigabit Ethernet ports
  • Power: 12V, 1.25A via barrel or 802.3af/at PoE

Links of Interest

Hardware Guide

Flashing

Flashing OpenWrt

Target: ath79
Subtarget: generic
Package architecture: mips_24kc
Supported Since Commit
Support started version: 23.05.0
Current supported version: 25.12.0
LAN Comment: Atheros AR8035-A GbE Phy
WLAN Hardware: Qualcomm Atheros QCA9558, Qualcomm Atheros QCA9880
WLAN Comment: 5GHz 3X3 MIMO, 2.4GHz 3X3 MIMO
Installation method(s):
see git-commit
Recovery method(s):
see git-commit
git • >>
ath79: add support for Senao WatchGuard AP300
FCC ID: Q6G-AP300

WatchGuard AP300 is an indoor wireless access point with
1 Gb ethernet port, dual-band wireless,
internal antenna plates, and 802.3at PoE+

this board is a Senao device:
the hardware is equivalent to EnGenius EAP1750
the software is modified Senao SDK which is based on openwrt and uboot
including image checksum verification at boot time,
and a failsafe image that boots if checksum fails

**Specification:**

  - QCA9558 SOC		MIPS 74kc, 2.4 GHz WMAC, 3x3
  - QCA9880 WLAN	PCI card 168c:003c, 5 GHz, 3x3, 26dBm
  - AR8035-A PHY	RGMII GbE with PoE+ IN
  - 40 MHz clock
  - 32 MB FLASH		S25FL512S
  - 2x 64 MB RAM	NT5TU32M16
  - UART console	J10, populated
  - GPIO watchdog	GPIO 16, 20 sec toggle
  - 6 antennas		5 dBi, internal omni-directional plates
  - 5 LEDs		power, eth0 link/data, 2G, 5G
  - 1 button		reset

**MAC addresses:**

  MAC address labeled as ETH
  Only one Vendor MAC address in flash at art 0x0

  eth0 ETH  *:3c art 0x0
  phy1 ---- *:3d ---
  phy0 ---- *:3e ---

**Serial console access:**

  For this board, its not certain whether UART is possible
  it is likely that software is blocking console access

  the RX line on the board for UART is shorted to ground by resistor R176
  the resistors R175 and R176 are next to the UART RX pin at J10

  however console output is garbage even after this fix

**Installation:**

  Method 1: OEM webpage

    use OEM webpage for firmware upgrade to upload factory.bin

  Method 2: root shell access

    downgrade XTM firewall to v2.0.0.1
    downgrade AP300 firmware: v1.0.1
    remove / unpair AP from controller
    perform factory reset with reset button
    connect ethernet to a computer
    login to OEM webpage with default address / pass: wgwap
    enable SSHD in OEM webpage settings
    access root shell with SSH as user 'root'
    modify uboot environment to automatically try TFTP at boot time
    (see command below)

    rename initramfs-kernel.bin to test.bin
    load test.bin over TFTP (see TFTP recovery)
    (optionally backup all mtdblocks to have flash backup)
    perform a sysupgrade with sysupgrade.bin

  NOTE: DHCP is not enabled by default after flashing

**TFTP recovery:**

  server ip: 192.168.1.101

  reset button seems to do nothing at boot time...
  only possible with modified uboot environment,
  running this command in the root shell:

  fw_setenv bootcmd 'if ping 192.168.1.101; then tftp 0x82000000 test.bin && bootm 0x82000000; else bootm 0x9f0a0000; fi'

  and verify that it is correct with

  fw_printenv

  then, before boot, the device will attempt TFTP from 192.168.1.101
  looking for file 'test.bin'

  to return uboot environment to normal:

  fw_setenv bootcmd 'bootm 0x9f0a0000'

**Return to OEM:**

  user should make backup of MTD partitions
  and write the backups back to mtd devices
  in order to revert to OEM
  (see installation method 2)

  It may be possible to use sysupgrade
  with an OEM image as well...
  (not tested)

**OEM upgrade info:**

  The OEM upgrade script is at /etc/fwupgrade.sh

  OKLI kernel loader is required because the OEM software
  expects the kernel to be no greater than 1536k
  and the factory.bin upgrade procedure would otherwise
  overwrite part of the kernel when writing rootfs.

**Note on eth0 PLL-data:**

  The default Ethernet Configuration register values will not work
  because of the external AR8035 switch between
  the SOC and the ethernet port.

  For QCA955x series, the PLL registers for eth0 and eth1
  can be see in the DTSI as 0x28 and 0x48 respectively.
  Therefore the PLL registers can be read from uboot
  for each link speed after attempting tftpboot
  or another network action using that link speed
  with `md 0x18050028 1` and `md 0x18050048 1`.

  The clock delay required for RGMII can be applied
  at the PHY side, using the at803x driver `phy-mode`.
  Therefore the PLL registers for GMAC0
  do not need the bits for delay on the MAC side.
  This is possible due to fixes in at803x driver
  since Linux 5.1 and 5.3

**Note on WatchGuard Magic string:**

  The OEM upgrade script is a modified version of
  the generic Senao sysupgrade script
  which is used on EnGenius devices.

  On WatchGuard boards produced by Senao,
  images are verified using a md5sum checksum of
  the upgrade image concatenated with a magic string.
  this checksum is then appended to the end of the final image.

  This variable does not apply to all the senao devices
  so set to null string as default

Pictures

User Images

See also

WatchGuardSenao