I tested the EnGenius ECW230S: One of the best security-focused WiFi 6 access point for SMBs

The EnGenius ECW230S is currently one of the two WiFi 6 access points that make use of the WIPS and Zero DFS radios to dramatically improve the way the system admin can monitor the network by getting a better understanding of the channel utilization, the live clients and some other network activities.

But another aspect of this refreshed version is the AirGuard security tools that help detect malicious attacks, rogue SSIDs, evil twins and even RF jamming. So, while the EnGenius ECW230S does look identical to the ECW230 in terms of design, some adjustments have been made at the hardware level to ensure that some of these feature can work. But yes, in most part the ECW230 and the ECW230S don’t really differ that much.

You still get the 2.5GbE Ethernet port that supports PoE, MU-MIMO 4×4 and the mandatory OFDMA tech to help with the denser networks. Furthermore, there is support for the Cloud management platform which allows the easy monitoring and management of large networks all over the world and there is also support for creating a mesh network alongside other EnGenius wireless access points.

But, as I asked myself when I tested the ECW220S, was the EnGenius ECW230S actually needed and is there a point upgrading from the ECW230 that soon? Let’s put the EnGenius ECW230S to the test and find out.

Design and Build Quality

If you put the EnGenius ECW230S and the ECW230 next to each other, you’re not going to be able tot tell them apart immediately. Both measure 8.27 x 8.27 x 1.31 inches (20.5 x 20.5 x 3.3cm) and both devices use a plastic top plus a metallic bottom for the case. And it’s a really well thought out design, the case is slim, it looks good on the wall, so it’s better than probably 90% of other access points on the market.

Of course, the plastic piece is covered by a white matte finish, so it will fit in on the ceiling, even if there are some LEDs pointing down. You can turn them off if you want, but they do serve the same function as on the ECW230. You get the Power LED (flashes oranges if you haven’t paired the EnGenius ECW230S to the controller) followed by the LAN LED and then there’s the 2.4GHz and the 5GHz LEDs (these other three LEDs should be solid blue). And then there are two additional LEDs that were not on the ECW230.

That’s right, this is the first design element that differentiates the EnGenius ECW230S from the ECW230. The first LED is responsible for the status of the scanning radio and the second LED will light up to show the status of the Bluetooth radio (BLE 5). If you turn the EnGenius ECW230S around, you’ll notice the second differentiating element, the metallic piece of the case. Instead of being smooth, as on the ECW230, it’s now ribbed and the entire case feels more robust due to the increased weight.

Indeed, the EnGenius ECW230S weighs 1.34lbs, a bit more than the ECW230. Everything else, such as the mounting ears and the ports position is the same. You get a Reset button (hold it for 10 seconds to return the access point to its default settings), a 2.5GbE Ethernet port (supports 802.3af/at) and a DC 12V port in case you want to connect it to a power adapter. There was no PoE adapter in the package, but you can purchase a separate one or just go with an PoE Ethernet switch.

What about the heat management? The ECW230 was running a bit hot to the touch which makes sense considering that the bottom-placed metallic plate has the role of taking the heat away from the chips. And the same remains true for the ECW230S as well considering that it’s even more crowded inside the case. As you can see from the photo, it can get hot to the touch, but even so, I didn’t see any throttling in action.

Internal Hardware (EnGenius ECW230S Teardown)

I had no problems opening up the ECW230, but things weren’t that smooth with the EnGenius ECW230S. After removing the four screws, I attempted to detach the top cover, but the manufacturer went with an unorthodox approach when it came to the Bluetooth antenna. They attached it to the plastic case, which is fine, but the connector was glued to the case as well, which I am not sure it was the intended effect.

It won’t have any impact on the functionality of the access point, just annoying to open up. The rest of the antenna layout is pretty much the same as on the ECW230, but I noticed something strange, there was an antenna loose on the PCB. What happened?

When I opened the lid, the antenna got detached – I used better glue when I put it back together. The PCB is similar to what I saw on the ECW230, but it’s not identical. At the top, there were no notable chips, so I turned the board upside down.

This way, I could identify the Qualcomm QCA9889 which is dedicated for one of the new radios (for detecting rogue APs and more). Then, there’s the quad-core Qualcomm IPQ8072A SoC (ARM Cortex A53S CPU clocked at 2.0GHz), 256MB of flash memory from MXIC (X201614 MX30UF2G18AC-XKI) and the 1GB of RAM from Samsung (SEC201 K4A8G165WC) which is an increase over the 512MB of the EnGenius ECW230.

Afterwards, I could see the SimpleLink CC2640 R2F 32-bit ARM Cortex-M3 Bluetooth 5.1 Low Energy MCU, the Qualcomm PMP8074 power management FBGA, the Qualcomm QCA8081 Ethernet PHY transceiver, the LV164A 19K G4 A8EH parallel-out serial shift register, the TPS23756 PoE PD controller and two MT774 LED drivers. As for the WiFi, EnGenius ECW230S uses the same chips as its predecessor.

EnGenius ECW220S vs ECW230S vs ECW230

There’s the Qualcomm QCN5074 and four Qorvo QPF4528 6CPF WiFi 802.11ax front end modules for the 5GHz radio and a Qualcomm QCN5054 chip with four Qorvo QPF4228 A7SH WiFi 802.11ax integrated front-end modules for the 2.4GHz radio.

Wireless Features

The EnGenius ECW230S uses pretty much the same wireless performance-enhancing features as the ECW230, so there’s the mandatory OFDMA which helps a lot with dense networks. And that was mostly the point of the WiFi 6, not to outdo the WiFi 5 devices in terms of throughput since the wireless access points from that standard were fast enough already.

But the idea is to more efficiently handle a far larger number of clients at the same time. That’s where OFDMA comes in to limit the interference and improve the bandwidth utilization. Then, there’s the MU-MIMO which has to be on all newer networking devices – it’s a nice feature to have since it can ensure that multiple clients can be served at the same time.

The only problem is that you need compatible clients and only a handful can actually use it to its maximum potential (I am not talking about some 2×2 smartphone). I also saw that the mesh technology has been included as well which makes sense if you want to interconnect multiple EnGenius access points and make them behave as a single network. This way, the compatible client devices can roam seamlessly between nodes, so the user experiences no disconnections at all.

Wireless Test (5GHz)

To test the EnGenius ECW230S, I used a server device (a computer) to which I connected a multi-Gigabit PoE switch (the EnGenius ECW2512FP), so there would be no bottleneck considering that the ECW230S does have a 2.5GbE port. Then, I connected the switch to the AP and a multi-Gigabit router (Asus RT-AX86U).

As for the client devices, I used three, one is a computer equipped with an AX200 WiFi 6 adapter, another is a WiFi 5 device equipped with an Intel 8265 and the last is Pixel 2 XL smartphone that I keep on reviving mostly for this specific test. So, on the first test, I connected the AX200 client to the EnGenius ECW230S 5GHz network (80MHz) and I checked the throughput based on both the signal strength and the distance between it and the server.

This way, I saw an average of 774Mbps upstream 5 feet away from the server device and 489Mbps downstream (34dB attenuation). At 45 feet, the average throughput was 308Mbps up and 172Mbps downstream (-70dB), but going farther to about 70-75feet, the signal dropped a lot (-86dB) which meant that the throughput was barely enough for some light Internet use: about 20Mbps up and downstream.

I am well aware that despite sharing a large amount of hardware with the ECW230, when it comes to the ECW230S it’s like testing a completely different device. How come? I think that it’s not the access point, it’s everything else. The ECW230 was tested in a different location and when I did so, the focus was on the distance and less on the signal strength (attenuation) and interference.

I then had to move to a new location, so, testing the EnGenius ECW230S shows different results because the home layout is different and there is a diverse amount of interference. Which is why I have added the signal strength graphs into the newer articles – to be able to maintain a good reference between different models. This is something that other publications should do as well, it’s less important to make an AP comparison based on distance and more imperative to focus on the signal strength.

Still, I will retest the ECW230 soon to make sure that the new features truly don’t impact on the wireless performance. With that out of the way, let’s check out the wireless performance using the Intel 8265 client device. I saw an average of 444Mbps at 5 feet and 84.2Mbps at 45 feet upstream; downstream, the throughput was 414Mbps near the EnGenius ECW230S and 67.9Mbps at 45 feet.

The signal drops almost completely around the same point as with the AX200 client device (about 75 feet, where the attenuation was 86dB). Lastly, I checked the wireless performance with the Pixel 2 XL and it wasn’t that different than with the Intel 8265 client device, for the most part. At 5 feet, I measured an average of 462Mbps upstream and 336Mbps downstream. Despite the very similar signal strength to the Intel 8265 device at 45 feet, I only saw 78.4Mbps up and 33.5Mbps downstream. Also, no chance to reach 75 feet, the signal dropped completely at that point.

Wireless Test (2.4GHz)

The differences in the throughput between the ECW230 and the ECW230S remain on the 2.4GHz radio as well – again, not due to the devices themselves. So, using the AX200 client device (40MHz), I managed to see an average of 302Mbps at 5 feet (upstream), which is excellent and the throughput remains solid even at 45 feet, offering an average of 131Mbps (-66dB, so the signal is quite strong).

Even at 75feet, the attenuation remained underneath 80dB and the speed was 30.2Mbps up and 11.8Mbps downstream. Moving to the WiFi 5 client devices, the Intel 8265 had a much better performance, remaining very stable up to 30 feet, but the speed did drop a bit at 45 feet and down to barely usable at 70+feet.

And that’s both upstream and downstream. The Pixel 2 XL had more trouble keeping a decent connection after 40 feet and after 45 feet, it barely managed to connect to the access point (the signal was cut by at least 80dB). This means that the EnGenius ECW230S and the ECW230 will work really well with WiFi 6 client devices on the 2.4GHz due to the OFDMA support, but the WiFi 5 client devices will not perform better than they would with a WiFi 5 access point.

Setup and Software

The access point from the ECW series are built around the Cloud management platform, so there is very little control in case you decide to use them in stand-alone mode. To access the interface, power up the EnGenius ECW230S and then check what IP address it received from the router. Enter that IP address in the URL of any browser, insert admin/admin as the username/password and then you should be able to see the available options.

There are two sections, Device Status and Local Setting, the former showing some general info about the device and the latter allowing some minimal customization (IPv4/6 settings, VLAN, web proxy and the possibility to upgrade the firmware).

As you can see, it’s pretty much the same as with the ECW230, so let’s move on to the Cloud adoption. The process is the same, you add it to the Inventory and then pair it to the Network that you want. Then, the EnGenius ECW230S will receive the global settings (if you set any), therefore start using the pre-customized SSIDs.

You still get the option to personalize these options for this access point only. Overall, it’s the same experience as with the ECW230, so you can read more about it in that article. But there are a few new features that we have explored with the ECW220S, so let’s see them in action on the ECW230S as well. Be aware that some of these options are limited under the basic license, so to fully use them, it’s a good idea to upgrade the plan.

Improved Diagnostics

I have discussed these new features when I tested the ECW220S, so know that the experience is essentially the same. You get a new Diag icon next to your access point (or a large Diag icon when you check the EnGenius ECW230S individually) which, when accessed, it will take you to a separate section of the Cloud platform and it will display various info.

The first part is the Network Activities where you can perform a scan for the channel utilization in your area, as to avoid interference, especially with the 2.4GHz radio. Then, you can view the live Activity meters, check the Internet Connectivity (which automatically pings some default websites) or to run a Traceroute towards a specific domain. The next section is called Spectrum and here, the developers created a very interesting animated graph that shows you in real time whether the EnGenius ECW230S is impacted by interference, the channels where it occurs and the attenuation (dBm).

I admit I haven’t yet seen such a tool and it’s very cool to see it in action, since it’s useful to detect any jamming attempts. The last section is called Live Clients and here you get to see when a client device connects or leaves your network.

This is something that seemingly most routers and access points offer, but the differentiating element is that it’s actually live up to the second when it’s connected. This way, it’s far easier for system admins to understand what happened in case the client device under-performs.
Note: Be aware that using the Basic license, you only get one minute at a time to access the Diag section.

AirGuard

The AirGuard section can be found under Manage and at the moment, it is built to improve the security of the networks via access points only. I suppose a security firewall could take some of the load, but the EnGenius ECW230S does use the extra radios to provide some unique features.

And, under AirGuard, you can set specific rules for the Rogue AP detection (both Blocklist and Whitelist), but as I anticipated, I got nothing under the Rogue SSIDs, which is a good thing. You can check Other SSIDs to get an idea on what devices surround you, as well as if the EnGenius ECW230S detected any Evil Twins attacks, Malicious Attacks and even RF Jamming. This last feature is unique for a networking device at this price range and it let’s you know if there is a malicious actor attempting to interfere with your wireless network.

The Conclusion

I admit I was skeptical of the ECW220S when I tested it since I wasn’t sure if there was really a need for a new iteration of the previous gen with seemingly very little differences in terms of hardware. But, I was proven wrong and just like the ECW220S, the EnGenius ECW230S does indeed take the network security to another level. The wireless performance is good, the Cloud platform experience remains intuitive and the improvements towards making things far easier for sys admins can be worth the extra dollars.

And the point was to help admins solve most network problems remotely, without needing to go to the site as often, thus cutting that extra cost. Would I upgrade from an ECW230? No, because you do get almost all of the security features anyway, but if you have clients with dense networks and wish to upgrade them to the newer WiFi standards, do give the EnGenius ECW230S (and even the ECW220S) a chance.