> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the Wi-Fi Library Item

> Set up the Wi-Fi Library Item in Iru Endpoint to deploy wireless network configurations. Configure SSID, security type, proxy, and 802.1X authentication.

<Callout icon="list-check" color="#B84A7A" iconType="regular">This Library Item is available for Apple and Windows devices</Callout>

The **Wi-Fi** Library Item lets you configure managed devices to automatically connect to wireless networks. You can define SSIDs, authentication methods, certificates, and proxy settings to ensure secure, consistent connectivity across your fleet.

You can deploy Wi-Fi profiles to **Apple** and **Windows** devices. While most options are shared, some settings are specific to certain platforms.

## Create a Wi-Fi Profile Library Item

To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.

<Steps>
  <Step title="Navigate to Library">
    Navigate to the **Library** and select **Add Library Item**.
  </Step>

  <Step title="Select Wi-Fi">
    Search for and select **Wi-Fi**.
  </Step>

  <Step title="Enter Name">
    Enter a **Name** for the Library Item.
  </Step>

  <Step title="Select Platforms">
    Select one or more platforms under **Install on**.
  </Step>

  <Step title="Assign to Blueprints">
    Assign the profile to one or more **Blueprints**.
  </Step>
</Steps>

## General Settings

<Tabs>
  <Tab title="Apple">
    <Steps>
      <Step title="Specify SSID">
        Specify the **Service Set Identifier (SSID)**, also known as the network's name.
      </Step>

      <Step title="Configure auto join">
        If you want devices to automatically join this network when it is available, select **Auto join network**. If you do not select Auto join network, devices will know how to connect to the network, but the user will have to choose to do so.
      </Step>

      <Step title="Set hidden network (if needed)">
        If the network is hidden—i.e., it does not broadcast its SSID—select Hidden network. Hidden networks are not standards-compliant and are not recommended.
      </Step>

      <Step title="Configure MAC address randomization">
        If you wish to turn off MAC address randomization, select **Disable MAC address randomization**.
      </Step>
    </Steps>

    <Note>
      Available for iOS 14+ and later versions.
    </Note>

    <Steps>
      <Step title="Enable IPv6 (optional)">
        To use IPv6 on this network, select **IPv6**.
      </Step>

      <Step title="Disable captive network detection (optional)">
        If you do not want to use Apple's Captive Network Assistant on this network, select **Disable captive network detection**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Windows">
    <Steps>
      <Step title="Specify SSID">
        Specify the **Service Set Identifier (SSID)**, also known as the network's name.
      </Step>

      <Step title="Configure auto join">
        If you want devices to automatically join this network when it is available, select **Auto join network**. If you do not select Auto join network, devices will know how to connect to the network, but the user will have to choose to do so.
      </Step>

      <Step title="Set hidden network (if needed)">
        If the network is hidden—i.e., it does not broadcast its SSID—select Hidden network. Hidden networks are not standards-compliant and are not recommended.
      </Step>

      <Step title="Configure MAC address randomization">
        If you wish to turn off MAC address randomization, select **Disable MAC address randomization**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Authentication

<Tabs>
  <Tab title="Apple">
    ### None

    Use the None authentication type when no password is necessary to join the network. If a network with the specified SSID is available and does not require authentication, the device will attempt to join it.

    * No password is required.
    * Devices automatically connect if the SSID is available.

    <Warning>
      It is highly recommended **NOT** to use this authentication type as anyone can join the network without authenticating.
    </Warning>

    ### Pre-Shared Key (PSK)

    PSK authentication is commonly used in home and small business environments. Anyone who has the network's shared password can join it.

    <Steps>
      <Step title="Select security type">
        Choose from: **WEP**, **WPA Personal**, **WPA2 Personal**, **WPA3 Personal**, or **Any Personal**. Any Personal will work with any of the methods above, and it is useful when some locations use WPA2, and others use WPA3.
      </Step>

      <Step title="Enter network password">
        Enter the **Password** for the network. If you do not enter a password, the device prompts the user to enter a password when connecting to the network.
      </Step>
    </Steps>

    ### Enterprise (802.1X EAP)

    Enterprise authentication uses 802.1X to provide more secure authentication options when connecting to Wi-Fi networks. Enterprise authentication types include:

    * **Dynamic WEP**
    * **WPA Enterprise**
    * **WPA2 Enterprise**
    * **WPA3 Enterprise**

    When an enterprise type is selected, additional settings appear depending on the chosen **EAP type** (e.g., EAP-TLS, PEAP, TTLS). You can configure:

    * Identity certificates (AD CS, SCEP, or PKCS #12)
    * Trusted server certificates
    * User authentication (username/password, smartcard, or certificates)

    <Note>
      Certificate options are only available if you select one of the WPA Enterprise options in the Authentication type dropdown.
    </Note>

    Configure Wi-Fi using the following options:

    <Steps>
      <Step title="Select authentication type">
        For **Authentication type**, choose Dynamic WEP, WPA Enterprise, WPA2 Enterprise, or WPA3 Enterprise.
      </Step>

      <Step title="Configure login window settings (macOS)">
        On macOS, if you wish to authenticate to the network as the user that logs in at the login window, select Use as a Login Window configuration. Otherwise, the configuration is considered a System configuration, and Mac systems will be able to authenticate to the network when a user has not logged in. You can also use this option in conjunction with EAP-TLS so a certificate identity is used to authenticate the system before login, but then login window credentials are used to authenticate the user.
      </Step>

      <Step title="Select EAP types">
        Select the **Accepted EAP Types** your network supports. You may select more than one and will need to set all the settings necessary for the selected EAP types. For more information on configuring specific EAP types, refer to [Configure Enterprise Wi-Fi authentication protocols](/en/endpoint/library/deployment-guides/apple/configure-eap-extensible-authentication-protocol-types).
      </Step>
    </Steps>

    <Note>
      Using this configuration requires integration with a directory service. See [this Apple support article](https://support.apple.com/en-us/102001) for more information.
    </Note>

    ### Configure an Identity Certificate

    You can configure an identity certificate using AD CS, SCEP, or by uploading a PKCS #12 file. For instructions on configuring identity certificates, see our [Using Identity Certificates for 802.1X Authentication](/en/endpoint/integrations/certificate-services/using-identity-certificates-for-802-1x-authentication) support article.

    If you are using AD CS, complete [AD CS Integration: Overview](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview) and [AD CS Integration: Configure the Integration](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-configure-the-integration) first.
  </Tab>

  <Tab title="Windows">
    <Note>
      On Windows, the authentication type must be something other than **None**.
    </Note>

    ### Pre-Shared Key (PSK)

    PSK authentication is commonly used in home and small business environments. Anyone who has the network's shared password can join it.

    <Steps>
      <Step title="Select security type">
        Windows supports **WPA Personal** and **WPA2 Personal**.
      </Step>

      <Step title="Enter network password">
        Enter the **Password** for the network. If you do not enter a password, the device prompts the user to enter a password when connecting to the network.
      </Step>
    </Steps>

    ### Enterprise (802.1X EAP)

    Enterprise authentication uses 802.1X to provide more secure authentication options when connecting to Wi-Fi networks. Windows supports:

    * **WPA Enterprise**
    * **WPA2 Enterprise**

    When an enterprise type is selected, additional settings appear depending on the chosen **EAP type** (e.g., EAP-TLS, PEAP, TTLS). You can configure:

    * Identity certificates (AD CS, SCEP, or PKCS #12)
    * Trusted server certificates
    * User authentication (username/password, smartcard, or certificates)

    <Note>
      Certificate options are only available if you select one of the WPA Enterprise options in the Authentication type dropdown.
    </Note>

    <Steps>
      <Step title="Select authentication type">
        For **Authentication type**, choose WPA Enterprise or WPA2 Enterprise.
      </Step>

      <Step title="Select EAP types">
        Select the **Accepted EAP Types** your network supports. You may select more than one and will need to set all the settings necessary for the selected EAP types. For more information on configuring specific EAP types, refer to [Configure Enterprise Wi-Fi authentication protocols](/en/endpoint/library/deployment-guides/windows/configure-eap-extensible-authentication-protocol-types).
      </Step>
    </Steps>

    ### Configure an Identity Certificate

    You can configure an identity certificate using AD CS, SCEP, or by uploading a PKCS #12 file. For instructions on configuring identity certificates, see our [Using Identity Certificates for 802.1X Authentication](/en/endpoint/integrations/certificate-services/using-identity-certificates-for-802-1x-authentication) support article.

    If you are using AD CS, complete [AD CS Integration: Overview](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview) and [AD CS Integration: Configure the Integration](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-configure-the-integration) first.
  </Tab>
</Tabs>

## Proxy

<Callout icon="apple" color="#B84A7A" iconType="regular">Proxy settings are available for Apple devices only</Callout>

Configure devices to use a network proxy by configuring the settings in the **Proxy** section.

<Steps>
  <Step title="Enable Proxy management">
    To configure network proxy settings, toggle the **Proxy** section to **Managed**.
  </Step>

  <Step title="Configure Automatic proxy">
    **Automatic**: Provide a Proxy Auto-Configuration (PAC) URL.
  </Step>

  <Step title="Configure PAC fallback (optional)">
    If you want devices to attempt to connect directly to destinations when the PAC file is not available, select **Proxy PAC fallback allowed**.
  </Step>

  <Step title="Configure Manual proxy">
    **Manual**: Enter proxy **server**, **port**, and (if required) **username** and **password**.
  </Step>
</Steps>

## Fast Lane Marking

<Callout icon="apple" color="#B84A7A" iconType="regular">Fast Lane marking is available for Apple devices only</Callout>

Use Fast Lane on networks and devices that support Quality of Service (QoS) marking to prioritize traffic from apps on connected devices as voice, video, or real-time data. To learn more about Fast Lane, refer to [iOS Compatibility with Cisco QoS Fastlane & Adaptive 802.11r.](https://support.apple.com/en-us/HT207308)

<Note>
  Fast Lane is not supported by all networks or devices and is primarily available on Apple devices.
</Note>

<Steps>
  <Step title="Disable Fast Lane (optional)">
    To turn off Fast Lane, choose **Disable Fast Lane for all apps**.
  </Step>

  <Step title="Enable Fast Lane for specific apps">
    To turn on Fast Lane, choose **Allow specific apps**.
  </Step>

  <Step title="Add applications to allow list">
    Fast Lane applies to network traffic from specific apps. Click **Add application** to add apps to the allow list.
  </Step>

  <Step title="Search apps by name">
    To add apps from your Iru Library, enter the app's name under **Search by name**. Select the apps you want to allow to use Fast Lane.
  </Step>

  <Step title="Add apps by Bundle ID">
    You may also specify apps by Bundle ID. Click **Add Bundle ID**.
  </Step>

  <Step title="Configure Bundle ID details">
    Provide the **App Name** and **Bundle ID** and click **Add**. You can add multiple Bundle IDs.
  </Step>

  <Step title="Complete Fast Lane configuration">
    Click **Done**.
  </Step>
</Steps>

## Certificate Trust Settings

Specifying trusted certificates in the Wi-Fi Library Item is not recommended. If certificates are renewed or changed, you will need to redeploy the entire Wi-Fi profile, potentially causing devices to disconnect from the Wi-Fi network. Instead, install the trusted certificate chain for your RADIUS server(s) using a separate Certificates Library item. Then specify the name of those certificates in the Wi-Fi Library item under **Specify server certificate names**. See [Apple Platform Deployment](https://support.apple.com/guide/deployment/connect-to-8021x-networks-depabc994b84/web) for more information.

Most enterprise Wi-Fi environments require that devices trust the 802.1X authentication server(s), typically a Remote Access Dial-In User Server (RADIUS). The **Certificate trust** settings allow you to configure which certificates presented by the server devices will trust. If a device does not trust the authentication server(s), the user will be prompted to trust it.

<Steps>
  <Step title="Specify trusted certificates (optional)">
    Select **Specify trusted certificates** if you want to provide certificates for the configured devices to trust. Then upload the certificates in .cer or .crt format.
  </Step>

  <Step title="Specify server certificate names (optional)">
    Select **Specify server certificate names** if you want to provide DNS names of certificates devices should trust. Then enter their DNS names — wildcards are accepted.
  </Step>
</Steps>