EnGenius ECW220S review: Peerless protection

On the surface, the EnGenius ECW220S looks like a standard business Wi-Fi 6 access point (AP), but what lies beneath makes it a bit special: it has not two, but three radios. Along with the 2.4GHz and 5GHz variety, the ECW220S has a dedicated wireless intrusion detection system (WIDS) radio for sniffing out wireless security threats and bringing them to your attention.

Collectively grouped under the AirGuard banner, the ECW220S can detect rogue APs, evil twins, misuse of valid SSIDs, man-in-the-middle attacks, RF jamming and de-authentication. And if that’s not enough, it even has a Bluetooth low energy (BLE) sensor for detecting nearby Bluetooth client devices.

You don’t need to be a wireless wizard to use AirGuard, thanks to its easy management from the EnGenius cloud portal. It took only a few seconds to add the ECW220S to our cloud account by using the Cloud To-Go iOS app on an iPad to scan in the QR code on its base.

Once registered to our site, the ECW220S received its predefined wireless settings and started broadcasting them. Up to eight SSIDs per site are supported and, for each one, you can decide which radios are active, enforce WPA3 encryption and enable application analysis.

The portal’s dashboard displays all cloud-managed switches and APs, along with a graph of wireless throughput for up to a month and doughnut charts for the top APs, clients and SSIDs. Below is a traffic analysis graph showing the top ten detected applications and their upload and download bandwidth usage.

AirGuard is accessed from the same management menu as the dashboard and is enabled with one click, although you should choose a convenient time to do this as all wireless clients will be briefly booted off the network. Once activated, the ECW220S scans the airwaves, reports back on all detected SSIDs and places them in the portal’s “Other SSIDs” list if it considers them to be non-threatening.

The scanning radio has a long reach and revealed 39 SSIDs near our location, even spotting an internet-enabled Samsung washing machine. Custom rules automatically classify SSIDs so any that match their keywords will be placed in the portal’s rogue AP list, while white list rules ensure your own SSIDs don’t get wrongly classified.

We tested AirGuard’s automatic rogue detection by connecting a Netgear AP to the lab network configured with the same SSID as our site account. When it came online, AirGuard spotted it, placed it straight in its rogue AP list and posted an alert in the mobile app. AirGuard won’t stop rogue APs from being used, however, as it doesn’t currently offer containment services.

The portal’s wireless client page has an extra tab for Bluetooth, and in only five minutes it had detected ten client devices and listed their MAC addresses. Some we identified as our own but others that kept popping up briefly we suspected were members of the public walking past our office with Bluetooth-enabled mobiles.

As a standard business AP, the ECW220S has a lot to offer. It can present captive portals with a range of authentication methods, while a client timeline shows which SSIDs they’re associated with. Along with AirGuard, these features require a paid-for Pro cloud account. The ECW220S includes the first year free, after which it costs around £38 per year for each device.

It’s no slouch in the Wi-Fi 6 performance stakes, either. Large file copies between a Windows 10 Pro workstation equipped with a TP-Link Archer TX3000E Wi-Fi 6 PCI-E adapter and a server on our 10GbE LAN averaged 102MB/sec at close range, dropping to 85MB/sec with the AP moved ten metres away and into the next room.

The ECW220S is a great choice for SMBs that want extra layers of wireless security. It delivers a superb range of features for the price, is a fine performer, and the EnGenius cloud portal makes light work of AirGuard management. DAVE MITCHELL

EnGenius ECW220S specifications