Private Password Manager: What does the R-Icon Mean?

If you use Private Passwords to authenticate wireless clients and the password management mode is set to Built-in and RADIUS, clients are authenticated in the following order:

1. The Access Point first checks whether the client's MAC address and private password match an entry in the built-in private password table.
2. If a matching entry is found, the client is authenticated immediately.
3. If no matching built-in entry exists, the Access Point forwards the authentication request to the configured RADIUS server.
4. If the RADIUS server validates the credentials, the client is allowed to connect.

Why does the R warning icon appear?

When a password-only entry is present in the private passwords table (also called a catch-all or wildcard password), a red R warning icon is displayed in the first column on the left .

A catch-all password has no MAC address associated with it, allowing any client that knows the password to connect.

When such an entry exists, the Access Point authenticates matching clients locally using the Built-in password table and does not contact the RADIUS server. As a result, those clients bypass RADIUS authentication.

To highlight this behavior, the following warning is displayed:

When does this warning not appear?

If Weaker encryption for legacy device compatibility is enabled in the SSID settings, all wireless clients use WPA2 instead of WPA3 authentication.

Because WPA2 follows different authentication behavior, the RADIUS bypass described above does not apply, and the R warning icon is not displayed.