Product Compliance

 
Country Certification
Singapore IMDA Registration Mark
Hong Kong Approval Mark

AP-Server Mutual Authentication

The AP-server communication begins with a mutual authentication step where the AP and server authenticate each other using a shared secret. If this authentication succeeds, the AP-server communication takes place.

After the authentication succeeds, the server generates a session key and encrypts all communication between the AP and server using the session key.

The AP and server ship with the same default value of the shared secret. Use CLI commands on the server and the AP to change the shared secret.

 

Note: After changing the shared secret on the server, all APs connected to the server automatically use the new communication key. You must manually configure the new communication key on an AP if not connected to the server when the key changes on the server.

 

Note:Arista Networks does not recommend installing older versions of APs on newer versions of servers.

For more information on the AP-server communication process, see the Wi-Fi Access Point Server Communication Workflow article.

Access Point Troubleshooting

The table below lists some of the access point (AP) troubleshooting guidelines.

 

 
Problem Solution
The AP did not receive a valid IP address via the DHCP. Be sure you have an active DHCP server on the VLAN/subnet with the connected AP. If the AP fails to get a valid IP address, reboot it to see if that resolves the problem.
Unable to connect to the server.
  • Be sure you have an active server reachable from the network with the connected AP. If a firewall or a router has Access Control Lists (ACLs) enabled between the AP and the server, be sure to allow traffic on UDP port 3851.
  • Use the IP-based server discovery method and be sure you have correctly entered the DNS name, wifi-security-server, on the DNS server.
  • Be sure that the DNS server has correctly configured IP addresses or the DHCP server provides the IP addresses.
  • The AP might fail to authenticate with the server. In this case, an 'Authentication failed ' event logs to the server. Refer to the event for recommended action.
The AP has encountered a problem.
  • If you use Arista Cloud Services, open the TCP port 443 (SSL). If you have an on-premises installation, then open UDP port 3851 and port 80.
  • If you use a Proxy, Web Accelerator, or URL Content Filter between the AP and the Internet, ensure that the settings allow communication between the AP and Arista Cloud Services.
  • If your configuration requires you to specify an exact IP address or IP range for Arista Cloud Services, please contact This email address is being protected from spambots. You need JavaScript enabled to view it..

Connecting the Access Point to the Network

To connect the AP to the network, perform the following steps:
  1. Be sure to install the AP on a network with a DHCP-enabled server.
  2. Set up a DNS entry for wifi-security-server on all DNS servers. This entry must point to the IP address of the server. This entry should point to the server IP address. By default, the AP looks for the DNS entry, wifi-security-server.
  3. Verify the AP LED status as ON with green LEDs, indicating an operational AP connected to the server.
  4. Log on to the server using SSH and run the get sensor list command.

    The command returns a list of all Arista devices recognized by the server. Single Sign-On users can go to the Monitor tab in CloudVision WiFi and check if the device appears on the Access Points tab.

 

Note:If zero configuration fails, the AP must be configured manually.

 

Important:If you do not have DHCP enabled on a subnet, the AP cannot connect to that subnet with zero-configuration. If no DNS entry exists on the DNS servers, or if you do not have a DHCP server running on the subnet, you must manually configure the AP. For details on configuring an AP manually, refer to the Access Point Configuration guide on Arista Product Documentation.

 

Connecting the Access Point using Power over Ethernet

If you use a Power over Ethernet (PoE) injector, be sure to plug the data connection into a suitable switch port with proper network connectivity.

For PoE port details, see the Rear Panel section.

Powering the Access Point On

Power the access point (AP) on by plugging one end of the Ethernet cable into the Power over Ethernet++ (PoE++) switch or injector and the other end into the Ethernet/PoE++ port on the AP. Be sure to turn on the PoE ++ source.

As an alternative to PoE++, you can insert one end of a compatible power adapter plug into an AC power outlet and the other end into the power input port on the AP.

 

Note: Ifnot using PoE++, use only an AC power adapter supported by the AP.

 

Using the Access Point with a Power Adapter

Use a compatible power adapter (Arista SKU: PWR-AP-W5) to power the AP.

Warning:

Install the C-460 AP with a UL-listed PoE power source suitable for operation at 40ºC and output that meets LPS requirements or PS2, with a 48V DC (0.5A minimum) rating. If you do not use PoE+, install the AP with an AC power adapter with a Listed Direct Plug-In Power Unit marked “Class 2”, Listed Power Adapter, or DC power source marked “L.P.S.” (or “Limited Power Source”) and rated from 12 V DC, 2.5A minimum.

The maximum altitude of operation for the power adapter is 5000m.

To power up the device with a power adapter, perform the following steps:
  1. Plug the power cable into the DC power receptacle on the back of the AP.
  2. Plug the other end of the power cable into a 110V~240V 50/60 Hz AC power source.
  3. Wait until the AP becomes ready. Refer to the LED status table.

Installing the Access Point

This section contains the procedure to install the access point (AP).

Zero-Configuration of the Access Point

The AP supports zero-configuration under the following conditions:

  • The device must be in AP mode with background scanning on and without a configured SSID.
  • Set up a DNS entry forwifi-security-server on all the DNS servers. This entry should point to the IP address of the server. By default, the AP looks for the DNS entry, wifi-security-server.
  • Place the AP on a DHCP-enabled subnet.

 

Refer to these articles to understand how APs communicate with the server and the ports that you need to open to enable communication:

 

Important: If placing the device on a network segment separated from the server by a firewall, you must first open port 3851, the port assigned to Arista Networks, for User Datagram Protocol (UDP) and Transport Control Protocol (TCP) bidirectional traffic on the firewall. Zero-configuration does not support setting up multiple devices to connect to multiple servers. In this case, you must manually configure the APs. See the Access Point Configuration Guide on the Arista website at Arista Product Documentation.

 

Assign a static IP address to the APor change the settings to DHCP. Make a note of the AP MAC address and the IP address in a safe place before installing it in a hard-to-reach location. Locate the AP MAC address on a label at the bottom of the product.

Use the following steps to install the AP with zero-configuration:
  1. Ceiling Mounting the Access Point or Wall Mounting the Access Point.
  2. Connecting the Access Point to the Network.
  3. Powering the Access Point On.

Ceiling Mounting the Access Point

Mounting the access point (AP) on the ceiling consists of the following steps:

  1. Attach the bracket to the T-grid - Use the mounting bracket to install the AP on the ceiling. Attach the bracket to the T-grid and rotate the bracket so that it snaps on the T-grid. The bracket becomes parallel to an arm of the T-grid. Be sure the bracket properly snaps to the T-grid, as shown below.

     

     

  2. Mounting the AP on the bracket - Place the first mounting post on the back of the AP to the lower notch of the bracket. Rotate the AP so that the center mounting post fits in to the center notch on the bracket. Be sure all the mounting posts on the back of the AP snap to the respective notches on the bracket. The mounting posts now properly fit in the respective notches of the bracket and the AP mounts properly.

     

     

    Mounting Instructions using the Silhouette/Interlude Bracket Mount: The Silhouette/Interlude mounting bracket does not ship as a part of the standard package and must be procured separately. The Silhouette/Interlude Bracket Mount mounting instructions has steps similar to the Standard Package Content mounting instructions.

     

    Note: As a best practice, label the APs using MAC addresses or your convention. For example, use serial numbers to easily identify the APs.

     

Wall Mounting the Access Point

Note: The wall mounting accessory SKU (MNT-AP-FLAT-14CM) can be ordered and purchased separately.

 

Refer to the Wall Mount the Access Point article for instructions on wall mounting the access point.

Access Point Overview

C-460 is a multi-radio 802.11be access point. Refer to the C-460 datasheet for more information.

 

Note: This equipment is suitable for use in environment air spaces (plenums).

 

This section provides an overview of the access point (AP) and discusses the following topics:

Front Panel

The front panel of the AP has 6 LEDs that indicate the status of various AP functions.

Figure 1. Front Panel LEDs

 

Table 1. AP Labels
1 Power 2 2.4 GHz Radio 3 5 GHz Radio
4 6 GHz Radio 5 LAN1 6 LAN2

 

Power LED

The following table describes the Power LED states:

 

Table 2. Power LED States Description
  Green Orange
Solid Running at full capability Running at reduced capability
Blinking Received IP address but not connected to the server Did not receive an IP address

 

Reduced capability indicates that the AP is receiving lower than the required maximum power from the PoE++ switch. This means that the AP receives 802.3at instead of 802.3bt.

LAN1 LED - ON when the corresponding interface is UP.

LAN2 LED - ON when the corresponding interface is UP and wired guest or link aggregation configured.

Radio LEDs - ON when the corresponding radio becomes operational.

Rear Panel

The rear panel of the AP has a DC power port and 802.3bt compliant PoE++ LAN ports to power the device and connect it to a wired LAN.

 

Figure 2. Rear Panel
Table 3. Rear Panel Labels
1 LAN1, POE++ 2 LAN2, POE++ 3 DC Power

 

Table 4. Port Details
Port Description Connector Type Speed/Protocol
Power 12V DC/4.0A 5.5 mm overall diameter / 2.1 mm center pinhole N/A
LAN 1 10 Gigabit Ethernet with 802.3bt compliant PoE RJ-45 11.5/8.6/1.4 Gbps Ethernet
LAN 2 10 Gigabit Ethernet with 802.3bt compliant PoE RJ-45 11.5/8.6/1.4 Gbps Ethernet

Side Panel

The side panel of the AP has a reset pinhole, USB port, and console port.

 

Figure 3. Side Panel
Table 5. Side Panel Labels
1 Reset 2 USB 3 Console

 

 

Table 6. Port Details
Port Description Connector Type Speed/Protocol
Console Establish a ‘config shell’ terminal session through a serial connection. RJ-45
  • RS 232 Serial (115200 bits per second)
  • Data bits:8; Stop bits: 1
  • Parity: None
  • Flow Control: None
USB USB 2.0 port with a power output rating of 5V/0.3A (1.5W). USB Future Use
Reset Reset to factory default settings port. Hold down and power cycle the device to reset. Pinhole push button N/A

 

When you reset the AP, the following settings also change:
  • The Config shell password resets to config.
  • Erases the server discovery value and changes to the default redirector.online.spectraguard.net (primary) and wifi-security-server (secondary).
  • The AP loses all the VLAN configurations.
  • If the AP has a static IP configured, the reset erases the IP address, and the AP is set to DHCP mode with the factory default IP address of 169.254.11.74.

Package Content

The access point (AP) package must contain the components shown in the following figure.

 

Figure 1. Package Components
1 C-460 Access Point 2 15/16" (24 mm) Mounting Bracket (MNT-AP-24MM)

 

 

Important: Make a note of the AP MAC address and the IP address in a safe place before installing it in a hard-to-reach location. Locate the AP MAC address on a label on the bottom of the product.

 

If you don't have a complete package, contact the Arista Networks Technical Support Team at This email address is being protected from spambots. You need JavaScript enabled to view it. or return the package to the vendor or dealer where you purchased the product.

Quick Start Guide
C-460 Access Point
Arista Networks

www.arista.com

DOC-06880-02

Headquarters
5453 Great America Parkway
Santa Clara, CA 95054, USA
+1-408 547-5500
www.arista.com
Support
+1-408 547-5502
+1-866 476-0000
This email address is being protected from spambots. You need JavaScript enabled to view it.
Sales
+1-408 547-5501
+1-866 497-0000
This email address is being protected from spambots. You need JavaScript enabled to view it.
© Copyright 2025 Arista Networks, Inc. The information contained herein is subject to change without notice. Arista Networks and the Arista logo are trademarks of Arista Networks, Inc., in the United States and other countries. Other product or service names may be trademarks or service marks of others.

About This Guide

This installation guide explains deploying the C-460 access point (AP).

Important:Read the EULA before installing the access point (AP). You can download and read the EULA from: Arista Product Documentation

Installing the AP constitutes your acceptance of the terms and conditions of the EULA mentioned above.

 

Intended Audience

This guide can be used by anyone installing and configuring the access point.

Document Overview

This guide contains the following sections:

 

Note:All instances of the term 'server' in this document refer to the Wireless Manager unless otherwise explicitly stated.

 

Product and Documentation Updates

To receive important news on product updates, please visit our website at Arista Product Documentation. We continuously enhance our product documentation based on customer feedback.

This equipment conforms to the requirements of the NCC.