Wi-Fi 7 on Windows 11

The other week I tested Wi-Fi 7 on Linux. It worked great. Let’s see how Intel BE200 Wi-Fi 7 adapter performs on Windows 11 23H2.

Intel NUC 12th generation with Intel BE200 Wi-Fi 7 adapter

Drivers

Download and install latest driver from Intel’s website. Windows Update itself won’t install any driver, so some manual steps are required. I originally tested driver version 23.20.0.4, and now updated to 23.30.0.6.

Setup

We are using TP-Link Deco BE85 BE19000 consumer Wi-Fi 7 router connected to a 10 Gigabit iperf3 server running on MacBook connected via OWC 10 GbE to Thunderbolt adapter. We have done this on Linux before, so let’s see how the same Wi-Fi adapter performs on Windows.

Wi-Fi 7 on Windows 11 test topology

Performance

On the router, we have configured and verified 320 MHz wide Wi-Fi 7 channel. But when we connect the Windows client, looking at the data rate, it is surprisingly low – if you forgive me calling 2882 Mbps ‘low’ 😊 Considering that the NUC is about 1 meter away from the router, I would expect ~5 Gbps data rate. So what’s going on here?

Connected Wi-Fi 7 client, but low data rate

Interestingly enough, it is the same data rate as we see when connected using 5 GHz 160 MHz channel. Yes, I know, that’s a no-no in Wi-Fi design. We are just testing here.

Hmm, 160 MHz wide 5 GHz channel gives us the same data rate
netsh wlan show interfaces command output

Since Windows doesn’t expose the channel width in the UI, we don’t quite know what is happening on the air. Let’s generate some 6 GHz traffic, and check using Oscium’s WiPry Clarity tri-band spectrum analyser. I love this little USB tool. In this example I use a WLAN Pi as a Remote Sensor. It scans for Wi-Fi networks and streams spectrum information to WiFi Explorer Pro on Mac.

WLAN Pi Remote Sensor with Oscium WiPry Clarity scanning 6 GHz
Windows client is using 160 MHz instead of 320 MHz

Bingo! Apparently, on Windows Intel BE200 uses 160 MHz channel width and doesn’t support 320 MHz wide channel. That halves our data rate and throughput. I wish Windows made channel width more obvious in the UI. Intel BE200 adapter supports 320 MHz wide channels on Linux without a sweat, so hopefully it will get fixed in a future Intel driver or Windows release.

Updated: Apparently, I didn’t read Intel’s release notes closely enough, my bad 😊 Intel BE200 adapter on Windows 11 is only able to use Wi-Fi 6E today. Windows 11 will introduce Wi-Fi 7 support in a future update. Since Wi-Fi 6E supports channel widths up to 160 MHz, that’s why we are not being able to use full 320 MHz channel width. What really confused me was the “Protocol: Wi-Fi 7 (802.11be)” misleading Wi-Fi network status reported by Windows. Thank you Ben for spotting the note in Intel’s documentation.

What does that translate to? Lower data rate and lower throughput. I would expect download and upload to be around 2.5 Gbps using 320 MHz wide channel. With the latest Intel driver 23.30.0.6, we get 1.71 Gbps TCP download speed with 16 parallel streams, and upload of 2.17 Gbps. But only the upper 160 MHz half of the 320 MHz wide channel is used.

1.71 Gbps TCP download speed with 16 parallel streams
Upload TCP speed 2.17 Gbps with 16 streams

I also ran a quick Speedtest.net test (I know it is not a proper throughput testing tool) on a 900/900 Mbps WAN link.

On a Linux Wi-Fi 7 client, I measured nearly 890/890 Mbps. Original Intel driver 23.20.0.4 performed 383/818 Mbps. The latest Intel driver 23.30.0.6 delivered more symmetric numbers, and results were closer to the actual WAN link speed.

Speedtest.net speeds using the latest 23.30.0.6 Intel driver

Summary

Wi-Fi worked well, but application speeds including Speedtest.net and other tools performed quite poorly and subjectively ‘felt slow’. iperf3 test showed higher performance, but the main problem for the purpose of a throughput test is that the adapter only uses 160 MHz out of the available 320 MHz.

When it comes to recommended channel width in real world, it depends. 80 MHz or 40 MHz wide channels are most likely the best place to start depending on your circumstances and region.

For reference: Disable 6 GHz on Intel BE200 adapter

If you are performing tests on an SSID that has multiple bands enabled, and you want to force the client to drop off 6 GHz and join using a 5 GHz channel instead, Intel BE200 driver has the option to disable the 6 GHz band.

Disable 6 GHz band on Intel BE200

Wi-Fi 7 comes to WLAN Pi M4

With the WLAN Pi team, we have designed and launched a M.2 adapter from A-key to E-key, which allows you to install a certified Wi-Fi 7 adapter Intel BE200 to your current WLAN Pi M4.

WLAN Pi M4

Is WLAN Pi selling ‘keys’ now? 😉

What is a ‘key’? It is formed of the notch on the Wi-Fi adapter PCB, and plastic blob separating pins inside the M.2 slot. The idea is to prevent users from plugging incompatible cards to the slot, and avoid any ‘magic smoke events’. Here is more about M.2 and the individual key types if you are interested.

WLAN Pi upgrade kit

Since Intel adapters use E-key and WLAN Pi M4 uses A-key, we needed to build an adapter. Badger Wi-Fi has the upgrade kit in stock. It comprises of the Oscium M.2 A-key to E-key adapter, Intel BE200 Wi-Fi 7 adapter, and 2 little bolts to secure the adapter and the Wi-Fi module.

Here is how the ‘butterfly’ setup looks like. Intel BE200 sits onboard of the A-key to E-key adapter, installed in the M.2 slot.

We are ready to connect existing tri-band antennas, and assemble the unit.

Software support

Make sure to either upgrade Linux packages to their latest versions using sudo apt update && sudo apt upgrade command, or download and flash the latest WLAN Pi software image on your SD card. Release 3.2.0 supports Wi-Fi 7 Intel BE200 adapter out of the box with no effort whatsoever on your part.

Wi-Fi 7 in action

For this demonstration I use a consumer Wi-Fi 7 router TP-Link Deco BE85 BE19000. Simply because it is available, Wi-Fi 7 certified, and it supports 320 MHz channel width – not that one would deploy that in an enterprise environment, but mainly to test the maximum Wi-Fi throughput of the Pi.

A bug in macOS doesn’t allow Macs to correctly recognise Wi-Fi 7 networks. Instead of Wi-Fi 7 320 MHz wide network, my MacBook reports Wi-Fi 6 and 160 MHz wide channel. So, we will use another WLAN Pi and its Wi-Fi radio as a Remote Sensor in WiFi Explorer Pro – you need the Pro version to do this.

Nice, Wi-Fi 7 AP!

Wi-Fi 7 network

Connecting the WLAN Pi as a Wi-Fi 7 client only takes few lines of wpa_supplicant config.

sudo nano /etc/wpa_supplicant/wpa_supplicant.conf
Wi-Fi 7 network settings

And we have successfully connected the WLAN Pi as a Wi-Fi 7 client to the AP using this command.

sudo wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -i wlan0
WLAN Pi connected as a Wi-Fi 7 client

Run this command to make sure the WLAN Pi requests an IP address from DHCP server running on the router:

sudo dhclient -i wlan0 -v

What channel are we using? 320 MHz channel width? Indeed.

Adapter and channel details

Before you ask, distance between the Pi and the router is sub 1 meter. What is the Wi-Fi data rate? We are using Wi-Fi 7 (EHT), 2 spatial streams, MCS 12 and 4096-QAM and short guard interval of 0.8 µs.

Data rates

We can refer to Francois Verges’ MCS index tool to check how we are doing. Yes, I have tried, but I have only been able to achieve MCS 13 extremely rarely.

MCS table

How far from the AP can we maintain 4096-QAM?

I hardly ever achieved MCS 13. To maintain MCS 12, I had to stay within about 1.5 meter distance from the router. I got best results with antennas position in this ‘V’ pattern.

V-shaped antenna placement

With a different client device designed for Wi-Fi 7 from the ground up (with professional quality antennas and placement), I would hope for slightly longer MCS 12 and MCS 13 range.

It’s throughput test time

It’s time to run an iperf3 test and see how much traffic we can actually push over the air and also how much the WLAN Pi M4 can handle. Here is our test setup. I recommend the OWC 10 GbE Thunderbolt adapter (it uses Thunderbolt protocol, not USB) connected via USB-C to your Mac.

With the help of Oscium WiPry Clarity 6 GHz spectrum analyser connected to another WLAN Pi, we can monitor the life spectrum and see how much red the iperf3 test introduces. We are able to achieve download TCP speed of 2.27 Gbps and upload speed of 1.74 Gbps.

I used iperf3 -c 192.168.68.51 -P32 -R to test download speed, and iperf3 -c 192.168.68.51 -P32 for upload. Number of parallel streams set to 32 provided the best performance.

Summary

Wi-Fi 7 works well on the WLAN Pi M4. In fact, it works better than Wi-Fi 7 on Windows 11. We have covered Intel BE200 on Windows 11 in this blog posts.

I was expecting 2.5 Gbps-ish throughput, which we have got quite close to. During the test, CPU of the WLAN Pi was running around 80 % utilisation, and interrupts were reaching 100 %. So, hardware of the WLAN Pi itself posed a bottleneck.

mpstat 1 300 -P ALL
High CPU utilisation due to interrupts

Orientation of the antennas mattered more than I expected to. Best position was a ‘V’ shape with antennas positioned away from the board. With AUX antenna placed 90 degrees relative to the Main antenna, data rates and throughput dropped. Perhaps there is RF noise from the board itself coming into play.

Apple iOS Shortcut: Install Wi-Fi diagnostics profile to your iPhone the easy way

Apple developed a diagnostics profile that allows you to monitor and troubleshoot Wi-Fi connectivity. Unfortunately, it is only available for 7 days after installation. After that, it get automatically removed. If you are a Wi-Fi professional, that means that you need to reinstall it every few days. Yes, it always disables when you are on site and need it the most :)

Manual installation of the profile – the hard way

Normally, I would google something along the lines of “Apple Wi-Fi diagnostics profile”, eventually I find the right link, log in, search for the iOS Wi-Fi profile on the Apple Developer website, download the profile, go to Settings > General > Profiles section, and I install it from there.

Wi-Fi diagnostics profile for iOS devices

What if there was a little tool that did most of the above for you?

The easy way

I put together a quick “Wi-Fi Profile” Apple Shortcut that removes some of these steps. Install the shortcut on your phone and it will guide you through the diagnostics profile installation every time you need it. It downloads the profile to your iPhone, lets you approve the installation and voilà, you open Wi-Fi settings and get RSSI measurements, channel details, BSSID and other useful info.

How to add the Shortcut to your phone

Download the latest version from my GitHub and follow the video instructions. Save it your home screen and execute it whenever you want to reenable Wi-Fi diagnostics.

See the shortcut in action

More shortcuts, anyone?

I wrote few other Shortcuts. Perhaps you are connected to a someone’s guest network, and would like to see who their access point vendor is? Your iPhone can tell you.

Or you use 2 iPhones and want to get a reminder when your secondary/test phone’s battery drops below 10%?

Useful WiFi Explorer Pro filters for finding rogue APs and APs with low minimum mandatory data rate

If you have not used WiFi Explorer before, get yourself a copy of the Pro version here. It is absolutely worth it and extremely useful tool if you have anything to do with Wi-Fi.

The Pro version (the Lite doesn’t) supports Filters. They allow you to filter scan results and get exactly the scan results you are interested in.

Find rogue access points

Let’s say you want to find APs that use other SSIDs than yours. This filter does just that. It shows all SSIDs other than CiscoLive or CiscoLive-WPA3. Simply paste this string into the Filters text field in the top right-hand corner.

dot11.net.ssid !~ "CiscoLive" AND dot11.net.ssid !~ "CiscoLive-WPA3"

Find APs using low minimum mandatory data rate

Other times you might want to look for access points that have minimum mandatory data rate configured to low – by mistake or by choice. In this example, I am interested in APs broadcasting these 2 SSIDs and using minimum mandatory rate of 6 or lower.

dot11.net.min_basic_rate <= 6 AND dot11.net.ssid ~~ "CiscoLive" OR dot11.net.ssid ~~ "CiscoLive-WPA3"

Download the cheat sheet

We have only scratched the surface. You can do so much more with filters.

Intuitibits, the makers of WiFi Explorer, published a great one-pager documenting the syntax. Get yourself a copy.

Convert Cisco Meraki MR access point to Catalyst DNA mode

Same hardware, your choice of management

The latest generation of Wi-Fi 6E Catalyst Wireless access points (CW9162, CW9164, CW9166 series) gives you the option to either cloud-manage them using Cisco Meraki Dashboard, or manage the APs by Cisco Catalyst 9800 series Wireless LAN Controller (WLC).

They are the exact same hardware and they ship pre-loaded with the Catalyst/DNA and Meraki software image. Depending on the mode setting, they either boot one image or the other.

What do we need

  • Catalyst Wireless CW9162I, CW9164I, CW9166I, CW9166D1, CW9163E access point in Meraki mode
  • Cisco Meraki MR access point license to perform the conversion
  • Cisco DNA Essentials or DNA Advantage access point license if you want to use join and manage the AP by a Catalyst 9800 controller

Choose AP mode before ordering

You will have the best experience when you order your access points in the right mode.

Order the right mode

Order a DNA persona AP and it will auto-discover your Catalyst 9800 controller using one of the supported methods. In the UK, I can order the “-ROW” AP and manage it by Catalyst 9800, and optionally add Catalyst Center (previously known as DNA Center) to get analytics, assurance and other great features. Find the right access point SKU and regulatory domain based on your coutry using this tool.

If you prefer, order the Meraki mode access point, connect it to the internet, and claim it in the Dashboard. Meraki APs use a single “-MR” SKU globally.

Conversion from MR to Catalyst/DNA mode

If you ordered a Meraki access point and your requirements have changed, you can convert the AP to DNA mode.

1. Make sure you have an active Meraki MR license. Why? We need the license to connect the AP to Dashboard, and to open a conversion request with Meraki technical support team.

2. Provide power and internet connectivity to the access point.

3. Log in to Dashboard. Navigate to Organization > Configure > Inventory and add the access point using its Meraki S/N.

Enter the Meraki S/N from the product label

4. Add your MR license to Dashboard under Organization > Configure > License Info.

5. Wait for the AP to connect to Dashboard and change its LED to solid green or solid blue. Perfect, the AP is now online.

6. Complete this checklist first. Disable Meshing feature and make sure your Catalyst 9800 is ready for the AP to connect after conversion has completed.

Disable Meshing feature

7. Open a new support case by clicking the (?) question mark in the top right hand corner > Cases > New Case.

8. Include all these details to speed up the conversion process. Find your Customer Number by clicking the person icon in the top right hand corner. To get your Daily Support Code, click the same person icon, then open My profile.

Hi,

Please convert my CW*****-MR AP with Meraki SN ****-****-**** to DNA mode. I do have an existing DNA license. I disabled Meshing in the Dashboard.

I have completed this checklist:
https://documentation.meraki.com/MR/Other_Topics/916X_Management_Mode_Checklist_and_Troubleshooting

I am aware that the AP will not join Dashboard after the conversion, unless I convert it back to MR mode.

Please go ahead and start the mode change immediately.

My customer number: ****-****
My support passcode for today: ****

Have a great day!

9. If this conversion is urgent, call into Meraki support. No, don’t e-mail the support team, call them. Have the case number by hand. Find the best phone number here.

10. After the support engineer starts the conversion, your AP will reboot. It is now in the Catalyst mode. You can verify that by keeping an eye on the Console port output during its boot. Just to remind you (and myself): The new Console port baud rate is 115200 from 17.12.1 release onwards.

Autoboot in 5 seconds
Catalyst Mode Selected

11. The AP should now follow the standard Catalyst LED pattern. It is ready to be managed by a Catalyst 9800 series controller – be it a hardware appliance, virtual machine, or public cloud instance.

12. Our DHCP server assigned an IP address to the AP, which has automatically discovered and joined the WLC located in the same IP subnet.

Successful WLC discovery and AP join
Followed by automatic software image upgrade
The AP has joined the WLC and is ready for use

To enable SSH and Console access, create a username, password and enable password in the Catalyst 9800 controller’s AP Join Profile > Management > User section. SSH protocol is disabled by default. You can enable it in the AP Join Profile.

You have full Console access and control over the AP

Wi-Fi Vendor – Detect vendor of a Wi-Fi access point with just your iPhone or iPad

Many of us walk into buildings and we immediately start looking for access points 🙃 Often times, the access points are not visibly installed. But how can you tell what vendor is your favourite coffee shop using, or what APs did your customer deploy?

Now, would it be cool if you could use your iPhone or iPad to find out what vendor is your customer, public venue, favourite football club, or train provider using?

Wi-Fi Vendor iOS Shortcut

I created a Shortcut for iOS, which does exactly that.

Simply connect to a Wi-Fi network and open the shortcut. We will automatically populate the input field with the BSSID of the AP you are currently connected to:

Simply connect to a Wi-Fi network and tap on the Wi-Fi Vendor icon

If you don’t want to connect to an AP, use Airport Utility to get the BSSID (aka the “wireless MAC address” of the AP) of the access points around you, and let Wi-Fi Vendor shortcut do its magic:

Scan for BSSIDs around you and detect vendor

Or you can even use the good old Copy & Paste method. Let’s say you saved the OUI to your Notes app. Copy it to clipboard and paste into Wi-Fi Vendor:

Benefits of this solution

  • iPhone or iPad is all you need. No need to open your laptop or other professional Wi-Fi tool.
  • It is free, and driven by your coffee donations 😉☕️
  • All data stays on your iPhone and iPad. No data, not even the BSSID, is sent to a cloud service.
  • Our OUI <-> Vendor database is Wi-Fi centric, open to additions of the new records by Wi-Fi professionals, it has extra entries from vendor documentation, and BSSIDs captured in the field
  • It is community-driven and customisable. Contribute new OUIs, or fork our repository and create your own tool.
  • For Cisco Meraki APs, I use an active detection method – more about this below

Cisco Meraki active vendor detection method

When there is no match based on the access point’s OUI, Wi-Fi Vendor shortcut performs an active check. Make sure you are connected to the AP, then open Wi-Fi Vendor. It will attempt to browse to the Local Status Page of the AP and if it find Cisco Meraki logo in the source code, that’s a match.

Supported iOS releases

I’ve tested Wi-Fi Vendor on these devices. Use iOS 17 or newer for the best results and all features.

  • iPad Air 2, iOS 15.7.7 – no Cisco Meraki active check, doesn’t detect BSSID you are currently connected to
  • iPhone SE 2nd gen, iOS 16.6 – no Cisco Meraki active check, doesn’t detect BSSID you are currently connected to
  • iPhone SE 2nd generation, iOS 17.0 – all features are supported
  • iPhone SE 3rd generation, iOS 17.0 – all features are supported

Download and install Wi-Fi Vendor iOS Shortcut

It takes less than a minute to install.

Follow this video guide to 🔽 download the latest version from my GitHub to your iPhone or iPad.

Install Wi-Fi Vendor shortcut

The mandatory boring bit

This tool is provided as is. If you spot anything that needs to be fixed, let us know, or even better submit a Pull Request including the fix. Blame Jiri for anything that needs to be fixed, not Cisco 😉

Cisco DART extension cable for C-ANT Wi-Fi antennas and Catalyst 9130AXE access points

Cisco’s Catalyst 9130AXE access point (the external antenna model) doesn’t have any antennas built-in by design. It uses a DART connector with 8 RF lines and 16 digital lines. They carry the RF signals and allow communication between the AP and antenna.

All new C-ANT9101, C-ANT9102 and C-ANT9103 antennas connect natively using their directly-attached DART connector to the Catalyst 9130AXE access point. It significantly simplifies the deployment process, allows the AP to automatically detect the antenna model, type and gain, and it doesn’t allow any room for installation errors like loose RP-TNC connectors or swapped antenna RF ports.

Here is an example of the new bell antenna C-ANT9102 with directly-attached DART connector.

And here is one connected to the C9130AXE-E access point.

Now, if your scenario requires the antenna to be installed further away from the access point (inside of a freezer for example) there is a 3-feet DART extension cable for that sold by Cisco.

The part number is AIR-CAB003-D8-D8=.

It has 90-degree 8-port plug on one side and straight 8-port jack on the other.

Azimuth and Elevation angles of external Wi-Fi antennas on Cisco DNA Center maps

Orientation of Wi-Fi access point with external antenna(s) on Cisco DNA Center maps is represented by 2 key attributes.

Azimuth tells us how many degrees we rotated the antenna around its vertical axis. It ranges from 0 to 360.

Elevation represents downtilt of the main lobe relative to horizon. It ranges from -90 to 90. Horizon equals to Elevation 0. If the antenna’s downtilt is 30° down, Elevation is -30. The minus sign tells us that the antenna is pointed downwards.

Downtilt of 30° equals to Elevation -30

Antenna shooting above the horizon, which is not very common, would have positive (larger than 0) Elevation value.

We are going to focus exclusively on access points with external antennas in this post. If you are deploying internal antenna AP or AP with dipole antennas, here are the correct settings for you.

Everything in this post applies to all Cisco’s directional antennas. To name a few, C-ANT9103, C-ANT9104, AIR-ANT2566D4M-R, AIR-ANT2566P4W-R, AIR-ANT2513P4M-N.

Enough theory. Pictures are worth a thousand of words.

We are going to use use Cisco’s AIR-ANT2566P4W-R, which has a nicely squished pattern and changes to its orientation are very visual.

Wall-mounted external antenna

By default DNA Center sets APs with external antennas to Azimuth 0 and Elevation 0. Elevation 0 means that the antenna is wall-mounted (downtilt 0°) and its main lobe shoots parallel to horizon.

Let’s assume perfectly wall-mounted antennas with no downtilt at all in the examples below. That way we don’t need to touch the Elevation setting at all. All we need to do is to adjust the Azimuth angle depending on which wall the antenna is mounted on.

Wall-mounted antenna shooting towards the right

Azimuth 0 and Elevation 0 is the default setting for external antennas. It represents a perfectly wall-mounted antenna (that’s what Elevation 0 means) shooting in the right hand direction (that’s what Azimuth 0 does). The main lobe travels parallel to the floor.

Azimuth 0, Elevation 0
Azimuth 0 and Elevation 0

On the floor plan, it is mounted on the ‘left wall’ of the room, shooting towards the right.

Wall-mounted antenna shooting towards the bottom of the map

Now, what if you installed the antenna on a wall, but it points towards the bottom of the map (I avoid the south as it is not true south) this time?

Azimuth 90 and Elevation 0

We rotated the antenna clockwise around it vertical axis by 90 degrees. There is Azimuth for that, so we will increase Azimuth by 90. The final setting is Azimuth 90 and Elevation 0.

The antenna appears as mounted on the ‘top wall’ of the room shooting towards the bottom of our floor plan.

Wall-mounted antenna shooting towards the left

We have now rotated the antenna by another 90 degrees clockwise. That results in Azimuth 180 and Elevation 0.

Azimuth 180 and Elevation 0

It is installed on the right wall pointed towards the left of our floor plan.

Wall-mounted antenna shooting towards the top of the map

Finally, if the antenna is mounted on the ‘bottom wall’ and it points towards the top of our floor plan, that is another 90-degree increment, and results in Azimuth 270 and Elevation 0.

Azimuth 270, Elevation 0

Hopefully, there are no surprises there?

If your antenna uses a different orientation, simply drag the blue Azimuth arrow and point it wherever the antenna’s main lobe is shooting towards.

Ceiling-mounted antenna

Ceiling-mounted antenna shooting towards the floor

Antenna mounted to the ceiling shooting towards the floor has downtilt of 90°. We simply set Elevation to -90. Don’t miss the minus sign.

This is how Azimuth 0 (antenna cables on the left, top side of the antenna on the right) and Elevation -90 looks like.

Azimuth 0, Elevation -90

The irregular ‘oval-ish’ pattern of this patch antenna is very obvious on the map. It kisses the top and the bottom of the floor plan.

My antenna is ceiling-mounted but it is rotated?!

To rotate the antenna on the ceiling by 90° clockwise, we just need to increment Azimuth.

Azimuth 90, Elevation -90

Azimuth 90, Elevation -90

This time the coverage area stretches from left to right, because we rotated the antenna by 90 degrees.

Azimuth 180, Elevation -90

Azimuth 180, Elevation -90

Azimuth 270, Elevation -90

Antenna cables point towards the bottom of the map, which is yet another 90-degree increment. It is still perfectly ceiling-mounted (that’s Elevation -90).

Azimuth 270, Elevation -90

Let’s practise

Now, let’s apply the theory.

What Azimuth and Elevation would you configure on C-ANT9103 antenna connected to Catalyst 9130 AP mounted using AP-BRACKET-9 bracket on the ‘top wall’ (don’t let the perspective of the photo confuse you) of the floor plan with 30-degree downtilt?

Azimuth 90, Elevation -30

The antenna is mounted on the top wall shooting to the bottom of the map. That translates to Azimuth 90. It is wall-mounted, which normally means Elevation 0, but it is tilted 30° down. So, we subtract 30 from Elevation. And here we go, that’s Elevation -30.