Features - Security
AiProtection is the second new feature based on Trend Micro technology. None of the features are documented, but you can probably figure most out.
AiProtection main page
[RMerlin] AiProtection regroups various security/control related features. Parental Control now falls into this new category. Just like QoS, the old time-based parental control is still present, but is also augmented with a new App-based control. This allows you to limit the applications specific devices (such as your kid's portable devices, for example) can use. You can, for example, prevent your kid's tablet from being able to use P2P applications.
On the purely security-related front, AiProtection has options that can prevent network intrusions, or block Internet access if a device on your LAN is detected as being actively hosting malware. It can also be set to block access to known malicious sites.
Finally, a new overall security check option lets you see at a glance all the security-related things you might need to check on your router. This page will show you for example if you are using a weak password, or if you have UPnP left enabled (for the more security-concious users who might want to close that door).
These new features based on the Trend Micro DPI engine require additional CPU power. For this reason, these cannot be implemented on older devices using a single core MIPS CPU (like the RT-AC66). The newer dual core ARM devices such as the RT-AC56 or RT-AC68 should be able to run it, however it is unknown at this point if ASUS intends to port these features to these older models.
Check the gallery below for some AiProtection feature screenshots with commentary. Note that despite the addition of AiProtection parental controls, URL, Keyword and Service filters are still available in the Firewall features. Only service filters can be applied to specific devices (IP address).
As noted earlier, ASUS has arguably the broadest feature set found in any stock router firmware. In addition to the major new features, there are old favorites like AiCloud Cloud Disk, Smart Access and Smart Sync. IPV6 is supported for both WAN connection and firewall. VPN support is flexible with both PPTP and OpenVPN servers. And dual WAN support is included for both select 3G / 4G WWAN USB dongles or by repurposing one of the LAN ports to connect to a second cable or DSL modem.
The last gallery further describes some of these features.
Features - Wireless
The AC87 is packing first-in-category 4x4 wireless technology inside. But that innovation doesn't surface in the wireless settings. The General wireless settings are the same as ASUS' other AC routers, with the 5 GHz General setting screen shown below. Everything here is familiar territory.
Basic Wireless Settings
Moving over to the 5 GHz Professional tab is anti-climactic...
5 GHz Advanced Wireless settings
...especially compared to the 2.4 GHz "pro" settings. Either Broadcom provides access to more knobs than Quantenna, or ASUS has decided to keep things simple on the 4x4 side of the house. At least both bands provide the new percent-style transmit power adjustment. In keeping with FCC's tighter rules, you can adjust power downward only. No more cranking it up to 11, folks.
Note that there are no MU-MIMO controls either, not even an enable/disable, even though Quantenna and ASUS say MU-MIMO is baked into the cake.
2.4 GHz Advanced Wireless settings
At least WDS bridging / repeating is supported on both bands. But note that neither RADIUS authentication nor channel 165 is supported on the 5 GHz radio.