We are pleased to welcome you as a new Sophos Access Point customer.
These operating instructions will help you install and configure the access point
and provide technical specifications of all Sophos access point models. In addition,
please also see the following documents that contain useful information on safety,
regulatory compliance, and configuration options:
Ì Sophos Access Points Safety Instructions and Regulatory Information
Ì Sophos UTM Administration Guide: Configuring the
UTM hardware and software appliance
The instructions must be read carefully prior to using the device and should be kept
in a safe place. You may download all user manuals and additional documentation
from the Sophos Knowledgebase at http://www.sophos.com/en-us/support/
knowledgebase.aspx.
Introduction
UTM Wireless Protection simplifies the operation of secure and reliable wireless
networks. It combines affordable and configuration-less access points through a builtin wireless controller in the in Sophos UTM. The wireless controller itself centrally
manages all wireless access points; all you need to do is plug in the device anywhere
in your network. The access point will find the controller, fetch its configuration and
become operable within seconds. In addition, it easily provides wireless guest Internet
access during the initial setup, unless you explicitly deny automatic configuration.
Installation
Preliminary steps
Please update your UTM appliance to the latest version available. Note that you also
need a valid UTM Wireless Protection subscription to operate the Sophos Access
Points.
Connect the access point to the internal network
Decide where you would prefer to place the access point, and put the access point in
that location. For mounting instructions, see below. Now connect the access point to
your internal network by plugging in the network cable to the access point’s RJ45 or
LAN (PoE) Ethernet interface, respectively.
1Wireless Access Points
Operating Instructions
Connect the access point to the power supply
The AAP 30, AP 50, AP 55, AP 55C, AP 100, AP 100C, and AP 100X can be powered
directly through the Power-over-Ethernet-injector. Note that it is also possible to
power them by a PoE-compliant switch. For more information on PoE-injectors, see
below.
Connect the AP 10 and AP 15 to the power supply. Please use the power supply from
the scope of supply. Note that the AP 15 can also be operated through a PoE-injector
or PoE-compliant switch.
Start the communication between the access point and the UTM appliance
When connected to the network, the access point will try to receive an IP address via
DHCP. Therefore, you need either the UTM appliance (with a DHCP server enabled
and listening on the interface the access point is connected to) or any other DHCP
server to provide an IP address for the access point.
After successfully receiving an IP address, the access point will communicate with
the UTM appliance. For this to happen, the UTM appliance needs to be put in the
upstream of the access points, either being the default gateway of the access points
(which was provided by the DHCP service) or on the default route (most likely your
route to the Internet).
Please note that the actual Internet access is not necessary to use UTM Wireless
Protection. While waiting for DHCP and searching for the UTM appliance, the access
point’s power LED will blink slowly.
Enable UTM Wireless Protection on the UTM appliance
In WebAdmin, navigate to the Wireless Protection menu entry. On the Global Settings
tab, click the Enable button. When enabling Wireless Protection for the first time,
the Initial Setup frame will appear. It shows the configuration which will be created:
A separate Wireless “Guest” network using WPA2 personal with DHCP for wireless
clients, which will be allowed to use DNS on the UTM appliance and the “Web
Surfing” service.
The pre-shared key is auto-generated and will only be shown in this section. This
configuration is intended as a template, you can edit the settings at any time on the
Wireless Protection > Wireless Networks tab. You can also skip the initial setup by
ticking the checkbox on the bottom of the section.
2Wireless Access Points
Operating Instructions
Accepting the access point
The UTM appliance will start to communicate with the access point and they will
show up as “Pending” on the Wireless Protection > Access Points tab in WebAdmin.
The ID of the Access Points, shown in square brackets, is also printed on the bottom
of the device. It can be used to distinguish the access point. By clicking the Accept
button, you are given the option to select the channel this access point will transmit
on. When leaving the channel setting on “Auto”, the access point will use the least
used channel.
We also suggest to give the access point a meaningful location (e.g., “Meeting Room”)
as this will ease handling multiple access points. After clicking the Save button,
the access points will reboot. Upon reconnect, the access point will check if a more
recent firmware is available. If so, they will automatically perform a firmware update.
During the firmware update, the access point’s power LED will blink rapidly.
Important note: Do not unplug the power while the firmware is updating. Otherwise
the access point will be rendered inoperable and must be returned to the reseller.
The access point will then reboot to complete the firmware update. If no new
firmware is available, the access point is operational and appears as “Active” in
WebAdmin.
Country code selection usage (WLAN devices)
Note: According to FCC regulations, all WLAN devices marketed and sold in the U.S.
must be restricted to U.S. channels only. Therefore, the country code selection is
applicable to non-U.S. models only. So changing the country setting of any Sophos
AP sold in the U.S. will not modify authorized parameters such as RF channels, which
means that the Access Point will always operate in U.S. authorized channels.
3Wireless Access Points
Operating Instructions
AP 10
Scope of supply
Sophos AP 10Security NotesPower supplyDetachable dipole antennaEthernet cable
Mounting instructions
The Sophos AP 10 can be mounted on the wall. Screws are not included in delivery.
Only use screws whose dimensions correspond with the mounting holes on the back
side.
AP 10
Controls
Power (LED display)
OffPower off
On continuouslyPower on
Blinking rapidlyFirmware update
Blinking slowlyNo connection to the Sophos UTM
LAN connection (LED display)
On continuouslyNetwork connection, no activity
BlinkingNetwork activity
WLAN access (LED display)
Reset10/100 Base-TXPower
On continuouslyNetwork connection, no activity
BlinkingNetwork activity
Interfaces and buttons
DC-INPower
RJ4510/100 Base-TX interface
ResetCurrently not supported
4Wireless Access Points
Operating Instructions
Technical specifications
Sophos AP 10
ChassisPlastic housing, white
Maximum throughput150 Mbit/s
LAN interfaces1 x 10/100 Base-TX
Supported WLAN standards802.11 b/g/n 2.4 GHz
Antenna1 x detachable dipole antenna (2 dBi)Connector type: RP-SMA
EMC:EN 301489-1, EN 301489-17CFR 47, Part 15 Subpart B
EMF:EN 50385FCC 1.1310, IEEE C95.1
Safety:EN 60950-1N/a
7Wireless Access Points
Operating Instructions
AP 15 Mounting template
Do not shrink to fit when printing
12 cm (4,72 in)
8Wireless Access Points
Operating Instructions
AP 30
Scope of supply
Power-over-Ethernet (PoE)
Sophos AP 302 screws and dowelsSecurity NotesEthernet cable2 Detachable dipole antenna
injector + power cord
Mounting instructions
The Sophos AP 30 can be mounted on the ceiling. Screws are included in delivery.
Use the screws from the scope of supply or screws whose dimensions correspond
with the mounting holes in the bracket.
1. Remove the bracket from the housing
Unlock the bracket on the backside by turning it (approx. 5°)
counter-clockwise. Then you can take off the bracket.
2. Mount the bracket on the ceiling
Use the screws and anchors from the scope of supply.
Power10/100 Base-TX
3. Place the access point on the bracket
Place the housing on the bracket and lock it by turning clockwise until stop.
Controls
Power (LED display)
OffPower off
On continuouslyPower on
Blinking rapidlyFirmware update
Blinking slowlyNo connection to the Sophos UTM
LAN connection (LED display)
On continuouslyNetwork connection, no activity
BlinkingNetwork activity
WLAN access (LED display)
On continuouslyNetwork connection, no activity
BlinkingNetwork activity
Interfaces and buttons
Reset
Ethernet10/100 Base-TX interface
12 V DC INPower
Currently not supported
9Wireless Access Points
Operating Instructions
Technical specifications
Sophos AP 30
ChassisPlastic housing, white (smoke detector design)
Sophos AP 50Ethernet cable2 Detachable dipole antenna
Security Notes
Power-over-Ethernet (PoE)
injector + power cord
Mounting instructions
The Sophos AP 50 can be mounted on the wall. Screws are not included in delivery.
Only use screws whose dimensions correspond with the mounting holes on the back
side.
Number of supported SSIDs8 per radio (16 in total)
Regulatory complianceCEFCC
Radio:EN 300 328, EN 301 893 CFR 47, Part 15 Subpart C, E
EMC:EN 301 489-1, EN 301 489-17 CFR 47, Part 15 Subpart B
EMF:EN 50385FCC 1.1310, IEEE C95.1
Safety:EN 60950-1N/a
5.180-5.320GHz (channels 36-64)
RLAN sub-band 2:
5.500-5.580GHz (channels 100-116)
5.660-5.700GHz (channels 132-140)
5.180-5.240GHz (channels 36-48)
U-NII-3:
5.745-5.825GHz (channels 149-165)
15Wireless Access Points
Operating Instructions
AP 55C
Scope of supply
Security NotesEthernet cableSophos AP 55CMounting bracket
Important note: Sophos AP 55C requires Sophos UTM V 9.308 to be installed.
Mounting instructions
The Sophos AP 55C can be mounted on the ceiling. Screws are included in delivery.
Use the screws from the scope of supply or screws whose dimensions correspond
with the mounting holes in the bracket.
1. Mount the bracket on the ceiling
Use the screws and anchors from the scope of supply.
2. Place the access point on the bracket
Place the housing on the bracket and lock it by turning clockwise until stop.
Controls
LED
Green - blinking slowlyAP is booting
Green - blinking rapidlyNetwork connectivity
Orange - blinking slowlyNo connection to the Sophos UTM
Orange - blinking rapidlyFirmware update
Power1 x 10/100/1000 Base-TX
Interfaces and buttons
12V DC-INPower
LAN (PoE)10/100/1000 Base-TX interface
Screws and
T-rail clips
16Wireless Access Points
Operating Instructions
Technical specifications
Sophos AP 55C
ChassisTop enclosure: plastic, white; bottom enclosure: metal, white
Number of supported SSIDs8 per radio (16 in total)
Regulatory complianceCEFCC
Radio:EN 300 328, EN 301 893 CFR 47, Part 15 Subpart C, E
EMC:EN 301 489-1, EN 301 489-17 CFR 47, Part 15 Subpart B
EMF:EN 50385FCC 1.1310, IEEE C95.1
Safety:EN 60950-1N/a
5.180-5.320GHz (channels 36-64)
RLAN sub-band 2:
5.500-5.580GHz (channels 100-116)
5.660-5.700GHz (channels 132-140)
5.180-5.240GHz (channels 36-48)
U-NII-2:
5.260-5.320GHz (channels 52-64)
U-NII-2e:
5.500-5.580GHz (channels 100-116)
5.660-5.700GHz (channels 132-140)
U-NII-3:
5.745-5.825GHz (channels 149-165)
19Wireless Access Points
Operating Instructions
AP 100C
Scope of supply
Security NotesEthernet cableSophos AP 100CMounting bracket
Important note: Sophos AP 100C requires Sophos UTM V 9.308 to be installed.
Mounting instructions
The Sophos AP 100C can be mounted on the ceiling. Screws are included in delivery.
Use the screws from the scope of supply or screws whose dimensions correspond
with the mounting holes in the bracket.
1. Mount the bracket on the ceiling
Use the screws and anchors from the scope of supply.
2. Place the access point on the bracket
Place the housing on the bracket and lock it by turning clockwise until stop.
Controls
LED
Green - blinking slowlyAP is booting
Green - blinking rapidlyNetwork connectivity
Orange - blinking slowlyNo connection to the Sophos UTM
Orange - blinking rapidlyFirmware update
Power1 x 10/100/1000 Base-TX
Interfaces and buttons
12V DC-INPower
LAN (PoE)10/100/1000 Base-TX interface
Screws and
T-rail clips
20Wireless Access Points
Operating Instructions
Technical specifications
Sophos AP 100C
ChassisTop enclosure: plastic, white; bottom enclosure: metal, white
Sophos AP 100XSecurity Notes6 antenna1 wall mount plate Ethernet cableGrounding wire
1 M25
cable gland
Installation
Important note: Sophos AP 100X requires Sophos UTM V 9.308 to be installed.
Mounting instructions
The Sophos AP 100X can be mounted on a pole. A mounting kit is included in delivery.
Warning: The equipment has a separate protective earthing terminal on the chassis
that must be permanently connected to earth ground to adequately ground the
chassis and protect the operator from electrical hazards.
Caution: Before equipment installation begins, ensure that a service personnel has
attached an appropriate grounding lug to the grounding cable that you supply.
Connect a ground cable from the outdoor
unit to an appropriate grounding point.
Power installation must be performed with qualified electrician and followed with
National Electrical Code, ANSI/NFPA 70 and Canadian Electrical Code, Part I, CSA C22.1.
To connect earth ground to Unit:
Ì Connect one end of the grounding cable to a proper earth ground.
Ì Place the grounding lug attached to the grounding
cable over the protective earthing terminal.
10/100/1000 Base-TX
Ì Secure the grounding lug to the protective earthing
terminal with the washers and screws.
Ì Dress the grounding cable and ensure that it does not
touch or block access to other components.
Warning: At first before powered on, connect the frame of the unit to earth. For
earthing wire, green-and-yellow insulation is required and the cross-sectional area of
the conductor must be more than 0.75mm2 or 18 AWG.
Controls
LED
Power (Green) - continuously onPower on
WLAN (Green) - blinking rapidlyWLAN activity
WLAN (Green) - blinking regularlyFirmware update
LAN (Green) - blinking rapidlyNetwork connectivity
Antenna6 x external dipole antennaConnector type: N-Type
Antenna gain4 dBi @ 2.4GHz, 6 dBi @5GHz
Supported WLAN standards802.11a/b/g/n/ac
Frequencies / channelsETSI
Dimensions W x H x D255 x 225 x 90 mm
Weight2.5 kg
Power supplyPoE only
Power consumption15 W (max.)
Power-over-Ethernet802.3at
Temperature rangeOperation: -20°C to 60°CStorage: -30°C to 60°C
Humidity (non-condensing)Operation: 0% to 90%Storage: 0% to 95%
Regulatory complianceCEFCCUL
Metal housing, white
2.412-2.472GHz (channels 1-13)RLAN sub-band 2:
FCC
2.412-2.462GHz (channels 1-11)U-NII-1:
Radio:EN 300 328, EN 301 893 CFR 47, Part 15
EMC:EN 301489-1,
EN 301489-17
EMF:EN 62311CFR 47, Part 2
Safety:EN 60950-22N/aUL 60950-22
5.500-5.580GHz (channels 100-116)
5.660-5.700GHz (channels 132-140)
5.180-5.240GHz (channels 36-48)
U-NII-2:
5.260-5.320GHz (channels 52-64)
U-NII-2e:
5.500-5.580GHz (channels 100-116)
5.660-5.700GHz (channels 132-140)
U-NII-3:
5.745-5.825GHz (channels 149-165)
Subpart C Section
15.247 and Subpart
E Section 15.407
CFR 47, Part 15
Subpart B
(Section 2.1091)
N/a
N/a
N/a
23Wireless Access Points
Operating Instructions
Power-over-Ethernet injector
Optionally included with AP 30, AP 50, AP 100 and AP 100X
The PoE injector converts alternating current (AC) to direct current (DC), which is
then provided over the Ethernet cable to power the Sophos Access Points AP 30,
AP 50, AP 100 and AP 100X.
Installation
Warning: Do not use crossover cable between the PoE injector’s output port and the
access point.
Before placing the PoE injector, please pay attention to the following safety
instructions:
Ì Do not cover the PoE injector or block the airflow to the PoE
with any foreign objects. Keep the PoE away from excessive
heat and humidity and free from vibration and dust.
Ì Ensure that the cable length from Ethernet network source to the access point
does not exceed 100 m
(330 ft). The PoE is not a repeater and does not amplify the Ethernet data signal.
To install the PoE injector, proceed as follows:
LED
Data & Power Out
Data In
Power
1. Connect an Ethernet cable to the Data & Power Out interface.
2. Connect the other end of this Ethernet cable to the
Ethernet interface of the access point.
3. Connect an Ethernet cable to the Data In interface.
4. Connect the other end of this Ethernet cable to your network switch.
5. Connect the AC power cord from the scope of supply to the PoE injector.
6. Connect the AC power cable to an AC outlet
(100-240 VAC).
Controls
PoE injector PD-3501/AC
(AP 30)
LED display
OffPower off
Yellow continuouslyPower on
Green continuouslyA remote terminal is connectedA remote terminal is connected
Green blinkingOverload state or short-circuitOverload state or short-circuit
Interfaces
Input (Data In)1 x 10/100 Base-TX1 x 10/100/1000 Base-TX
Output (Data & Power Out) 1 x 10/100 Base-TX, plus 50 VDC1 x 10/100/1000 Base TX, plus 55 VDC
PoE injector PD-9001GR/AC
(AP 50/AP 55/AP 55C/
AP 100/ AP 100C/AP 100X)