WatchGuard AP420 operation manual

WatchGuard

AP420

Hardware

Guide

the WatchGuard Web site that is used herein are either registered trademarks or trademarks of WatchGuard Technologies, Inc. and/or its subsidiaries in the United States and/or other countries. All other trademarks are the property of their respective owners.

Revised: November 21, 2019 Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this guide may be

reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc.

Complete copyright, trademark, patent, and licensing information can be found in the WatchGuard product documentation. You can find this document online at:

https://www.watchguard.com/help

ABOUT WATCHGUARD

WatchGuard® Technologies, Inc. is a global leader in network security, providing bestin-class Unified Threat Management, Next Generation Firewall, secure Wi-Fi, and network intelligence products and services to more than 75,000 customers worldwide. The company's mission is to make enterprise-grade security accessible to companies of all types and sizes through simplicity, making WatchGuard an ideal solution for Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visit WatchGuard.com.

For additional information, promotions and updates, follow WatchGuard on Twitter, @WatchGuard on Facebook, or on the LinkedIn Company page. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them at www.secplicity.org.

ii WatchGuard AP420

ADDRESS

505 Fifth Avenue South Suite 500 Seattle, WA 98104

SUPPORT

www.watchguard.com/support U.S. and Canada +877.232.3531 All Other Countries +1.206.521.3575

SALES

U.S. and Canada +1.800.734.9905 All Other Countries +1.206.613.0895

Hardware Specifications

The WatchGuard® AP family of wireless access points provide secure, reliable, wireless communications while delivering high performance and broad coverage—a perfect combination of services to meet the needs of enterprise-level customers, small businesses, branch offices, campuses, and hotels alike.

Internal antennas, slim cases, minimalist labeling, and small LEDs, coupled with wall and ceiling mount options, make these devices ideal for low profile deployment scenarios. Power can be provided by any Power over Ethernet (PoE+) power source or an AC adapter. WatchGuard AP420 devices are high performance, enterprise access points that feature 4x4:4 MU-MIMO 802.11ac Wave 2 capabilities with a dedicated third radio for security scanning and automated over-the-air attack prevention.

There are two ways you can manage your AP420:

Total Wi-Fi and Secure Wi-Fi with WatchGuard Wi-Fi Cloud

A powerful cloud-based enterprise wireless management solution for AP configuration, security, and monitoring.

Basic Wi-Fi with WatchGuard Firebox Gateway Wireless Controller

Local management, configuration, security, and monitoring of APs directly from your WatchGuard Firebox. The WatchGuard Firebox requires Fireware v11.12.4 and higher.

Note: The third-radio is not available when managed locally with a Gateway Wireless Controller.

For more information about how to set up and manage your WatchGuard AP, you can find documentation online at: https://www.watchguard.com/help

Package Contents

 WatchGuard AP420  Quick Start Guide  Mounting bracket for T-rail ceilings (15/16”, 24mm)

Optional mounting accessories for walls or ceilings without a T-rail, or different size T-rail ceilings are also available from WatchGuard. For more information, see “Mounting Instructions” on page 9.

Hardware Guide 1

Hardware Specifications

About Your Hardware

Hardware Specifications

AP420

Radio Type and Frequency Band

Antenna 10 integrated omnidirectional antennas

Ethernet interface 1 x 10/100/1000 Mbps Gigabit Ethernet (LAN1)

2.4GHz, 802.11b/g/n. Max data rate: 800 Mbps 5GHz, 802.11a/n/ac. Max data rate: 1.733 Gbps Third radio for dedicated RF and security scanning

 4 antennas: 2.4GHz radio  4 antennas: 5GHz radio  2 antennas: Third scanning radio

802.3at PoE+ / 802.3af PoE, PoE input voltage: 48V

1 x 10/100/1000 Mbps Gigabit Ethernet (LAN2) for link aggregation or a wired extension.

1 x RJ45 serial console RS232 Serial Bits per second: 115200 Data Bits: 8, Stop Bits: 1 Parity: None, Flow Control: None

USB Port 1 USB 2.0 port (Not in use) Power Interface Power over Ethernet: 802.3at (PoE+) / 802.3af (PoE)

DC jack (6.3mm connector): 12V DC input, 2.0A

Power Consumption

MTBF Rating 1,320,756 hours at 25°C

Dimensions 220mm × 220mm × 57mm Weight 2.86 lb. (1.3 kg)

802.3at (PoE+): 21.5W

802.3af (PoE): 12.95W DC power: 19.5W Idle: 8W

662,479 hours at 40°C

2 WatchGuard AP420

Environmental Requirements

To safely install your WatchGuard AP, we recommend that you:

 Install the device indoors.  Make sure the device has adequate clearance for air flow and cooling.  Connect it to a surge-protected power supply to prevent damage from sudden power changes

Other environmental requirements:

Operating temperature 0°C to 40°C (32°F to 104°F) Operating relative humidity 0% to 95% non-condensing Non-operating temperature -25°C to 75°C (-13°F to 167°F) Non-operating relative humidity 0% to 95% non-condensing

Hardware Specifications

Hardware Guide 3

Hardware Specifications

Hardware Description

Device Connections and Buttons

Ethernet Network Interfaces

LAN1 (PoE+): Standard RJ45 connector that supports link speeds of 10/100/1000 Mbps and PoE+ connectivity.

LAN2: Standard RJ45 connector that supports link speeds of 10/100/1000 Mbps. This interface can be used for link aggregration or as a wired extension for a wireless SSID that has NAT enabled. For more information, see the WatchGuard Wi-Fi Cloud Help.

For APs managed locally by a Gateway Wireless Controller with Fireware v12.2.1 and higher, you can bridge together the LAN ports on AP models that have two LAN interfaces. This enables you to extend the wired network on the second LAN interface. For more information, see the Fireware Help.

Power Input

The WatchGuard AP420 can be powered by 802.3at PoE+ or 802.3af PoE on the LAN1 (PoE+) interface, or an optional power adapter.

To make sure that LLDP-capable switches provide appropriate PoE+ power to the AP420:

 You must enable LLDP on the switch  Disable static allocation of maximum power of 30W (if previously configured)

For more information, see AP420 and PoE+ power with switches and LLDP.

The use of 802.3af PoE results in limited feature functionality of the AP:

 USB port and LAN2 Ethernet extension port is disabled.  The 2.4 GHz radio is downgraded to 1x1 15dbm or lower, or as set in the device template.  The 5 GHz radio is downgraded to 1x1 15dbm or lower, or as set in the device template.  Third scanning radio is downgraded to 1x1 with 12dBm transmit power. Lower PoE power

results in reduced performance and effectiveness of WIPS scanning and intrusion prevention functions.

4 WatchGuard AP420

Hardware Specifications

Console Port

Standard RJ45 connector for serial console access.

USB Port

The USB port is currently not in use.

Reset Button

Resets the WatchGuard AP to factory-default settings. You must use a paper clip or other small object to press the reset button through the small hole on top of the device.

To reset the device to factory-default settings, press and hold the reset button for up to 10 seconds until all LEDs go off to indicate that the device has rebooted.

Kensington Security Lock Slot

Kensington security lock slot for use with a security cable to secure your device.

Hardware Guide 5

Hardware Specifications

Device Indicators

The front panel of the AP420 has four LEDs that indicate the status of the AP.

6 WatchGuard AP420

Hardware Specifications

The AP420 always works in AP combo mode where the first two radios work in AP mode and the third radio works in WIPS (Wireless Intrusion Prevention System) sensor mode. The fourth LED indicates that the WIPS sensor on the third radio is active.

AP Firmware 8.8.1 and Higher

LED Status

Off Powered off. Radio inactive. Green Powered on. Operating at normal power and capabilities.

Flashing Green

Orange Powered on. Operating at reduced power and

Flashing Orange

Power/Ethernet 2.4 GHz, 5 GHz, and

3rd Radios

Radio active.

(PoE+ or DC power). Connected at 10/100/1000 Mbps Not connected to Wi-Fi Cloud or paired with a Gateway

Wireless Controller.

capabilities. (For example: PoE 802.3af) See AP Power Requirements

No IP address received from DHCP. -

Hardware Guide 7

Hardware Specifications

AP Firmware 8.8.0 and Lower

Power / Ethernet

Solid green Solid green Solid green Powered on and operating correctly with a gigabit

Fast flash green Any Any Did not receive a valid IP address from DHCP.

Slow flash green Any Any Cannot connect to WatchGuard

Solid green / Solid yellow

Solid Green / Solid yellow

Solid yellow Solid green Solid green Powered on and operating correctly with non-gigabit

Fast flash yellow Any Any Did not receive a valid IP address from DHCP.

Slow flash yellow Any Any Cannot connect to WatchGuard Wi-Fi Cloud services.

Solid orange Any Any No ethernet connection. Slow flash orange Any Any Software upgrade in progress. Off Off Off Not powered on or in startup process.

2.4GHz 5GHz Description

ethernet connection. Connected to WatchGuard Wi-Fi Cloud services.

Connected with a gigabit ethernet connection.

Wi-Fi Cloud services. Connected with a gigabit ethernet connection.

Fast flash green

Solid green Fast flash

Slow flash green

Solid green Slow flash

Solid green Troubleshooting running on 2.4GHz radio.

LED1 = Solid green if AP is on gigabit ethernet connection. Solid yellow if on non-gigabit ethernet connection.

Troubleshooting running on 5GHz radio.

green

Solid green Prevention running on 2.4GHz radio.

green

LED1 = Solid green if AP is on gigabit ethernet connection. Solid yellow if on non-gigabit ethernet connection.

Prevention running on 5GHz radio. LED1 = Solid green if AP is on gigabit ethernet connection. Solid yellow if on non-gigabit ethernet connection.

ethernet connection. Connected to WatchGuard Wi-Fi Cloud services.

Connected with non-gigabit ethernet connection.

The LEDs for 2.4GHz and 5GHz will flash indicating activity if a client is connected on the corresponding radio. If no client is connected to a radio, the corresponding LED will remain solid green.

8 WatchGuard AP420

Mounting Instructions

Your package includes the AP420 device, and a mounting bracket.

Hardware Specifications

The MAC address and serial number of your AP are printed on a label on the back of the device. Make sure you record this information before you mount the AP.

Hardware Guide 9

Hardware Specifications

T-rail Brackets

Use the included mounting bracket (15/16”, 24mm, Part #: WG8021) to install the AP420 on a ceiling with a T-rail. Optional T-rail mount brackets are available from WatchGuard:

 9/16” T-rail mount, 15mm, Part #: WG8026  Silhouette/Interlude T-rail mount, 15mm, Part #: WG8027

1. Put the first mounting post on the back of the AP over the lower bracket notch and rotate into place.

2. Make sure that all the mounting posts on the back of the AP are securely positioned in their bracket notches.

3. To attach the bracket to the T-rail, rotate the bracket so it is parallel to the T-rail, and snap the bracket on the T-rail.

10 WatchGuard AP420

+ 26 hidden pages