Watchguard AP User guide

Brand: Watchguard

Model: AP

Type: User guide

WatchGuard AP, an advanced wireless access point, empowers you with seamless network extension and robust security features. Ideal for small businesses and branch offices, it offers secure Wi-Fi connectivity for your employees and guests. With its centralized management through the WatchGuard Gateway Wireless Controller, you can effortlessly configure and monitor multiple APs, ensuring a consistent and protected wireless experience.

WatchGuard APDeployment Guide

WatchGuard AP

Deployment Guide

AP100, AP200

2 APDeployment Guide

About this Guide

The WatchGuard APDeployment Guide is a guide for deployment of a WatchGuard APdevice with an

XTMdevice. For the most recent product documentation, see the Fireware XTM WatchGuard System

Manager Help or Fireware XTMWeb UI Help on the WatchGuard web site at:

http://www.watchguard.com/help/documentation/.

Information in this guide is subject to change without notice. Companies, names, and data used in examples

herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any

form or by any means, electronic or mechanical, for any purpose, without the express written permission of

WatchGuard Technologies, Inc.

Guide revised: 1/7/2014

mentioned herein, if any, are the property of their respective owners.

Complete copyright, trademark, patent, and licensing information can be found in the Copyright and

Licensing Guide, available online at: http://www.watchguard.com/help/documentation/.

About WatchGuard

WatchGuard offers affordable, all-in-one network and content

security solutions that provide defense-in-depth and help meet

regulatory compliance requirements. The WatchGuard XTM line

combines firewall, VPN, GAV, IPS, spam blocking and URL

filtering to protect your network from spam, viruses, malware, and

intrusions. The new XCS line offers email and web content

security combined with data loss prevention. WatchGuard

extensible solutions scale to offer right-sized security ranging from

small businesses to enterprises with 10,000+ employees.

WatchGuard builds simple, reliable, and robust security

appliances featuring fast implementation and comprehensive

management and reporting tools. Enterprises throughout the world

rely on our signature red boxes to maximize security without

sacrificing efficiency and productivity.

For more information, please call 206.613.6600 or visit

www.watchguard.com.

Address

505 Fifth Avenue South

Suite 500

Seattle, WA 98104

Support

www.watchguard.com/support

U.S. and Canada +877.232.3531

All Other Countries

+1.206.521.3575

Sales

U.S. and Canada +1.800.734.9905

All Other Countries

+1.206.613.0895

AP Deployment Guide i

Table of Contents

WatchGuard APDeployment Guide 1

About this Guide 2

About WatchGuard 2

Address 2

Support 2

Sales 2

Introduction 1

WatchGuard AP Device Requirements and Limitations 1

Requirements 1

Limitations 1

AP Deployment Steps 2

Benefits of Using VLANs with Your APDevice 2

Step 1 — Enable the Gateway Wireless Controller 3

Step 2 — Connect the APDevice 4

Step 3 — Configure the SSIDs 5

Step 4 — Pair the APDevice 6

Step 5 — Configure the APDevice Radios 7

Plan your Wireless APDevice Deployment 8

Wireless Site Survey 9

Wireless Modes and Channels 10

Wireless Channels 10

Channel Selection 10

Wireless Signal Strength and Noise Levels 11

Signal Strength 11

Noise Level 11

Signal to Noise Ratio 11

Wireless Environmental Factors 12

Wireless Placement 13

Monitor AP Device Status 14

Monitor Wireless Clients 15

About APDevice Activation 16

Reset the WatchGuard AP Device 16

Additional Resources 16

AP Deployment Guide ii

AP Deployment Guide 1

Introduction

The mass adoption of smart wireless devices such as tablets, smartphones and notebooks is driving the

BYOD (bring your own device) explosion, putting ever increasing demands for wireless access on your

network. WatchGuard's AP100 and AP200 devices enable you to add wireless access to the networks

protected by your XTM device.

To add wireless access to your network, you simply connect one or more WatchGuard APdevices to any

trusted or optional network on your XTMdevice. Then you use the Gateway Wireless Controller on the

XTMdevice to discover, configure, and manage the APdevices. The network security policies already on

your XTMdevice automatically apply to wireless users.

You can then configure the AP device and SSIDs to meet your wireless network requirements.

n To increase the wireless range of your network and support wireless roaming you can use the same

SSID on multiple APdevices.

n To support different groups of wireless users, you can configure your AP device to use multiple

wireless SSIDs.

n You can optionally enable VLAN tagging in your SSIDs, and then use the VLANs in your policies to

create more granular rules for your wireless users, based on the SSIDthat they connect to.

The procedures in this document describe how to use Policy Manager to configure the

XTM device and APdevice. You could also use the Fireware XTMWeb UI to do these

steps. For more information, see the Fireware XTMWeb UI Help.

This document focuses on what you need to know for initial deployment of a WatchGuard AP 100 or AP 200

device on your network. For a more comprehensive reference to all AP device functionality, see the

WatchGuard System Manager Help.

WatchGuard AP Device Requirements and Limitations

Before you add a WatchGuard AP device to your network, it is important to understand the requirements and

limitations of the AP device.

Requirements

n The WatchGuard AP device must be managed by a WatchGuard XTMdevice that uses Fireware XTM

OS v11.7.2 or higher.

n The XTMdevice must be configured in mixed routing mode.

n The APdevice must connect to a trusted or optional network.

n The XTM device configuration must include a policy that allows NTP traffic from the APdevice to the

Internet. The AP device uses an NTPserver to set the correct local time.

Limitations

n You cannot use the Fireware XTMCommand Line Interface to manage WatchGuard AP devices.

n You cannot use a WatchGuard Management Server to manage WatchGuard AP devices.

n You cannot locate WatchGuard APdevices behind a NATfirewall.

AP Deployment Steps

When you add one or more WatchGuard AP devices to your network, you can manage and configure the AP

devices from the Gateway Wireless Controller on an XTMdevice. You do not have to connect directly to the

AP device to configure it. The Gateway Wireless Controller on the XTMdevice manages the AP device for

you.

To deploy any AP device on your XTMdevice network you must:

1. Enable the Gateway Wireless Controller on the XTMdevice.

2. Connect the APdevice to your network.

3. Configure the SSIDs you want to use.

4. Pair the APdevice with the XTMdevice.

5. Configure the APdevice settings.

You can optionally enable VLAN tagging in the SSIDs for your APdevice. If you enable VLAN tagging, you

must also configure the necessary VLANs on your XTM device.

This APDeployment Guide describes the basic steps necessary to deploy an AP device on your network. For

a more detailed description of the configuration settings, see the WatchGuard System Manager Help.

Benefits of Using VLANs with Your APDevice

To deploy an APdevice on your network, you do not need to enable VLAN tagging. There are, however,

several reasons you could want to enable VLAN tagging:

You want to configure different firewall policies for SSIDs that connect to the same network

If you configure multiple SSIDs for your AP devices, and you want to set different firewall policies for

each SSID, you can enable VLANtagging in the SSID and then use the VLAN IDassociated with each

SSID in policies specific to each SSID. For example, you could add a different HTTP policy for each

SSID that specifies the VLANassociated with that SSID. This enables you to specify which users can

connect to each SSID.

You want to separate the traffic on the same physical network to different logical networks.

If you have several APdevices connected to the same physical network, VLAN tagging gives you the

ability to separately examine traffic for wireless clients connected to each SSID. For example, if you run

a network analyzer, you can use the VLAN tags to see the traffic for the VLANIDassociated with an

SSID.

Or, you might want to set up all of your AP devices with one SSID for the trusted network and a different

SSID for the optional network. You can set up a trusted VLAN and an optional VLAN to separate the

traffic for the trusted and optional wireless clients.

The subsequent sections provide a more detailed overview of the steps to deploy an AP device without

VLANtagging. See the WatchGuard System Manager Help for more information about VLANs, and for

configuration examples,

AP Deployment Steps

APDeployment Guide

AP Deployment Steps

AP Deployment Guide 3

Step 1 — Enable the Gateway Wireless Controller

For the XTM device to discover and manage APdevices, you must enable the Gateway Wireless Controller.

1. Open your XTMdevice configuration in Policy Manager.

2. Select Network >Gateway Wireless Controller.

3. Select the Enable the Gateway Wireless Controller check box.

4. Type the WatchGuard APPassphrase that you want all your APdevices to use after they are paired.

5. Click Settings.

6. Select the location of the WatchGuard APdevices from the list of countries.

This location is used to help configure the wireless radio on your APdevices.

7. Save the configuration to the XTMdevice.

Step 2 — Connect the APDevice

Use one of these options to connect the APdevice to your trusted or optional network. By default, the

APdevice automatically requests an IP address from a DHCP server on the local network.

If the network you connect your APdevice to does not use DHCP, you can use the web UI

on the AP device to manually assign a staticIPaddress to the APdevice before you

connect it to your network. See the APSetup Guide or WatchGuard System Manager Help

for more information.

APdevice connected to the XTMdevice APdevice connected to a switch

Option 1 —Connect the APdevice to an XTMdevice interface

If you have an unused interface on your XTMdevice, you can connect the AP device directly to an

XTMdevice trusted or optional interface.

To configure the XTM device interface as a trusted or optional interface:

1. In Policy Manager, select Network > Configuration.

2. Configure the XTMdevice interface as trusted or optional, and enable DHCP on that interface.

3. Save the configuration to the XTMdevice.

4. Connect the APdevice to the interface you configured.

Option 2 - Connect the APdevice to a switch

You can connect the AP device to the switch on your trusted or optional network. It is not necessary to

change the network settings on the XTM device interface.

AP Deployment Steps

APDeployment Guide

AP Deployment Steps

AP Deployment Guide 5

Step 3 — Configure the SSIDs

Configure the SSIDs that you want your wireless users to connect to.

1. In Policy Manager, select Network >Gateway Wireless Controller.

2. In the SSIDs tab, click Add to add an SSID.

3. In the Network Name (SSID) text box, type the SSID for the wireless network.

The SSID is the network name wireless clients see when they connect to the AP device.

4. Click the Security tab.

5. From the Security Mode drop-down list, select the wireless security mode.

By default, the security mode is set to Disabled. In this mode, the SSID operates as an open wireless

network. You can change this to one of the WPA or WPA security modes that use pre-shared keys

(PSK) or RADIUS authentication.

n WPAonly (PSK)

n WPA2 only (PSK)

n WPA/WPA2 (PSK)

n WPA Enterprise

n WPA2 Enterprise

n WPA/WPA2 Enterprise

6. Configure the security settings for the selected security mode.

7. Repeat these steps to create additional SSIDs.

To use the Enterprise authentication methods, you must have a RADIUSserver.

Step 4 — Pair the APDevice

When you first connect the AP device to your network, it is an unpaired Access Point. In this step, you pair the

AP device to your XTMdevice.

1. In Policy Manager, select Network >Gateway Wireless Controller.

2. Click the Access Points tab.

3. Below the Unpaired Access Points list, click Refresh to start a scan for unpaired APdevices.

4. Type the XTMdevice configuration passphrase.

The XTMdevice begins to scan for unpaired APdevices.

5. From the Unpaired Access Points list, select the AP device you want to pair.

6. Click Pair.

7. In the Pairing Passphrase dialog box, type the passphrase of the AP device.

The default AP passphrase is wgwap.

8. Click OK.

The Edit Access Dialog box appears.

AP Deployment Steps

APDeployment Guide

AP Deployment Steps

AP Deployment Guide 7

Step 5 — Configure the APDevice Radios

The Edit Access Point dialog box automatically opens after you pair the APdevice. Here, you select the

radio settings to use for each radio.

1. For an AP100, you can select the radio Band to use.

The AP100 has one radio, Radio 1. You can configure it to use either the 2.4 GHz or 5 GHz band.

The AP200 has two single-band radios, Radio 1 and Radio 2. Radio 1 always uses the 2.4 GHz band,

and Radio 2 always uses the 5 GHz band.

2. For each radio, select the Wireless Mode. The available modes depend on the radio band.

n The 2.4 GHz band supports 802.11 B, G and N wireless modes.

n The 5 GHz band supports 802.11 A and N wireless modes.

3. (Optional) For each radio, select the Preferred Channel.

4. (Optional) For each radio, select the Rate.

The rate limits the maximum data transfer rate per wireless client.

5. For each radio, select a configured SSID and click Add.

6. Save the configuration to the XTMdevice.

The Preferred Channel and Rate are configurable in Fireware XTM v11.8 and higher.

Plan your Wireless APDevice Deployment

Before you deploy WatchGuard APdevices on your network, you must research, design, and plan your

wireless network deployment to make sure it meets your requirements for coverage, signal strength, data

rates, and security.

We recommend that you review these sections for general wireless knowledge and guidelines for a

successful deployment.

n Wireless Site Survey — Perform a wireless site survey to analyze your current environment and

wireless requirements.

n Wireless Modes and Channels — Determine which wireless modes and channels you support for

your wireless clients.

n Wireless Signal Strength and Noise Levels — Understand wireless signal strength and signal-to-

noise ratios.

n Wireless Environment Factors — Identify environmental factors that can affect the range and

performance of wireless networks.

n WatchGuard APDevice Placement — Determine the best location and placement of your

WatchGuard AP devices.

Plan your Wireless APDevice Deployment

APDeployment Guide

Plan your Wireless APDevice Deployment

AP Deployment Guide 9

Wireless Site Survey

Before you deploy a new WatchGuard AP device, you can perform a wireless site survey to analyze your

current environment and existing wireless signals. The wireless site survey helps you to identify your specific

requirements for your wireless network, and any external factors that could affect your deployment.

Site survey results can help you determine this information:

n Number of wireless clients that must be supported

n Areas of coverage and number of AP devices required

n Best physical placement of AP devices

n Range from clients to each AP device

n Minimum data rates required for specific applications

n Wireless signal strength and potential sources of wireless noise and interference

n Environmental factors that affect wireless signals, such as building construction and materials

Typically, you begin a site survey with a physical walk-through of your environment. It is helpful to have a

floor plan of your facilities that shows your existing networking environment and a list of requirements for

your planned wireless networks. A visual inspection helps you to understand the areas of coverage required,

the physical limitations and barriers due to building construction, and potential sources of wireless

interference.

After you complete a physical inspection of your facilities, you must be able to visualize and understand

where the current wireless signals are located in your environment, and how they react to your physical

environment.

Many wireless site survey tools are available that enable you to map your environment and generate

wireless heat maps, which provide a visual representation of the wireless signals in your environment. The

heat map shows the strength and range of wireless access points, how their signals react to your physical

environment, and identifies any existing wireless interference.

To determine what wireless signals and interference already exist in your environment, you can generate a

heat map to help you plan your deployment scenario. You can use one of the many available third-party

wireless site survey tools. such as Ekahau HeatMapper. After you install your AP devices, you can make

another heat map of your environment to see if your current placement provides adequate coverage and

signal strength for your wireless network.

Wireless Modes and Channels

The WatchGuard AP wireless device supports two different wireless bands: 2.4 GHz and 5 GHz. The band

you select and the country determine the wireless modes available.

n The 2.4 GHz band supports 802.11b, 802.11g and 802.11n

n The 5 GHz band supports 802.11a and 802.11n

The 802.11n protocol is the latest wireless standard, and provides high data rates and performance in the 5

GHz frequency band. It is only supported in the most recent types of wireless devices.

If you choose a wireless mode that supports multiple 802.11 standards, the overall

performance can drop considerably. This is partly because of the need for backward

compatibility when devices that use slower modes are connected. The slower devices

tend to dominate the throughput because it can take much longer to send or receive the

same amount of data to devices that use a slower mode.

Wireless Channels

A wireless channel is a specific division of frequencies within a specific wireless band.

For example, in the 2.4GHz band with a channel width of 20MHz, there are 14 defined channels spaced

every 5MHz. Channels 12 and 13 are applicable in countries outside of North America. Channel 14 is for

Japan only and is spaced at 12 MHz.

One wireless channel can overlap the frequency of another wireless channel. When you design and deploy

wireless networks, you must take into account which channels you use for your wireless network. For

example, in the 2.4 GHz band, adjacent channels such as channel 3 and 4 have very closely overlapping

frequencies that can cause interference. In the 2.4 GHz band, channels 1, 6, and 11 do not overlap each

other because of the spacing between their frequencies, and these are the channels most commonly used.

The 2.4GHz band is crowded because many other devices that operate on this band, such as cordless

phones, microwaves, monitors, and wireless headsets, also use the same channels, and can cause wireless

congestion.

In the 5GHz band, the full channel width is reserved and there is a very large selection of non-overlapping

channels. 802.11n also allows you to combine two 20MHz channels to form a 40MHz channel for increased

bandwidth.

Channel Selection

The WatchGuard AP is configured by default to automatically select the wireless channel to use. When you

power on the WatchGuard AP device, it automatically scans the network and selects the wireless channel

with the least amount of interference.

The default channel width is configured as 20/40MHz. This mixed mode sets the radio to use 40MHz channel

width, but with additional transmission information that enable it to be used in an environment that includes

802.11a/b/g wireless access points.

Plan your Wireless APDevice Deployment

APDeployment Guide

Plan your Wireless APDevice Deployment

AP Deployment Guide 11

Wireless Signal Strength and Noise Levels

To make sure that all users in your environment receive a strong wireless signal, consider these guidelines

when you install your WatchGuard AP devices.

Signal Strength

The signal strength is the wireless signal power level received by the wireless client.

n Strong signal strength results in more reliable connections and higher speeds.

n Signal strength is represented in -dBm format (0 to -100). This is the power ratio in decibels (dB) of

the measured power referenced to one milliwatt.

n The closer the value is to 0, the stronger the signal. For example, -41dBm is better signal strength

than -61dBm.

Noise Level

The noise level indicates the amount of background noise in your environment.

n If the noise level is too high, it can result in degraded strength and performance for your wireless

signal strength.

n Noise level is measured in -dBm format (0 to -100). This is the power ratio in decibels (dB) of the

measured power referenced to one milliwatt.

n The closer the value to 0, the greater the noise level.

n Negative values indicate less background noise. For example, -96dBm is a lower noise level than

-20dBm.

Signal to Noise Ratio

The signal-to-noise ratio (SNR) is the power ratio between the signalstrength and the noise level.

n This value is represented as a +dBm value.

n In general, you should have a minimum of +25dBm signal-to-noise ratio. Lower values than +25dBm

result in poor performance and speeds.

For example:

n If you have a -41dBm signal strength, and a -50dBm noise level, this results in a poor signal-to-noise

ratio of +9dBm.

n If you have a -41dBm signal strength, and a -96dBm noise level, this results in an excellent signal-to-

noise ratio of +55dBm.

Wireless Environmental Factors

There are several environmental factors that can affect the range and performance of wireless networks.

Walls and ceilings

Walls and ceilings between the AP device and wireless clients can degrade signal strength. Wireless

signals can penetrate walls and other structures, but the rate of penetration is directly related to the type

of building materials, materials thickness, and the distance from the wireless antenna.

Building materials

Metal and aluminum doors, glass, concrete, and other types of building materials can have a

significantly negative effect on the signal strength of wireless signals.

EMI (Electro-magnetic interference)

EMI from other electrical devices, such as microwaves, cordless phones, and wireless headsets, can

generate significant RF noise and degrade or disrupt wireless communications.

Distance

Wireless signals degrade quickly past their maximum range. You must plan your network carefully to

provide adequate wireless coverage over the range you require in your environment.

Plan your Wireless APDevice Deployment

APDeployment Guide

Plan your Wireless APDevice Deployment

AP Deployment Guide 13

Wireless Placement

For full wireless coverage and to make sure that all users in your environment receive a strong wireless

signal, consider these guidelines for the location and placement of your WatchGuard AP devices:

n Place your AP devices in a central location away from any corners, walls, or other physical

obstructions to provide maximum signal coverage.

n Place your AP devices in a high location to provide the overall best signal strength reception and

performance for your wireless network.

n Make sure you do not install an AP device in close proximity to any electronic devices that can

interfere with the signal, such as televisions, microwave ovens, cordless phones, air conditioners,

fans, or any other type of equipment that can cause signal interference.

n When you install multiple AP devices, make sure to space them to provide maximum coverage for

your wireless network area of availability. For wireless coverage over multiple floors, you can stagger

the placement of devices to cover both vertical and horizontal space.

Monitor AP Device Status

1. Start Firebox System Manager for your XTMdevice.

2. Select the Gateway Wireless Controller tab.

The Gateway Wireless Controller Summary and Detail information appears.

3. Select the Access Points tab.

From the Access Points tab, you can:

n See the connection status and uptime of your APdevice.

n See the radio frequency and channel used by each radio.

n See the APdevice activation status.

n See the log messages for the selected APdevice.

n See network statistics for the selected APdevice.

n Reboot the selected APdevice.

n Upgrade the firmware on the selected APdevice.

n Perform a site survey from the selected AP device to detect other wireless access points.

Monitor AP Device Status

APDeployment Guide

Monitor Wireless Clients

AP Deployment Guide 15

Monitor Wireless Clients

In Firebox System Manager, you can see the wireless clients that are connected to your WatchGuard

APdevices. You can also disconnect a wireless client from an AP device.

To see the connected wireless clients:

1. Start Firebox System Manager for your XTM device.

2. Select the Gateway Wireless Controller tab.

3. Select the Wireless Clients tab.

A list of connected wireless clients appears.

4. To show only wireless clients that are connected to a specific AP device, select an AP device from the

Filter By APdrop-down list.

5. To show only wireless clients that are connected to a specific SSID, select an SSID from the Filter By

SSIDdrop-down list.

6. To disconnect a wireless client, select the client and click Disconnect Client.

About APDevice Activation

You must activate your WatchGuard AP device to start your LiveSecurity subscription. The WatchGuard

LiveSecurity subscription activates your hardware replacement warranty, enables you to receive technical

support, and provides access to the latest OS updates and product news.

After you pair a WatchGuard APdevice with an XTMdevice, the XTM device automatically connects to the

WatchGuard web site and sends the information necessary to activate the AP device on the same

WatchGuard account where the XTM device was activated.

If automatic activation fails, the XTMdevice periodically tries to activate again. The activation status of your

APdevice does not affect the functionality of the AP device.

If your APdevice has not been activated automatically and you want to activate it manually, you can activate

the AP device in your WatchGuard account just as you would activate an XTMdevice or add-on feature.

Reset the WatchGuard AP Device

To reset the AP device with the reset button on the APdevice:

1. With the APdevice powered on, press and hold the reset button.

2. After 12 seconds, release the reset button.

The APdevice resets.

When the device completes initialization, it is reset to the factory default settings.

Additional Resources

This APDeployment Guide provides information about initial setup of your WatchGuard AP100 or AP200

device.

For information about your APdevice hardware and physical installation, see the WatchGuard APSetup

Guide.

For more detailed information about VLAN configuration, and AP device configuration examples, see the

WatchGuard System Manager Help.

You can view and download the most current documentation for the WatchGuard AP on the WatchGuard

APProduct Documentation page at http://www.watchguard.com/help/documentation.ap.asp.

About APDevice Activation

APDeployment Guide

Watchguard AP User guide

Watchguard AP User guide

Related papers

Other documents