Contents

Related Topics

AP Deployment with a Single SSID

For basic AP installation, you can deploy WatchGuard APs with a single SSID. In this simple deployment scenario, you do not have to configure VLANs or complex network settings. This example is recommended for small office deployments where the requirement is to add secure, wireless access to an existing LAN.

If your environment is large enough to require more than one AP for wider wireless coverage, you can assign the same SSID to multiple APs. When you assign the same SSID to more than one AP, the range of that SSID is extended, which enables mobile users to roam from one AP coverage area to another. For more information, see AP Deployment with Simple Roaming.

For wireless networks with a large number of WatchGuard APs to deploy that will be assigned the same SSIDs and do not require unique configurations, you can use the Automatic Deployment feature. For more information, see About AP Automatic Deployment.

With this deployment scenario, there are two primary methods you can use to physically connect your WatchGuard AP to the network:

  • Connect the AP directly to your Firebox on a Trusted or Optional network interface.

Diagram of an AP device connected directly to an XTM device trusted or optional interface

  • Connect the AP to a switch that is on a Trusted or Optional network.

Diagram of an AP device connected to a switch connected to the XTM device

AP Deployment and Firebox Policies

Note these policy requirements, which depend on how you connect the APs and other resources to your network.

  • If you connect the AP directly to a Firebox interface, the wireless users do not automatically have access to trusted resources that connect to other trusted interfaces on the Firebox. You must configure policies to allow that traffic because the wireless users are on a separate trusted network. The default firewall policies only allow outbound traffic from trusted networks, but do not allow traffic between devices on different trusted networks.
  • If you connect the AP to a switch on the trusted network, the wireless users can access other network resources on the network connected to the same interface. You do not need to create additional policies to allow access because the traffic does not go through the Firebox, but you do need to create policies for traffic to resources that connect to any other trusted interface.

Configure a Firebox Interface and Enable DHCP

To connect the AP directly to a Firebox interface, configure that interface as a Trusted or Optional interface. Enable the DHCP server or DHCP relay on that interface so that the Firebox can automatically assign an IP address to the AP and to wireless clients.

To configure the interface for this deployment scenario, from Fireware Web UI:Closed
  1. Select Network > Interfaces.
  2. Select a network interface and click Edit.

Screen shot of Network interfaces page for Trusted wireless

  1. In the Interface Name (Alias) text box, type a name for this network.
    For this example, type Trusted-Wireless.
  2. (Optional) In the Interface Description text box, type a description of the interface.
  3. From the Interface Type drop-down list, select Trusted.
  4. In the IP Address text box, type the IP address for this interface in slash notation.
    For this example, type 10.0.10.0/24.
  5. Select DHCP Server.
  6. In the Address Pool section, click Add.
  7. In the Starting IP and Ending IP text boxes, type the IP addresses for the DHCP range.
    For this example, type 10.0.10.2 and 10.0.10.100.
  8. Click Save to save the interface settings.
To configure the interface for this deployment scenario, from Policy Manager:Closed
  1. Select Network > Configuration.
    The Network Configuration dialog box appears.
  2. Select a network interface and click Configure.

Screen shot of the Interface Settings dialog box

  1. In the Interface Name (Alias) text box, type a name for this network.
    For this example, type Trusted-Wireless.
  2. (Optional) In the Interface Description text box, type a description of the interface.
  3. From the Interface Type drop-down list, select Trusted.
  4. In the IP Address text box, type the IP address for this interface in slash notation.
    For this example, type 10.0.10.0/24.
  5. Select Use DHCP Server.
  6. In the Address Pool section, click Add.
    The Add Address Range dialog box appears.
  7. In the Starting IP and Ending IP text boxes, type the IP addresses for the DHCP range.
    For this example, type 10.0.10.2 and 10.0.10.100.
  8. Click OK to save the DHCP configuration.
    The IP address range appears in the Address Pool list.
  9. Click OK to save the interface settings.
  10. Save the configuration file to your Firebox.

Add an SSID to the Gateway Wireless Controller

To add and configure an SSID on the Gateway Wireless Controller, from Fireware Web UI:Closed
  1. Select Network > Gateway Wireless Controller.
  2. Select the Enable the Gateway Wireless Controller check box.
  3. On the SSIDs tab, click Add.

Screen shot of SSID settings page for Trusted wireless

  1. In the Network Name (SSID) text box, type a name for this SSID.
    For this example, type Trusted.
  2. In the Access Points tab, select the APs that will use this SSID.
    If the APs have not been paired to the Firebox yet, you can assign this SSID to each AP after you add it to the Gateway Wireless Controller.
  3. Select the Security tab.
  4. Configure your wireless encryption security settings for this SSID.
  5. Save the SSID configuration.
  6. Click Save to save the Gateway Wireless Controller configuration.
To add and configure an SSID on the Gateway Wireless Controller, from Policy Manager:Closed
  1. Select Network > Gateway Wireless Controller.
    The Gateway Wireless Controller configuration page appears, with the SSIDs tab selected.
  2. Select the Enable the Gateway Wireless Controller check box.
    This enables the Firebox to discover unpaired APs on your trusted or optional network.

Screen shot of the Gateway Wireless Controller dialog box, SSIDs tab

  1. On the SSIDs tab, click Add.
    The Add SSID dialog box appears, with the Settings tab selected.
  2. In the Network Name (SSID) text box, type a name for this SSID.
    For this example, type Trusted.

Screen shot of SSID settings page

  1. Make sure the Enable VLAN tagging check box is cleared.
    This is required because you do not want to configure VLANs for this simple deployment scenario.
  2. In the Access Points tab, move the APs that you want to use this SSID from the Available list to the Member list.
  3. Select the Security tab.
  4. Configure your wireless encryption security settings for this SSID.
  5. Click OK to save your SSID settings.
  6. Save the configuration file to your Firebox.

After you have configured the SSIDs, you can pair the AP with the Firebox, and assign these SSIDs to the radios on the AP.

See Also

About AP Configuration

Configure APs with the Gateway Wireless Controller

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.