Maintenance Release (MR-4) version 1.4.1748 has the following new features and bug fixes for the AP6 Series access points.

New Features

Wireless Guest Network (Bridge Mode): AP6 Series access points now offer wireless guest network capabilities. When enabled the guest network creates an isolated network that uses the same AP6 access point and enforces traffic restrictions to the local network for any wireless devices connected to that SSID. The guest network feature allows wireless clients to connect to the SSID and access the internet but enforces traffic restrictions that limit access to the local network.

For more information on how to enable the wireless guest network feature from Sophos Central for the AP6 Series access points.


The MR4 firmware will be released in two phases.

  • In phase one the firmware will be made available to AP6’s managed by Sophos Central Wireless in the US-East Region.
  • In the second phase targeted for May 2, 2024, the firmware for all other Sophos Central Wireless regions will be made available.

Bug fixes   

Issue Key Summary 

Enabling client isolation does not allow wireless users to connect to an SSID and receive an IP address. This happens when any Mesh Node AP6 has an SSID synchronized from the Root Mesh Node with client isolation enabled.


A display issue with the AP6 CLI shows the wrong authentication mode when an SSID is configured to use WPA3-EAP Enterprise.


In the local AP6 GUI, the deleted SSID entries are not being removed from the list of SSIDs displayed on the traffic shaping page for all radio bands.


The AP6 experiences multiple reboots when 802.11r fast roaming is enabled on a DD/WW/MM password SSID.


An intermittent issue is seen with the auto-reboot feature after a firmware upgrade and when more than 5 SSIDs configured on the AP6 access point.


The local GUI is accessible from non-management interfaces when the captive portal is set on an SSID using a tagged VLAN assignment.

WIFIX-2935 For the AP6 access points, when setting the channel bandwidth explicitly to Auto on the 2.4GHz radio, wireless clients will only negotiate on the 20MHz frequency and not the 40Mhz frequency.
WIFIX-2716 When enabling the Proxy ARP feature from Central, the underlying functionality is working as expected, and the Proxy ARP setting is enabled successfully. However, the output of the SSH command shows the status network “proxyarp” is “ProxyArp Disable.”
WIFIX-2691 If the AP6 SSID name has special characters (BS!@#$%^&*) and has the captive portal enabled, the SSID policy will not be applied to the AP6 access point correctly and the captive portal may not work correctly.
WIFIX-5125 On the AP6 840E, we discovered an issue where the access point reboots when proxy ARP is enabled

Known Issues:

For a list of known issues please visit https://doc.sophos.com/support/kil/index.html