APX320 switching from green to yellow to green LED from time to time


reading https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/Wireless/AccessPoints/LEDBehavior/index.html the yellow LED is shown when the APX320 is rebooting.

I can say this is probably not the exact description as I have reviewed a dozen APX320 in one location and I noticed a handful of them showing switching from constant green LED to constant yellow for a few seconds and then and then back to constant green.

Some did that multiple times.

The APX did not reboot.

Is it possible that this is also happening when the APX changes the channel or frequency band? I had no chance to correlate the behavior with the logs afterwards.

Edited TAGs
[edited by: Erick Jan at 6:22 AM (GMT -7) on 3 Jun 2024]
  • Hi  ,

    Thanks for reaching out. Are these access points behind an SF? Are there other nearby APs to this APX320? Are there any disconnection from clients when this occurs or APX320 getting disconnected on Central?

    Would also suggest you open a support case for for this to be further investigated and please do share with us caseID. Thank you


    Raphael Alganes
    Community Support Engineer | Sophos Technical Support
    Sophos Support Videos Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.

  • Hi,
    I cannot say what happened. All of our APX320 are not near me so I cannot handle a support case for such a thing easily. Also I'm a bit afraid of WiFi Support cases because they tend to be lengthy.
    At first a documentation of the behavior would be helpful.


  • A couple of guesses:

    1. Are the AP's scanning for other/bad APs? (There's a mode where they scan, as opposed to simply documenting what they see, and I believe this mode takes them off the air briefly -- I was thinking 30 seconds which is not what you're seeing, though.

    2. Are the AP's running in the extra channels that are scanned for radar/military activity? If the AP thinks it sees radar activity, it jumps to another channel, and that might be indicated by the yellow light.

    3. Are the APs in the auto-channel mode, where they scan and can select a lesser-used channel?

    4. Are the APs highly loaded? (I run mine via Sophos Central, and you can see the CPU utilization percentage there.) Is it possible that if they hit, say, 90% usage or above the light goes yellow? Similarly, I can occasionally see warnings that a DNS query from the AP timed out.

    (Sorry I forget all of the proper names for modes, but hopefully you can understand.)

  • Rogue Access point detection is enabled but it would not bring the AP down.

    The AP are all indoor in a highly residential shielded building (you have no mobile phone connection inside) and they do not use the military channels.

    on the AP enabled is Autochannel and Dynamic background Channel Selection and I can see in the overview of my AP that many are using the same channels for 2,4 and 5G bands can 1 and 44. This* looks a bit bad to me. Unfortunately in Central you cannot see, which other networks the AP can see and their channels - I wonder why does Sophos hide it? Most consumer products can do that. So by now you can only figure that out locally and not remotely. Now way.

    The AP load is very low. never more than 5 devices per AP.

    The logs show from time to time a bunch of warnings:

    Access Point "xxx" has high data packet retries (60%) on "5 GHz" Band, Channel "44"​

    Access Point "yyy" has high data packet retries (91%) on "2.4 GHz" Band, Channel "1"


  • So, it's not clear to me if you've confirmed that the blinking could reflect the AP switching channels due to busy channels. Which could cause cascades of multiple of your APs switching over time, as they end up creating traffic jams after a switch.

    (My theory is that your AP color changes are NOT the device crashing or otherwise rebooting, but otherwise being temporarily unavailable, as in a channel change, which is briefly reconfiguring the radio. I think there's also a rogue-detection mode that takes the AP offline for the duration of the scan -- or am I thinking of another brand?)