APX120 behin SD-RED20

Question

Hi there, 
 
 I want to setup the following: 
 We have a small branch office for one employee for which we need a wireless LAN. I have set up a SD-RED20 for this location which works quite well via LTE. 
 To access the network via WiFi, I have also set up an APX120 with a SSID which bridges to AP-LAN. Everything works quite well in the main office. 
 If I connect the APX to the SD-RED20, the APX does not connect to the UTM which I do not understand as the Branch offices network connected over the RED is allowed to connect to the firewalls main network via Any protocol. 
 
 Do I miss something here? Do I have to create another firewall rule for the initial handshake between UTM an AP? 
 
 Appreciate your help! 
 
 Thanks in advance 
 Alex

kerobra_retired · Accepted Answer

Hi Alex, 
 2 things can be an issue here. 
 First is the RED deployment mode. Which one do you use, unified or one of the split modes? If one of the split modes is used you will either have a host object with IP "1.2.3.4" to be included in the "Split Networks"-list or you will need to have a DHCP Option "234 - AP Magic IP" be active and set to an IP-address of the UTM (e.g. the RED interface's IP). 
 Second is the Wireless Protection tab. There you will have to set the RED interface as an "Allowed Interface" under "Global Settings". 
 
 For a RED20 I would recommend using the internal module slot for WLAN if that slot isn't already in-use for a 3G/4G module.

FormerMember · Answer

Hi AlexSaternus 
 Thank you for reaching out to the Community! 
 If the RED operation mode is not Standard/Unified, you have to add Magic IP 1.2.3.4 to the split network. 
 Access point registration 
 
 After being powered on the AP boots up ~45 seconds to complete. 
 After boot, the AP connects to the DHCP server and obtains an IP address 
 The AP connects to Magic IP of 1.2.3.4 on port 2712.
 
 Traffic is sent to the APs default gateway. 
 If no response from Firewall the AP reboots and the process starts over again.

The AP appears on the GUI of the Sophos Firewall in the Pending list.
 
 The AP will reboot until accepted by administrator

The administrator manually accepts AP and assigns networks. 
 AP moves into the Inactive list.
 
 If the firewall's AP firmware is newer than firmware on AP it pushes new firmware. The AP installs new firmware then reboots.

Configuration settings transferred from the firewall to the AP 
 The AP moves into the Active list. 
 
 Thanks,