Watchguard AP420 Installation instructions

WatchGuard
AP420
Hardware Guide
AP420
Access Point

About This Guide
Information in this guide is subject to change without notice. Companies, names, and data used in
examples herein are fictitious unless otherwise noted. No part of this guide may be reproduced or
transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express
written permission of WatchGuard Technologies, Inc.
Guide revised: 6/4/2020
Copyright, Trademark, and Patent Information
Copyright © 1998 – 2020 WatchGuard Technologies, Inc. All rights reserved. All trademarks or trade names
mentioned herein, if any, are the property of their respective owners.
Complete copyright, trademark, patent, and licensing information can be found in the Copyright and
Licensing Guide, available online at https://www.watchguard.com/wgrd-help/documentation/overview.
About WatchGuard
WatchGuard® Technologies, Inc. is a global leader in network
security, providing best-in-class Unified Threat Management, Next
Generation Firewall, secure Wi-Fi, and network intelligence
products and services to more than 75,000 customers worldwide.
The company’s mission is to make enterprise-grade security
accessible to companies of all types and sizes through simplicity,
making WatchGuard an ideal solution for Distributed Enterprises
and SMBs. WatchGuard is headquartered in Seattle, Washington,
with offices throughout North America, Europe, Asia Pacific, and
Latin America. To learn more, visit WatchGuard.com.
For additional information, promotions and updates, follow
WatchGuard on Twitter, @WatchGuard on Facebook, or on the
LinkedIn Company page. Also, visit our InfoSec blog, Secplicity,
for real-time information about the latest threats and how to cope
with them at www.secplicity.org.
Address
505 Fifth Avenue South
Suite 500
Seattle, WA 98104
Support
www.watchguard.com/support
U.S. and Canada +877.232.3531
All Other Countries +1.206.521.3575
Sales
U.S. and Canada +1.800.734.9905
All Other Countries +1.206.613.0895
WatchGuard Technologies, Inc. i

Contents
WatchGuard AP420 Hardware Guide 1
Requirements 1
About Your Hardware 2
Hardware Specifications 2
Environmental Requirements 4
Hardware Description 5
Device Connections and Buttons 5
Device Indicators 7
Mounting Instructions 11
T-Rail Mount Installation 12
Flat Surface Bracket (Optional) 13
Connect the AP 14
Connect the AP for Link Aggregation 14
Ethernet Power Injector (Optional) 15
AC Power Adapter (Optional) 17
Notices 18
Safety Notices 18
Product Safety Certification 18
Safety Warning 18
Disclaimer 18
HINWEISE ZUR SICHERHEIT 18
Sicherheitshinweis 19
AVISO DE SEGURIDAD 19
Certificación de seguridad del producto 19
Advertencia de seguridad 19
FCC Certification 20
ii WatchGuard Technologies, Inc.

CE Notice 21
Industry Canada Certification 21
Europe – EU Declaration of Conformity (Wireless) 23
Brasil ANATEL 26
Mexico NOM 26
Taiwan Class B Notice 26
Taiwan NCC 26
Japan VCCI Notice (Class B ITE) 26
RoHS Statement 26
WEEE Statement 27
REACH Certificate of Compliance 27
WatchGuard Technologies, Inc. iii

WatchGuard AP420 Hardware Guide
WatchGuard AP420 Hardware Guide
WatchGuard AP420 devices are high performance, enterprise access points that feature 4x4:4 MU-MIMO
802.11ac Wave 2 capabilities with dual concurrent 5 GHz and 2.4 GHz radios supporting 802.11a/n/ac
Wave 2, 802.11b/g/n, and data rates of up to 1.73 Gbps and 800 Mbps, respectively. The AP420 also
contains a third 2x2 MIMO 802.11ac Wave 2 radio for dedicated multi-function security and wireless
network scanning (Wi-Fi Cloud mode only).
Requirements
There are two ways you can manage your AP420:
Total Wi-Fi and Secure Wi-Fi with WatchGuard Wi-Fi Cloud
A powerful cloud-based enterprise wireless management solution for AP configuration, security, and
monitoring.
Basic Wi-Fi with WatchGuard Firebox Gateway Wireless Controller
Local management, configuration, security, and monitoring of APs directly from your WatchGuard
Firebox. The WatchGuard Firebox requires Fireware v11.12.4 and higher.
The third radio is not available when the AP is managed locally with a Gateway Wireless Controller.
WatchGuard Technologies, Inc. 1

About Your Hardware
Hardware Specifications
Chipset Qualcomm QCA9994
Processor and RAM Qualcomm IPQ8064 1.4GHz dual core ARM processor with 256 MB
RAM and 128 MB Flash
Radio Type and
Frequency Band
2.4 GHz, 802.11b/g/n. Max data rate: 800 Mbps
5 GHz, 802.11a/n/ac. Max data rate: 1.733 Gbps
Third radio for dedicated RF and security scanning in Wi-Fi Cloud mode
Antenna 10 integrated omnidirectional antennas
n4 antennas: 2.4 GHz radio
n4 antennas: 5 GHz radio
n2 antennas: Third scanning radio
Ethernet Interface 1 x 10/100/1000 Mbps Gigabit Ethernet (LAN1) 802.3at PoE+ / 802.3af
PoE, PoE input voltage: 48V
1 x 10/100/1000 Mbps Gigabit Ethernet (LAN2) for a wired extension of
an SSIDor link aggregation.
1 x RJ45 serial console
RS232 Serial
Bits per second: 115200
Data Bits: 8, Stop Bits: 1
Parity: None, Flow Control: None
USB Port 1 USB 2.0 port (not in use)
Power Interface Power over Ethernet: 802.3at (PoE+) / 802.3af (PoE)
DC jack (6.3 mm connector): 12V DC input, 2.0A
Power Consumption Max: PoE+(802.3at): 21.5W
Max: PoE (802.3af): 12.95W
Max:DC power: 17.9W
Min: 8.1W
Average: 16W
WatchGuard AP420 Hardware Guide
2 WatchGuard Technologies, Inc.

WatchGuard AP420 Hardware Guide
MTBF Rating 1,320,756 hours at 25°C
662,479 hours at 40°C
Dimensions L = 220 mm (8.66")
W = 220 mm (8.66")
H = 57 mm(2.24")
Weight 1.3 kg(2.86 lbs)
WatchGuard Technologies, Inc. 3

Environmental Requirements
To safely install your WatchGuard AP, we recommend that you:
nInstall the device indoors
nMake sure the device has adequate clearance for air flow and cooling
nConnect the device to a surge-protected power supply to prevent damage from sudden power changes
Other environmental requirements:
Operating Temperature 0° to 40°C (32° to 104°F)
Operating Humidity 0% to 95% non-condensing
Non-operating Temperature -25° to 75°C (-13° to 167°F)
Non-operating Humidity 0% to 95%, non-condensing
WatchGuard AP420 Hardware Guide
4 WatchGuard Technologies, Inc.

WatchGuard AP420 Hardware Guide
Hardware Description
Device Connections and Buttons
Ethernet Network Interfaces
LAN1 (PoE+): Standard RJ45 connector that supports link speeds of 10/100/1000 Mbps and PoE+
connectivity.
LAN2: Standard RJ45 connector that supports link speeds of 10/100/1000 Mbps.
You can configure this interface as a wired extension for an SSID or for link aggregation. For more
information, see the WatchGuard Wi-Fi Cloud Help .
For APs managed locally by a Gateway Wireless Controller with Fireware v12.2.1 and higher, you
can bridge together the LAN ports on AP models that have two LAN interfaces. This enables you to
extend the wired network on the second LAN interface. For more information, see the Fireware Help .
Power Input
The WatchGuard AP420 can be powered by 802.3at PoE+ or 802.3af PoE on the LAN1 (PoE+)
interface, or an optional power adapter.
To make sure that LLDP-capable switches provide appropriate PoE+ power to the AP420:
nYou must enable LLDP on the switch
nDisable static allocation of maximum power of 30W (if previously configured)
For more information, see WatchGuard APs and PoE+ power with switches and LLDP.
The use of 802.3af PoE results in limited feature functionality of the AP:
nUSB port and LAN2 Ethernet extension port is disabled.
nThe 2.4 GHz radio is downgraded to 1x1 15dbm or lower, or as set in the device template.
nThe 5 GHz radio is downgraded to 1x1 15dbm or lower, or as set in the device template.
nThird scanning radio is downgraded to 1x1 with 12dBm transmit power. Lower PoE power results
in reduced performance and effectiveness of WIPS scanning and intrusion prevention functions.
WatchGuard Technologies, Inc. 5

Console Port
Standard RJ45 connector for serial console access.
USB Port
The USB port is currently not in use.
Reset Button
Resets the WatchGuard AP to factory-default settings. You must use a paper clip or other small
object to press the reset button through the small hole on top of the device.
To reset the device to factory-default settings, press and hold the reset button for up to 10 seconds
until all LEDs go off to indicate that the device has rebooted.
Kensington Security Lock Slot
Kensington security lock slot for use with a security cable to secure your device.
WatchGuard AP420 Hardware Guide
6 WatchGuard Technologies, Inc.

WatchGuard AP420 Hardware Guide
Device Indicators
The front panel of the AP420 has four LEDs that indicate the status of the AP.
WatchGuard Technologies, Inc. 7

The AP420 operates in AP combo mode where the 2.4 GHz and 5 GHz radios work in AP mode to
broadcast Wi-Fi, while the third radio operates in WIPS (Wireless Intrusion Prevention System) sensor
mode (Wi-Fi Cloud management only).
Device Indicators in AP Firmware 8.8.1 and Higher
LED Power/Ethernet
2.4 GHz, 5 GHz, and Third
Radio
Off Powered off. 8.8.2 and higher: No SSID
enabled on the radio.
8.8.1: Wireless radio is
inactive.
Green Powered on.
Operating at normal power and capabilities. (PoE+ or DC
power). Connected at 10/100/1000 Mbps.
8.8.2 and higher: Wireless
radio is active with a
configured SSID
WIPSscanning is active on
third radio (Wi-Fi Cloud
mode only)
8.8.1: Wireless radio is
active.
Flashing
Green
Not connected to Wi-Fi Cloud or paired with a Gateway
Wireless Controller.
-
Orange Powered on. Operating at reduced power and capabilities.
(For example: PoE 802.3af). See WatchGuard AP Power
Requirements.
-
Flashing
Orange
No IPaddress received from DHCP. -
WatchGuard AP420 Hardware Guide
8 WatchGuard Technologies, Inc.

WatchGuard AP420 Hardware Guide
Device Indicators in AP Firmware 8.8.0 and Lower
Power /
Ethernet
2.4
GHz 5 GHz Description
Solid Green Solid
Green
Solid
Green
Powered on and operating correctly with a gigabit Ethernet
connection. Connected to WatchGuard Wi-Fi Cloud services.
Fast Flash
Green
Any Any Did not receive a valid IP address from DHCP. Connected with a
gigabit Ethernet connection.
Slow Flash
Green
Any Any Cannot connect to WatchGuard Wi-Fi Cloud services.
Connected with a gigabit Ethernet connection.
Solid Green
/ Solid
Yellow
Fast
Flash
Green
Solid
Green
Troubleshooting running on 2.4GHz radio.
LED1 = Solid green if AP is on gigabit Ethernet connection. Solid
yellow if on non-gigabit Ethernet connection.
Solid Green
/ Solid
Yellow
Solid
Green
Fast
Flash
Green
Troubleshooting running on 5GHz radio.
LED1 = Solid green if AP is on gigabit Ethernet connection. Solid
yellow if on non-gigabit Ethernet connection.
Solid Green
/ Solid
Yellow
Slow
Flash
Green
Solid
Green
Prevention running on 2.4GHz radio.
LED1 = Solid green if AP is on gigabit Ethernet connection. Solid
yellow if on non-gigabit Ethernet connection.
Solid Green
/ Solid
Yellow
Solid
Green
Slow
Flash
Green
Prevention running on 5GHz radio.
LED1 = Solid green if AP is on gigabit Ethernet connection. Solid
yellow if on non-gigabit Ethernet connection.
Solid Yellow Solid
Green
Solid
Green
Powered on and operating correctly with non-gigabit Ethernet
connection.
Connected to WatchGuard Wi-Fi Cloud services.
Fast Flash
Yellow
Any Any Did not receive a valid IP address from DHCP. Connected with
non-gigabit Ethernet connection.
Slow Flash
Yellow
Any Any Cannot connect to WatchGuard Wi-Fi Cloud services.
Connected with non-gigabit Ethernet connection.
WatchGuard Technologies, Inc. 9

Power /
Ethernet
2.4
GHz 5 GHz Description
Solid
Orange
Any Any No Ethernet connection.
Slow Flash
Orange
Any Any Software upgrade in progress.
Off Off Off Not powered on or in startup process.
WatchGuard AP420 Hardware Guide
10 WatchGuard Technologies, Inc.

WatchGuard AP420 Hardware Guide
Mounting Instructions
Your package includes the AP420 device, and a mounting bracket.
The MAC address and serial number of your AP are printed on a label on the back of the
device. Make sure you record this information before you mount the AP.
WatchGuard Technologies, Inc. 11

T-Rail Mount Installation
Use the included mounting bracket (15/16”, 24mm, Part #: WG8021) to install the AP420 on a ceiling with a
T-rail. Optional T-rail mount brackets are available from WatchGuard:
n9/16” T-rail mount, 15mm, Part #: WG8026
nSilhouette/Interlude T-rail mount, 15mm, Part #: WG8027
1. Put the first mounting post on the back of the AP over the lower bracket notch and rotate into place.
2. Make sure that all the mounting posts on the back of the AP are securely positioned in their bracket
notches.
3. To attach the bracket to the T-rail, rotate the bracket so it is parallel to the T-rail, and snap the bracket
on the T-rail.
WatchGuard AP420 Hardware Guide
12 WatchGuard Technologies, Inc.

WatchGuard AP420 Hardware Guide
Flat Surface Bracket (Optional)
An optional surface mount bracket for walls or ceilings is available from WatchGuard (Part #: WG8020).
1. Attach the bracket to the wall with screws.
2. Pull the side latch to unlock the mount bracket.
3. Attach the AP stubs to the bracket holders.
4. Lock the latch and attach the AP to the mount with the included screw.
WatchGuard Technologies, Inc. 13

Connect the AP
To power on and connect the AP420 to the network with PoE+:
1. Connect one end of the network interface cable to the LAN1 PoE+ port on the AP420.
2. Connect the other end of the network interface cable to an Ethernet jack that provides PoE+ power.
To connect the AP420 to the network and to power on the AP420 with a power adapter:
1. Connect one end of the network interface cable to the LAN1 PoE+ port on the AP420.
2. Connect the other end of the network interface cable to an Ethernet network jack.
3. Plug the power adapter cable into the 12V DC power receptacle on the back of the AP420.
4. Plug the power adapter into an 100V-240V 50/60 Hz AC power source.
Connect the AP for Link Aggregation
With WatchGuard Wi-Fi Cloud, you can use both Ethernet ports of the AP420 for link aggregation that
enables these ports to logically merge into a single link for higher aggregate bandwidth.
You must enable link aggregation in a device template for the AP420, and link aggregation must also be
enabled on your network switch for the two ports connected to your AP. Both links should use CAT6
Ethernet cabling.
Make sure that PoE+ power is supplied to the indicated first Ethernet port labeled PoE+ on the AP420.
WatchGuard AP420 Hardware Guide
14 WatchGuard Technologies, Inc.

WatchGuard AP420 Hardware Guide
Ethernet Power Injector (Optional)
You can power the WatchGuard AP with an optional Ethernet Power Injector. This PoE+ capable device
allows you to power the WatchGuard AP through an existing Ethernet connection. With this feature, you do
not have to position your WatchGuard AP near a power outlet.
This device complies with IEEE 802.3at/af PoE specifications. Do not use any PoE
adapters that are not IEEE 802.3at/af compliant as they may damage your device.
To connect an Ethernet Power Injector to the WatchGuard AP:
1. Plug the Ethernet Power Injector into an AC power source.
2. Connect an Ethernet cable from your network backbone (for example, a router, switch, or hub) to the
LAN connector on the Ethernet Power Injector.
3. Connect an Ethernet cable from the LAN1 PoE+ Ethernet interface on the AP to the PoE connector on
the Ethernet Power Injector.
WatchGuard Technologies, Inc. 15

The table below provides the specifications for the Ethernet PoE Injector.
WatchGuard Part Number 802.3at PoE+ Injector with AC cord (US/FCC) (WG8599)
802.3at PoE+ Injector with AC cord (CE) (WG8600)
802.3at PoE+ Injector with AC cord (UK) (WG8601)
802.3at PoE+ Injector with AC cord (AUS) (WG8602)
Specification IEEE 802.3at/af
AC Input Voltage Rating 100-240VAC
Input Current 0.8A max for 100VAC
Output Power 30W maximum
Ethernet Interfaces LAN: RJ-45 for 10/100/1000 Mbps data
POE: RJ-45 for 10/100/1000 Mbps data and power
Voltage: Pin4, 5:54V, Pin7, 8:Return
Indicator Power: Green
Temperature Operating: 0 - 40°C (32 - 104°F)
Storage: -30 - 80°C (-22 - 176°F)
Humidity 5% – 90% Operating and storage
Dimensions L = 99 mm (3.9")
W = 68.5 mm (2.27")
H = 33 mm(1.3")
Weight 2.86 lbs(1.3 kg)
WatchGuard AP420 Hardware Guide
16 WatchGuard Technologies, Inc.