Watchguard AP420 Installation instructions

WatchGuard
AP420
Hardware Guide
AP420

ii WatchGuard AP420
ADDRESS
505 Fifth Avenue South
Suite 500
Seattle, WA 98104
SUPPORT
www.watchguard.com/support
U.S. and Canada +877.232.3531
All Other Countries +1.206.521.3575
SALES
U.S. and Canada +1.800.734.9905
All Other Countries +1.206.613.0895
ABOUT WATCHGUARD
WatchGuard® Technologies, Inc. is a global leader in network security, providing best-
in-class Unified Threat Management, Next Generation Firewall, secure Wi-Fi, and
network intelligence products and services to more than 75,000 customers worldwide.
The company's mission is to make enterprise-grade security accessible to companies of
all types and sizes through simplicity, making WatchGuard an ideal solution for
Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle,
Washington, with offices throughout North America, Europe, Asia Pacific, and Latin
America. To learn more, visit WatchGuard.com.
For additional information, promotions and updates, follow WatchGuard on Twitter,
@WatchGuard on Facebook, or on the LinkedIn Company page. Also, visit our InfoSec
blog, Secplicity, for real-time information about the latest threats and how to cope with
them at www.secplicity.org.
Copyright and Patent Information
Copyright© 2017 WatchGuard Technologies, Inc. All rights reserved.
WatchGuard, the WatchGuard logo, LiveSecurity, and any other mark listed as a trademark in the “Terms of Use” portion of
the WatchGuard Web site that is used herein are either registered trademarks or trademarks of WatchGuard Technologies,
Inc. and/or its subsidiaries in the United States and/or other countries. All other trademarks are the property of their
respective owners.
Revised: September 26, 2017
Notice to Users
Information in this guide is subject to change without notice. Updates to this guide are posted at:
http://www.watchguard.com/wgrd-help/documentation/hardware-guides
Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this guide may be
reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express
written permission of WatchGuard Technologies, Inc.
Complete copyright, trademark, patent, and licensing information can be found in
the WatchGuard product documentation. You can find this document online at:
http://www.watchguard.com/wgrd-help/documentation/overview

Hardware Guide 1
Hardware Specifications
The WatchGuard® AP family of wireless access points provide secure, reliable, wireless communications while
delivering high performance and broad coverage—a perfect combination of services to meet the needs of
enterprise-level customers, small businesses, branch offices, campuses, and hotels alike.
Internal antennas, slim cases, minimalist labeling, and small LEDs, coupled with wall and ceiling mount
options, make these devices ideal for low profile deployment scenarios. Power can be provided by any Power
over Ethernet (PoE+) power source or an AC adapter. WatchGuard AP420 devices are high performance,
enterprise access points that feature 4x4:4 MU-MIMO 802.11ac Wave 2 capabilities with a dedicated third
radio for security scanning and automated over-the-air attack prevention.
There are two ways you can manage your AP420 device:
WatchGuard Wi-Fi Cloud
A powerful cloud-based enterprise wireless management solution for AP configuration, security, and
monitoring.
WatchGuard Firebox Gateway Wireless Controller
Local management, configuration, security, and monitoring of APs directly from your WatchGuard
Firebox. The WatchGuard Firebox requires Fireware OS v11.12.4 or higher.
Note: The third-radio is not available when managed locally with a Gateway Wireless Controller.
For more information about how to set up and manage your WatchGuard AP, you can find documentation
online at: http://www.watchguard.com/wgrd-help/documentation/overview
Package Contents
WatchGuard AP
Quick Start Guide
Mounting bracket for T-rail ceilings (15/16”, 24mm)
Optional mounting accessories for walls or ceilings without a T-rail, or different size T-rail ceilings are
also available from WatchGuard. For more information, see “Mounting Instructions” on page 8.

2WatchGuard AP420
Hardware Specifications
About Your Hardware
Hardware Specifications
AP420
Radio Type and
Frequency Band
2.4GHz, 802.11b/g/n. Max data rate: 800 Mbps
5GHz, 802.11a/n/ac. Max data rate: 1.733 Gbps
Third radio for dedicated RF and security scanning
Antenna 10 integrated omnidirectional antennas
4 antennas: 2.4GHz radio
4 antennas: 5GHz radio
2 antennas: Third scanning radio
Ethernet interface 1 x 10/100/1000 Mbps Gigabit Ethernet (LAN1)
802.3at PoE+ / 802.3af PoE, PoE input voltage: 48V
1 x 10/100/1000 Mbps Gigabit Ethernet (LAN2) for link
aggregation or a wired extension of an SSID with NAT
enabled.
1 x RJ45 serial console
RS232 Serial
Bits per second: 115200
Data Bits: 8, Stop Bits: 1
Parity: None, Flow Control: None
USB Port 1 USB 2.0 port (Not in use)
Power Interface Power over Ethernet: 802.3at (PoE+) / 802.3af (PoE)
DC jack (6.3mm connector): 12V DC input, 2.0A
Power
Consumption
Max: 19 W
Min: 11W
Average: 16W
Dimensions 220mm × 220mm × 57mm
Weight 2.86 lb. (1.3 kg)

Hardware Guide 3
Hardware Specifications
Environmental Requirements
To safely install your WatchGuard AP, we recommend that you:
Install the device indoors.
Make sure the device has adequate clearance for air flow and cooling.
Connect it to a surge-protected power supply to prevent damage from sudden power changes
Other environmental requirements:
Operating temperature 0°C to 40°C (32°F to 104°F)
Operating relative humidity 0% to 95% non-condensing
Non-operating temperature -25°C to 75°C (-13°F to 167°F)
Non-operating relative humidity 0% to 95% non-condensing

4WatchGuard AP420
Hardware Specifications
Hardware Description
Device Connections and Buttons
Ethernet Network Interfaces
LAN1 (PoE+): Standard RJ45 connector that supports link speeds of 10/100/1000 Mbps and PoE+
connectivity.
LAN2: Standard RJ45 connector that supports link speeds of 10/100/1000 Mbps.
This interface can be used for link aggregration or as a wired extension for a wireless SSID that has
NAT enabled. For more information, see the WatchGuard Wi-Fi Cloud Help.
The second Ethernet port is not supported when the AP420 is managed locally by a Gateway Wireless
Controller on a Firebox.
Power Input
The WatchGuard AP420 can be powered by 802.3at PoE+ or 802.3af PoE on the LAN1 (PoE+)
interface.
The use of 802.3af PoE results in limited feature functionality of the AP:
The USB port is disabed.
Second Ethernet extension port for wired extension or link aggregation is disabled.
The 2.4GHz radio is downgraded to 1x1 15dbm or lower, or as set in the device template.
The 5GHz radio is downgraded to 2x2 18dbm or lower, or as set in the device template.
You can also power the device with an optional AC power adapter. Make sure you use only an AC
power adapter supported by the AP420 device.

Hardware Guide 5
Hardware Specifications
Console Port
Standard RJ45 connector for serial console access.
USB Port
The USB port is currently not in use.
Reset Button
Resets the WatchGuard AP to factory-default settings. You must use a paper clip or other small object
to press the reset button through the small hole on top of the device.
To reset the device to factory-default settings, press and hold the reset button for 10 seconds until all
LEDs go off to indicate that the device has rebooted.

6WatchGuard AP420
Hardware Specifications
Device Indicators
The front panel of the AP420 has four LEDs that indicate the status of the AP.

Hardware Guide 7
Hardware Specifications
The AP420 always works in AP combo mode where the first two radios work in AP mode and the third radio
works in WIPS (Wireless Intrusion Prevention System) sensor mode. The fourth LED indicates that the WIPS
sensor on the third radio is active.
The LEDs for 2.4GHz and 5GHz will flash indicating activity if a client is connected on the
corresponding radio. If no client is connected to a radio, the corresponding LED will remain solid
green.
Power /
Ethernet
2.4GHz 5GHz Description
Solid green Solid green Solid green Powered on and operating correctly with a gigabit
ethernet connection.
Connected to WatchGuard Wi-Fi Cloud services.
Fast flash green Any Any Did not receive a valid IP address from DHCP.
Connected with a gigabit ethernet connection.
Slow flash green Any Any Cannot connect to WatchGuard
Wi-Fi Cloud services. Connected with a gigabit
ethernet connection.
Solid green /
Solid yellow
Fast flash
green
Solid green Troubleshooting running on 2.4GHz radio.
LED1 = Solid green if AP is on gigabit ethernet
connection. Solid yellow if on non-gigabit ethernet
connection.
Solid green /
Solid yellow
Solid green Fast flash
green
Troubleshooting running on 5GHz radio.
LED1 = Solid green if AP is on gigabit ethernet
connection. Solid yellow if on non-gigabit ethernet
connection.
Solid green /
Solid yellow
Slow flash
green
Solid green Prevention running on 2.4GHz radio.
LED1 = Solid green if AP is on gigabit ethernet
connection. Solid yellow if on non-gigabit ethernet
connection.
Solid Green /
Solid yellow
Solid green Slow flash
green
Prevention running on 5GHz radio.
LED1 = Solid green if AP is on gigabit ethernet
connection. Solid yellow if on non-gigabit ethernet
connection.
Solid yellow Solid green Solid green Powered on and operating correctly with non-gigabit
ethernet connection.
Connected to WatchGuard Wi-Fi Cloud services.
Fast flash yellow Any Any Did not receive a valid IP address from DHCP.
Connected with non-gigabit ethernet connection.
Slow flash yellow Any Any Cannot connect to WatchGuard Wi-Fi Cloud services.
Connected with non-gigabit ethernet connection.
Solid orange Any Any No ethernet connection.
Slow flash orange Any Any Software upgrade in progress.
Off Off Off Not powered on or in startup process.

8WatchGuard AP420
Hardware Specifications
Mounting Instructions
Your package includes the AP420 device, and a mounting bracket.
The MAC address and serial number of your AP are printed on a label on the back of the device.
Make sure you record this information before you mount the AP.

Hardware Guide 9
Hardware Specifications
T-rail Bracket
Use the included mounting bracket to install the AP420 on a ceiling with a T-rail (15/16”, 24mm). An optional
bracket for T-rail ceilings (9/16”, 15mm) is also available from WatchGuard (Part #: WG8026).
1. Attach the bracket to the T-rail and rotate the bracket so that it snaps on the T-rail. The bracket must
be parallel to the T-rail.
2. To mount the AP420 on the bracket, place the first mounting post on the rear-side of the device on to
the lower notch of the bracket.
3. Rotate the device so that the center mounting post fits in to the center notch on the bracket.

10 WatchGuard AP420
Hardware Specifications
4. Make sure that all the mounting posts on the rear-side of the device are secured into the respective
notches on the bracket.

Hardware Guide 11
Hardware Specifications
Silhouette/Interlude T-rail Bracket (Optional)
An optional silhouette/interlude mount bracket for T-rail celings is available from WatchGuard
(Part #: WG8021).
1. To attach the bracket to the T-rail, rotate the bracket so it is parallel to the T-rail, and snap the bracket
on the T-rail.
2. To mount the AP420 on the bracket, put the first mounting post on the back of the device over the
lower bracket notch.
3. Rotate the AP420 device so that the center mounting post fits into the center notch on the bracket.
4. Make sure that all the mounting posts on the back of the AP420 device are securely positioned in their
bracket notches.

12 WatchGuard AP420
Hardware Specifications
Flat Surface Bracket (Optional)
An optional surface mount bracket for walls or ceilings is available from WatchGuard (Part #: WG8020).
1. Attach the bracket to the wall with screws (not included).
2. Pull the side latch to unlock the mount bracket.
3. Attach the AP stubs to the bracket holders.
4. Lock the latch and attach the AP to the mount with the included screw.

Hardware Guide 13
Hardware Specifications
Connect the AP
To power on and connect the AP420 to the network with PoE+:
1. Connect one end of the network interface cable to the LAN1 PoE+ port on the AP420.
2. Connect the other end of the network interface cable to an Ethernet jack that provides PoE+ power.
To connect the AP420 to the network and to power on the AP420 with a power adapter:
1. Connect one end of the network interface cable to the LAN1 PoE+ port on the AP420.
2. Connect the other end of the network interface cable to an Ethernet network jack.
3. Plug the power adapter cable into the 12V DC power receptacle on the back of the AP420.
4. Plug the power adapter into an 100V-240V 50/60 Hz AC power source.
Connect the AP for Link Aggregation
With WatchGuard Wi-Fi Cloud, you can use both Ethernet ports of the AP420 for link aggregation that enables
these ports to logically merge into a single link for higher aggregate bandwidth.
You must enable link aggregation in a device template for the AP420, and link aggregation must also be
enabled on your network switch for the two ports connected to your AP. Both links should use CAT6 Ethernet
cabling.
Make sure that PoE+ power is supplied to the indicated first Ethernet port labelled PoE+ on the AP420.
The second Ethernet port is not supported when managed locally by a Gateway Wireless Controller
on a Firebox.

14 WatchGuard AP420
Hardware Specifications
Ethernet Power Injector (Optional)
You can power the WatchGuard AP with an optional Ethernet Power Injector. This PoE+ capable device allows
you to power the WatchGuard AP through an existing Ethernet connection. With this feature, you do not have
to position your WatchGuard AP near a power outlet.
This device complies with IEEE 802.3at/af PoE specifications. Do not use any PoE adapters that are not
IEEE 802.3at/af compliant as they may damage your device.
Connect the Ethernet Power Injector
To connect an Ethernet Power Injector to the WatchGuard AP:
1. Plug the Ethernet Power Injector into an AC power source.
2. Connect an Ethernet cable from your network backbone (for example, a router, switch, or hub) to the
LAN connector on the Ethernet Power Injector.
3. Connect an Ethernet cable from the PoE+ Ethernet interface on the AP to the PoE connector on the
Ethernet Power Injector.

Hardware Guide 15
Hardware Specifications
Ethernet Power Injector Specifications
Ethernet Power Injector
WatchGuard Part # 802.3at PoE+ Injector with AC cord (US/FCC)(WG8599)
802.3at PoE+ Injector with AC cord (CE)(WG8600)
802.3at PoE+ Injector with AC cord (UK)(WG8601)
802.3at PoE+ Injector with AC cord (AUS)(WG8602)
Specification IEEE 802.3at/af
AC Input Voltage Rating 100 to 240VAC
Input Current 0.8A Max for 100VAC
Output Power 30W maximum
Ethernet Interfaces LAN: RJ-45 for 10/100/1000 Mbps data
POE: RJ-45 for 10/100/1000 Mbps data and power
Voltage: Pin4, 5:54V, Pin7, 8:Return
Indicator Power: Green
Temperature Operating: 32°F to 104°F (0°C to 40°C)
Storage: -22°F to 176°F (-30°C to 80°C)
Humidity 5 to 90% (Operating and storage)
Dimensions L = 3.9” (99 mm)
W = 2.27” (68.5 mm)
H = 1.3” (33 mm)
Weight 0.33 lbs (149.6 g)

16 WatchGuard AP420
Hardware Specifications
AC Power Adapter (Optional)
An optional AC power adapter supplies 12V DC power to the WatchGuard AP420 and includes region-specific
adapter plugs.
AC Power Adapter Specifications
AC Power Adaptor
WatchGuard Part # WG8025
AC Input Voltage Rating 100-240V, 50-60Hz
Output Voltage DC12V, 2.0A
Region-specific
Adapter Plugs
US, EU, UK
Temperature Operating: 0 to +40°C
Storage: -20 to +70°C
Humidity Operating: 0% to 90%
Storage: 0% to 95%

Hardware Guide 17
Hardware Specifications
Safety Notices
All WatchGuard products are designed and tested to meet strict safety requirements. These requirements
include product safety approvals and other global compliance standards. Read these instructions carefully
before you operate the product, and refer to them as needed for continued safe operation of your product.
Product Safety Certification
The WatchGuard product is safety certified under the following standards:
IEC 60950-1:2005 (Second Edition)+Am 1:2009+Am 2:2013
EN 60950-1:2006+A11+A1+A12+A2:2013
EN 61000-3-2:2006+A1:2009+A2:2009
EN 61000-3-3:2008
Safety Warning
Do not place objects on the power cord.
Do not obstruct the ventilation openings. These openings prevent overheating of the machine.
Never push objects of any kind into slots or openings on this equipment. Making a contact with a
voltage point or shorting out a part may result in fire or electrical shock.
When removing or installing an appliance, follow the general installation safety instructions.
Disclaimer
WatchGuard shall not be held liable if the end user alters, modify, or repairs any WatchGuard hardware
appliance.
HINWEISE ZUR SICHERHEIT
Alle WatchGuard Produkte werden entwickelt und getestet, um strenge Sicherheitsanforderungen zu
erfüllen. Diese Anforderungen umfassen Produktsicherheit Zulassungen und andere globale Compliance-
Standards. Bitte lesen Sie die folgenden Anweisungen sorgfältig, bevor Sie das Produkt, und bezeichnen sie
als notwendig, um den sicheren Betrieb des Geräts zu gewährleisten.
Die WatchGuard Produkt ist Sicherheit unter den folgenden Normen zertifiziert:
IEC 60950-1:2005 (Second Edition)+Am 1:2009+Am 2:2013
EN 60950-1:2006+A11+A1+A12+A2:2013
EN 61000-3-2:2006+A1:2009+A2:2009
EN 61000-3-3:2008
Sicherheitshinweis
Legen Sie keine Gegenstände auf das Netzkabel.
Verdecken Sie nicht die Lüftungsöffnungen. Diese Öffnungen verhindern eine Überhitzung der
Maschine.
Stecken Sie niemals Gegenstände jeglicher Art in die Schlitze oder Öffnungen des Geräts stecken. Der
Kontakt mit einem spannungsführenden Punkt oder das Kurzschließen eines Bauteils kann zu einem
Brand oder elektrischen Schlag führen.
Beim Entfernen oder Installieren eines Gerätes, nach den allgemeinen Installation Sicherheitshinweise.

18 WatchGuard AP420
Hardware Specifications
AVISO DE SEGURIDAD
Todos los productos WatchGuard están diseñados y probados para satisfacer estrictos requisitos de
seguridad. Estos requisitos incluyen la homologación de productos de seguridad y otras normas de
cumplimiento global. Por favor, lea atentamente las siguientes instrucciones antes de utilizar el producto, y se
refieren a ellos como sea necesario para garantizar el funcionamiento seguro y continuo de su producto.
Información adicional se puede encontrar en la Guía del usuario electrónica.
Certificación de seguridad del producto
El producto tiene certificación de seguridad WatchGuard bajo las siguientes normas:
IEC 60950-1:2005 (Second Edition)+Am 1:2009+Am 2:2013
EN 60950-1:2006+A11+A1+A12+A2:2013
EN 61000-3-2:2006+A1:2009+A2:2009
EN 61000-3-3:2008
Advertencia de seguridad
No coloque objetos sobre el cable de alimentación.
No obstruya las aberturas de ventilación. Estas aberturas evitan el sobrecalentamiento de la máquina.
Nunca introduzca objetos de ningún tipo en las ranuras o aberturas del equipo. El contacto con puntos
de voltaje o el cortocircuito de una pieza podría provocar un incendio o una descarga eléctrica.
Al extraer o instalar un electrodoméstico, siga las instrucciones generales de instalación de seguridad.