Setting up network policies for a Sophos XG controller

Setting up network policies for a Sophos XG controller

I had a client who wanted to keep two APX access points and change firewall brand. The Sophos XG was left to handle wireless only. That works, but only if the setup is kept tight.

Decide: factory reset or clean the existing config

Back up the current XG config first. Export it from System > Backup and keep a copy offline. I do that before any major change.

Then check AP support. Sophos manages APs in more than one way. Some APX models are managed only through Sophos Central, so do not waste time trying to force unsupported hardware onto the XG. I check the supported access point list and the firewall AP docs first: Supported access points – Sophos Central Admin and Access points – Sophos Firewall.

If the APs are supported by the XG, decide whether to factory reset. My rule of thumb is simple:

• If the XG config is small and tidy, cleaning interfaces, NAT and rules is quicker. That keeps useful items like static routes or logs.
• If the XG has a messy firewall config or unknown custom rules, a factory reset is safer. It clears out old settings that get in the way of access point management and VLANs.

A factory reset gives you a clean slate and fewer surprises. The downside is that you need to reapply any routes, licences and static IPs you still need. Cleaning the config is quicker and keeps non-wireless bits you want, but hidden dependencies are easy to miss.

For a box that is only acting as a wireless controller, I usually reset it. That forces me to document the minimal setup properly.

Convert the XG to a dedicated wireless controller

Here is the sequence I use.

Preparation

1. Back up the current config and save the export. Take a screenshot of the current Wireless Protection view and the interface map.
2. Note the licences. If the APs move to Sophos Central later, check the Central licensing and onboarding process.

If you choose factory reset

1. Go to System > Backup & firmware. Download a local backup. Then go to System > Device > Reset to factory defaults.
2. After the reset, set the admin password and update the firmware to a recent SFOS version supported by the AP series.

Create the management plane

1. Create a management interface for APs. Example: interface mgmt0 on VLAN 10 with IP 10.10.10.1/24.
2. Create a DHCP scope for APs and client devices on that VLAN. Example: 10.10.10.10–10.10.10.250, gateway 10.10.10.1, DNS as required.
3. Add a static route if the APs or management tools live in another subnet.

Enable wireless on the XG

1. In the XG admin, go to Wireless Protection. The menu varies by firmware. Turn on wireless protection.
2. Add a wireless network, or SSID. Example: OFFICE-STAFF mapped to VLAN 20, guest SSID mapped to VLAN 30.
3. Choose bridging mode or NAT mode for each SSID. For a simple setup, I bridge VLANs to the wired network so clients get policy and DHCP from the firewall.

Access point onboarding and grouping

1. Plug the APs into a switch port in the management VLAN. Make sure the AP has a route to the XG management IP.
2. In Wireless Protection > Access Points, click Add access point. Follow the wizard to give the AP a name and group.
3. Create AP groups when different SSID maps or radio settings are needed. Example: AP group “Ground Floor” with high transmit, “Office” with reduced power.

Firewall configuration and network policies

1. Allow management traffic from APs to the XG. If the APs are on the same VLAN, the XG already listens for them. If they are remote, permit the management protocol and ports between subnets. Keep the rules tight and open only what is needed.
2. Create firewall rules for client traffic. Example rules:

• Allow STAFF_VLAN to LAN and WAN as required.
• Deny STAFF_VLAN to MGMT_VLAN except for authorised services.
• Guest VLAN: restrict to internet only.

3. Apply IDS/IPS and web filtering only where needed. I limit deep inspection on guest VLANs to avoid user issues.

APX and AP model checks

• Some APX models are newer and only supported through Sophos Central Wireless. Check model support before you spend time onboarding them. Use the support pages above.
• If the APX devices can be managed by the XG, they should appear under Wireless Protection once they have contact and a valid group assignment.

Verification and testing

1. Check the Access Points list. The AP should appear as Connected and show firmware and radio status.
2. Confirm the SSID is broadcasting. Use a laptop or phone to scan for it.
3. Connect a client. Check that it gets an IP from the assigned VLAN DHCP range.
4. Verify traffic flows and policy. Test internet access and internal resource access as the policy allows. Check guest isolation if it is configured.
5. Look at the logs: Wireless Protection and Network > Firewall logs. Check there are no blocked management packets.

Troubleshooting notes

• If the APs do not appear, confirm they can reach the XG. Ping the management IP from a device in the same VLAN.
• Check VLAN tagging on trunk ports. A wrong tag is the usual cause.
• If DHCP behaves oddly, confirm the DHCP server is bound to the correct interface.
• If AP firmware versions do not match, update the AP firmware from the XG or Central depending on model support.

Concrete example configuration I use

• MGMT VLAN 10: 10.10.10.1/24. DHCP 10.10.10.10–10.10.10.50.
• STAFF VLAN 20: bridged SSID OFFICE-STAFF. DHCP 10.20.0.10–10.20.0.200.
• GUEST VLAN 30: SSID GUEST-INTERNET with captive portal and internet-only firewall rule.

Final checks and operational tips

• Document the minimal firewall config. Keep a named backup after you finish.
• Label switch ports so future changes do not break the management VLAN.
• If long-term AP management matters, move APs to Sophos Central for easier lifecycle updates. That is the current Sophos direction for many APX models.