If you encounter any issues during installation, please consult our AP7 troubleshooting guide. 

Feel free to email us at help@firewalla.com or use this link to create a support case, and our engineers will help you directly.

A Firewalla unit (Any Gold or Purple unit in router mode) is required to use the AP7

• STEP 1: Prepare Your Firewalla Box and App
• STEP 2: Get to Know the Hardware
• STEP 3: Wire Up the Access Point
• STEP 4: Setting Up with the App
• STEP 5: Get Started with Firewalla AP7

 

STEP 1: Prepare Your Firewalla Box and App

Before installing your AP7, make sure:

1. Your Firewalla App is updated to the latest.
2. The Firewalla unit is in Router Mode.

 

STEP 2: Get to Know the Hardware

Model: AP7 Desktop (AP7D)

• Firewalla Access Point Desktop has two bridged, multi-speed Ethernet ports: one 2.5 Gbps and one 10 Gbps.
• Firewalla AP7D powers on by itself after the power supply is connected to the unit. More details are available in the AP7 Troubleshooting Guide here. 
• On the back, there is an "action" button with an LED light next to it, function TBD.
• The reset button on the bottom of the device can be used to reset the Access Point to factory settings. Learn more about how to reset Firewalla AP7. 
• The LED light on the front is used to show the status of the Access Point. Learn more about status light definitions here.
• The Firewalla AP7 Desktop can mesh with the AP7 Ceiling using Ethernet or Wi-Fi backhaul.

Model: AP7 Ceiling (AP7C)

• Firewalla Access Point Ceiling has two bridged, multi-speed Ethernet ports: one 2.5 Gbps and one 10 Gbps with PoE+.
• Firewalla AP7C powers on by itself after the power is connected to the unit. The AP7C can be powered either through a PoE+ switch, PoE+ injector, or through a power adapter connected to the power port (not included and must be purchased separately). 
  • Please make sure the power supports IEEE 802.3at or IEEE 802.3bt, NOT IEEE 802.3af. 
• The reset button on the bottom of the device can be used to reset the Access Point to factory settings. Learn more about how to reset Firewalla AP7. 
• The LED light on the front is used to show the status of the Access Point. Learn more about status light definitions here.
• The Firewalla AP7 Ceiling can mesh with the AP7 Desktop using Ethernet or Wi-Fi backhaul.
• For mounting instructions, see our mounting guide here. (We recommend mounting your AP7C unit AFTER successfully pairing the unit with your Firewalla box.)

 

 Status Light Definition

Light	Status
Solid Blue	Normal
Blinking Blue	Applying Configurations
Solid White	Upgrading
Blinking White	Ready for Pairing
Solid Green	Locating
Blinking Green	Pairing
Solid Red	Booting Up, or System Error (Rare)
Blinking Red	Network Down

 

 

STEP 3: Wire Up the Access Point

• The setup process per Access Point may take 5-10 minutes (including software updates); please be patient. 
• Please note that we only support setting up one Access Point at a time. If you have multiple Access Points during setup, connect them to power one at a time (paired Access Points are OK to remain powered on). 

 

STEP 3-1: Power On the Access Point

AP7 Desktop

Power on the Access Point with the power adapter that comes in the box. 

AP7 Ceiling

Ensure your Ethernet cable supports PoE+ and receives power from a PoE+ switch or PoE+ injector. Plug the Ethernet cable into the Access Point's 10G (PoE+) port.

If you'd like to use a regular power adapter instead, make sure it's 12V 2.5A.

 

STEP 3-2: Connect the Access Point to a Firewalla Box 

• AP7 Desktop
• AP7 Ceiling 
• Additional Firewalla Access Points

AP7 Desktop

If it's the FIRST Firewalla Access Point to be set up with your Firewalla Box,

1. Connect one end of an Ethernet cable to the LAN port of your Firewalla Box or a switch connected to the Firewalla LAN port.
   • Ensure that the Firewalla LAN port has a LAN created in the Network Manager of your Firewalla app.
   • If you're connecting through a managed switch and want to use VLANs with the AP7, ensure the switch port connected to the Firewalla Access Point is a trunk port (carrying all VLANs). 
2. Then, connect the other end to either the 2.5 Gbit or 10 Gbit port on the Firewalla Access Point.

When placing your Firewalla AP7 Desktop:

• We recommend a central location where the internet is used the most, like a living room or a bedroom.
• To maximize signal coverage, avoid placing it close to major obstructions like walls, furniture, or appliances.
• If possible, place them 3 to 5 feet above the floor.

Once connected, the front LED light will blink white, indicating that the device is ready for pairing. 

 

AP7 Ceiling 

The Firewalla AP7 Ceiling and AP7 Desktop are mesh compatible and support both Wi-Fi and Ethernet backhaul.

If it's the FIRST Firewalla Access Point to be set up with your Firewalla Box,

1. Connect one end of an Ethernet cable to the LAN port of your Firewalla Box or a switch connected to the Firewalla LAN port.
   • Ensure that the Firewalla LAN port has a LAN created in the Network Manager of your Firewalla app.
   • If you're connecting through a managed switch and want to use VLANs with the AP7, ensure the switch port connected to the Firewalla Access Point is a trunk port (carrying all VLANs). 
2. Then, connect the other end to the LAN port of the:
   • PoE+ switch
   • PoE+ injector
   • 2.5 Gbit port on the Firewalla Access Point

When placing your Firewalla AP7 Ceiling:

• We recommend a central location where the internet is used the most, like a living room.
• To maximize signal coverage, avoid placing it close to major obstructions.
• For best coverage, mount on the ceiling or 6 to 10 feet high on the wall. For mounting instructions, see our mounting install guide. 
• We recommend mounting your AP7C unit AFTER successfully pairing the unit with your Firewalla box.

Once connected, the front LED light will blink white, indicating that the device is ready for pairing. 

 

Additional Firewalla Access Points

Firewalla Access Points (both Desktop and Ceiling) support Wi-Fi mesh with Ethernet or Wi-Fi backhaul. Both units are compatible with each other.

Wi-Fi backhaul: After connecting the additional Access Point to power, follow Step 4 to set it up. After setup, it will wirelessly connect to the Firewalla box through the paired Access Points.

• Note: If you have any issues pairing your additional Access Point via Wireless Backhaul, try placing the unit closer to an existing paired Access Point.

Ethernet backhaul: After connecting the additional Access Point to power, use an Ethernet cable to connect any port on the additional Access Point to:

1. A LAN port on the Firewalla box (it must be on the same LAN as the paired Access Point).
2. A switch connected to a LAN port on the Firewalla box.*
3. Any port on a paired Access Point (chained).

 

Note:

• Only one Access Point can be paired at a time. During pairing, please leave other unpaired Access Points powered off (already paired Access Points are OK to remain powered on).
• If you're using a managed switch to connect the AP7s and the Firewalla box, make sure the ports connected to both the Firewalla box and the AP7s have the same untagged and tagged VLANs, as well as the same PVID settings.

 

*When connecting additional Access Points through a switch, there are a few ways to do this:

1. Connect all Access Points to the switch directly.

2. Connect one Access Point to the switch, and wirelessly connect the rest.

3. Connect one Access Point to the switch and connect additional Access Points to the paired Access Point (chained).

 

STEP 4: Setting Up with the App

Open the Firewalla app on your phone, and go to the main screen of the Firewalla Box you are setting up your Access Point with. For Access Points connected via Ethernet, a banner will appear at the top of the screen. Tap "Pair" to begin the pairing process.

• For wired Access Points, the Firewalla App supports remote AP7 installation, meaning you don’t need to be on the same network or even in the same room as the AP7 to install it.

 

 

Alternatively, you can scroll down to find and tap on the Wi-Fi button, then tap Access Point -> Add Access Point. The App will guide you through the process. 

 

 

The app will ask you to create a Wi-Fi for the first Access Point. Select an existing LAN/VLAN to create the Wi-Fi on, or tap New Network, enter a VLAN ID, and Firewalla will automatically create the Wi-Fi and a new VLAN.

 

Note:

• To create Firewalla Wi-Fi on a specific VLAN, make sure that the VLAN is assigned to the same ports as the LAN your Access Point is connected to. For example, if your Access Point is plugged into Port 1 of your Firewalla router, and your LAN is set up to use Ports 1 and 2, the VLAN must also use Ports 1 and 2.
• If you would like to use the same SSID + password as your existing third-party APs, we recommend disconnecting them or changing the SSID of the third-party APs to something else before creating the new Firewalla Wi-Fi.

 

For additional Access Points, the app will confirm the existing Firewalla Wi-Fi before setting up.

 

The setup process may take 5-10 minutes. After setting up, the Access Point usually takes another 1-2 minutes to initialize and start broadcasting your Wi-Fi.

 

Note: If you have multiple Firewalla Access Points, any Wi-Fi created will apply to all of them. The Firewalla AP7s are installed as a set, and individual control is not available.

 

STEP 5: Get Started with Firewalla AP7

This article shows the first steps to creating your Wi-Fi and all the new features available:
Getting Started with Firewalla Access Point 7

Learn more about Firewalla Zero Trust:

• Firewalla Zero Trust Network Architecture
• Firewalla Zero Trust Network Architecture Example
• Firewalla Zero Trust Best Practices and Examples

Learn more about Firewalla Microsegmentation:

• VqLAN: Firewalla Microsegmentation
• Segmentation and Microsegmentation Tutorial (For a quick video guide, check out our YouTube video below)

For more Firewalla AP7 guides: 

• Firewalla Access Point 7 Ceiling Mount Installation Guide
• Firewalla AP7 Troubleshooting Guide

For AP7 beta feedback and discussions, please join our AP7 Community page here.