Welcome to your new Firewalla Access Point 7! We’re excited to help you set up and secure your network with your new Firewalla AP7. This guide will show the first steps to creating your Wi-Fi and all the new features available.

If you haven't installed your Firewalla AP7 yet, please see our installation guide.

Basic Wi-Fi Guide
Advanced Configurations
Getting Started with Zero Trust and Microsegmentation
FAQs

Other helpful resources:

To troubleshoot your unit, please see our Troubleshooting Guide.
For general discussions, please join our Firewalla AP7 Community Page.

1. Basic Wi-Fi Guide

The Firewalla Access Point 7 offers unique configuration options beyond what is typically available in other consumer access points. This guide displays how Firewalla AP7’s basic features provide more control and flexibility to better fit your networking needs.

In this guide, we may refer to "Wi-Fi" and "SSID" (the name of your Wi-Fi) interchangeably.

1.1 Create Firewalla Wi-Fi

When you pair your first Firewalla AP7, the app will ask you to create your Wi-Fi.

By default, each Wi-Fi name, or SSID, uses WPA2/WPA3 security with all frequency bands enabled. If your networking needs are simple, this default option works perfectly.

To create a new Firewalla Wi-Fi:

Tap the Wi-Fi button on the main screen.
Tap Create Wi-Fi.
Set the Wi-Fi name (SSID), password, and network.

Note: If you have multiple Firewalla AP7s, any SSID created will apply to all of them. The Firewalla AP7s are installed as a set.

Unlike many consumer-grade APs, each SSID can be customized, including:

Network: The LAN or VLAN for the SSID. (Note: Wi-Fi can only be created on VLANs using the same ports as the LAN the Firewalla AP7 is wired to.)
User/Group (optional): When connected, assign devices to a user/group automatically.
Security Settings: Choose from WPA/WPA2, WPA2, WPA2/WPA3, or WPA3.
Frequency Bands: Select from 2.4 GHz, 5 GHz, and/or 6 GHz.

1.2 Additional Wi-Fi

Firewalla AP7 allows you to create up to 10 separate SSIDs, each customizable for different needs, devices, or networks.

For example, create separate SSIDs for kids, IoT devices, or guests.
If you have a family of four, you can create an SSID for each person, and all SSIDs can share the main network.
Creating multiple SSIDs on the 2.4 GHz channel is not recommended, as the overhead may slow down the 2.4 GHz band.

(Optional) Each SSID can be automatically assigned to specific users, groups, or networks:

Assign to User/Group
Assign to Different Networks

1.2.1 Assign to User/Group

To assign an SSID to a user or device group:

Create a new Wi-Fi or use an existing one.
Tap on the SSID. On the Wi-Fi detail page, tap Edit in the top right corner.
Tap User/Group, choose a user or device group, then save.

Once configured, Firewalla will automatically map devices to the assigned user or device group when they connect to Wi-Fi.

create wifi.jpg

1.2.2 Assign to Different Networks

To assign an SSID to a different network:

Create a VLAN or use an existing one (ensure that the VLAN is configured to the same ports as the LAN the Firewalla AP7 is connected to).
Create a new SSID and select the VLAN as the network, or edit an existing SSID and choose the VLAN for the network.

Once configured, Firewalla will automatically map devices to the VLAN when they connect to Wi-Fi.

1.3 View Your AP Topology Layout

Firewalla AP7 supports both wired and wireless mesh. The Firewalla app displays your Access Point topology and the signal strength of wirelessly connected (backhaul) Access Points to help you visualize how your APs are laid out.

To view the topology:

Tap on Wi-Fi from the main screen.
Tap the Access Points tab.

It is possible for some of the Wi-Fi backhaul units to be nested. For example, in the setup below:

The Yard AP is connected to the Kitchen AP via Wi-Fi.
The Kitchen AP is connected to the Living Room AP via Wi-Fi.
The Living Room AP and the Garage AP are directly wired to the Firewalla router.

1.4 New Visibility Features

With the Firewalla AP7, network visibility is extended to your LAN, giving you full visibility on how devices communicate within your local network.

1.4.1 Signal Strength

Devices connected to Firewalla AP7s can be sorted by signal strength, with each device displaying a colored label indicating its value.

To sort and view the signal strength per device:

Tap Devices on the main screen.
Tap the View Options in the top right corner.
Tap sort devices by Signal Strength.

1.4.2 Wi-Fi and Access Point Details

With the Firewalla AP7, the device detail page now displays Wi-Fi information for each device connected to Firewalla Wi-Fi, including:

Connected Wi-Fi Name (SSID)
Access Point
Channel
Signal Strength
Wi-Fi Standard
MIMO (Multiple Input, Multiple Output)
Rx/Tx Rates (Receive/Transmit Rates)

1.5 Local Flows

The Local Flows feature is enhanced to display connections between local devices connected to the Firewalla AP7.

1.6 Improved Wi-Fi Testing

With the Firewalla AP7, the Wi-Fi Test is enhanced to help you find the best Wi-Fi spots in your home or office.

When connected to Firewalla Wi-Fi, the Wi-Fi Test will provide detailed information about the connection between your phone and the Firewalla AP7, including:

SSID
BSSID
Access Point
Channel
Band
Signal Strength

2. Advanced Configurations

If you’re an advanced networker looking to improve Wi-Fi performance, the Firewalla AP7 offers more options to customize your Access Points.

2.1 Multiple Frequency Band Support

Each SSID supports 2.4 GHz, 5 GHz, and 6 GHz frequency bands. By default, all three bands are enabled.

To choose the frequency bands:

Tap Wi-Fi on the main screen, then tap on the SSID to configure.
Tap Edit in the top right corner.
Tap Band under Advanced Settings, select the bands you’d like to use, then save.

Note: The 6 GHz band only works with WPA3 or WPA2/WPA3 Personal security, and it is disabled on microsegmented SSIDs with personal keys. Learn more about microsegmentation here.

2.2 Advanced Access Point Settings

Each Firewalla AP7 can be configured to different settings per frequency band.

Navigate to a specific Firewalla AP7 from your Access Point list (Wi-Fi > Access Points) or Device List.

From an Access Point’s detail page, you’ll be able to configure:

Channels: For 2.4 GHz and 5 GHz frequency bands, manually specify the channel to use, or let Firewalla choose it automatically. (6 GHz channel specifications will be available in the future.)
TX Power: For all frequency bands, manually specify the power to use, or let Firewalla choose it automatically. A high TX power may not always be the best. A lower TX power may be better if you are in a crowded place and have your Firewalla AP7s fairly close.

Warning: Unless you know what you are doing, keep these settings “automatic”.

To ensure you are working with the correct Access Point, navigate to the Firewalla AP7 detail page and tap Locate This Access Point. This will make the LED light turn green on the corresponding Firewalla AP7.

2.3 Advanced Wi-Fi Settings

The Firewalla AP7 provides advanced Wi-Fi settings that apply to all Access Points, such as:

Band Steering: Automatically switch between Wi-Fi Bands during idle times.
Maximize Compatibility: Improve your Wi-Fi to be compatible with more devices. This option is enabled by default.

Tap the Wi-Fi Settings button in the top right corner of the Wi-Fi page to toggle these settings.

If any wireless devices are experiencing unstable Wi-Fi, you can optimize their Wi-Fi performance using the Optimize Wi-Fi Experience button on the device’s detail page. Firewalla may reconnect the device to a different Firewalla AP7 with a better signal (if available).

3. Getting Started with Zero Trust and Microsegmentation

Firewalla empowers homes and small businesses with Zero Trust architecture. With the introduction of the Firewalla AP7, we can push Zero Trust further into the network by protecting both the LAN and WAN.

If you are already using "Groups" or "Users" to manage devices, all you need to do is go to groups (or users) and turn on VqLAN. (With VqLAN on, your group/user will now be segmented from the rest of your devices).

Use groups (or users) to identify the devices that need to be microsegmented. These devices will need to be on the same network.
When VqLAN is on, your devices within the group/user can only talk to themselves and the internet. They will not be able to access devices outside the group/user.
You can further enhance this microsegment by turning on Device Isolation. This will isolate devices within the same group from talking to each other.

For more advanced uses of Zero Trust + Microsegmentation + Segmentation, please continue with these articles:

Learn more about Firewalla Zero Trust architecture here.
See more advanced Microsegmentation and Segmentation Examples here.

4. FAQs

Can the Firewalla AP7 be added to existing APs?
What security type does Firewalla AP7 support?
Does Firewalla AP support separating/merging different bands in the same or different SSID?
What happens if I don't choose a User/Group for an SSID?

Can the Firewalla AP7 be added to existing APs?

Yes. There are a few options depending on your setup:

1. Using only Firewalla AP7s.

If you use only Firewalla AP7s, your Wi-Fi will roam from one Firewalla AP7 to another when you walk around.
Roaming is seamless and efficient for large homes or enterprise networks with multiple APs.

2. With third-party APs and different SSIDs.

You can use the Firewalla AP7 in parallel with your existing third-party APs already connected to your Firewalla box.
Connect the Firewalla AP7 to another LAN port of your Firewalla box. Ensure the new port is configured as either bridged with an existing LAN or a new LAN. Then, create a new SSID on the Firewalla AP7.
Your third-party APs will continue broadcasting the old SSID, while the Firewalla AP7 will broadcast the new SSID.

3. With third-party APs, but the same SSID.

If you have third-party APs or Wi-Fi routers, you can configure the same SSID + password on the Firewalla AP7.
This setup is not recommended. If the APs are not from the same manufacturer, roaming will cause a disconnect/reconnect, and your network may not be stable during the process.

The downside of using third-party APs with the Firewalla AP7 is that the advanced Firewalla features won’t run on the third-party AP Wi-Fi.

What security type does Firewalla AP7 support?

Firewalla AP7 supports WPA/WPA2, WPA2, WPA2/WPA3, and WPA3 personal. We plan to support enterprise security in the future.

Note: Microsegments with personal keys are only supported with security type WPA2 personal or WPA/WPA2 Personal (WPA3 is not supported).

Does Firewalla AP7 support separating/merging different bands in the same or different SSID?

Yes. Each SSID can be configured to use a combination of 2.4 GHz, 5 GHz, and 6 GHz frequency bands, or just a single band per SSID.

For example:

Your main SSID can be configured for all three bands simultaneously, allowing newer devices to connect to the higher 5 GHz or 6 GHz bands, while older devices can still connect to the 2.4 GHz band.
Your kids’ Wi-Fi can be set up with 2.4 GHz and 5 GHz under the same SSID.
Your guest Wi-Fi can be limited to just 2.4 GHz.

Note: Only SSIDs without microsegments (using personal keys) will support the 6 GHz band. Creating microsegments on an SSID with personal keys will disable the 6 GHz band for that SSID.

What happens if I don't choose a User/Group for an SSID?

Selecting a User/Group for each SSID is optional and will dynamically assign devices to groups when they connect to the SSID.

If you don't choose a User/Group, the group membership will remain static. Devices that connect to the SSID will stay in their original user or group, and if New Device Quarantine is enabled, new devices will be placed in the quarantine group.

Articles in this section

Getting Started with Firewalla Access Point 7

1. Basic Wi-Fi Guide

1.1 Create Firewalla Wi-Fi