Access Point Firmware Releases

This firmware update is a maintenance release that resolves several Airspace Monitoring issues that could cause false Evil Twin, Rogue, and Suspected Rogue access point detections and alerts.

[AP-3261, AP-3277, AP-3293, AP-3314, AP-3316, AP-3333, AP-3334]

This firmware release is for all WatchGuard access points managed in WatchGuard Cloud, and contains stability and performance improvements, new features, enhancements, and resolved issues.

New Features

Access Point Client Journey

The Client Journey provides a visualization of recent activities of how a wireless client associates, authenticates, and roams across access points, making it easy to analyze and troubleshoot wireless activity. This feature requires a USP Wi-Fi Management license.

Access Point Client Timeline

The Client Timeline provides a clear view of how a wireless client associates, authenticates, and roams across access points over time, with detailed connection event messages to simplify analysis and troubleshooting.

Access Point Third-Party Captive Portal Vendor and ADIPSYS Support

This feature enables you to specify a vendor identifier when you configure a third-party captive portal to ensure reliable integration with supported vendors, including new ADIPSYS support for deployments that use custom-branded or region-specific splash URLs.

Access Point Channel History Report

The Channel History report provides details about channel usage for WatchGuard access points and identifies the reasons an access point changed its operating channel. These reasons include automatic or manual channel selection, Dynamic Channel Selection (DCS), DFS radar detections, and device reboots.

This firmware release enables these additional new features for AP230W, AP332CR, AP430CR, and AP432 devices that were already available for AP130 and AP330 devices in firmware v3.1 and higher.

Platform Update for Improved Performance and Stability

This firmware release includes an important update to the internal platform to improve overall wireless performance, connectivity, and stability.

• This release includes updates to the wireless drivers and kernel upgrades that improve system stability and wireless client connectivity.
• These updates resolve many previously reported customer issues about client disconnections and access point reliability under higher loads.
• This release includes improvements to authentication flow, key‑exchange reliability, and client state recovery, resulting in fewer abnormal disconnections and more consistent client reconnection following transient failures.
• This release also includes several logging and reporting enhancements to help troubleshoot access point issues when they occur:
• Improved ability to capture fault report and crash details after an irregular system event.
• Additional data in the diagnostic snapshot file to capture more memory usage information and improve data capture after irregular device reboots.

DCS Enhancements and Interference Mitigation (AP230W, AP332CR, AP430CR, and AP432)

The Dynamic Channel Selection (DCS) algorithm is updated to improve the evaluation and selection of channels and prevent co-channel and adjacent channel interference. During a regular scan, DCS evaluates channels by the number of BSSIDs that use a channel and the current amount of channel utilization to determine the best channel to use.

You can also enable a new DCS Interference Mitigation feature that enables the 5 GHz radio to manage the current real-time channel congestion and interference by switching to a less congested channel if the current channel utilization is greater than the configured utilization threshold (default 60%). Interference Mitigation is not supported on the 2.4 GHz radio.

Client Balancing (AP230W, AP332CR, AP430CR, and AP432)

You can now enable a new Client Balancing feature in the radio settings of an Access Point Site. Client Balancing utilizes the BSS transition management (BTM) feature of the 802.11v protocol and information about the current state of the network to steer wireless clients to the most optimal access point. This network optimization helps evenly distribute client connections across multiple access points in dense Wi-Fi deployments. Wireless clients are steered to less-congested access points, even if the signal strength is not as strong as a nearby access point that already has a high number of connected clients.

You can only enable Client Balancing in the 2.4 GHz and 5 GHz radio settings of an Access Point Site configuration. This ensures that all access points are enabled with this feature to share data and optimize client balancing.

Enhancements

• The WPA group key rotation interval is changed to 24 hours to reduce unnecessary client disconnects caused by missed hourly rekeys for sleeping or idle client devices. [AP-2961]
• WPA‑Enterprise mandatory re‑authentication (session timeout) is set to 24 hours to align with the updated WPA group key interval. [AP-2962]

Resolved Issues

• The network interface status of the AP430CR now correctly shows eth1 as down when the LAN2 interface is disabled. [AP-2427]
• Reporting data for wireless clients now returns correct values for the security mode and association ID. [AP-2272, AP-2991]
• Accounting sessions now correctly start for wireless clients that fast roam to another access point. [AP-2964]
• Resolved a boot time security issue. [AP-2995]
• Airspace monitoring and ThreatSync detection now correctly identifies Wi-Fi 7 802.11be devices. [AP-3065]
• SSIDs with PPSK now continue to function correctly after an SSID is renamed. [AP-3042]
• Airspace Monitoring now reports accurate and consistent information when scanning wireless channels. [AP-3060]
• An AP330 no longer encounters configuration reloads, airspace monitoring errors, or incorrect Evil Twin detection. [AP-3075]
• The ARP scan interval for Airspace Monitoring on wired networks is increased to approximately 5 minutes to reduce ARP broadcast traffic. [AP-3044, AP-3056]
• An AP330 no longer unexpectedly reboots while under a high-client load and sustained traffic. [AP-3067]
• Excessive kernel debug logging no longer occurs during Dynamic Channel Selection and Interference Mitigation events. [AP-2983]
• Client balancing now provides more detailed reason messages for balancing decisions. [AP-2796]
• A memory leak issue is resolved. [AP-3070]
• Client balancing now remains enabled and functional after an access point firmware upgrade. [AP-3077]
• In some cases, AP330 devices continuously rebooted after a firmware upgrade. [AP-3108]
• An AP330 upgrade no longer causes a neighbor access point's SSID to be incorrectly reported as an Evil Twin with an "Invalid signature detected" alert. [AP-3131]
• Access points no longer incorrectly identify themselves as Evil Twin threats during Airspace Monitoring scans. [AP-3136]
• Legitimate network devices such as Wi-Fi-connected printers are no longer incorrectly detected as rogue access points. [AP-3137]
• Airspace Monitoring scans no longer consumes excessive CPU resources. [AP-3189]

This firmware release is for all WatchGuard access points managed in WatchGuard Cloud, and contains stability and performance improvements, new features, enhancements, and resolved issues.

New Features

Access Point Client Timeline (Beta)

The Client Timeline provides a clear view of how a wireless client associates, authenticates, and roams across access points over time, with detailed connection event messages to simplify analysis and troubleshooting.

Access Point Channel History Report (Beta)

The Channel History report provides details about channel usage for WatchGuard access points and identifies the reasons an access point changed its operating channel. These reasons include automatic or manual channel selection, Dynamic Channel Selection (DCS), DFS radar detections, and device reboots.

This firmware release enables these additional new features for AP230W, AP332CR, AP430CR, and AP432 devices that were already available for AP130 and AP330 devices in firmware v3.1 and higher.

Platform Update for Improved Performance and Stability

This firmware release includes an important update to the internal platform to improve overall wireless performance, connectivity, and stability.

• This release includes updates to the wireless drivers and kernel upgrades that improve system stability and wireless client connectivity.
• These updates resolve many previously reported customer issues about client disconnections and access point reliability under higher loads.
• This release includes improvements to authentication flow, key‑exchange reliability, and client state recovery, resulting in fewer abnormal disconnections and more consistent client reconnection following transient failures.
• This release also includes several logging and reporting enhancements to help troubleshoot access point issues when they occur:
• Improved ability to capture fault report and crash details after an irregular system event.
• Additional data in the diagnostic snapshot file to capture more memory usage information and improve data capture after irregular device reboots.

DCS Enhancements and Interference Mitigation (Beta for AP230W, AP332CR, AP430CR, and AP432)

The Dynamic Channel Selection (DCS) algorithm is updated to improve the evaluation and selection of channels and prevent co-channel and adjacent channel interference. During a regular scan, DCS evaluates channels by the number of BSSIDs that use a channel and the current amount of channel utilization to determine the best channel to use.

You can also enable a new DCS Interference Mitigation feature that enables the 5 GHz radio to manage the current real-time channel congestion and interference by switching to a less congested channel if the current channel utilization is greater than the configured utilization threshold (default 60%). Interference Mitigation is not supported on the 2.4 GHz radio.

Client Balancing (Beta for AP230W, AP332CR, AP430CR, and AP432)

You can now enable a new Client Balancing feature in the radio settings of an Access Point Site. Client Balancing utilizes the BSS transition management (BTM) feature of the 802.11v protocol and information about the current state of the network to steer wireless clients to the most optimal access point. This network optimization helps evenly distribute client connections across multiple access points in dense Wi-Fi deployments. Wireless clients are steered to less-congested access points, even if the signal strength is not as strong as a nearby access point that already has a high number of connected clients.

You can only enable Client Balancing in the 2.4 GHz and 5 GHz radio settings of an Access Point Site configuration. This ensures that all access points are enabled with this feature to share data and optimize client balancing.

Enhancements

• The WPA group key rotation interval is changed to 24 hours to reduce unnecessary client disconnects caused by missed hourly rekeys for sleeping or idle client devices. [AP-2961]
• WPA‑Enterprise mandatory re‑authentication (session timeout) is set to 24 hours to align with the updated WPA group key interval. [AP-2962]

Resolved Issues

• The network interface status of the AP430CR now correctly shows eth1 as down when the LAN2 interface is disabled. [AP-2427]
• Reporting data for wireless clients now returns correct values for the security mode and association ID. [AP-2272, AP-2991]
• Accounting sessions now correctly start for wireless clients that fast roam to another access point. [AP-2964]
• Resolved a boot time security issue. [AP-2995]
• Airspace monitoring and ThreatSync detection now correctly identifies Wi-Fi 7 802.11be devices. [AP-3065]
• SSIDs with PPSK now continue to function correctly after an SSID is renamed. [AP-3042]
• Airspace Monitoring now reports accurate and consistent information when scanning wireless channels. [AP-3060]
• An AP330 no longer encounters configuration reloads, airspace monitoring errors, or incorrect Evil Twin detection. [AP-3075]
• The ARP scan interval for Airspace Monitoring on wired networks is increased to approximately 5 minutes to reduce ARP broadcast traffic. [AP-3044, AP-3056]
• An AP330 no longer unexpectedly reboots while under a high-client load and sustained traffic. [AP-3067]
• Excessive kernel debug logging no longer occurs during Dynamic Channel Selection and Interference Mitigation events. [AP-2983]
• Client balancing now provides more detailed reason messages for balancing decisions. [AP-2796]
• Client balancing now remains enabled and functional after an access point firmware upgrade. [AP-3077]

This firmware release is for AP130 and AP330 devices only, and contains these resolved issues:

• An AP330 on firmware v3.1 no longer unexpectedly reboots when performing threat remediation actions while under a high client load. [AP-3003]
• Resolved an issue where the access point sometimes failed to process Airspace Monitoring messages, which prevented wireless scan data from being sent successfully. [AP-2987]
• Resolved an issue where an access point configuration deployment could fail with a "Cannot get response" error when handling messages from the Airspace Monitoring process. [AP-3037]
• The ARP scan interval for Airspace Monitoring on wired networks is increased to approximately 5 minutes to reduce ARP broadcast traffic. [AP-3056]

This firmware release is for AP130 and AP330 devices only, and contains stability and performance improvements, new features, enhancements, and resolved issues.

For additional information on this release, go to New features, enhancements, and stability and performance improvements in firmware v3.1 for AP130 and AP330 devices in the WatchGuard Knowledge Base.

New Features

Platform Update for Improved Performance and Stability

This firmware release includes an important update to the internal platform to improve overall wireless performance, connectivity, and stability of AP130 and AP330 devices.

• This release includes updates to the wireless drivers and kernel upgrades that improve system stability and wireless client connectivity.
• These updates resolve many previously reported customer issues about client disconnections and access point reliability under higher loads.
• This release includes improvements to authentication flow, key‑exchange reliability, and client state recovery, resulting in fewer abnormal disconnections and more consistent client reconnection following transient failures.
• This release also includes several logging and reporting enhancements to help troubleshoot access point issues when they occur:

• Improved ability to capture fault report and crash details after an irregular system event.
• Additional data in the diagnostic snapshot file to capture more memory usage information and improve data capture after irregular device reboots.

DCS Enhancements and Interference Mitigation

The Dynamic Channel Selection (DCS) algorithm is updated to improve the evaluation and selection of channels and prevent co-channel and adjacent channel interference. During a regular scan, DCS evaluates channels by the number of BSSIDs that use a channel and the current amount of channel utilization to determine the best channel to use.

You can also enable a new DCS Interference Mitigation feature that enables the 5 GHz radio to manage the current real-time channel congestion and interference by switching to a less congested channel if the current channel utilization is greater than the configured utilization threshold (default 60%). Interference Mitigation is not supported on the 2.4 GHz radio.

These features are currently only supported on AP130 and AP330 devices with firmware v3.1 and higher.

Client Balancing

You can now enable a new Client Balancing feature in the radio settings of an Access Point Site. Client Balancing utilizes the BSS transition management (BTM) feature of the 802.11v protocol and information about the current state of the network to steer wireless clients to the most optimal access point. This network optimization helps evenly distribute client connections across multiple access points in dense Wi-Fi deployments. Wireless clients are steered to less-congested access points, even if the signal strength is not as strong as a nearby access point that already has a high number of connected clients.

You can only enable Client Balancing in the 2.4 GHz and 5 GHz radio settings of an Access Point Site configuration. This ensures that all access points are enabled with this feature to share data and optimize client balancing.

This feature is currently only supported on AP130 and AP330 devices with firmware v3.1 and higher.

Scheduled Reboots

You can now schedule a one-time or recurring access point reboot. Regular reboots help refresh access point resources and optimize channel selection. The access point will reboot at the scheduled date and time based on the time zone set in the device configuration.

You can schedule a one-time reboot from the Device Settings or Device Summary page of an access point. Recurring reboots must be configured in the device configuration or an Access Point Site. In an Access Point Site configuration, you can also select the Stagger Reboots option so that access points subscribed to the site do not reboot at the same time and reboot in 5-minute intervals to prevent network disruption.

• Access points on firmware version 2.7.21 and higher support the ability to schedule both one-time reboots and recurring reboots.
• Access points on firmware version 2.7.17 and lower only support a scheduled one-time reboot.

Enhancements

• The access point’s ability to capture fault report and crash details after an irregular system event is improved. [AP-1534, AP-2747]
• The access point diagnostic snapshot file now includes the device startup event logs to improve data capture after irregular device reboots. [AP-2318]
• The access point diagnostic snapshot file now includes improved process memory usage information. [AP-2735]
• A new "collectmem" CLI command is available that collects memory process information and usage for a specified number of days. This information is logged and added to the diagnostic snapshot file of the access point for troubleshooting.

Resolved Issues

• Access points no longer randomly reboot when Fast Handover is enabled. [AP-859. AP-2721]
• Access points no longer crash when the number of client connection attempts exceeds the configured client limit on the device. [AP-2544, AP2577]
• SSID broadcast schedule issues that caused frequent client dissociation no longer occur when Wi-Fi scheduling is enabled. [AP-2470]
• RADIUS accounting packets from the access point now correctly include the client’s Framed-IP-Address in the first packet. This prevented wireless clients from passing traffic on applied RADIUS policies until the next accounting interval. [AP-1452]
• You can now correctly download a diagnostic snapshot file after a packet capture (pcap) file download fails. [AP-2561]
• Repeated configuration deployments no longer cause the access point to stop Airspace Monitoring scanning on the wired network. [AP-2555]
• The Security column for wireless client connection details now correctly shows “WPA2 Personal” when Protected Management Frames (802.11w) is enabled instead of “Open”. [AP-2588]
• The access point no longer sends traffic to www.google.com, 8.8.8.8, and ipinfo.io at boot time. [AP-2599]
• An access point no longer starts the IPsec process after a device reboot when an access point VPN is disabled. [AP-2634]
• Wireless clients can now connect to PPSK SSIDs when single or double quote characters (‘, “) are used in the passphrase. [AP-2772]
• The previous behavior of the device automatically rebooting after 30 minutes of LAN interface inactivity to recover the connection is removed. [AP-2819]
• Wireless clients were unable to connect to SSIDs with Enterprise authentication when an Access Point VPN is enabled [AP-2788, AP-2829]
• An access point no longer responds to ICMP time stamp requests (CVE-1999-0524). [AP-2936]

This firmware release is for AP230W, AP332CR, AP430CR, and AP432 devices only, and contains new features, enhancements, and resolves several issues.

New Features

Scheduled Reboots

You can now schedule a one-time or recurring access point reboot. Regular reboots help refresh access point resources and optimize channel selection. The access point will reboot at the scheduled date and time based on the time zone set in the device configuration.

You can schedule a one-time reboot from the Device Settings or Device Summary page of an access point. Recurring reboots must be configured in the device configuration or an Access Point Site. In an Access Point Site configuration, you can also select the Stagger Reboots option so that access points subscribed to the site do not reboot at the same time and reboot in 5-minute intervals to prevent network disruption.

• Access points on firmware version 2.7.21 and higher support the ability to schedule both one-time reboots and recurring reboots.
• Access points on firmware version 2.7.17 and lower only support a scheduled one-time reboot.

Enhancements

• A new "collectmem" CLI command is available that collects memory process information and usage for a specified number of days. This information is logged and added to the diagnostic snapshot file of the access point for troubleshooting. [AP-2852]

Resolved Issues

• Access points no longer randomly reboot when Fast Handover is enabled. [AP-859, AP-2721, AP-2855]
• In some cases, WatchGuard access points were incorrectly detected as an Evil Twin. [AP-2849]
• Steering logs now correctly encode the SSID profile name. [AP-2850]
• You can now correctly download a diagnostic snapshot file after a packet capture (pcap) file download fails. [AP-2561, AP-2851
• The Security column for wireless client connection details now correctly shows “WPA2 Personal” when Protected Management Frames (802.11w) is enabled instead of “Open”. [AP-2588, AP-2862]
• The LAN2 interface of the AP430CR is now correctly disabled when it is disabled in the configuration. [AP-2864]
• RADIUS accounting packets from the access point now correctly include the client’s Framed-IP-Address in the first packet. This prevented wireless clients from passing traffic on applied RADIUS policies until the next accounting interval. [AP-1452, AP-2865]
• In some cases, the security information for a client connection was incorrectly reported. [AP-2866]
• The Security column for wireless client connection details now correctly shows “WPA2 Personal” when Protected Management Frames (802.11w) is enabled instead of “Open”. [AP-2867]
• The previous behavior of the device automatically rebooting after 30 minutes of LAN interface inactivity to recover the connection is removed. [AP-2819, AP-2848]
• An access point no longer responds to ICMP time stamp requests (CVE-1999-0524). [AP-2936]

This firmware release is for AP130 and AP330 devices only, and contains stability and performance improvements, new features, enhancements, and resolved issues.

New Features

Platform Update for Improved Performance and Stability

This firmware release includes an important update to the internal platform to improve overall wireless performance, connectivity, and stability of AP130 and AP330 devices.

• This release includes updates to the wireless drivers and kernel upgrades that improve system stability and wireless client connectivity.
• These updates resolve many previously reported customer issues about client disconnections and access point reliability under higher loads.
• This release includes improvements to authentication flow, key‑exchange reliability, and client state recovery, resulting in fewer abnormal disconnections and more consistent client reconnection following transient failures.
• This release also includes several logging and reporting enhancements to help troubleshoot access point issues when they occur:

• Improved ability to capture fault report and crash details after an irregular system event.
• Additional data in the diagnostic snapshot file to capture more memory usage information and improve data capture after irregular device reboots.

DCS Enhancements and Interference Mitigation (Beta)

The Dynamic Channel Selection (DCS) algorithm is updated to improve the evaluation and selection of channels and prevent co-channel and adjacent channel interference. During a regular scan, DCS evaluates channels by the number of BSSIDs that use a channel and the current amount of channel utilization to determine the best channel to use.

You can also enable a new DCS Interference Mitigation feature that enables the 5 GHz radio to manage the current real-time channel congestion and interference by switching to a less congested channel if the current channel utilization is greater than the configured utilization threshold (default 60%). Interference Mitigation is not supported on the 2.4 GHz radio.

These features are currently only supported on AP130 and AP330 devices with beta firmware v3.1.

Client Balancing (Beta)

You can now enable a new Client Balancing feature in the radio settings of an Access Point Site. Client Balancing utilizes the BSS transition management (BTM) feature of the 802.11v protocol and information about the current state of the network to steer wireless clients to the most optimal access point. This network optimization helps evenly distribute client connections across multiple access points in dense Wi-Fi deployments. Wireless clients are steered to less-congested access points, even if the signal strength is not as strong as a nearby access point that already has a high number of connected clients.

You can only enable Client Balancing in the 2.4 GHz and 5 GHz radio settings of an Access Point Site configuration. This ensures that all access points are enabled with this feature to share data and optimize client balancing.

This feature is currently only supported on AP130 and AP330 devices with beta firmware v3.1.

Scheduled Reboots (Beta)

You can now schedule a one-time or recurring access point reboot. Regular reboots help refresh access point resources and optimize channel selection. The access point will reboot at the scheduled date and time based on the time zone set in the device configuration.

You can schedule a one-time reboot from the Device Settings or Device Summary page of an access point. Recurring reboots must be configured in the device configuration or an Access Point Site. In an Access Point Site configuration, you can also select the Stagger Reboots option so that access points subscribed to the site do not reboot at the same time and reboot in 5-minute intervals to prevent network disruption.

• AP130 and AP330 access points on beta firmware version 3.1 support the ability to schedule both one-time reboots and recurring reboots.
• All access point models currently on firmware version 2.7 and lower currently only support a scheduled one-time reboot.

Enhancements

• The access point’s ability to capture fault report and crash details after an irregular system event is improved. [AP-1534, AP-2747]
• The access point diagnostic snapshot file now includes the device startup event logs to improve data capture after irregular device reboots. [AP-2318]
• The access point diagnostic snapshot file now includes improved process memory usage information. [AP-2735]
• A new "collectmem" CLI command is available that collects memory process information and usage for a specified number of days. This information is logged and added to the diagnostic snapshot file of the access point for troubleshooting.

Resolved Issues

• Access points no longer randomly reboot when Fast Handover is enabled. [AP-859. AP-2721]
• Access points no longer crash when the number of client connection attempts exceeds the configured client limit on the device. [AP-2544, AP2577]
• SSID broadcast schedule issues that caused frequent client dissociation no longer occur when Wi-Fi scheduling is enabled. [AP-2470]
• RADIUS accounting packets from the access point now correctly include the client’s Framed-IP-Address in the first packet. This prevented wireless clients from passing traffic on applied RADIUS policies until the next accounting interval. [AP-1452]
• You can now correctly download a diagnostic snapshot file after a packet capture (pcap) file download fails. [AP-2561]
• Repeated configuration deployments no longer cause the access point to stop Airspace Monitoring scanning on the wired network. [AP-2555]
• The Security column for wireless client connection details now correctly shows “WPA2 Personal” when Protected Management Frames (802.11w) is enabled instead of “Open”. [AP-2588]
• The access point no longer sends traffic to www.google.com, 8.8.8.8, and ipinfo.io at boot time. [AP-2599]
• An access point no longer starts the IPsec process after a device reboot when an access point VPN is disabled. [AP-2634]
• Wireless clients can now connect to PPSK SSIDs when single or double quote characters (‘, “) are used in the passphrase. [AP-2772]
• The previous behavior of the device automatically rebooting after 30 minutes of LAN interface inactivity to recover the connection is removed. [AP-2819]
• Wireless clients were unable to connect to SSIDs with Enterprise authentication when an Access Point VPN is enabled [AP-2788, AP-2829]

This firmware update is a maintenance release that includes these enhancements and resolved issues:

Enhancements

• DCS (Dynamic Channel Selection) scan times are improved to prevent access points from scanning channels at the same time and optimize channel selection. [AP-2592]
• In the access point radio settings, the DCS Scan Interval selection options are updated to 2, 3, 4, 6, 8, 12, and 24 hours. If you have set a different custom value, it will be changed to the nearest higher value, for example, 10 hours to 12 hours. You must deploy the updated configuration to the access points for the changed settings to take effect. [WIFI-10809, AP-2422]

Resolved Issues

• Memory usage issues on access points are resolved. [AP-2554, AP-2562, AP-2570, AP-2575, AP-2584, AP-2591]
• In some cases, access points crashed and rebooted after deployment of configuration changes for Airspace Monitoring and ThreatSync. [AP-2132]
• DCS scan intervals set to values over 24 hours were performed at the 24 hours interval. The maximum DCS scan interval time is now 24 hours. [AP-2422]
• In some cases, access points configured with multiple SSIDs issued beacon frames that were missing the SSID name. [AP-2571]
• Wi-Fi schedules now work correctly on all configured radios for an SSID. [AP-2435]
• The Called Station ID and NAS ID for WPA2 or WPA3 Enterprise Authentication now support up to 108 characters after variable expansion. [AP-2580]

This firmware update includes these new features, enhancements, and resolved issues:

New Features

This firmware update supports these new features in WatchGuard Cloud:

• Access Point and Wireless Client Visibility Enhancements
• The access point and wireless client monitoring and details pages now include additional visibility data about devices, clients, and connection events.
• Access Point ThreatSync Response Actions
• This firmware update supports threat response features in ThreatSync to block client connections to malicious access points.

Enhancements

• New kernel integrity check measures show alerts in WatchGuard Cloud when suspicious files are detected in the access point operating system. [AP-2119]
• The access point reset procedure is updated. To reset the device to factory-default settings, press and hold the reset button for at least 10 seconds or more until all LEDs turn off, then release the button. After a few seconds, the LEDs will show solid red or orange to indicate the device is reset and rebooting to factory-default settings. [AP-2169]
• The access point reboot log is now included in the snapshot diagnostic file. [AP-2200]
• The DNS Lookup diagnostic tool response messages are improved when the hostname does not correctly resolve. [AP-2106]
• Performance is improved when you view the live status of wireless clients. [AP-2214]
• Added support for Thinix Wi-Fi third-party captive portal integration. [AP-2021, WIFI-9568]

Resolved Issues

• In some cases, WatchGuard Cloud managed access points were classified as an Evil Twin by Airspace Monitoring as a false positive detection. [AP-1968]
• Timeout and deployment errors no longer occur when a large number of PPSK are applied to multiple SSIDs. [AP-2096, AP-2267]
• Access points no longer send excessive DHCP requests when client isolation is enabled. [AP-1267, AP-1846]
• In some cases, access points lost their connection then become inaccessible and did not respond to network traffic. The access point now reboots after 30 minutes of detected network inactivity from the LAN interface to try to recover the connection when the device is in this state. [AP-2157, AP-2098, AP-2116]
• Client data from an AP230W about client association time is now correctly sent to the Performance Issues report. [AP-2110]
• The access point local Web UI and CLI now report the correct country of operation for the device. [AP-2117]
• The SSH server is updated to resolve CVE-2023-48795 and CVE-2002-20001. [AP-2152, AP-2345].
• An error is fixed in the local Web UI failed firmware notification text. [AP-2121]
• The Client Name field in the Live Status > Clients page is now limited to display 31 characters to prevent data errors in the Wireless Mode column. [AP-2210]
• The Gateway and DNS Server fields are now mandatory when you configure static IP address settings in the local Web UI. [AP-2238]
• Wireless clients can now correctly access the network after you disable NAT on an SSID configured with Network Access Enforcement and Client Isolation enabled. [AP-1814]
• Wireless clients can now correctly access the network on an SSID with VLAN and Client isolation enabled. [AP-1276]
• An access point now correctly sends a DNS request to the first listed DNS server instead of all DNS servers. [AP-2188]
• In rare cases, an access point that broadcasts many SSIDs might crash and reboot after an upgrade from firmware v2.6.7 to v2.7.6. [AP-2360]

This beta firmware update includes these new features, enhancements, and resolved issues:

New Features

This firmware update supports these new beta features in WatchGuard Cloud:

• Access Point and Wireless Client Visibility Enhancements
• The access point and wireless client monitoring and details pages now include additional visibility data about devices, clients, and connection events.
• Access Point ThreatSync Response Actions (Beta)
• This firmware update supports threat response beta features in ThreatSync to block client connections to malicious access points.

Enhancements

• New kernel integrity check measures show alerts in WatchGuard Cloud when suspicious files are detected in the access point operating system.
• The access point reset procedure is updated. To reset the device to factory-default settings, press and hold the reset button for at least 10 seconds or more until all LEDs turn off, then release the button. After a few seconds, the LEDs will show solid red or orange to indicate the device is reset and rebooting to factory-default settings.
• The access point reboot log is now included in the snapshot diagnostic file.
• The DNS Lookup diagnostic tool response messages are improved when the hostname does not correctly resolve.
• Performance is improved when you view the live status of wireless clients.

Resolved Issues

• In some cases, WatchGuard Cloud managed access points were classified as an Evil Twin by Airspace Monitoring as a false positive detection. [AP-1968]
• Timeout and deployment errors no longer occur when a large number of PPSK are applied to multiple SSIDs. [AP-2096, AP-2267]
• Access points no longer send excessive DHCP requests when client isolation is enabled. [AP-1267, AP-1846]
• In some cases, access points lost their connection then become inaccessible and did not respond to network traffic. The access point now reboots after 30 minutes of detected network inactivity from the LAN interface to try to recover the connection when the device is in this state. [AP-2157, AP-2098, AP-2116]
• Client data from an AP230W about client association time is now correctly sent to the Performance Issues report. [AP-2110]
• The access point local Web UI and CLI now report the correct country of operation. [AP-2117]
• The SSH server is updated to resolve CVE-2023-48795. [AP-2152]
• An error is fixed in the local Web UI failed firmware notification text. [AP-2121]
• The Client Name field in the Live Status > Clients page is now limited to display 31 characters to prevent data errors in the Wireless Mode column. [AP-2210]
• The Gateway and DNS Server fields are now mandatory when you configure static IP address settings in the local Web UI. [AP-2238]
• Wireless clients can now correctly access the network after you disable NAT on an SSID configured with Network Access Enforcement and Client Isolation enabled. [AP-1814]
• Wireless clients can now correctly access the network on an SSID with VLAN and Client isolation enabled. [AP-1276]

New Features and Enhancements

• This firmware update supports the Private Pre-Shared Key (PPSK) feature on an SSID that uses WPA2 Personal security.
• The Client Details page, Connection Events, and Performance Issues reports now show information about the security mode used by wireless clients. [AP-1912, AP-2064], [WIFI-9266]
• New access points now use 0.pool.ntp.org, 1.pool.ntp.org, and 2.pool.ntp.org as the default NTP servers on their initial startup until they receive their configuration from WatchGuard Cloud. [AP-2055]
• The descriptions for access point CLI commands are improved. [AP-1328]

Resolved Issues

• Access points now correctly use only IPv4 to connect to WatchGuard Cloud. [AP-2071, WIFI-9646]
• The RADIUS accounting interim update interval and session timeout settings now correctly use the values configured by the third-party captive portal service after a client roams between access points. [AP-2040, AP-2041]
• The Vendor-Specific value in a RADIUS Access-Accept message for Skyfii third-party captive portal integration now correctly shows “WatchGuard Technologies Inc.”. [AP-1925]
• An access point now correctly sends a low memory alert to WatchGuard Cloud. [AP-2045]
• The time zone settings for Mexico no longer include Daylight Saving Time. [AP-2093]
• SSIDs now correctly follow the configured SSID broadcast schedule. [AP-2100].

New Features and Enhancements

• This firmware update supports the Private Pre-Shared Key (PPSK) feature on an SSID that uses WPA2 Personal security.
• The Client Details page, Connection Events, and Performance Issues reports now show information about the security mode used by wireless clients. [AP-1912, AP-2064], [WIFI-9266]
• New access points now use 0.pool.ntp.org, 1.pool.ntp.org, and 2.pool.ntp.org as the default NTP servers on their initial startup until they receive their configuration from WatchGuard Cloud. [AP-2055]
• The descriptions for access point CLI commands are improved. [AP-1328]

Resolved Issues

• Access points now correctly use only IPv4 to connect to WatchGuard Cloud. [AP-2071, WIFI-9646]
• The RADIUS accounting interim update interval and session timeout settings now correctly use the values configured by the third-party captive portal service after a client roams between access points. [AP-2040, AP-2041]
• The Vendor-Specific value in a RADIUS Access-Accept message for Skyfii third-party captive portal integration now correctly shows “WatchGuard Technologies Inc.”. [AP-1925]
• An access point now correctly sends a low memory alert to WatchGuard Cloud. [AP-2045]
• The time zone settings for Mexico no longer include Daylight Saving Time. [AP-2093]

New Features and Enhancements

• This firmware update adds support for the Packet Capture feature.
• WatchGuard Cloud now generates an informational device alarm notification if the access point system integrity check allows a new non-executable internal system file to be installed on the device and no threat is detected.
• Added support for Mambo Wi-Fi third-party captive portal integration.

Resolved Issues

• The configuration reload time for the AP230W is improved. [AP-1806]
• Wireless clients that use a third-party captive portal now correctly retain their session IDs and accounting data when they roam to another access point. [AP-1935]
• The device description now correctly displays all characters in the Device Settings page when you enter the maximum number of characters. [AP-1978]
• An SSID now correctly broadcasts when fast roaming is enabled and the NAS ID is longer than 84 characters. [AP-1845]
• Network speed tests are no longer performed when an access point boots. [AP-1860]
• Open SSH components are upgraded to address vulnerabilities identified by CVE-2023-48795 (Terrapin). [AP-1873]
• You can no longer upgrade the access point firmware with the local Web UI or CLI when the device license is expired. [WIFI-1829]
• Real-time interface statistics in the local Web UI now show correctly for access points with multiple LAN interfaces. [AP-1883]
• Access point forwarding of multicast traffic is improved when you enable a VLAN on an SSID. [AP-1920]
• The 5G radio no longer uses a 20 MHz channel width when the radio is configured to use 802.11ac mode with a 40 MHz channel width and a fixed transmit power. [AP-1955]
• The device no longer responds to external traffic on TCP port 4430. [AP-1963]
• Access points now correctly support a 40 MHz channel width on the 2.4 GHz radio. [AP-1971]
• The channel width currently in use is now correctly displayed in WatchGuard Cloud when the channel width is set to 20/40 MHz. [AP-1975]
• The Link Layer Discovery Protocol (LLDP) stopped working after the installation of firmware v2.4. This functionality now works correctly after the installation of firmware v2.5. [AP-1999]
• When the channel width on the 2.4 GHz radio is set to 20/40 MHz, the access point now correctly selects a channel from the configured candidate channel list instead of channel 1. [AP-2027]

New Features and Enhancements

• This firmware update adds support for the Packet Capture beta feature. [WIFI-7529]

Resolved Issues

• The configuration reload time for the AP230W is improved. [AP-1806]
• Wireless clients that use a third-party captive portal now correctly retain their session IDs and accounting data when they roam to another access point. [AP-1935]
• The device description now correctly displays all characters in the Device Settings page when you enter the maximum number of characters. [AP-1978]
• An SSID now correctly broadcasts when fast roaming is enabled and the NAS ID is longer than 84 characters. [AP-1845]
• Network speed tests are no longer performed when an access point boots. [AP-1860]
• Open SSH components are upgraded to address vulnerabilities identified by CVE-2023-48795 (Terrapin). [AP-1873]
• You can no longer upgrade the access point firmware with the local Web UI or CLI when the device license is expired. [WIFI-1829]
• Real-time interface statistics in the local Web UI now show correctly for access points with multiple LAN interfaces. [AP-1883]
• The 5G radio no longer uses a 20 MHz channel width when the radio is configured to use 802.11ac mode with a 40 MHz channel width and a fixed transmit power. [AP-1955]
• The device no longer responds to external traffic on TCP port 4430. [AP-1963]
• Access points now correctly support a 40 MHz channel width on the 2.4 GHz radio. [AP-1971]
• The Link Layer Discovery Protocol (LLDP) stopped working after the installation of firmware v2.4. This functionality now works correctly after the installation of firmware v2.5. [AP-1999]

New Features and Enhancements

• This firmware update adds support for the AP230W access point hardware model.
• This firmware update supports the Third-Party Captive Portal Integration feature.
• This firmware update supports the ability to configure network interfaces for access point models with additional LAN interfaces.
• DCS (Dynamic Channel Selection) is improved for optimized channel selection.
• The firmware upgrade confirmation page in the local Web UI now shows the SHA1 checksum of the upgrade file instead of the MD5 checksum. [AP-1817]
• The country of operation detection for the access point is improved. [AP-1906]
• To improve password security, the admin password for Web UI and CLI access to the device now supports a maximum length up to 32 characters. [AP-1546]

Resolved Issues

• The transmit power for an access point is now correctly reported when SSIDs are inactive due to a schedule. [AP-1907]
• You can no longer change the access point IP address configuration from WatchGuard Cloud after an access point license expires. [AP-1887]
• Access points with a configured channel width of 20/40 MHz on the 2.4 GHz radio now correctly allow client connections with a 40 MHz channel width. [AP-1895]
• After 21 days, the access point stopped sending event logs to a syslog server. [AP-1911]
• In some cases, access points might reboot into failsafe mode if the firmware upgrade process is interrupted. [AP-1937]

• This firmware update resolves an issue where in some cases, access points might reboot into failsafe mode if the firmware upgrade process is interrupted. [AP-1937]

• This firmware update supports the Third-Party Captive Portal Integration beta feature.
• DCS (Dynamic Channel Selection) is improved for optimized channel selection.
• The firmware upgrade confirmation page in the local Web UI now shows the SHA1 checksum of the upgrade file instead of the MD5 checksum. [AP-1817]
• The country of operation detection for the access point is improved. [AP-1906]

This update also includes these resolved issues:

• The transmit power for an access point is now correctly reported when SSIDs are inactive due to a schedule. [AP-1907]
• You can no longer change the access point IP address configuration from WatchGuard Cloud after an access point license expires. [AP-1887]
• After 21 days, the access point stopped sending event logs to a syslog server. [AP-1911]

• This firmware update supports the Dynamic VLANs, Captive Portal Web Form, Guest Analytics report, and Network Access Enforcement landing page features.
• You can now reboot the access point from the access point local Web UI. This action is available in the top-right corner of the Web UI when you click on the user account icon.
• The Live Status > Clients monitoring page in WatchGuard Cloud now loads client data much faster. [AP-1792, WIFI-8250]

This update also includes these resolved issues:

• An SNMP licensing issue is resolved. [AP-1692]
• DCS now operates correctly to set an optimal channel from the candidate channels list. [AP-1703]
• The access point transmit power is now correctly set to the values from the device configuration after a firmware upgrade. [AP-1756]
• The country of operation for the access point is now correctly updated when a device with no SSIDs configured is connected in a new region. [AP-1757]
• The access point connection status in WatchGuard Cloud now shows the correct status and is consistent with the local Web UI. [AP-1774]
• An access point with an expired MSSP license is now correctly disconnected and deregistered from WatchGuard Cloud. [AP-1801]
• Wireless clients no longer experience connection issues when scheduling is enabled on an SSID and DCS is enabled. [AP-1818]
• Special characters and maximum lengths for each field are now correctly processed by a captive portal web form. [AP-1819, AP-1820]
• An access point now correctly forwards multicast traffic to a wireless client after the client joins an IGMP group. [AP-1833]
• An AP430CR hardware revision M or higher with no LAN2 port now correctly receives a configuration from WatchGuard Cloud. [AP-1836]

• This firmware update supports the Dynamic VLANs and Captive Portal Enhancements beta features.
• You can now reboot the access point from the access point local Web UI. This is available in the top-right corner of the Web UI when you click on the user account icon.
• The Live Status > Clients monitoring page in WatchGuard Cloud now loads client data much faster. [AP-1792], [WIFI-8250]

This update also includes these resolved issues:

• An SNMP licensing issue is resolved. [AP-1692]
• DCS now operates correctly to set an optimal channel from the candidate channels list. [AP-1703]
• The access point transmit power is now correctly set to the values from the device configuration after a firmware upgrade. [AP-1756]
• The country of operation for the access point is now correctly updated when a device with no SSIDs configured is connected in a new region. [AP-1757]
• The access point connection status in WatchGuard Cloud now shows the correct status and is consistent with the local Web UI. [AP-1774]
• An access point with an expired MSSP license is now correctly disconnected and deregistered from WatchGuard Cloud. [AP-1801]

• With this firmware update, the access point now uses a cryptographic signature to verify the integrity of the device each time the access point boots. Integrity checks make sure that system files are valid and have not been corrupted. For more information, go to Access Point System Integrity Checks.
• This firmware update also supports the Network Access Enforcement and Enterprise Authentication Enhancements features.

You must currently run firmware version v2.0.28 or higher to upgrade to v2.1.12. If your access point runs a firmware version lower than v2.0.28 and you upgrade directly to v2.1.12, the device will upgrade twice, first to v2.0.28 and then to v2.1.12 automatically. It might take additional time for the firmware upgrade to complete.

This update also includes these enhancements and resolved issues:

• In some cases, access points managed by WatchGuard Cloud were incorrectly reported as threat access points. [AP-1617]
• Fast Roaming for wireless clients now works correctly with WPA2 Enterprise security. [WIFI-8251]
• Traffic shaping now consistently limits upload and download traffic as configured. [AP-1689]
• NTP server retry attempts are no longer delayed in some scenarios. [AP-1668]
• The diagnostic snapshot file download no longer times out when multiple wireless clients are connected. [AP-1659]
• The AP432 now uses the correct transmit power when it is configured to use the minimum setting of 8 dBm. [AP-1704]
• The diagnostic snapshot file now contains additional information for troubleshooting.

• With this firmware update, the access point now uses a cryptographic signature to verify the integrity of the device each time the access point boots. Integrity checks make sure that system files are valid and have not been corrupted.

• This firmware update also supports the Network Access Enforcement and Enterprise Authentication Enhancements beta features.

This update also includes these enhancements and resolved issues:

• Fast Roaming for wireless clients now works correctly with WPA2 Enterprise security. [WIFI-8251]
• Traffic shaping now consistently limits upload and download traffic as configured. [AP-1689]
• NTP server retry attempts are no longer delayed in some scenarios. [AP-1668]
• The diagnostic snapshot file download no longer times out when multiple wireless clients are connected. [AP-1659]
• The AP432 now uses the correct transmit power when it is configured to use the minimum setting of 8 dBm. [AP-1704]
• The diagnostic snapshot file now contains additional information for troubleshooting.

This is an important security update that enables a cryptographic signature to verify the integrity of future signed firmware files before each software upgrade. Integrity checks make sure that system files are valid and have not been corrupted. After you upgrade to an access point firmware version that includes integrity checks, you cannot downgrade to a version that is not signed by WatchGuard. This access point firmware version 2.0.28 becomes the minimum version required before you can install any future firmware upgrades.

This update also provides these enhancements and resolved issues:

• You can now configure up to 3 NTP servers in a device configuration or an Access Point Site. [AP-1527]
• You can now configure the Device LEDs option in an Access Point Site. [WIFI-8105]
• The access point diagnostic snapshot file now includes the system information, associated wireless clients, and rogue access point wired and wireless network scan results. [AP-1324, AP-1511, AP-1524].
• The Realtime traffic status in the local access point Web UI no longer shows negative values. [AP-1410]
• The Device status in the local access point Web UI now correctly shows the channel for the 5 GHz radio. [AP-1537]
• Font display inconsistencies in the access point local Web UI are resolved. [AP-1538, AP1539]
• An access point configuration can now be correctly deployed when the 2.4 GHz channel width is set to 20/40MHz in the European region. [AP-1566]
• Access point transmit power settings are now correctly applied to prevent exceeding the maximum power for a region. [WIFI-7961]

This firmware update enables support for the Airspace Monitoring feature, a new access point local Web UI, and resolves these issues:

• The RADIUS accounting interim update and stop packets now include the correct traffic size for the client. [AP-1353]
• The access point CLI tpmtest command now executes correctly. [AP-1390]
• This release includes Airspace Monitoring optimizations since the last beta version.
• This release includes minor access point Web UI page and text updates since the last beta version.

This firmware update enables support for the Airspace Monitoring beta feature, a new access point local Web UI, and resolves these issues:

• The RADIUS accounting interim update and stop packets now include the correct traffic size for the client. [AP-1353]
• The access point CLI tpmtest command now executes correctly. [AP-1390]

Resolved Issues

• The RADIUS accounting server shared secret is now correctly processed by the access point to allow the server and access point to exchange accounting messages. [AP-1351]
• NTP server connection alerts are optimized to reduce the number of connection alerts. [AP-1358]
• This release updates the version of OpenSSH to 9.0p1. [AP-1307]
• The SSL/TLS cipher key size for DH/RSA exchange is increased to 2048 bits. [AP1341]
• New commands are available in the access point CLI to show and test the RSA public key of the access point for troubleshooting connections to WatchGuard Cloud.

New Features and Enhancements

• This update is required for the access point SNMP monitoring feature.
• You can now add up to 256 MAC addresses for the MAC Address Access Control feature.

Resolved Issues

• After the installation of access point firmware 1.1.23, the AP130 fails to broadcast an SSID with NAT enabled on the 2.4 GHz radio. [AP-1320]

This update replaces the current 1.1.22 beta firmware, and resolves these issues:

• SSIDs failed to broadcast after the installation of firmware version 1.1.22 on the AP130. [AP-1311]
• Radar detection traps are not sent to the trap server. [AP-1295]

This update is required for the SNMP monitoring beta feature.

New Features and Enhancements

This update adds support for the access point Description and Radio Details features.

Resolved Issues

• Wireless clients now successfully reconnect to an access point with WPA2 and WPA3 Enterprise authentication. [AP-1163]
• Wireless clients now correctly obtain an IP address after you change the access point from a static IP address with a management VLAN enabled to a DHCP only address. [AP-1222]
• Security scan warnings no longer occur for the access point certificate and hashing algorithm for local access to the device. [AP-1165]
• Syslog entries accessed from the access point CLI interface are now correctly displayed in time-sequential order with the newest entries at the end of the list. [AP-1061]

Enhancements

• This update is required to use the Diagnostic Tools and Support Snapshot features.
• The access point LED indicator status is enhanced to provide more granular status of the device connection to WatchGuard Cloud. This enables you to more accurately troubleshoot the issue if the access point status stops in a specific state. For more information about the LED status and how to troubleshoot connection issues, see the Hardware Guide for your device.

Resolved Issues

• The correct wireless mode for a client now appears on the Live Status > Clients monitoring page. [AP-1140]
• The operating system of Apple iOS 14.8 and 15.x wireless clients are now correctly identified. [AP-1075]
• You can now correctly disable a VLAN on an SSID after you enable the Captive Portal feature. [AP-1092]
• Dynamic channel selection now correctly switches to a new channel when interference is detected on the current channel. [AP-1115]
• Access point firmware upgrade from the CLI now correctly validates the specified download link and correct firmware version for the device model. [AP-1039, AP-1083]

• This update is required to use the Diagnostic Tools and Support Snapshot beta features. To learn more or to report an issue, go to the Wi-Fi in WatchGuard Cloud Beta test community.
• The operating system of Apple iOS 14.8 and 15.x wireless clients are now correctly identified. [AP-1075]
• You can now correctly disable a VLAN on an SSID after you enable the Captive Portal feature. [AP-1092]
• Dynamic channel selection now correctly switches to a new channel when interference is detected on the current channel. [AP-1115]
• Access point firmware upgrade from the CLI now correctly validates the specified download link and correct firmware version for the device model. [AP-1039, AP-1083]

• This update is required to use the Diagnostic Tools and Support Snapshot beta features. To learn more or to report an issue, go to the Wi-Fi in WatchGuard Cloud Beta test community.

• Access Point VPN now correctly connects when the Firebox VPN settings use a domain name of 16 characters or greater. [AP-1105]
• Minor bug fixes and enhancements. [AP-1077, AP-1085, AP-1086]

• Initial firmware release.