Wi-Fi employee access – Sophos

In this topic, you will learn how to configure Sophos access points to work together with Portnox™ Cloud for 802.1X authentication of Wi-Fi connections.

Important:
This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.
Important:
All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.

Sophos Fusion

In this section, you will configure SSIDs in the Sophos Fusion cloud. Sophos Fusion manages two series of access points, AP6 and APX, with different SSID settings. Follow the section that matches your access points.

Important:
Sophos Fusion has limited AAA capabilities compared to most other vendors in this guide: it has no field for a RADIUS accounting server and does not support MAC Authentication Bypass (MAB), RadSec, or Identity PSK. As a result, this topic only covers 802.1X authentication.

Create an SSID for AP6 access points

In this section, you will add the Portnox™ Cloud RADIUS servers to Sophos Fusion, and create an SSID for AP6 access points that uses these servers for WPA2 or WPA3 Enterprise authentication.

  1. In the top menu of Sophos Fusion, click on the following menu options: My Products > Wireless > SSIDs.

  2. In the Wireless - SSIDs pane, click on the Go to RADIUS server button.

  3. In the Radius Servers pane, click on the Add button, and select the Add external RADIUS server option.

  4. In the Add External RADIUS server window, enter the details of the Portnox Cloud RADIUS server that you created earlier:

    1. In the Name field, enter a display name for this server.
    2. In the Primary RADIUS section, in the Server address field, enter the Cloud RADIUS IP value from Portnox Cloud.
    3. In the Port field, enter the Authentication port value from Portnox Cloud.
    4. In the Password field, enter the Shared Secret value from Portnox Cloud.
  5. Optional: If you use Cloud RADIUS servers in both regions, activate the Enable secondary RADIUS server checkbox. Then, in the Secondary RADIUS section, enter the details of the second RADIUS server in the same way.

  6. Click on the Save button.

    Result: The new RADIUS server appears in the Radius Servers pane.

  7. Click on the Back to SSID list link.
  8. In the Wireless - SSIDs pane, click on the Create AP6 button, and select the SSID option.

  9. On the Basic settings tab:

    1. In the SSID field, enter the network name that devices see when they search for Wi-Fi networks.
    2. In the Encryption mode field, select the WPA2/WPA3 Enterprise option.
      Note:
      You can also select WPA2-Enterprise or WPA3-Enterprise. The configuration process is identical for all three options.
    3. In the RADIUS server field, select the RADIUS server that you created earlier.
    4. Click on the Next button.
  10. On the Assign network tab, select the Multiple Access points option. Then, in the Available Access Points section, activate the checkboxes next to the access points that you want to broadcast this SSID.

    Sophos Fusion does not add access points that you register later. Assign them to the SSID explicitly.

  11. Click on the Save button in the top-right corner.

    The assigned access points update immediately. Connected Wi-Fi clients may disconnect briefly during the update.

Result: You created an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS servers.

Create an SSID for APX access points

In this section, you will create an SSID for APX access points that uses the Portnox™ Cloud RADIUS server for WPA2 Enterprise authentication.

Note:
APX SSIDs accept only one RADIUS server, so you cannot add a second Cloud RADIUS server.
  1. In the top menu of Sophos Fusion, click on the following menu options: My Products > Wireless > SSIDs.

  2. In the Wireless - SSIDs pane, click on the Create APX button, and select the SSID option.

  3. On the Basic settings tab, enter the details of the Portnox Cloud RADIUS server that you created earlier:

    1. In the SSID field, enter the network name that devices see when they search for Wi-Fi networks.
    2. In the Encryption mode field, select the WPA2-Enterprise option.
    3. In the RADIUS server IP field, enter the Cloud RADIUS IP value from Portnox Cloud.
    4. In the RADIUS port field, enter the Authentication port value from Portnox Cloud.
    5. In the Shared secret field, enter the Shared Secret value from Portnox Cloud.
    6. Click on the Next button.
  4. On the Assign network tab, select the Multiple Access points option. Then, in the Available Access Points section, activate the checkboxes next to the access points that you want to broadcast this SSID.

    Sophos Fusion does not add access points that you register later. Assign them to the SSID explicitly.

  5. Click on the Save button in the top-right corner.

    The assigned access points update immediately. Connected Wi-Fi clients may disconnect briefly during the update.

Result: You created an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS server.