Wi-Fi employee access – WatchGuard

In this topic, you will learn how to configure WatchGuard™ devices to work together with Portnox™ Cloud and 802.1X RADIUS authentication for Wi-Fi connections.

Important:

This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.

Important:

All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.

WatchGuard Firebox

In this section, you will learn how to configure the built-in wireless interface of a WatchGuard™ Firebox, managed by WatchGuard Cloud or locally in Fireware Web UI, to work together with Portnox™ Cloud and 802.1X RADIUS authentication for Wi-Fi connections.

Note:

This section assumes that you already have a wireless Firebox model, either added to WatchGuard Cloud as a cloud-managed device or managed locally in Fireware Web UI. Follow the section that matches the way you manage your Firebox.

Important:

The built-in wireless interface of a WatchGuard Firebox has very limited RADIUS capabilities. It supports only 802.1X authentication with a primary and a backup RADIUS server. It does not support MAC-based authentication (MAB), IPSK, RadSec, or RADIUS accounting.

Note:

This configuration was tested on WatchGuard Cloud and in Fireware Web UI with a Firebox T115-W running Fireware 2026.2.3. The capabilities and the user interface on other versions of the platform may differ.

WatchGuard Cloud

In this section, you will add the Portnox™ Cloud RADIUS servers to WatchGuard Cloud, create a wireless network with an SSID that uses these servers, and deploy the configuration to the Firebox.

Create an authentication domain

In this section, you will create an authentication domain that contains the Portnox™ Cloud RADIUS servers. WatchGuard Cloud uses authentication domains to store RADIUS server settings.

In the WatchGuard Cloud top menu, select the Configure > Directories and Domain Services option.
On the Directories and Domain Services screen, click on the Add Authentication Domain link.
Select the External Directory option, and click on the Next button.
Select the RADIUS option, and configure the RADIUS authentication server:
1. In the Domain Name field, enter clear-rad.portnox.com.
  
  WatchGuard requires a name with a domain suffix in this field. It does not use this name to connect to the RADIUS server.
2. In the RADIUS Server Type field, select the RADIUS Authentication Server option.
3. In the IP Address field, enter the Cloud RADIUS IP value from Portnox Cloud.
4. In the Port field, enter the Authentication port value from Portnox Cloud.
5. In the Shared secret field, enter the Shared Secret value from Portnox Cloud.
6. Click on the Save button.
On the Directories and Domain Services screen, click on the clear-rad.portnox.com domain name.
On the Servers tab, click on the Add Server link.
Select the RADIUS option, and configure the RADIUS accounting server:
1. In the RADIUS Server Type field, select the RADIUS Accounting Server option.
2. In the IP Address field, enter the Cloud RADIUS IP value from Portnox Cloud.
3. In the Port field, enter the Accounting port value from Portnox Cloud.
4. In the Shared secret field, enter the Shared Secret value from Portnox Cloud.
5. Click on the Save button.
Optional: If you use Cloud RADIUS servers in both regions, add the second RADIUS authentication server to the same authentication domain:
1. On the Directories and Domain Services screen, click on the clear-rad.portnox.com domain name.
2. On the Servers tab, click on the Add Server link.
3. In the RADIUS Server Type field, select the RADIUS Authentication Server option.
4. In the IP Address field, enter the Cloud RADIUS IP value of the second Cloud RADIUS server.
5. In the Port field, enter the Authentication port value of the second Cloud RADIUS server.
6. In the Shared secret field, enter the Shared Secret value of the second Cloud RADIUS server.
7. Click on the Save button.
Optional: If you use Cloud RADIUS servers in both regions, add the second RADIUS accounting server to the same authentication domain:
1. On the Directories and Domain Services screen, click on the clear-rad.portnox.com domain name.
2. On the Servers tab, click on the Add Server link.
3. In the RADIUS Server Type field, select the RADIUS Accounting Server option.
4. In the IP Address field, enter the Cloud RADIUS IP value of the second Cloud RADIUS server.
5. In the Port field, enter the Accounting port value of the second Cloud RADIUS server.
6. In the Shared secret field, enter the Shared Secret value of the second Cloud RADIUS server.
7. Click on the Save button.

Result: You created an authentication domain that contains the Portnox Cloud RADIUS servers.

Add the authentication domain to the Firebox

In this section, you will add the authentication domain to the Firebox configuration. The SSID settings list only the domains that you add to the Firebox.

In the WatchGuard Cloud top menu, select the Configure > Devices option.
In the Device Manager pane, click on the name of your Firebox.
In the Devices menu, click on the Device Configuration option.
In the Authentication section, in the Domains tile, click on the Add Authentication Domains link.
On the Authentication Domains screen, click on the Add Authentication Domain link.
On the Add Authentication Domain screen:
1. In the Select an existing Authentication Domain field, select the authentication domain that you created earlier.
2. In the Primary Server field, select the primary Cloud RADIUS server.
3. Optional: If you added a second Cloud RADIUS server to the domain, select it in the Backup Server (optional) field.
4. Click on the Save button.

Result: The authentication domain is available in the SSID settings of the Firebox.

Create a wireless network

In this section, you will create an internal network for the SSID and configure a DHCP server for it. Without a DHCP server, Wi-Fi clients connect but do not receive an IP address.

In the WatchGuard Cloud top menu, select the Configure > Devices option.
In the Device Manager pane, click on the name of your Firebox.
In the Devices menu, click on the Device Configuration option.
In the Networking section, click on the Networks tile.
Click on the Add Network link in the top-right corner, and select the Add Internal Network option.
On the Add Internal Network screen, on the Network tab:
1. In the Name field, enter a name for the network.
2. In the IP Address field, enter the IP address of the Firebox in this network, with the netmask in slash notation.
  
  For example, enter 10.9.57.1/24.
  
  Note:
  The subnet must not overlap with any other network on the Firebox.
On the DHCP Settings tab:
1. In the DHCP Mode field, select the DHCP Server option.
2. In the Address Pool section, click on the Add IP Address Range link, and add a range of addresses from the network subnet.
  
  For example, for the 10.9.57.1/24 network, add the range from 10.9.57.100 to 10.9.57.200.

Result: You provided the basic network settings. The network is ready for you to add the SSID.

Add an SSID for 802.1X authentication

In this section, you will add an SSID to the network that you created, and configure it for WPA2 Enterprise authentication using the authentication domain.

This section continues the previous section: Create a wireless network. Continue on the same screen, without leaving the network settings.

Go back to the Network tab and in the Wireless section, click on the Add SSID tile.
Configure the SSID:
1. In the SSID Name field, enter the network name that devices see when they search for Wi-Fi networks.
2. In the Radio field, select the bands that broadcast this SSID, as required.
3. In the Security field, select the WPA2 Enterprise option.
  
  Note:
  You can also select the WPA3 Enterprise option instead. The authentication configuration is identical.
4. In the RADIUS Authentication Domain field, select the authentication domain that you created earlier.
  
  The RADIUS Authentication Server field shows the IP address and port of the primary Portnox Cloud RADIUS server from this domain.
5. Click on the Add button.
Click on the Save button.

Result: You added an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS servers.

Deploy the configuration

In this section, you will deploy the saved configuration to the Firebox. WatchGuard Cloud stores the changes that you save, but the Firebox does not use them until you deploy them.

In the You have undeployed saved changes banner at the bottom of the page, click on the Schedule Deployment link.

Note:
You can also click on the Deployment History option in the Firebox menu, and then click on the Schedule Deployment link.
In the Schedule Deployment dialog, select the Deploy changes now option, enter a Description, and click on the Deploy button.

Note:
You can also schedule deployment for later.

Result: The Firebox receives the new configuration and broadcasts the SSID.

Fireware Web UI

In this section, you will add the Portnox™ Cloud RADIUS servers to a locally managed Firebox, configure a wireless access point with its own network, and add an SSID that uses these servers.

Important:

Before you start, save a backup of the current Firebox configuration. In Fireware Web UI, select System > Configuration File, and click on the Download the Configuration File link.

Add a RADIUS domain

In this section, you will add a RADIUS domain that contains the Portnox™ Cloud RADIUS servers.

Log in to Fireware Web UI with your administrative credentials.
If the screen is locked, click on the lock icon at the top of the screen (Click the lock to make changes).

The screens stay unlocked until you lock them again.
In the left-hand side menu, select the Authentication > Servers option, and then click on the RADIUS link.
On the RADIUS screen, click on the ADD button.
Configure the RADIUS domain:
1. In the Domain Name field, enter a name for this RADIUS domain.
  
  Note:
  The Firebox does not use this name to connect to the RADIUS server. You use it to identify the RADIUS domain when you select it in the Authentication Server field of the SSID. For example, enter clear-rad.portnox.com.
2. In the Primary Server Settings section, make sure that the Enable RADIUS Server checkbox is activated.
3. In the IP Address field, enter the Cloud RADIUS IP value from Portnox Cloud.
4. In the Port field, enter the Authentication port value from Portnox Cloud.
5. In the Shared Secret and Confirm Secret fields, enter the Shared Secret value from Portnox Cloud.
6. Optional: If you use Cloud RADIUS servers in both regions, in the Backup Server Settings section, activate the Enable Backup RADIUS Server checkbox, and enter the IP Address, Port, Shared Secret, and Confirm Secret values of the second Cloud RADIUS server.
7. Click on the SAVE button.

Result: The RADIUS domain appears on the RADIUS screen.

Configure the wireless network

In this section, you will enable a wireless access point on the Firebox and configure a network with a DHCP server for it.

Note:

You can configure the network in a different way, for example, as a bridge to an existing network or without a DHCP server, as required by your network design. The network configuration is not part of the authentication setup. You need it only because the SSID must belong to a network.

In the left-hand side menu, select the Network > Wireless option.
On the Wireless screen, activate the Enable Wireless checkbox and select the Enable wireless access points option.
Click on the CONFIGURE button next to any access point that you do not use yet.
On the Configure Network for Access Point screen, activate the Enable Access Point checkbox. Then, on the Network tab, configure the network:
1. Leave the Interface Name (Alias) field at its default value, or enter a different name.
  
  The Firebox uses this name only to identify the access point interface.
2. In the Interface Type field, select the Trusted option.
3. In the IP Address fields, enter the IP address of the Firebox in this network and the netmask length.
  
  For example, enter 10.9.57.1 and 24.
  
  Note:
  The subnet must not overlap with any other network on the Firebox.
4. In the field below the IP Address fields, select the DHCP Server option.
5. In the Address Pool section, click on the ADD button, and add a range of addresses from the network subnet.
  
  For example, for the 10.9.57.1/24 network, add the range from 10.9.57.100 to 10.9.57.200.

Result: You provided the basic network settings. The access point is ready for you to configure the SSID.

Configure the SSID for 802.1X authentication

In this section, you will configure the SSID of the access point for WPA2 Enterprise authentication using the RADIUS domain.

Click on the Wireless tab.
Configure the SSID:
1. Activate the Broadcast SSID checkbox.
2. In the Radio field, select the bands that broadcast this SSID, as required.
3. In the Network Name (SSID) field, enter the network name that devices see when they search for Wi-Fi networks.
4. In the Security field, select the WPA2 Enterprise option.
  
  Note:
  You can also select the WPA3 Enterprise option instead. The authentication configuration is identical.
5. In the Authentication Server field, select the RADIUS domain that you created earlier.
Click on the RETURN TO MAIN PAGE button.
On the Wireless screen, click on the SAVE button.

Warning:
After you save the Wireless screen for the first time, Fireware Web UI may fail to save later changes to any access point, with the Alias ... is already in use error. We encountered this problem during testing. If it happens, restore the configuration file that you downloaded before you started: select System > Configuration File, unzip the downloaded file, and in the Restore Configuration File section, click on the Choose File button, select the configuration file, and click on the RESTORE button. Then, configure all access points again before you click on the SAVE button, including the access point for guest access with the captive portal (see the following topic: Guest access – WatchGuard Firebox).

Result: You configured an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS servers. Fireware Web UI applies the changes immediately, and the Firebox broadcasts the SSID.

WatchGuard AP

In this section, you will learn how to configure WatchGuard™ access points for 802.1X authentication with Portnox™ Cloud.

Note:

This section assumes that you already added your WatchGuard access points to WatchGuard Cloud as cloud-managed devices.

Important:

WatchGuard access points have very limited RADIUS capabilities. They support only 802.1X authentication with one RADIUS server. They do not support a backup RADIUS server, MAC-based authentication (MAB), IPSK, or RadSec.

Note:

This configuration was tested on WatchGuard Cloud with a WatchGuard [MODEL] access point running firmware [VERSION]. The capabilities and the user interface on other versions of the platform may differ.

WatchGuard Cloud

In this section, you will configure the access points in WatchGuard Cloud. You store the RADIUS and SSID settings in an access point site, and then deploy the site to the access points.

Create an authentication domain

In this section, you will add the Portnox™ Cloud RADIUS server to WatchGuard Cloud as an authentication domain.

In the WatchGuard Cloud top menu, select the Configure > Directories and Domain Services option.
On the Directories and Domain Services screen, click on the Add Authentication Domain link.
Select the External Directory option, and click on the Next button.
Select the RADIUS option, and configure the RADIUS authentication server:
1. In the Domain Name field, enter clear-rad.portnox.com.
  
  WatchGuard requires a name with a domain suffix in this field. It does not use this name to connect to the RADIUS server.
2. In the RADIUS Server Type field, select the RADIUS Authentication Server option.
3. In the IP Address field, enter the Cloud RADIUS IP value from Portnox Cloud.
4. In the Port field, enter the Authentication port value from Portnox Cloud.
5. In the Shared secret field, enter the Shared Secret value from Portnox Cloud.
6. Click on the Save button.
On the Directories and Domain Services screen, click on the clear-rad.portnox.com domain name.
On the Servers tab, click on the Add Server link.
Select the RADIUS option, and configure the RADIUS accounting server:
1. In the RADIUS Server Type field, select the RADIUS Accounting Server option.
2. In the IP Address field, enter the Cloud RADIUS IP value from Portnox Cloud.
3. In the Port field, enter the Accounting port value from Portnox Cloud.
4. In the Shared secret field, enter the Shared Secret value from Portnox Cloud.
5. Click on the Save button.

Result: You created an authentication domain that contains the Portnox Cloud RADIUS server.

Create an access point site

In this section, you will create an access point site. WatchGuard Cloud uses access point sites to store wireless settings that it applies to all access points subscribed to the site.

Note:

You can also configure each access point separately, without a site. To do this, select the Configure > Devices option, click on the access point, and click on the Device Configuration option. In this case, you do not subscribe the access point to a site. You deploy the changes using the You have undeployed saved changes banner.

In the WatchGuard Cloud top menu, select the Configure > Access Point Sites option.
On the Access Point Sites screen, click on the Add Site link.
On the Add Site screen, enter a Name for the site, and click on the Add button.

Result: The site configuration screen opens on the Configuration Details tab.

Add the authentication domain to the site

In this section, you will add the authentication domain to the access point site. The SSID settings list only the domains that you add to the site.

On the Configuration Details tab, in the Authentication section, click on the Add Authentication Domains tile.
On the Authentication Domains screen, click on the Add Authentication Domain link.
On the Add Authentication Domain screen:
1. In the Select an existing Authentication Domain field, select the authentication domain that you created earlier.
2. In the RADIUS Authentication Server field, select the Cloud RADIUS server.
3. In the RADIUS Accounting Server field, select the Cloud RADIUS server.
4. Click on the Save button.
Click on the Back button to return to the site configuration.

Result: The authentication domain is available in the SSID settings of the site.

Add an SSID for 802.1X authentication

In this section, you will add an SSID to the access point site, and configure it for WPA3 Enterprise authentication using the authentication domain.

On the Configuration Details tab, in the Wi-Fi Networks section, click on the Add SSID tile.
On the Add SSID screen, on the Wireless tab, configure the SSID:
1. In the SSID Name field, enter the network name that devices see when they search for Wi-Fi networks.
2. In the Security field, select the WPA3 Enterprise option.
  
  You can also select the WPA2 Enterprise option. It is available only if the Radio field does not include the 6 GHz band.
  
  Configure any extra security options, such as the Enable WPA3 Enterprise 192-bit mode checkbox, as required. They do not affect the authentication configuration.
3. In the Authentication Domain field, select the authentication domain that you created earlier.
  
  The RADIUS Authentication Server and RADIUS Accounting Server fields show the IP addresses and ports of the Portnox Cloud RADIUS server from this domain.
4. Click on the Save button.
On the SSIDs screen, click on the Back button to return to the site configuration.

Result: You added an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS server.

Subscribe access points to the site

In this section, you will subscribe access points to the site. Subscribed access points use the wireless settings of the site.

On the site configuration screen, click on the Subscribed Devices tab, and then click on the Select Devices link.
On the Select Devices screen, activate the checkboxes next to the access points that you want to subscribe, and click on the Save button.

Note:
If an access point is already subscribed to another site, the configuration of this site replaces its current configuration.

Result: The access points appear on the Subscribed Devices tab.

Deploy the configuration

In this section, you will deploy the site configuration to the access points. WatchGuard Cloud stores the changes that you save, but the access points do not use them until you deploy them.

On the site configuration screen, click on the Deployment History tab, and then click on the Schedule Deployment link.

Note:
You can also click on the Schedule Deployment link in the You have undeployed saved changes banner at the bottom of the page.
In the Schedule Deployment dialog, select the Deploy changes now option, enter a Description, and click on the Deploy button.

Note:
The deployment restarts the wireless radios of the access points. Connected Wi-Fi clients disconnect for a short time. If you need to avoid disruption, select the Schedule deployment option and deploy later.

Result: The access points receive the new configuration and broadcast the SSID.