Wi-Fi employee access – WatchGuard Firebox

In this topic, you will learn how to configure the built-in wireless interface of a WatchGuard™ Firebox, managed by WatchGuard Cloud or locally in Fireware Web UI, to work together with Portnox™ Cloud and 802.1X RADIUS authentication for Wi-Fi connections.

Important:

This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.

Important:

All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.

Note:

This topic assumes that you already have a wireless Firebox model, either added to WatchGuard Cloud as a cloud-managed device or managed locally in Fireware Web UI. Follow the section that matches the way you manage your Firebox.

Important:

The built-in wireless interface of a WatchGuard Firebox has very limited RADIUS capabilities. It supports only 802.1X authentication with a primary and a backup RADIUS server. It does not support MAC-based authentication (MAB), IPSK, RadSec, or RADIUS accounting. You can create up to three wireless networks on one Firebox, with one SSID per network.

Note:

This configuration was tested on WatchGuard Cloud and in Fireware Web UI with a Firebox T115-W running Fireware 2026.2.3. The capabilities and the user interface on other versions of the platform may differ.

Important:

Before you start, save a backup of the current Firebox configuration. In Fireware Web UI, select System > Configuration File, and click on the Download the Configuration File link.

Configure 802.1X authentication in WatchGuard Cloud

In this section, you will add the Portnox™ Cloud RADIUS servers to WatchGuard Cloud, create a wireless network with an SSID that uses these servers, and deploy the configuration to the Firebox.

Create an authentication domain

In this section, you will create an authentication domain that contains the Portnox™ Cloud RADIUS servers. WatchGuard Cloud uses authentication domains to store RADIUS server settings.

In the WatchGuard Cloud top menu, select the Configure > Directories and Domain Services option.
On the Directories and Domain Services screen, click on the Add Authentication Domain link.
Select the External Directory option, and click on the Next button.
Select the RADIUS option, and configure the RADIUS server:
1. In the Domain Name field, enter clear-rad.portnox.com.
  
  WatchGuard requires a name with a domain suffix in this field. It does not use this name to connect to the RADIUS server.
2. In the IP Address field, enter the Cloud RADIUS IP value from Portnox Cloud.
3. In the Port field, enter the Authentication port value from Portnox Cloud.
4. In the Shared secret field, enter the Shared Secret value from Portnox Cloud.
5. Click on the Save button.
Optional: If you use Cloud RADIUS servers in both regions, add the second RADIUS server to the same authentication domain:
1. On the Directories and Domain Services screen, click on the clear-rad.portnox.com domain name.
2. On the Servers tab, click on the Add Server link.
3. Enter the IP Address, Port, and Shared secret values of the second Cloud RADIUS server, in the same way as for the first server.
4. Click on the Save button.

Result: You created an authentication domain that contains the Portnox Cloud RADIUS servers.

Add the authentication domain to the Firebox

In this section, you will add the authentication domain to the Firebox configuration. The SSID settings list only the domains that you add to the Firebox.

In the WatchGuard Cloud top menu, select the Configure > Devices option.
In the Device Manager pane, click on the name of your Firebox.
In the Devices menu, click on the Device Configuration option.
In the Authentication section, in the Domains tile, click on the Add Authentication Domains link.
On the Authentication Domains screen, click on the Add Authentication Domain link.
On the Add Authentication Domain screen:
1. In the Select an existing Authentication Domain field, select the authentication domain that you created earlier.
2. In the Primary Server field, select the primary Cloud RADIUS server.
3. Optional: If you added a second Cloud RADIUS server to the domain, select it in the Backup Server (optional) field.
4. Click on the Save button.

Result: The authentication domain is available in the SSID settings of the Firebox.

Create a wireless network

In this section, you will create an internal network for the SSID and configure a DHCP server for it. Without a DHCP server, Wi-Fi clients connect but do not receive an IP address.

In the WatchGuard Cloud top menu, select the Configure > Devices option.
In the Device Manager pane, click on the name of your Firebox.
In the Devices menu, click on the Device Configuration option.
In the Networking section, click on the Networks tile.
Click on the Add Network link in the top-right corner, and select the Add Internal Network option.
On the Add Internal Network screen, on the Network tab:
1. In the Name field, enter a name for the network.
2. In the IP Address field, enter the IP address of the Firebox in this network, with the netmask in slash notation.
  
  For example, enter 10.9.57.1/24.
  
  Note:
  The subnet must not overlap with any other network on the Firebox.
On the DHCP Settings tab:
1. In the DHCP Mode field, select the DHCP Server option.
2. In the Address Pool section, click on the Add IP Address Range link, and add a range of addresses from the network subnet.
  
  For example, for the 10.9.57.1/24 network, add the range from 10.9.57.100 to 10.9.57.200.

Result: You provided the basic network settings. The network is ready for you to add the SSID.

Add an SSID for 802.1X authentication

In this section, you will add an SSID to the network that you created, and configure it for WPA2 Enterprise authentication using the authentication domain.

This section continues the previous section: Create a wireless network. Continue on the same screen, without leaving the network settings.

Go back to the Network tab and in the Wireless section, click on the Add SSID tile.
Configure the SSID:
1. In the SSID Name field, enter the network name that devices see when they search for Wi-Fi networks.
2. In the Radio field, select the bands that broadcast this SSID, as required.
3. In the Security field, select the WPA2 Enterprise option.
  
  Note:
  You can also select the WPA3 Enterprise option instead. The authentication configuration is identical.
4. In the RADIUS Authentication Domain field, select the authentication domain that you created earlier.
  
  The RADIUS Authentication Server field shows the IP address and port of the primary Portnox Cloud RADIUS server from this domain.
5. Click on the Add button.
Click on the Save button.

Warning:
After you save the Wireless screen for the first time, Fireware Web UI may fail to save later changes to any access point, with the Alias ... is already in use error. We encountered this problem during testing. If it happens, restore the configuration file that you downloaded before you started: select System > Configuration File, unzip the downloaded file, and in the Restore Configuration File section, click on the Choose File button, select the configuration file, and click on the RESTORE button. Then, configure all access points again before you click on the SAVE button, including the access point for guest access with the captive portal (see the following topic: Guest access – WatchGuard Firebox).

Result: You added an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS servers.

Deploy the configuration

In this section, you will deploy the saved configuration to the Firebox. WatchGuard Cloud stores the changes that you save, but the Firebox does not use them until you deploy them.

In the You have undeployed saved changes banner at the bottom of the page, click on the Schedule Deployment link.

Note:
You can also click on the Deployment History option in the Firebox menu, and then click on the Schedule Deployment link.
In the Schedule Deployment dialog, select the Deploy changes now option, enter a Description, and click on the Deploy button.

Note:
You can also schedule deployment for later.

Result: The Firebox receives the new configuration and broadcasts the SSID.

Configure 802.1X authentication in Fireware Web UI

In this section, you will add the Portnox™ Cloud RADIUS servers to a locally managed Firebox, configure a wireless access point with its own network, and add an SSID that uses these servers.

Add a RADIUS domain

In this section, you will add a RADIUS domain that contains the Portnox™ Cloud RADIUS servers.

Log in to Fireware Web UI with your administrative credentials.
If the screen is locked, click on the lock icon at the top of the screen (Click the lock to make changes).

The screens stay unlocked until you lock them again.
In the left-hand side menu, select the Authentication > Servers option, and then click on the RADIUS link.
On the RADIUS screen, click on the ADD button.
Configure the RADIUS domain:
1. In the Domain Name field, enter a name for this RADIUS domain.
  
  Note:
  The Firebox does not use this name to connect to the RADIUS server. You use it to identify the RADIUS domain when you select it in the Authentication Server field of the SSID. For example, enter clear-rad.portnox.com.
2. In the Primary Server Settings section, make sure that the Enable RADIUS Server checkbox is activated.
3. In the IP Address field, enter the Cloud RADIUS IP value from Portnox Cloud.
4. In the Port field, enter the Authentication port value from Portnox Cloud.
5. In the Shared Secret and Confirm Secret fields, enter the Shared Secret value from Portnox Cloud.
6. Optional: If you use Cloud RADIUS servers in both regions, in the Backup Server Settings section, activate the Enable Backup RADIUS Server checkbox, and enter the IP Address, Port, Shared Secret, and Confirm Secret values of the second Cloud RADIUS server.
7. Click on the SAVE button.

Result: The RADIUS domain appears on the RADIUS screen.

Configure the wireless network

In this section, you will enable a wireless access point on the Firebox and configure a network with a DHCP server for it.

Note:

You can configure the network in a different way, for example, as a bridge to an existing network or without a DHCP server, as required by your network design. The network configuration is not part of the authentication setup. You need it only because the SSID must belong to a network.

In the left-hand side menu, select the Network > Wireless option.
On the Wireless screen, activate the Enable Wireless checkbox and select the Enable wireless access points option.
Click on the CONFIGURE button next to any access point that you do not use yet.
On the Configure Network for Access Point screen, activate the Enable Access Point checkbox. Then, on the Network tab, configure the network:
1. Leave the Interface Name (Alias) field at its default value, or enter a different name.
  
  The Firebox uses this name only to identify the access point interface.
2. In the Interface Type field, select the Trusted option.
3. In the IP Address fields, enter the IP address of the Firebox in this network and the netmask length.
  
  For example, enter 10.9.57.1 and 24.
  
  Note:
  The subnet must not overlap with any other network on the Firebox.
4. In the field below the IP Address fields, select the DHCP Server option.
5. In the Address Pool section, click on the ADD button, and add a range of addresses from the network subnet.
  
  For example, for the 10.9.57.1/24 network, add the range from 10.9.57.100 to 10.9.57.200.

Result: You provided the basic network settings. The access point is ready for you to configure the SSID.

Configure the SSID for 802.1X authentication

In this section, you will configure the SSID of the access point for WPA2 Enterprise authentication using the RADIUS domain.

Click on the Wireless tab.
Configure the SSID:
1. Activate the Broadcast SSID checkbox.
2. In the Radio field, select the bands that broadcast this SSID, as required.
3. In the Network Name (SSID) field, enter the network name that devices see when they search for Wi-Fi networks.
4. In the Security field, select the WPA2 Enterprise option.
  
  Note:
  You can also select the WPA3 Enterprise option instead. The authentication configuration is identical.
5. In the Authentication Server field, select the RADIUS domain that you created earlier.
Click on the RETURN TO MAIN PAGE button.
On the Wireless screen, click on the SAVE button.

Result: You configured an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS servers. Fireware Web UI applies the changes immediately, and the Firebox broadcasts the SSID.