Notes on configuring Sophos XG 135 firewall as a Wireless LAN Controller
Subject: Notes on configuring Sophos XG 135 firewall as a Wireless LAN Controller
Good day from Singapore,
Author: Mr. Turritopsis Dohrnii Teo En Ming
Date: 6 Nov 2026 Friday 2.53 pm
Country: Singapore
I will guide you through configuring your Sophos XG 135 firewall from factory defaults, using your TP-Link Archer NX500 (192.168.26.1) as the internet gateway.
Our objective is to use the Sophos XG 135 as a wireless controller and DHCP server for your three Sophos APX 530 access points, without NAT or routing client internet traffic through the Sophos firewall.
1. Final network design
IP addressing plan
Device IP address
TP-Link Archer NX500: 192.168.26.1
Sophos XG 135: 192.168.26.2
Subnet mask: 255.255.255.0
Default gateway: 192.168.26.1
DHCP pool: 192.168.26.100–199
DHCP Option 234: 192.168.26.2
The Sophos will distribute DHCP addresses, but wireless clients will use the TP-Link router directly for internet access.
Important: Factory resetting the XG 135 erases its existing configuration. Back up anything important first, and perform this during a maintenance window.
2. Factory-reset the Sophos XG 135
Do this with the Sophos XG 135 disconnected from your production LAN.
1. Connect a monitor and keyboard to the Sophos XG 135, or use its console port with the appropriate cable.
2. Power on the firewall.
3. Log in to the console.
4. Open the device-management/reset menu and choose the factory-reset option.
5. Confirm that you want to erase the existing configuration.
6. Wait for the firewall to restart.
The exact reset-menu sequence varies by installed SFOS version. Do not select firmware recovery or reinstallation unless necessary.
3. Connect your laptop to the Sophos XG 135
Initially, use a direct Ethernet connection:
Set a temporary static IPv4 address on your Windows laptop:
Setting Value
IP address: 172.16.16.2
Subnet mask: 255.255.255.0
Default gateway: Leave blank
DNS: Leave blank
Open:
https://172.16.16.16:4444
On the Sophos XG 135 Rev. 3, Sophos documents Port 1 as the default management interface, with the default credentials admin / admin. Newer firmware may require an immediate password change.
4. Complete the initial setup wizard
After logging in:
1. Set a strong administrator password.
2. Select the correct timezone: Asia/Singapore (UTC+8).
3. Configure DNS and the device hostname.
4. Complete any registration or licensing steps required by the installed firmware.
5. Skip optional security services that you do not intend to use, where the wizard permits.
6. Finish the setup and log in to the main administration interface.
Because your Sophos XG 135 will not be your internet gateway, you do not need to enable NAT or configure a production WAN connection.
Do not connect the Sophos XG 135 to the PoE switch yet. First configure its management IP address.
5. Change the Sophos XG 135 LAN IP address
Navigate to Network → Interfaces.
Edit the LAN interface, normally Port 1, and configure:
Setting Value
Name: LAN
Zone: LAN
IPv4 configuration: Static
IP address: 192.168.26.2
Netmask: /24
Gateway: Not configured on the interface
Save the changes.
Your browser will disconnect because the firewall's IP address has changed.
Change your laptop's temporary address to:
- IP: 192.168.26.10
- Subnet mask: 255.255.255.0
Reconnect at:
https://192.168.26.2:4444
Then configure the XG 135's default route under Routing → Static Routes:
- Destination: 0.0.0.0/0
- Gateway: 192.168.26.1
- Interface: LAN
On some SFOS versions, a default route via a LAN interface may need to be configured as a gateway under Routing → Gateways instead. Verify that the Sophos XG 135 can reach 192.168.26.1 and the internet before proceeding.
6. Configure DHCP on the Sophos XG 135
Navigate to Network → DHCP → Server → Add.
Configure:
Setting Value
Name: LAN_DHCP
Interface: Port 1 / LAN
Dynamic IP lease: 192.168.26.100–192.168.26.199
Subnet mask: 255.255.255.0
Gateway: 192.168.26.1
DNS 1: 192.168.26.1
DNS 2: 1.1.1.1
Lease time: 1440 minutes
Very important: Enter 192.168.26.1 as the DHCP gateway. Do not select Use interface IP as gateway, because that would make clients use the Sophos XG 135 instead of the tp-link Archer NX500.
Sophos supports specifying a gateway other than the DHCP server's own interface IP.
Save the DHCP configuration, but leave the tp-link Archer NX500 DHCP service running until you are ready for the cutover.
7. Configure DHCP Option 234
This is the important setting for Sophos APX 530 discovery.
Under the DHCP server's DHCP Options / Custom Options section, create:
Setting Value
Option code: 234
Type: IP address
Value: 192.168.26.2
Bind the option to the LAN_DHCP server and save.
Sophos confirms that Option 234 directs AP registration requests to the firewall IP instead of the default discovery address 1.2.3.4.
8. Enable Sophos Wireless Protection
Navigate to Wireless → Wireless Settings.
1. Enable Wireless Protection.
2. Under Allowed Zones, select LAN.
3. Click Apply.
4. Under Administration → Device Access, ensure the appropriate LAN management and wireless services are permitted, if that option is available in your firmware.
Sophos documents LAN as a supported zone for AP registration.
9. Connect the Sophos XG 135 to your PoE switch
Once its interface and DHCP settings are ready:
1. Connect the Sophos XG 135 Port 1 to a regular Ethernet port on the PoE switch.
2. Connect a tp-link Archer NX500 LAN port to the same switch.
3. Disable DHCP on the tp-link Archer NX500.
4. Ensure the Sophos DHCP server is running.
5. Change your laptop back to automatic IP addressing.
6. Reconnect your laptop to the LAN and renew its DHCP lease.
10. Connect and register your three Sophos APX 530 access points
Connect each Sophos APX 530 to an adequately powered PoE+ port.
On the Sophos XG 135:
1. Go to Wireless → Access Points.
2. Wait for the APs to receive DHCP addresses and discover the firewall.
3. Look under Pending Access Points.
4. Check the serial numbers against the labels on your APs.
5. Click Accept for each one.
6. Wait until they show as Active.
Sophos uses TCP port 2712 for AP management.
If the APs do not appear, check that Option 234 is being supplied in their DHCP leases and that they can reach 192.168.26.2 on TCP 2712.
11. Create the Wi-Fi network
Go to Wireless → Wireless Networks → Add.
Setting Recommended configuration
Name: Office_WiFi
SSID: Office-WiFi
Security mode: WPA2-Personal
Encryption: AES
Password: Strong unique password
Client traffic: Bridge to AP LAN
Frequency bands: 2.4 GHz and 5 GHz
Save, then go to Wireless → Access Points and assign Office_WiFi to all three Sophos APX 530s.
Do not create a separate bridge interface on the Sophos XG 135. Sophos specifically confirms that external APX access points using Bridge to AP LAN do not require a firewall bridge interface.
Regards,
Mr. Turritopsis Dohrnii Teo En Ming
Republic of Singapore
6 Nov 2026 Friday 3.11 pm Singapore Time
REFERENCES
==========
[2] mail-archive.com - NIL
Comments
Post a Comment