Build a Sophos Network: Firewall, Switch, Wi-Fi

A network runs at the speed of its slowest hop. You can buy an excellent firewall, an excellent switch and excellent access points, wire them together, and still get a slow network. The three have to be sized against each other, not bought separately.

This guide covers the three pieces of a Sophos network and, more importantly, how they connect.

Start with the bottleneck, not the box

Wi-Fi 6 and 6E push far more traffic than older wireless. If that traffic then passes through a 1 Gigabit switch port, the switch becomes your ceiling no matter how good the access point is.

The fix is 2.5 Gigabit Ethernet end to end: a 2.5 GbE access point, into a 2.5 GbE switch port, powered over that same cable.

Switches also outlast firewalls and access points, so specifying 2.5 GbE now is a reasonable hedge even if today's traffic does not demand it. Replacing a switching layer later is more disruptive than getting it right at the start.

1. The firewall

Sophos XGS runs identical firewall software across every model, from the smallest desktop unit to a 2U rackmount. What changes is throughput and port count, not features.

Two things matter for a high-speed build:

• TLS inspection throughput. Almost all web traffic is encrypted, so this figure, not raw firewall throughput, is what limits real-world inspection.
• Interface speed. Check the firewall can feed your switching layer rather than throttle it. A 1 GbE uplink into a 2.5 GbE switch undoes the rest of the design.

Compare XGS models to match throughput to your connection and user count.

2. The switch

Sophos CS series switches are cloud-managed from Sophos Fusion, the same console as your firewall and access points. Two specifications decide whether a switch fits: port speed and Power over Ethernet.

Non-PoE versions exist as well (CS101-8, CS110-24, CS110-48). To power access points over the network cable, choose a P or FP model.

For one or two access points, a PoE injector can power them without a switch. Beyond that, a PoE switch is tidier and usually cheaper than a pile of injectors.

3. The access points

The AP6 Series is the current Sophos generation, managed from Sophos Fusion with no local controller. Four indoor models and one outdoor, spanning Wi-Fi 6 and 6E. The 6E models add the 6 GHz band, which is less congested.

The one gotcha worth planning for. The AP6 840E needs PoE++ (802.3bt), and among the 2.5 Gigabit switches only the CS210-8FP supplies it. The CS210-24FP and CS210-48FP provide PoE+ (802.3at). If you are putting an 840E on a larger 2.5G switch, budget for a separate PoE++ injector, and use both of the access point's 2.5 GbE ports.

Every AP6 model except the AP6 420 has a built-in 2.5 GbE port, which is what pairs with a 2.5 GbE switch for end-to-end speed.

How the pieces connect

Read the path from the internet inwards and check no hop is slower than the ones around it.

One console for all of it

Firewall, switches and access points are managed together from Sophos Fusion. That matters less on day one than it does in month six, when a change to one piece needs checking against the other two.

A worked example

A 40-person office with gigabit fibre and four access points, one of which is a 6E model in the boardroom:

• Firewall: an XGS 2100 or similar, sized on TLS inspection throughput rather than the headline figure.
• Switch: a CS210-8FP if the 6E unit is an AP6 840E, since it is the only 2.5G switch supplying PoE++. Otherwise a CS210-24FP gives more ports.
• Access points: AP6 840 units for general coverage, an AP6 840E where device density is highest.
• Cabling: Cat 6 or better to every access point. The cable outlives all three devices.

Frequently asked questions

What makes a network slow when all the components are good?

The slowest hop sets the speed. Wi-Fi 6 and 6E access points push far more traffic than older wireless, and if that traffic passes through a 1 Gigabit switch port, the switch becomes the ceiling. Run 2.5 Gigabit Ethernet end to end: a 2.5 GbE access point into a 2.5 GbE switch port, powered over the same cable.

Which Sophos switch supports 2.5 Gigabit Ethernet?

The CS210 family is the multi-gigabit line, including the CS210-8FP with eight 2.5 GbE ports, plus the CS210-24FP and CS210-48FP. The CS101 and CS110 families are 1 GbE.

Which switch can power a Sophos AP6 840E?

The AP6 840E requires PoE++ (802.3bt). Among the 2.5 Gigabit switches only the CS210-8FP supplies it. The CS210-24FP and CS210-48FP provide PoE+ (802.3at), so an 840E on one of those needs a separate PoE++ injector. Use both of the 840E 2.5 GbE ports for best performance.

Do I need a PoE switch for access points?

For one or two access points, a Power over Ethernet injector can power them without a switch. Once you have several on walls and ceilings, a PoE switch is tidier and usually cheaper than multiple injectors.

Should I buy 2.5 GbE switches if my traffic does not need it yet?

Usually yes. Switches outlast firewalls and access points, so 2.5 GbE is a sensible hedge. Replacing a switching layer later is more disruptive than specifying it correctly at the start.

Which AP6 models have a 2.5 GbE port?

All of them except the AP6 420, which has a 1 GbE uplink. The AP6 840E has two 2.5 GbE ports and both should be used.

Can I manage the firewall, switches and access points together?

Yes. Sophos XGS firewalls, CS series switches and AP6 access points are all managed from Sophos Fusion, so there is one console rather than three.

Get your network specified

Nuformat is a Sophos partner serving Canada and the United States. Tell us your site size, internet speed and how many access points you need, and we will specify firewall, switching and wireless together so no hop throttles another. Request a quote.

Sophos XGS firewalls · Sophos switches · AP6 access points · Compare XGS models

Specifications and recommended pairings as published by Sophos. Pricing and availability confirmed by Nuformat at the time of quotation.