Sophos AP6 420E.
Indoor Wi-Fi 6E, managed from the cloud.
The AP6 420E is Sophos's indoor access point for spaces that already have 6 GHz clients on the
floor. You get tri-band Wi-Fi 6/6E, a 2.5G uplink so the network doesn't bottleneck behind the AP, and WPA3
security, all managed in Sophos Central. It's a solid fit for retail,
K12 classrooms, and busy small-to-medium offices.
Expert Pre-Sales AdviceCertified reps reply in 1 hour.
Config & Managed ServicesSkip the setup. We'll do it.
POs · Tax-Exempt · Net 30Welcomed for Corp, Edu, & Gov.
Same-Day ShippingOrder by 3pm EST, ships today.
Specifications
AP6 420E at a Glance
Wi-Fi 6/6E Performance
Tri-radio design covers the 2.4, 5, and 6 GHz bands on the 802.11ax standard. The 6
GHz band is the cleaner, less crowded space that Wi-Fi 6E opens up, which is where the 420E earns its
keep in higher-density rooms. Runs a 2x2:2 radio config with WPA3 security.
Uplink & Power
One 2.5G Ethernet port keeps the AP from becoming the choke point on a fast LAN.
Powered over that same cable with PoE+ (802.3at). No power adapter or PoE injector is
included in the box, so plan for a PoE+ switch or injector.
Management
Managed in Sophos Central, the same console as your Sophos firewalls, switches, and
endpoints. A local web interface is available for setting up a single AP on site. A support subscription
per AP is required for Central management.
Deployment & Build
Plenum-rated (UL2043) for indoor desktop, wall, or ceiling mounting, including above
drop ceilings. Backed by a limited lifetime warranty, with firmware updates, Advanced
RMA, and 24/7 support tied to the AP support contract.
Not sure the 420E is the right AP6?
The AP6 lineup runs from the entry 420 up to the high-throughput 840E, plus the outdoor 420X. If you
don't need the 6 GHz band, the AP6 420 covers 2.4 and 5 GHz for less. Line them up side by side and pick
the right fit for your space.
Yes, for cloud management. A Sophos Central support and services subscription per AP
is what unlocks Central management, firmware updates, Advanced RMA, and 24/7 support. The hardware
itself carries a limited lifetime warranty, and you can run the local web interface for a single AP
without Central, but most customers want Central so their Wi-Fi lives in the same console as the rest
of their Sophos gear. Add the support term that matches your deployment when you order.
No. The AP6 420E ships as the access point only, with no power adapter or PoE
injector in the box. It needs PoE+ (802.3at) to run, so you'll power it from a PoE+ capable switch or
a separate PoE+ injector. If you're deploying more than one or two APs, a Sophos PoE+ switch is
usually the cleaner option since you can manage the switch in Sophos Central alongside the access
points. Ask us and we'll add the right power option to your quote.
There's no single number, because real capacity depends on your space, wall
materials, and how the clients are using the network. As a general-purpose, medium-density AP, the
420E is built for rooms like retail floors, classrooms, and small-to-medium offices. For heavier
client counts you'll usually plan several APs and let Sophos Central handle roaming between them
rather than pushing one unit to its limit. Tell us your square footage and rough headcount and a
Sophos-certified rep will help you size the deployment.
No. The AP6 Series, including the 420E, cannot be managed from any Sophos firewall.
It's managed in Sophos Central, or through the local web interface for a single AP. If you
specifically need a firewall to act as the Wi-Fi controller, that's the end-of-sale APX Series, which
Sophos has set for end-of-life on December 31, 2027. For any new install we'd point you to the AP6
420E and Central rather than starting on hardware that's already sunsetting.
The "E" is the difference. The AP6 420E is a tri-radio access point that adds the 6
GHz band for Wi-Fi 6E clients and includes a 2.5G uplink port. The standard AP6 420 covers the 2.4 and
5 GHz bands only and uses a 1GE port. If you have newer devices that can use 6 GHz, or you want the
faster uplink to avoid a bottleneck, the 420E is the one. If your clients are all on 2.4 and 5 GHz,
the 420 does the job for less.
Yes, and it's the right direction to go. The APX Series is Wi-Fi 5 and end-of-sale,
with an end-of-life date of December 31, 2027, so any refresh should move to the Wi-Fi 6/6E AP6
Series. The 420E is a strong indoor replacement that adds WPA3, the 6 GHz band, and a 2.5G uplink. One
thing to plan for: APX was often firewall-managed, while AP6 runs in Sophos Central, so budget a
Central support subscription per AP as part of the migration. We can help map your existing APX units
to the right AP6 models.
Ready to roll out the AP6 420E?
Firewalls.com is a Sophos Platinum Partner. Tell us about your space and we'll build a quote with the
right APs, PoE, and Sophos Central support to match. Certified reps reply within the hour.
Login and Registration Form
Existing User