Hands on: I tested the Sophos AP6 420E - see how this access point debut from Sophos works out

Best known for its excellent security appliances and endpoint protection services, Sophos makes its first foray into Wi-Fi 6E territory with the AP6 420E access point. It teams up the 2.4GHz, 5GHz and Wi-Fi 6E 6GHz bands, supports 5GHz and 6GHz high-speed 160MHz channels and can be standalone or cloud managed.

The AP6 420E presents six spatial streams – two each for 2.4GHz, 5GHz and 6GHz, with claimed top speeds for each radio of 600Mbits/sec, 2,400Mbits/sec and 2,400Mbits/sec respectively. For a tri-band AP it’s pleasingly compact and yet manages to squeeze in two omnidirectional aerials for each radio and a 2.5GbE multi-gig network port that requires a PoE+ power source.

Small businesses that only want one AP will find it easy to deploy as it defaults to standalone operations. Security is tight: its browser interface insists you change the admin password and gets you started with a preconfigured SSID that presents all three radios and applies a unique key using the AP’s serial number.

There’s a lot to play with here: you can create up to eight SSIDs for each radio and select WPA2 or the mandatory WPA3 encryption for Wi-Fi 6E networks. All radios support opportunistic wireless encryption (OWE), which allows you to present a safe open public network that encrypts all endpoint traffic but doesn’t require authentication.

Other features include client isolation, walled gardens and captive portals with custom landing pages, URL redirects and authentication using AP-generated daily, weekly or monthly passwords, vouchers, and Facebook and Google logins. Traffic shaping is extensive as different upload and download limits can be applied to each radio, selected SSIDs or their associated clients. The AP also supports SNMP v1/2/3 monitoring and can run packet capture sessions and save their output as Pcap files.

Sophos delivered good results in our real-world performance tests where we used a Dell Windows 11 Pro workstation with a TP-Link Archer TXE75E Wi-Fi 6/6E PCI-E adapter. With the 160MHz channels enabled on the 6GHz radio, large file copies between the workstation and a Windows server on our 10GbE LAN averaged 210MB/sec at close range, dropping to 183MB/sec with the AP moved ten meters away and into an adjoining room.

The cloud management option will appeal to businesses invested in Sophos as all APs and wireless networks are managed from the same Sophos Central web portal. Onboarding isn’t as smart as other wireless vendors that provide mobile apps and QR code scanning, as you enter the AP’s serial number or bulk-provision up to 30 at a time using a CSV file.

The Sophos Central portal has been refreshed, with all the main menu options moved to the top for easier access. Selecting the wireless page presents a dashboard with status charts for all APs, alerts and the number of connected devices. The usage insights chart shows traffic categories for all clients, but this isn’t currently supported for any AP6 model – and neither are rogue AP detection and roaming assist for sticky clients.

All other features present in standalone mode are available from the portal, however, so you can create the same number of SSIDs on all radios each with their own security settings. For easier fleet management, the portal also allows you to create different sites with associated maps and floor plans, with each assigned a set of APs.

The AP6 420E is comparatively expensive and a number of features for AP6 devices are yet to be implemented in the Sophos Central portal. That said, it delivers good overall performance and is a natural choice for businesses that already rely on Sophos for their network security.

We rate the best Wireless Access Points (WAPs).