Roll out Sophos AP6 firmware safely in Central

For a centrally managed Sophos AP6, the shortest route is My Products > Wireless > Access Points > Firmware upgrade. Select the devices, then use Now for an immediate upgrade, Custom for a one-time date and time, or Recurring to apply new firmware automatically every day, week, or month. This article covers AP6 only.

⚠️ Plan for an outage: The AP6 cannot continuously serve wireless clients during a firmware upgrade. Do not turn off or disconnect the access point while it is upgrading because this could damage the device. Stabilize power, PoE, and uplink before starting, and do not interrupt the operation with a restart or reset.

Management plane and data path

Sophos Fusion (formerly Sophos Central) is the management plane in this workflow: Central schedules or starts the task, and the AP6 downloads and installs the firmware. Client traffic still follows the AP6, switch/VLAN, and gateway data path; it does not pass through Central. An available Central portal therefore cannot keep the wireless data path available while the AP restarts.

The AP6 must be registered, online, and reachable through its management path. A valid support subscription is also required for the latest firmware. See Central Wireless requirements and Manage AP6 locally or with Central for the underlying network and licensing requirements.

Before the rollout

The Avanet Release Owner exports the model, current Firmware, site, configuration features, online state, and Last activity from My Products > Wireless > Access Points into the change record. A green mark in the firmware column means current, a blue arrow means an upgrade is available, and a clock means an upgrade is scheduled.
At the start of every change, the owner opens the live AP6 release notes and records Latest version, release date, affected models, fixes, new features, and known issues. This live check is required; a version written into this article must not become the target release.
The Avanet release ledger records the review date, candidate version, installed versions and models, support status, relevant features, and links to the change and release notes. The owner assesses known issues, fixed vulnerabilities and security advisories, dependencies on switches, VLAN, RADIUS, captive portal, and mesh, and any required configuration changes. The outcome is approve, defer, or reject, with rationale and sign-off by the responsible Service Owner.
If approved, the owner defines the maintenance window, pilot AP, small site/model rings, broad ring, observation period, success criteria, and stop/go decision for each ring. Never begin a critical area with its only AP; hardware or feature combinations outside the approval remain outside the wave.
Before each ring, the implementing engineer verifies the support subscription, PoE supply, switch port, DHCP, DNS, outbound Central connectivity, and a configuration backup or export. Do not start with unstable power, an AP already shown offline, or unmet approval criteria.
The change defines identical before-and-after tests: SSID visibility, authentication, IP address, gateway, DNS, allowed destinations, and, where used, VLAN, RADIUS, captive portal, or mesh. Immediately before execution, the owner and engineer confirm the target version, device list, window, communication route, and rollback boundary below.

MR10 1.10.3192: validate selected features and fixes

Dated reference: AP6 MR10 carries firmware version 1.10.3192. The release notes give August 24, 2026 as its release date; the MR10 announcement dated September 8, 2026 describes the phased regional rollout and associated management features. These details replace neither the live release check nor approval for your own tenant.

For EU-Central, the announcement contains conflicting dates: the phase 3 heading says «New Date Coming September 14, 2026», while the text below still says September 7, 2026. Neither establishes that regional availability was actually achieved. Before a change in the affected tenant, check the firmware offered, the upgrade arrow or model-specific download, and the required Wireless features. If anything is missing, defer the ring and clarify availability with Sophos Support. A historical date or an available firmware file does not prove that every cloud feature is already available in the tenant.

First upgrade only the pilot AP’s firmware and repeat the existing client tests. Then validate new authentication, Traffic Shaping, or profile values separately; otherwise, a failure cannot reliably be attributed to firmware or a configuration change. For each feature, record the previous value, planned change, client used, and result in the change record.

Entra ID and RADIUS per SSID

MR10 adds Microsoft Entra ID as a cloud identity provider for AP6 SSIDs using Enterprise Authentication. Follow the existing AP6 Entra ID runbook. EAP-TTLS/PAP, server certificate and server identity checks, and the client and tenant limitations described there remain mandatory. A successful Test connection is only the first stage: next, test a real sign-in with an approved pilot identity and client profile, plus DHCP, DNS, and allowed destinations. The Entra announcement does not remove the limitations on RADIUS VLAN assignment, Accounting, or Captive Portal.

The MR10 announcement mentions RADIUS management per SSID; the release notes explicitly document RADIUS server assignment per SSID in the local AP6 interface. This is not a blanket promise that every combination of different servers or IdPs works without conflicts on overlapping frequency bands. First record the server/IdP assignments and bands of all Enterprise SSIDs on the pilot AP. After the change, sign in to every affected SSID again and check which server processes the request in the RADIUS log. If an existing assignment changes unexpectedly, stop and restore the documented configuration; do not skip the band-conflict check in the Entra runbook.

For classic RADIUS, also check the expected VLAN assignment and NAS Identifier. The MR10 announcement lists WIFIX-10111/10166 for incorrect VLAN assignments with WPA2/WPA3 Enterprise and WIFIX-7922 for the AP serial number as NAS Identifier. Acceptance requires the RADIUS response, actual client VLAN, and NAS mapping used at the server to agree. This RADIUS check is not a test of dynamic VLANs with the Entra IdP.

Traffic Shaping and WMM

Traffic Shaping for AP6 SSIDs is configured in Sophos Fusion under Advanced settings > Quality of service. Choose a pilot SSID, save its existing policy, and use a controlled transfer to check the configured limit in practice. Test an unchanged production SSID alongside it. WIFIX-9535 concerns policies that stopped taking effect after several days: repeat the measurement after two to three days of operation before accepting this case. A short throughput test immediately after the upgrade is insufficient.

WMM prioritizes wireless traffic and is distinct from an SSID throughput limit. Profile management distributes WMM values to one or more AP6 devices. The release notes assign WMM-EDCA configuration in the Advanced Wireless tab to the earlier management release Central 2026.29 of July 20, 2026; do not treat it as a new MR10 firmware feature. Keep the WMM defaults unless different values have been validated in your own wireless environment. If a change is needed, first use a profile assigned only to the pilot AP and compare voice or video under simultaneous data load with the previous state. If performance worsens, restore the saved profile values and repeat the same test.

Additional fix checks after the upgrade

The following checks apply only to features actually in use. A fix entry is not proof that your own site is already operating without faults:

WIFIX-12318: An approved pilot configuration change must reach the AP. Compare Task queue, applied configuration, and client impact; an unblocked queue status alone is insufficient.
WIFIX-10877: The fix addresses an SD daemon crash causing an AP restart. Record uptime and unexpected restarts throughout the agreed observation period. A single successful restart after the upgrade does not establish long-term stability.
WIFIX-10717: If Walled Garden is used, compare an allowed and a blocked test destination; the block list must actually enforce the intended restriction.
WIFIX-10142: The fix addresses intermittently incorrect power alerts. Still check new alerts against the PoE class, port budget, and total budget first; do not ignore them because a fix is listed.
WIFIX-9594: MR10 updates Dnsmasq to 2.91 to fix vulnerabilities. Verify the approved firmware version and repeat your DHCP/DNS tests. Without additional evidence, do not infer full security approval for the device.

Fusion Wireless 2026.41: a separate management release

Newer management release: Fusion 2026.44, released October 12, 2026. The following 2026.41 details remain as a reference.

The release notes checked on October 11, 2026 list Fusion 2026.41, released on September 22, 2026, as the current management release. This is a later Wireless management release and not AP6 firmware version 1.10.41. The new features require the appropriate license; check their visibility in your tenant separately from the pilot AP’s firmware. The release notes list neither new local UI features nor resolved issues for this management release.

In AP profile management, the Network settings tab provides settings for wired Ethernet ports: Spanning Tree Protocol (STP), Internet Group Management Protocol (IGMP) snooping, Link Layer Discovery Protocol Media Endpoint Discovery (LLDP-MED), and, exclusively for AP6 840E, port trunking. Do not enable these options automatically alongside MR10. First record the existing profile, assigned APs, and corresponding switch port configuration. Apply a required change only to the pilot profile, then check management reachability, Ethernet link, and the affected client path. If unexpected effects occur, stop assigning the profile to further APs and restore the documented profile and switch values. The presence of an option does not guarantee a particular trunking configuration or support on another AP6 model.

Under Diagnostics > System logs, optional advanced diagnostic logging can be enabled. It is for targeted troubleshooting, not a firmware upgrade. For an investigation, record the time, AP, and reproduced symptom, save the relevant logs, and disable the additional logging afterwards or restore its documented previous state. Check logs for credentials and personal information before sharing them. Do not try to force missing tenant options to appear through a reset or an assumed firmware downgrade.

Upgrade now, once, or recurrently in Central

Open My Products > Wireless > Access Points and click Firmware upgrade.
Select only the intended pilot or rollout APs and click Choose schedule.
Choose one option:
- Now: Click Upgrade to start upgrading the selected APs immediately.
- Custom: Select a date and time for a one-time upgrade, then click Save.
- Recurring: Select a daily, weekly, or monthly schedule. This automatically applies firmware upgrades to the selected APs. The displayed default is weekly on Tuesdays at 03:00 AM; deliberately change it to your maintenance window before saving.
Return to the access-point list and verify the selection and the icon in the Firmware column. A clock must appear for an AP with a scheduled upgrade.

Before a scheduled upgrade starts, cancel it through Firmware upgrade, select the AP6, and click Cancel schedule. This is the safe stop boundary for a planned rollout, not a firmware downgrade.

Staged rollout under Avanet ownership

The implementing engineer records each wave’s start, end, selected APs, and Central status. The Avanet Release Owner releases the next ring only after validation passes:

Pilot: Upgrade one representative AP6 that is not the sole critical device. Run the complete client tests and observe it for a period representative of normal operation.
Small group: Upgrade a small wave of APs with the same model and similar configuration. Keep enough coverage at each site outside the simultaneous wave.
Broad rollout: Schedule more groups only after the pilot result is documented. Do not assume that mesh, RADIUS, or captive-portal deployments behave identically to simple standalone APs.
Remainder: In Central, look for a blue arrow, a clock, or a differing version. The owner reconciles the result with the ledger and records whether to bring the device forward or hold it because of an open issue.

Before a wave starts, the recovery route is not an invented downgrade: cancel its schedule and leave the unupgraded APs on their existing version until the pilot issue is understood.

Update an AP6 locally

The local web interface provides two sources under Advanced > Update firmware:

Auto: The AP6 updates firmware automatically from Sophos. The page shows Current Firmware Version, Server Firmware Version, and Status.
a file on your PC: In Central, first go to My Environment > Installers. Under Wireless, click Download firmware for your wireless. Extract exactly the .tar.gz.sig file for the relevant AP6 model from the downloaded archive. In the local interface, open Advanced > Update firmware > a file on your PC > Choose file, select that file, click Open, then click Update.

Obtaining the latest firmware also requires Central registration and a valid support subscription. The local upload does not bypass these prerequisites. Do not mix model packages or alter the signed file, and do not disconnect power or network during the update.

Validate success

After the restart, wait for the AP6 to return online. In Central, compare the displayed Firmware with the approved release; a green mark indicates a current release. For local management, check Current Firmware Version, Server Firmware Version, and Status.

Connect a real test client and repeat the predefined tests. Management being online is not enough: authentication, DHCP, gateway, DNS, and allowed destinations must work. Where applicable, test VLAN, RADIUS, captive portal, or mesh specifically. The engineer records the result, AP model, old and new versions, timestamp, and deviations in the change; the owner updates the release ledger and releases the next ring only when all success criteria pass.

Troubleshoot safely

No upgrade is offered: Check registration, valid subscription, online state, and Last activity. Then inspect the blue upgrade arrow and the release notes. An AP that is already current does not need a task.

A scheduled run does not start: Confirm that the correct AP was selected and that the clock is visible in the firmware column. Reopen the date, time, and recurring choice. Before it starts, cancel and recreate a clean schedule rather than creating parallel appointments.

The local upload is rejected: Download the Central archive again and ensure that the .tar.gz.sig file matches the exact AP6 model. Do not rename, edit, or unpack that signed file any further. Record repeated failures with model, current version, filename, time, and message.

The AP remains offline after the upgrade: Do not quickly remove power or use Factory default as the first response. Check PoE, switch port, DHCP lease, and Central connectivity. If the AP returns, validate firmware and client data path. If it remains unreachable or reports an upgrade failure, the owner stops all later rings and records time, model, serial number, installed/target version, status, and infrastructure checks; the engineer then opens a Sophos Support case with that package. The AP6 offline troubleshooting guide walks through power and management connectivity checks.

Safe rollback boundary

This AP6 workflow has no approved firmware downgrade. Do not upload an older image speculatively or promise a downgrade. Before a Central schedule starts, the engineer uses Cancel schedule; during a staged rollout, the owner blocks later waves in the change and ledger. Once an AP upgrade is running, preserve power and connectivity, wait for completion or a clear failure, and capture its state. The owner then chooses between restoring power, network, or configuration conditions, escalating to Support, and replacing the device; rollout resumes only after recovery is documented and approval is renewed. A reset does not automatically restore the previous firmware.