Diagnose Sophos Firewall Wireless Controller from CLI
The SFOS Wireless Controller has additional diagnostic and operational parameters in 4. Device Console. They include local AP debugging, controller logging, remote packet capture, a RADIUS Accounting delay, automatic AP acceptance, BSS statistics and channel width. These values do not replace the normal Wireless Network setup in WebAdmin.
The commands do not all have the same effect. Some only increase logging, while others change AP onboarding, online behavior or radio parameters. Never execute the complete command set. Reproduce the specific fault on one AP and one test client, then change exactly one value.
⚠️ Maintenance and privacy rule: Wireless captures can contain user traffic, IP addresses, DNS, authentication and session data. Enable debugging only briefly, protect the files and save every baseline value before the change.
Save the baseline
The SFOS help presents several options as a shortened command tree. Check the installed build with ? before entering a command. These read operations are useful for the baseline:
system wireless-controller ?
system wireless-controller ap_localdebuglevel get
system wireless-controller global show
system wireless-controller remote_pktcap show <AP_serial_number>
Also record the firewall build, AP model, serial number, firmware, SSID, band, channel, channel width, affected client, time and symptom. In HA, identify which node holds the controller state and where the command is run. A successful CLI status does not prove a working radio or data path.
Parameters and safe operating boundaries
| Area | Value documented by Sophos | Operating boundary |
|---|---|---|
ap_localdebuglevel | 0 to 15, with get and set | AP-local logging. Increase only for the test and restore the saved value afterwards. |
global log_level | 0 to 7 | Controller log level. A higher number does not automatically mean more logging; Sophos states that messages at or above the configured level are written. |
global ap_debuglevel | Number, with no published range on this page | Must be at least 4 for remote packet capture. Do not guess a maximum. |
global radius_accounting_start_delay | 0 to 60 seconds | Use only when Accounting Start demonstrably occurs before the DHCP address. |
global ap_autoaccept | 0 off, 1 on | Automatic AP acceptance changes the onboarding control point and is not a troubleshooting shortcut. |
global stay_online | 0 off, 1 on | Sophos does not explain the exact effect on this page. Do not change without Support guidance. |
global store_bss_stats | 0 off, 1 on | Stores BSS statistics. Clarify storage, privacy and analysis purpose first. |
global tunnel_id_offset | 0 to 65535 | Sophos does not explain the operational effect here. Do not change without a confirmed design or Support guidance. |
The documented branches include:
system wireless-controller ap_localdebuglevel set <0-15>
system wireless-controller global log_level <0-7>
system wireless-controller global ap_debuglevel <number>
system wireless-controller global radius_accounting_start_delay <0-60>
Do not enter the square brackets from the Sophos syntax. Replace placeholders with a concrete value. After every change, read the corresponding get or show state again and use the same test client.
Remote packet capture on an AP
remote_pktcap captures packets on an access point while a packet capture is running on the firewall. Sophos requires a global ap_debuglevel of at least 4. Save the current debug value before starting.
system wireless-controller global ap_debuglevel 4
system wireless-controller remote_pktcap enable <AP_serial_number>
Then use a narrow filter under Diagnostics > Packet capture for the test client, destination, port or protocol. Trigger only a short, reproducible flow. Stop AP capture immediately afterwards:
system wireless-controller remote_pktcap disable <AP_serial_number>
Restore the saved global ap_debuglevel. Confirm the stopped state with remote_pktcap show. A capture without the exact AP serial number or a filter can collect unnecessary traffic from other clients and is not a suitable permanent state.
Classify RADIUS delay and channel width correctly
radius_accounting_start_delay delays 802.1X Accounting Start by 0 to 60 seconds. This can let the Wi-Fi client receive a DHCP address before the Accounting Start message supplies that address to SFOS for Wi-Fi SSO. The complete proof with RADIUS logs and a capture is in Check RADIUS SSO and Accounting. Do not change the value without a visible ordering problem.
For channel width, Sophos publishes this branch:
system wireless-controller set_channel_width <WiFi_interface> band <WiFi_band> channel_width <number>
The documented widths are 20 and 40 MHz for the 2.4 GHz band and 20, 40 and 80 MHz for 5 GHz. The official CLI page calls the first band 2.5GHz in one place, while WebAdmin and radio technology use 2.4 GHz. Verify the accepted band token with ? on the installed build instead of copying that typo.
A wider channel is not automatically faster. Channel use, neighboring networks, signal, retransmissions, client capabilities and site density all matter. Set up Wireless Network on Sophos Firewall explains the planning and measurement.
Acceptance and rollback
After one change, verify AP status, client association, DHCP, DNS, authentication, expected firewall rule ID, packet loss, latency and a real application. Channel changes require checks of all affected SSIDs and a new scan of the environment. RADIUS checks include Accounting Start, Framed-IP-Address and user mapping.
If the symptom remains unchanged, restore the exact previous value. Disable debug and capture functions regardless of the result. When the effect of a parameter such as stay_online or tunnel_id_offset is not clearly documented, stop before entry and clarify it with Sophos Support.
FAQ
Why does remote packet capture show no packets?
ap_debuglevel must be at least 4, the correct AP serial number must be selected and a packet capture must run on the firewall at the same time. Then check the filter and test flow.