Sophos Fusion Network Map: Check and Export Topology

Under My Environment > Network Map, Sophos Fusion displays connections between managed firewalls, switches and AP6. Before maintenance, for example, this helps identify which switch an AP6 connects to and which devices might depend on an uplink. The map relies on LLDP neighbour data and does not replace a connectivity test.

For useful documentation, first check the device inventory and LLDP, compare important links with the physical cabling, and only then save the layout and export. This turns an automatically generated view into a traceable snapshot.

Prerequisites before the first comparison

The participating Sophos devices must be managed in the intended Fusion account and have LLDP enabled. LLDP provides information about directly neighbouring network devices; if it is missing on a participating device, the view may be incomplete. Plan any changes with the network administrator rather than immediately treating a missing line as a cabling fault.

The current Sophos help lists these minimum versions:

These lower limits are not a recommendation to remain on an old build. Compatibility, maintenance windows and the relevant release notes still apply to an update. If the menu item is missing in your account, check the intended account and access context; no particular licence or blanket role entitlement is inferred here.

Check topology using a known device path

A documented path such as Firewall → Switch → AP6 is a useful starting point. Have the expected device names and the actual ports from your own documentation available.

1. Open My Environment > Network Map and use the refresh icon to update device status.
2. Search for a known device by name, serial number, MAC address or IP address. Verify the account, device identity and online status.
3. Open the firewalls, switches or access points view and follow the expected neighbour. For a switch, compare the port view in the device details with the documented cabling.
4. For an AP6, check its connection to the switch and, for mesh, the root/node assignment. The actual mesh acceptance checks also test backhaul and client traffic.
5. If there is a discrepancy, first check device management, firmware and LLDP. Then check the actual link and port status on the device. A line on the map alone does not determine whether packets can take that path.

For configuration jobs and synchronisation failures, the switch fleet guide remains the relevant reference. Network Map answers the neighbour question; Task queue answers whether a configuration job succeeded.

Save the layout and document the SVG

Fusion 2026.44, released on 12 October 2026, introduced saved layouts, SVG export and clearer displays of offline devices and AP6 mesh groups. The release notes describe this enhancement. The older July entry mentioning PNG refers to the initial launch; SVG applies to the version described here.

Drag devices into a useful arrangement. For example, place the known uplink path side by side and group devices at one site together spatially. Moving the icons changes the layout, not the cabling.

After arranging the devices, use the available layout-saving function. Then refresh device status and check that the arrangement is retained. Use the download icon to export the map as SVG and open the file to check the visible area and readability.

Record the date, account and checked scope alongside the export in your operational documentation. Before sharing it, check whether device names, IP/MAC addresses or other internal details are visible. A saved graphic does not update as the network changes later.

Limitations and common misinterpretations

• STP blocks a port: LLDP can still show a neighbour. A drawn connection does not imply active forwarding. Also check the current STP and port status when assessing the path.
• An offline device still has connections: The map may rely on stale data and the last known state. Assess online status, the time of your own refresh check and direct device access together.
• Endpoints connected directly to the firewall are missing: According to Sophos, these endpoints do not appear on the map. Their absence does not establish a connection fault.
• APX or other unmanaged devices appear incomplete: They are not among the fully supported managed device types. Such devices may appear only as a generic Device or be absent; an unmanaged device connected directly to a switch is visible only under the documented conditions involving downstream endpoints.

If an expected path remains unclear, record device identities, firmware versions, LLDP state, affected ports and the time. Then compare the map with the actual link status and escalate the specific issue if necessary. The map therefore helps with inventory and troubleshooting; successful application testing must still be performed separately.