How to interpret Sophos AP6 and APX LED blink codes

The LED provides the quickest initial clue, but it is not a complete diagnosis. First, identify the model on the product label: the AP6 420X and APX 320X have their own combinations of status, radio, and mesh LEDs, which must not be interpreted like the single LED on other models.

Quick guide: On the AP6 420, 420E, 840, and 840E as well as the APX 320X, green indicates startup or normal operation, amber indicates that there is no controller connection or that the access point has not yet been claimed, and red indicates an error, configuration reset, or firmware update. Different patterns apply to the APX 120, 320, 530, and 740 and the AP6 420X, as detailed separately below. If the status LED on one of the first group of models flashes red rapidly, a firmware update is in progress; do not interrupt the power supply.

In the local AP6 user interface, the LEDs can be enabled or disabled under Advanced > LED settings. A dark LED on a locally managed device therefore does not by itself prove that power has been lost.

Scope and model status

The following matrices apply only to the models explicitly named in each section. Before taking action, record the model and hardware revision from the product label and the actual management path: AP6 can be managed through Sophos Fusion (formerly Sophos Central) or locally, while APX can be managed through Sophos Fusion or, where supported, an SFOS Wireless Controller. Compare Sophos AP6 models covers deployment location, radio bands, PoE, SKU, and country checks; the Sophos product lifecycle calendar identifies the End-of-Sale and End-of-Life status of APX and AP6. A blink code listed here therefore describes installed hardware; it does not prove that the model is still orderable, supported, licensed, or approved in the deployment country.

For an APX managed by SFOS, also verify that the exact model is supported by the installed SFOS release and is available under Wireless > Access points. If either check fails, do not apply a mesh or reset procedure from another model family; clarify the support and migration status first.

AP6 420, 420E, 840, and 840E

These four AP6 models use a single status LED:

Off: The access point is switched off or restarting.
Solid green: Normal operation.
Flashing green: The access point is starting and connecting to the Wireless Controller.
Solid amber: No connection to the Wireless Controller.
Flashing amber: The access point has not yet been claimed by the Wireless Controller.
Solid red: Error or no Wireless Controller found. An unclaimed AP restarts. If the LED remains in this state, check the network connection next. If the reset button has been pressed, this signal instead indicates that a configuration reset is about to begin.
Flashing red: The configuration is being reset.
Rapidly flashing red: A firmware update is in progress. Do not switch off the AP or disconnect it from the PoE port.

A solid red LED is therefore ambiguous. The context—normal operation or an intentionally pressed reset button—determines whether it indicates a connection error or preparation for a reset.

AP6 420X: interpret all three LEDs together

On the outdoor AP6 420X, Sophos identifies the three indicators as Status, Radio, and Mesh. The official matrix does not specify colors for these combinations, only off, on, and flashing speeds. Colors used by other AP6 models must therefore not be applied to this table.

All three off: The AP is switched off or restarting.
Status flashing, Radio and Mesh off: The AP is starting, connecting to the Wireless Controller, or applying a configuration.
Status and Radio flashing, Mesh off: The configuration is being reset.
All three flashing: Error or no Wireless Controller found. An unclaimed AP restarts. If the pattern persists, check the network connection. If the reset button has been pressed, the same pattern indicates preparation for a reset.
Status flashing rapidly, Radio and Mesh off: Firmware update. Do not interrupt the power supply.
Status on, Radio and Mesh flashing: No connection to the Wireless Controller.
Status on, Radio flashing, Mesh flashing rapidly: The AP has not yet been claimed by the Wireless Controller.
Status on, Radio off, Mesh off or on: Single-band operation on 2.4 or 5 GHz.
Status and Radio on, Mesh off or on: Operation on 2.4 and 5 GHz.

In countries where single-radio operation is mandatory, the AP6 420X uses radio 0 on either 2.4 or 5 GHz; radio 1 cannot be configured there. In Israel, only 2.4 GHz is permitted outdoors. In these cases, the Radio LED lights red. Before installation or changing the country setting, complete the model, SKU, and country checks linked above for the specific device.

APX 120, 320, 530, and 740

Sophos distinguishes fewer LED states on these APX models, so the same signal can indicate several different causes:

Off: The AP is switched off.
Flashing green: The AP is restarting or applying a configuration from the cloud.
Solid green: Normal operation or the cloud configuration has been applied.
Solid amber, APX 320 only: The hardware reset button was pressed for 3 to 5 seconds; the AP restarts.
Solid red: Ethernet is not connected, the cloud cannot be reached, or the reset button was pressed for 15 to 20 seconds and a reset is in progress.

On an APX, a solid red LED therefore has three possible causes. Before performing a reset, first check the switch port link, DHCP, DNS, gateway, and internet path.

APX 320X: Status, Radio, and Mesh

The APX 320X has its own status matrix:

Status off: AP switched off or restarting.
Status solid green: Normal operation.
Status flashing green: AP starting, connecting to the Wireless Controller, or applying a configuration.
Status solid amber: No connection to the Wireless Controller.
Status flashing amber: AP has not yet been claimed by the Wireless Controller.
Status solid red: Error or no Wireless Controller found. An unclaimed AP restarts. If the LED remains in this state, check the network connection.
Status flashing red: Configuration reset in progress.
Status flashing red rapidly: Firmware update; do not interrupt the power supply.

The other two LEDs indicate radio and mesh operation:

Radio solid green: 2.4 and 5 GHz.
Radio solid amber: Dual 5 GHz operation.
Radio solid red: Single-radio operation on 2.4 or 5 GHz.
Mesh off: Mesh is not enabled.
Mesh solid green: Mesh is enabled.

The same model, SKU, and country checks as for the AP6 420X apply to country-specific single-radio restrictions. For an APX network managed by SFOS, Set up and test Sophos Firewall Wireless Mesh explains how to verify the root AP, common channel, client SSID, and mesh status together. Use that procedure only after the scope check above has confirmed the exact APX model and installed SFOS release.

From the LED pattern to the next check

The indicator helps narrow down the next step, but it does not replace checking the device state:

Off: Check the PoE port and PoE budget. For a locally managed AP6, also check whether the LED has been intentionally disabled.
Startup or configuration in progress: Wait a few minutes and check whether the AP subsequently reaches the documented normal state.
No controller or cloud connection: Check the Ethernet link, DHCP lease, DNS resolution, default gateway, NTP, and outbound destinations against the Sophos Fusion Wireless requirements.
Not claimed: Check the serial number, the correct Sophos Fusion tenant, and Wireless > Access points. The LED alone does not confirm a successful assignment.
Firmware update: Do not restart the AP or disconnect PoE. Continue only after the AP has returned to a normal operating state.
Red without an intentionally initiated reset: Check the network path first. If the state persists, record the model, LED combination, and Sophos Fusion status for support analysis.

An AP6 can be registered without a license. However, ongoing management in Sophos Fusion requires a valid AP6 Support and Services license.

Successful completion is not indicated by a green LED alone: the AP must appear online in the intended management system, receive the expected configuration, and connect a test client to the correct SSID and VLAN.

Distinguishing a restart from a factory reset

A restart with the current firmware image retains the current configuration. A factory reset, however, discards the configuration and may require the AP to be registered with the controller again. Check the network and controller connection first, then proceed only with the appropriate procedure.

Warning: An AP6 factory reset replaces all configuration changes with the factory defaults. The configured IP address and administrator password are also lost. An APX factory reset retains the current firmware image, but resets the configuration to factory defaults and requires the access point to be registered with Sophos Fusion again.

Consider a factory reset if the AP was registered with the wrong Sophos Fusion tenant, is being transferred from another tenant, or still shows an incorrect assignment after connectivity has been corrected. Before deleting it from Sophos Fusion, verify the serial number and target tenant. Only then remove the AP from Sophos Fusion, reset it with the appropriate procedure, and register it again; this process interrupts Wi-Fi service.

Restart an APX with the current image and configuration

Press and hold the reset button for no more than 8 seconds.
Release the button.
The LED goes out, flashes, and then lights solid green while the AP restarts.

Start an APX with the current image and factory settings

Press and hold the reset button for 15 to 20 seconds.
Release the button.
The AP restarts with the factory configuration. The current firmware image is not rolled back to an older factory version.
Then register the access point again with the intended controller.

Restart an AP6 with the current image and configuration

Press the reset button.
Release the reset button.
The LED goes out, begins to flash, and then lights solid green while the access point restarts.

Reset an AP6 420, 420E, 840, or 840E to factory settings

Press and hold the reset button for 5 seconds until the Status LED lights solid red.
Continue holding it for another 5 seconds. During this phase, you can still cancel the process by releasing the button.
Release the button only when the Status LED flashes red.
Wait for the restart and, if the AP is managed through Sophos Fusion, register it there again.

Reset an AP6 420X to factory settings

Press and hold the reset button for 5 seconds until the Status, Radio, and Mesh LEDs flash red.
Continue holding it for another 5 seconds. Releasing the button during this phase cancels the reset.
Release the button as soon as the Mesh LED goes out.
Wait for the restart and, if the AP is managed through Sophos Fusion, register it there again.

Reset an AP6 to factory settings through the local user interface

Sign in to the access point’s local user interface.
Open Advanced > Factory default.
Select Factory Default and confirm the security prompt with OK.
Wait for the AP to restart with the factory settings.