Firewalla Access Point 7 Ceiling: Enabling Zero Trust Network Security with Wi-Fi 7 and Firewalla

A Firewalla unit (Any Gold or Purple unit in router mode) is required to use the AP7

Disclaimer:

• This is the final production hardware + production Wi-Fi controller + beta platform software (half beta)
• Compatibility Requirements:
  • Gold, Gold Pro, Gold Plus, Gold SE, Purple, Purple SE
  • Firewalla must operate in Router mode.
    
  • Works with AP7 Desktop
• Availability: USA customers only.
• Shipping: 1–30 days post-order, in waves (FIFO). Please follow this forum post on shipping status. 
• Return: 60 days return period. (instead of 30)
• Order Limit: Soft limit of 5 units per order; exceeding this may delay shipment
  
• Installation: After you receive the unit, please follow this installation guide  
  
• Please see the mounting guide for physical installation
• This unit is PoE+ powered (Power brick is NOT included)
• Your credit card will be charged after the order

Full Integration 

with the Firewalla Security Stack

Extending Firewalla security features to the LAN

Building Zero Trust Network

Never automatically trust devices

Zero Trust is a security framework that assumes no user or device can be trusted by default, even within the network. 

Firewalla AP7 and Firewalla Router 

bring the power of Zero Trust security to your home or business network

• Segmentation and Microsegmentation: Divide your network into smaller segments to limit the lateral movement of threats. 

• Least Privilege Access: Grant users and devices only the minimum access necessary to perform their functions on the Network.

• Continuous Monitoring: Continuously monitor and verify the security posture of all users and devices.
  

Microsegmentation with VqLAN

Firewalla VqLAN offers simplified network segmentation by dividing a network into smaller, isolated segments to limit the spread of threats without requiring network-wide changes. If you already have groups defined, you just need to turn VqLAN on.

Personal Key 

Assign different personal keys (PPSK via WPA2) to the same SSID to identify users. Devices logging in with a specific key will be assigned to the configured user, group, or VLAN network (experimental), ensuring user identification and rule enforcement (even if the user’s MAC address is randomized).

Example:

• You can assign a personal key to your child, and any devices your child uses will be automatically quarantined to the “Kid” user group. Even if the device’s MAC address randomizes, you will always be able to group devices.

Device Isolation Support

Completely isolate any of your devices from your home network. Perfect for guests and devices that don't need to talk to each other on your LAN network. This will complement the existing Firewalla network quarantine and guest network feature.

Rule-Based Least Privilege Access 

Zero Trust Networks should never fully trust any devices on the network. After your network is segmented and isolated, you can use Firewalla Rules or Policies to grant the device only the minimum permissions needed to reduce security risks.

Monitoring

Firewalla provides full network visibility by monitoring traffic and identifying who’s on your network, their activity, and potential security risks. With Firewalla AP7, we extend this capability to your LAN, giving you full visibility into how your devices communicate within your local network.

Local Flow Visibility 

Internet or WAN Visibility

More Wi-Fi Control and Visibility

Wi-Fi 7 

Mesh

With Ethernet or WiFi Backhaul

Learn More:

• Building a zero trust network with Firewalla 
• Firewalla microsegmentation and segmentation with AP7
• Firewalla AP7 Installation Guide
• Firewalla AP7 Community (login required)
• All Firewalla AP7 Documents

Unboxing

Spec

• Triband 2.4 GHz 2x2, 5 GHz 2x2, 6 GHz 2x2

• 6 Spatial Streams, 320 MHz channel support 6 GHz

• Network Interfaces: 10 Gbit RJ45 (PoE+) + 2.5 Gbit RJ45

• Power: PoE+ (IEEE802.3at) ; Input: 12V 2.5A 

• VLAN Support

• WPA/WPA2/WPA3 Support

• PPSK (Personal Key) requires WPA2 

• Mesh with Ethernet or Wi-Fi backhaul

• Dimensions: 7.49 x 7.49 x 1.37 inch

• Item Weight: 1.57 lbs

• Compatible with and Required: Firewalla Gold / Firewalla Purple in router mode

• Mounting distance to the wall/ceiling: 13 mm

Shipping

• This unit is available for shipping to the USA only 
• This is a PoE unit; there is no power adapter inside
• If you need to mount it over a t-bar, please get this

FAQ

Please see the community link here for FAQ and discussions

Can this unit be used as the main router?

No, Firewalla Gold or Purple is required. Firewalla AP7 is an access point, not a router. 

Does Firewalla AP7 support Android and iOS?

Yes, and yes. A smartphone is required to use the unit

Return / Refund Policy

• For the first "Beta" launch, the product can be returned for a refund within 60 days of receiving the item.
• The product is not refundable if parts or accessories are missing
  
• Please see this page for details.

Have more questions?

Please email us at help@firewalla.com or visit our community https://help.firewalla.com