Configuring and Monitoring Socket Wi-Fi Networks

This article explains how to configure Wi-Fi networks on supported Sockets and review analytics for the networks.

Overview

The X1600 and X1600 5G Socket models include an optional integrated Wi-Fi capability that lets you deliver secure wireless access directly from the Socket. By combining SD-WAN, security, and enterprise-grade Wi-Fi in a single device, you can reduce hardware footprint at the site, simplify deployment, and centrally enforce consistent network and security policies for both wired and wireless users.

Integrated Wi-Fi extends the Cato SASE platform to the wireless edge. Wireless traffic is inspected by the same security engines as wired traffic, including Firewall, IPS, Anti-Malware, and additional security services enabled in your account. This ensures consistent policy enforcement, full visibility, and simplified segmentation for corporate, guest, and IoT networks without requiring a separate wireless controller or firewall appliance.

Because Wi-Fi is managed directly from the Cato Management Application (CMA), you can configure SSIDs, authentication methods, encryption standards, and network segmentation for multiple sites from a single console. This centralized management model helps you maintain uniform security standards, streamline site rollouts, and reduce operational overhead.

HA Configurations for Socket Wi-Fi Networks

These are the supported configurations to provide HA including Wi-Fi connectivity:

2 X1600 Sockets with integrated Wi-Fi
2 X1600 5G Sockets with integrated Wi-Fi

HA is not supported (for either wired or Wi-Fi connectivity) in a site with one X1600 Socket and one X1600 5G Socket. A site with 2 X1600 Sockets (or 2 X1600 5G Sockets), one with integrated Wi-Fi and one without, supports HA for wired connectivity but not for Wi-Fi.

Configuring Socket Wi-Fi Networks

For sites with connection type X1600 or X1600 Cellular, with Socket models with integrated Wi-Fi, you can configure up to four Wi-Fi networks.

To configure a Socket Wi-Fi network

From the navigation menu, click Network > Sites and select the site.
From the navigation menu, select Site Configuration > Socket.
In the ports table, under Default Ports, click one of the Wi-Fi interfaces (labelled WBR1-WBR4). The Edit SSID panel opens.
In the General section, enter a name for the network and move the toggle to Enabled.
In the SSID Setup section, select whether the SSID name is Hidden or Visible to users.
In the Network section:
- Enter the Subnet IP range for the network.
- Enter the Local IP address for the interface.
- Under DHCP:
  - Enable or disable DHCP for wireless clients on this SSID.
  - When DHCP is enabled, enter the IP Range that defines the pool of addresses assigned to clients.
  The DHCP lease time follows the global account setting for DHCP lease time. For more information on setting account DHCP lease time, see Configuring DHCP Settings.
In the Security section:
- Select the Authentication Mode for the SSID:
  - PSK - Users authenticate with a shared password
  - Open – Users connect without authentication
- In Password, enter the pre-shared key when PSK is selected.
  Click Generate Strong Password to automatically create a secure password.
- Under Security Protocol, select the encryption standard.
- Under Track, select Track authentication events to generate events for wireless authentication activity.
In the Radio section, select the Broadcast Bands for this SSID. You can enable one or both bands.

Configuring Wi-Fi Radio Settings

You can configure the radio settings for each Wi-Fi band on the X1600 Socket. This lets you adjust the wireless configuration for the physical environment, client density, and available spectrum at the site.

For each band, you can configure these settings:

Wi-Fi standard
Channel width
Channel
DFS frequency usage for the 5 GHz band

Wider channels can provide higher throughput, but they can also increase the chance of interference in congested environments. Narrower channels can be useful in high-density areas where many access points or wireless networks are operating nearby.

Dynamic Frequency Selection (DFS) lets the 5 GHz band use additional channels that may have less interference. When DFS is enabled, the Socket only uses supported DFS channels that are valid for the site location.

The available radio settings are based on the site country. The CMA only shows channel and channel-width combinations that are supported for the site location, helping prevent invalid radio configurations.

Notes:

When you move a radio to a DFS channel, the Socket performs a Channel Availability Check (CAC) before using the channel. During this process, Wi-Fi clients on that band may experience a brief interruption.
Wi-Fi radio settings requires Socket v27 or higher

To configure Wi-Fi radio settings:

From the navigation menu, click Network > Sites and select the site.
From the navigation menu, select Site Configuration > Socket.
In the Socket & Wi-Fi Radio Configuration section, configure the settings for each Wi-Fi band.
- For the 2.4 GHz band, configure the radio settings.
- For the 5 GHz band, configure the radio settings and select whether to use DFS frequencies.
Click Save. The Wi-Fi settings are applied to the Socket.

Configuring an Internet-Only SSID for Guest Access

You can configure a Wi-Fi SSID as Internet-only to provide guest access from the X1600 Socket. Devices connected to an Internet-only SSID can access the Internet, but can’t access private site resources, LAN networks, or WAN destinations.

This lets you provide guest Wi-Fi without creating separate firewall rules to block access to internal resources. Guest traffic is still sent through the Cato security stack, so security services configured for the account can inspect and enforce policy on the traffic.

Internet-only SSIDs are useful for:

Guest networks
Contractor access
Networks that should be isolated from private resources

Note: Internet-Only SSID Configuration for Wi-Fi requires Socket v27 or higher.

To configure a Guest Wi-Fi (Internet-only) SSID:

From the navigation menu, click Network > Sites and select the site.
From the navigation menu, select Site Configuration > Socket.
In the ports table, under Default Ports, click one of the Wi-Fi interfaces (labeled WBR1-WBR4).
The Edit SSID panel opens.
In the SSID Setup section, enable the guest Wi-Fi option.
Configure the remaining SSID settings.
Click Apply.
Click Save. The Wi-Fi settings are applied to the Socket.

Configuring RADIUS Authentication for Socket Wi-Fi Networks

You can use your organization's RADIUS servers to authenticate users and devices connecting to Wi-Fi networks on X1600 and X1600 5G Sockets with integrated Wi-Fi. When you select Enterprise authentication for an SSID, the Socket forwards authentication requests to the configured RADIUS server. The server authenticates clients using credentials or certificates, according to its authentication policy.

RADIUS servers are configured at the account level and assigned to individual SSIDs. A server can be located on the site LAN or at another site reached over the WAN. Each SSID configured for Enterprise authentication requires a primary server and can also use a secondary server for redundancy.

Note: RADIUS Authentication for Wi-FI requires Socket v27.0.24419 or higher.

Configuring RADIUS Servers

Configure RADIUS servers for the account from the Radius Servers page.

To configure a RADIUS server:

From the navigation menu, click Network > Radius Servers.
Click New.
In the General section, enter a Name for the server.
In the Radius Settings section, enter the server address in Radius IP, the authentication port in Radius Port, and the shared secret in Radius Secret. The shared secret must match the value configured on the RADIUS server.

(Optional) Select Enable Accounting to send accounting records, such as who connected and when, to the server.
Note: Accounting automatically uses the same IP address as the RADIUS server and port 1813. You cannot configure a separate accounting server address or change the accounting port. Enable accounting on the server and make sure port 1813 is allowed between the Socket and the server.
Click Apply.
(Optional) Repeat this procedure to configure a secondary server.

Configuring RADIUS Authentication for an SSID

Use the Socket page to configure the Enterprise authentication mode and assign RADIUS servers to the SSID. The Security Protocol setting selects WPA2 or WPA3 encryption for the wireless connection between the client and the Socket.

To configure RADIUS authentication for an SSID:

From the navigation menu, click Network > Sites and select the site.
From the navigation menu, select Site Configuration > Socket.
In the ports table, under Default Ports, click a Wi-Fi interface (labeled WBR1-WBR4). The Edit SSID panel opens.
In the Security section, set Authentication Mode to Enterprise.

Select the Primary Radius Server.
(Optional) Click Add Secondary and select the Secondary Radius Server.
Under Security Protocol, select WPA2 or WPA3.
Configure the remaining SSID settings.
Click Apply.
Click Save. The Wi-Fi settings are applied to the Socket.

Monitoring Socket Wi-Fi Networks

You can monitor Socket Wi-Fi networks at the interface, SSID, device, and traffic levels from multiple pages in the CMA. This gives you operational visibility into radio status, connected clients, IP assignment, and throughput per Wi-Fi interface.

Viewing Socket Wi-Fi Network Status

The Networks page provides an overview of the Socket Wi-Fi networks including configured SSIDs and connected devices.

These are the fields shown for each interface:

Port - The identifier for the interface
SSID - The configured name of the Wi-Fi network
Status - Shows whether the SSID is enabled on the interface
Connected Devices - the number of devices connected on each band
Network Range - The configured subnet for the SSID
Visibility - Shows whether users can see the SSID name
Auth Mode - Shows whether users authenticate with a password or connect without authentication
Bands - Shows the broadcast bands configured for the SSID

Viewing Wi-Fi Interface Status

The Snapshot page shows operational status for the Socket Wi-Fi interfaces. In the Link State section, the Wi-Fi interfaces are listed as WBR1 – WBR4.

These are the fields shown for each interface:

Status - shows if the link is Up or Down
Media Connected - Always shows Yes for Wi-Fi interfaces as no cable connection is required.
Link Speed - Auto-negotiation, or the maximum speed configured for the link in the Socket WebUI
Duplex - Auto-negotiation, or the duplex configured for the link in the Socket WebUI

Viewing Connected Wi-Fi Hosts

The Known Hosts page provides device-level visibility for Wi-Fi clients.

These are the fields shown for each host connected to a Wi-Fi network:

IP Address
MAC Address
DHCP Range
Network Range
IP Allocation - Shows how the IP address was allocated to the host:
- Dynamic - hosts with a dynamic IP address allocated by the Cato DHCP server
- Reserved - hosts with a static IP address allocated by the Cato DHCP server
  - Reserved hosts are defined in the Hosts screen for the site (Network > Sites > {site name} > Site Configuration > Static Host Reservations)
- N/A - Hosts that are sending traffic, but the IP address was not allocated by the Cato DHCP server
Last Host Activity - Amount of time that elapsed since this host had network activity
Lease Time - Duration for the DHCP lease
For hosts with Reserved IP Allocation, the Lease Time value is Permanent.
Expires In - Amount of time remaining for the DHCP lease for this host
For hosts with Reserved IP Allocation, the Expires In value is Never.
Radio - Shows the broadcast band for the Wi-Fi network the host is connected to
SSID

Monitoring Wi-Fi Traffic and Throughput

You can analyze Wi-Fi interface traffic from the Network Analytics page Port Utilization tab.

In the Avg. Throughput by Port widget, select a Wi-Fi interface (for example, WBR1) to view:

Transmit (Tx) utilization
Receive (Rx) utilization

This view helps you monitor wireless usage, identify peak utilization periods, and validate throughput on specific Wi-Fi interfaces.

Viewing Historical Wi-Fi Analytics

You can use the Network Analytics page to view historical Wi-Fi metrics for X1600 Socket Wi-Fi networks.

Historical Wi-Fi analytics can help you:

Identify channel utilization trends
Understand usage patterns for the 2.4 GHz and 5 GHz bands
Track connected device counts over time
Plan capacity changes for sites with increasing wireless usage

The Network Analytics page shows the following metrics for each band:

Channel Utilization - Shows how much of the available airtime is used on the selected Wi-Fi band over time. Use this metric to identify congestion, interference, or periods when the band is heavily used
Connected devices - Shows the number of devices connected to the selected Wi-Fi band over time. Use this metric to understand client distribution between bands and identify usage trends for capacity planning

To view historical Wi-Fi analytics:

From the navigation menu, click Network > Sites and select the site.
From the navigation menu, select Monitoring Pages > Network Analytics.
Click the Wi-Fi tab. The page shows Channel Utilization and Connected Devices for the Wi-Fi bands.