---
title: "Configuring and Monitoring Socket Wi-Fi Networks"
slug: "configuring-and-monitoring-socket-wi-fi-networks"
tags: ["Sites"]
updated: 2026-10-19T07:02:08Z
published: 2026-10-19T07:02:08Z
canonical: "knowledge.catonetworks.com/configuring-and-monitoring-socket-wi-fi-networks"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.catonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring and Monitoring Socket Wi-Fi Networks

This article explains how to configure Wi-Fi networks on supported Sockets and review analytics for the networks.

## Overview

The X1600 and X1600 5G Socket models include an optional integrated Wi-Fi capability that lets you deliver secure wireless access directly from the Socket. By combining SD-WAN, security, and enterprise-grade Wi-Fi in a single device, you can reduce hardware footprint at the site, simplify deployment, and centrally enforce consistent network and security policies for both wired and wireless users.

Integrated Wi-Fi extends the Cato SASE platform to the wireless edge. Wireless traffic is inspected by the same security engines as wired traffic, including Firewall, IPS, Anti-Malware, and additional security services enabled in your account. This ensures consistent policy enforcement, full visibility, and simplified segmentation for corporate, guest, and IoT networks without requiring a separate wireless controller or firewall appliance.

Because Wi-Fi is managed directly from the Cato Management Application (CMA), you can configure SSIDs, authentication methods, encryption standards, and network segmentation for multiple sites from a single console. This centralized management model helps you maintain uniform security standards, streamline site rollouts, and reduce operational overhead.

### HA Configurations for Socket Wi-Fi Networks

These are the supported configurations to provide HA including Wi-Fi connectivity:

- 2 X1600 Sockets with integrated Wi-Fi
- 2 X1600 5G Sockets with integrated Wi-Fi

HA is not supported (for either wired or Wi-Fi connectivity) in a site with one X1600 Socket and one X1600 5G Socket. A site with 2 X1600 Sockets (or 2 X1600 5G Sockets), one with integrated Wi-Fi and one without, supports HA for wired connectivity but not for Wi-Fi.

## Configuring Socket Wi-Fi Networks

For sites with connection type X1600 or X1600 Cellular, with Socket models with integrated Wi-Fi, you can configure up to four Wi-Fi networks.

**To configure a Socket Wi-Fi network**

1. From the navigation menu, click **Network > Sites** and select the site.
2. From the navigation menu, select **Site Configuration > Socket**.
3. In the ports table, under **Default Ports**, click one of the Wi-Fi interfaces (labelled WBR1-WBR4). The **Edit SSID** panel opens.

![Wif_Ports_table.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/34310571523101.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)
4. In the **General** section, enter a name for the network and move the toggle to **Enabled**.

![Wifi_Edit_SSID_panel_1.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/34310574042781.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)
5. In the **SSID Setup** section, select whether the SSID name is **Hidden** or **Visible** to users.
6. In the **Network** section:

![Wifi_Edit_SSID_Panel_2.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/34310591760285.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)
  - Enter the **Subnet IP** range for the network.
  - Enter the **Local IP** address for the interface.
  - Under **DHCP**:

The DHCP lease time follows the global account setting for DHCP lease time. For more information on setting account DHCP lease time, see [Configuring DHCP Settings](/v1/docs/configuring-dhcp-settings).
    - Enable or disable DHCP for wireless clients on this SSID.
    - When DHCP is enabled, enter the IP **Range** that defines the pool of addresses assigned to clients.
7. In the **Security** section:

![Wifi_Edit_SSID_Panel_Security.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/34310574082205.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)
  - Select the **Authentication Mode** for the SSID:
    - **PSK** - Users authenticate with a shared password
    - **Open** – Users connect without authentication
  - In **Password**, enter the pre-shared key when PSK is selected.

Click **Generate Strong Password** to automatically create a secure password.
  - Under **Security Protocol**, select the encryption standard.
  - Under **Track**, select **Track authentication events** to generate events for wireless authentication activity.
8. In the **Radio** section, select the **Broadcast Bands** for this SSID. You can enable one or both bands.

### Configuring Wi-Fi Radio Settings

You can configure the radio settings for each Wi-Fi band on the X1600 Socket. This lets you adjust the wireless configuration for the physical environment, client density, and available spectrum at the site.

For each band, you can configure these settings:

- Wi-Fi standard
- Channel width
- Channel
- DFS frequency usage for the 5 GHz band

Wider channels can provide higher throughput, but they can also increase the chance of interference in congested environments. Narrower channels can be useful in high-density areas where many access points or wireless networks are operating nearby.

Dynamic Frequency Selection (DFS) lets the 5 GHz band use additional channels that may have less interference. When DFS is enabled, the Socket only uses supported DFS channels that are valid for the site location.

The available radio settings are based on the site country. The CMA only shows channel and channel-width combinations that are supported for the site location, helping prevent invalid radio configurations.

**Notes:**

- When you move a radio to a DFS channel, the Socket performs a Channel Availability Check (CAC) before using the channel. During this process, Wi-Fi clients on that band may experience a brief interruption.
- Wi-Fi radio settings requires Socket v27 or higher

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/Wi-Fi radio settings.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

**To configure Wi-Fi radio settings:**

1. From the navigation menu, click **Network > Sites** and select the site.
2. From the navigation menu, select **Site Configuration > Socket**.
3. In the **Socket & Wi-Fi Radio Configuration** section, configure the settings for each Wi-Fi band.
  - For the 2.4 GHz band, configure the radio settings.
  - For the 5 GHz band, configure the radio settings and select whether to use DFS frequencies.
4. Click **Save**. The Wi-Fi settings are applied to the Socket.

### Configuring an Internet-Only SSID for Guest Access

You can configure a Wi-Fi SSID as Internet-only to provide guest access from the X1600 Socket. Devices connected to an Internet-only SSID can access the Internet, but can’t access private site resources, LAN networks, or WAN destinations.

This lets you provide guest Wi-Fi without creating separate firewall rules to block access to internal resources. Guest traffic is still sent through the Cato security stack, so security services configured for the account can inspect and enforce policy on the traffic.

Internet-only SSIDs are useful for:

- Guest networks
- Contractor access
- Networks that should be isolated from private resources

**Note:** Internet-Only SSID Configuration for Wi-Fi requires Socket v27 or higher.

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/Wi-fi guest internet only.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

**To configure a Guest Wi-Fi (Internet-only) SSID:**

1. From the navigation menu, click **Network > Sites** and select the site.
2. From the navigation menu, select **Site Configuration > Socket**.
3. In the ports table, under **Default Ports**, click one of the Wi-Fi interfaces (labeled WBR1-WBR4).

The **Edit SSID** panel opens.
4. In the **SSID Setup** section, enable the guest Wi-Fi option.
5. Configure the remaining SSID settings.
6. Click **Apply**.
7. Click **Save**. The Wi-Fi settings are applied to the Socket.

### Configuring RADIUS Authentication for Socket Wi-Fi Networks

You can use your organization's RADIUS servers to authenticate users and devices connecting to Wi-Fi networks on X1600 and X1600 5G Sockets with integrated Wi-Fi. When you select Enterprise authentication for an SSID, the Socket forwards authentication requests to the configured RADIUS server. The server authenticates clients using credentials or certificates, according to its authentication policy.

RADIUS servers are configured at the account level and assigned to individual SSIDs. A server can be located on the site LAN or at another site reached over the WAN. Each SSID configured for Enterprise authentication requires a primary server and can also use a secondary server for redundancy.

**Note:** RADIUS Authentication for Wi-FI requires Socket v27.0.24419 or higher.

#### Configuring RADIUS Servers

Configure RADIUS servers for the account from the Radius Servers page.

**To configure a RADIUS server:**

1. From the navigation menu, click **Network > Radius Servers**.
2. Click **New**.
3. In the **General** section, enter a **Name** for the server.
4. In the **Radius Settings** section, enter the server address in **Radius IP**, the authentication port in **Radius Port**, and the shared secret in **Radius Secret**. The shared secret must match the value configured on the RADIUS server.

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/Radius settings(1).png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

1. (Optional) Select **Enable Accounting** to send accounting records, such as who connected and when, to the server. **Note:** Accounting automatically uses the same IP address as the RADIUS server and port 1813. You cannot configure a separate accounting server address or change the accounting port. Enable accounting on the server and make sure port 1813 is allowed between the Socket and the server.
2. Click **Apply**.
3. (Optional) Repeat this procedure to configure a secondary server.

#### Configuring RADIUS Authentication for an SSID

Use the Socket page to configure the Enterprise authentication mode and assign RADIUS servers to the SSID. The **Security Protocol** setting selects WPA2 or WPA3 encryption for the wireless connection between the client and the Socket.

**To configure RADIUS authentication for an SSID:**

1. From the navigation menu, click **Network > Sites** and select the site.
2. From the navigation menu, select **Site Configuration > Socket**.
3. In the ports table, under **Default Ports**, click a Wi-Fi interface (labeled **WBR1-WBR4**). The **Edit SSID** panel opens.
4. In the **Security** section, set **Authentication Mode** to **Enterprise**.

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/RADIUS authentication mode settings.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

1. Select the **Primary Radius Server**.
2. (Optional) Click **Add Secondary** and select the **Secondary Radius Server**.
3. Under **Security Protocol**, select **WPA2** or **WPA3**.
4. Configure the remaining SSID settings.
5. Click **Apply**.
6. Click **Save**. The Wi-Fi settings are applied to the Socket.

## Monitoring Socket Wi-Fi Networks

You can monitor Socket Wi-Fi networks at the interface, SSID, device, and traffic levels from multiple pages in the CMA. This gives you operational visibility into radio status, connected clients, IP assignment, and throughput per Wi-Fi interface.

### Viewing Socket Wi-Fi Network Status

The Networks page provides an overview of the Socket Wi-Fi networks including configured SSIDs and connected devices.

![Wifi_Networks_page.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/34310582537757.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

These are the fields shown for each interface:

- **Port** - The identifier for the interface
- **SSID** - The configured name of the Wi-Fi network
- **Status** - Shows whether the SSID is enabled on the interface
- **Connected Devices** - the number of devices connected on each band
- **Network Range** - The configured subnet for the SSID
- **Visibility** - Shows whether users can see the SSID name
- **Auth Mode** - Shows whether users authenticate with a password or connect without authentication
- **Bands** - Shows the broadcast bands configured for the SSID

### Viewing Wi-Fi Interface Status

The Snapshot page shows operational status for the Socket Wi-Fi interfaces. In the **Link State** section, the Wi-Fi interfaces are listed as WBR1 – WBR4.

![Wifi_Snapshot_page.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/34310562477853.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

These are the fields shown for each interface:

- **Status** - shows if the link is **Up** or **Down**
- **Media Connected** - Always shows **Yes** for Wi-Fi interfaces as no cable connection is required.
- **Link Speed** - Auto-negotiation, or the maximum speed configured for the link in the Socket WebUI
- **Duplex** - Auto-negotiation, or the duplex configured for the link in the Socket WebUI

### Viewing Connected Wi-Fi Hosts

The Known Hosts page provides device-level visibility for Wi-Fi clients.

![Wifi_Known_Hosts.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/34310562515229.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

These are the fields shown for each host connected to a Wi-Fi network:

- **IP Address**
- **MAC Address**
- **DHCP Range**
- **Network Range**
- **IP Allocation** - Shows how the IP address was allocated to the host:
  - **Dynamic** - hosts with a dynamic IP address allocated by the Cato DHCP server
  - **Reserved** - hosts with a static IP address allocated by the Cato DHCP server
    - Reserved hosts are defined in the Hosts screen for the site (Network > Sites > {site name} > Site Configuration > Static Host Reservations)
  - **N/A** - Hosts that are sending traffic, but the IP address was not allocated by the Cato DHCP server
- **Last Host Activity** - Amount of time that elapsed since this host had network activity
- **Lease Time** - Duration for the DHCP lease

For hosts with **Reserved** IP Allocation, the Lease Time value is **Permanent**.
- **Expires In** - Amount of time remaining for the DHCP lease for this host

For hosts with **Reserved** IP Allocation, the Expires In value is **Never**.
- **Radio** - Shows the broadcast band for the Wi-Fi network the host is connected to
- **SSID**

### Monitoring Wi-Fi Traffic and Throughput

You can analyze Wi-Fi interface traffic from the Network Analytics page **Port Utilization** tab.

![Wifi_Network_Analytics.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/34310571766685.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

In the **Avg. Throughput by Port** widget, select a Wi-Fi interface (for example, WBR1) to view:

- Transmit (Tx) utilization
- Receive (Rx) utilization

This view helps you monitor wireless usage, identify peak utilization periods, and validate throughput on specific Wi-Fi interfaces.

### Viewing Historical Wi-Fi Analytics

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/Wi-Fi Network Analytics.png?sv=2026-02-06&spr=https&st=2026-11-05T14%3A59%3A04Z&se=2026-11-05T15%3A59%3A04Z&sr=c&sp=r&sig=T9XifZiF0rtGHD7cDQ4uvDUFDp1bg8rW1DilBXWuR%2Fo%3D)

You can use the Network Analytics page to view historical Wi-Fi metrics for X1600 Socket Wi-Fi networks.

Historical Wi-Fi analytics can help you:

- Identify channel utilization trends
- Understand usage patterns for the 2.4 GHz and 5 GHz bands
- Track connected device counts over time
- Plan capacity changes for sites with increasing wireless usage

The Network Analytics page shows the following metrics for each band:

- **Channel Utilization** - Shows how much of the available airtime is used on the selected Wi-Fi band over time. Use this metric to identify congestion, interference, or periods when the band is heavily used
- **Connected devices** - Shows the number of devices connected to the selected Wi-Fi band over time. Use this metric to understand client distribution between bands and identify usage trends for capacity planning

**To view historical Wi-Fi analytics:**

1. From the navigation menu, click **Network > Sites** and select the site.
2. From the navigation menu, select **Monitoring Pages > Network Analytics**.
3. Click the **Wi-Fi** tab. The page shows **Channel Utilization** and **Connected Devices** for the Wi-Fi bands.