Firewalla Access Point 7 Review

I have previously reviewed the Firewalla Gold Plus and thought it was excellent, with it effectively offering enterprise-level security features with a user-friendly interface ideal for home users/prosumers and small businesses.

The Gold Plus is a router only, with no WiFi, but Firewalla have started to release WiFi hardware to complement their firewall routers.

So far, this includes the basic $59 Firewalla Wi-Fi SD, which is a USB dongle that plugs into your Firewalla but is only designed for up to 5 clients and is designed to be used as a temporary backup for your LAN if your AP/WiFi is down.

They then have the recently launched Access Point 7, which I am reviewing today. This is a $400 desktop access point with tri-band WiFi 7 and multi-gig ethernet connectivity, including a 10GbE port.

It is slightly odd for an access point due to its desktop design, furthermore, it uses DC power and not POE, and it can only be used by a Firewalla router.

The reason why you can only use it with Firewalla, is that it is designed to integrate seamlessly with the features of Firewalla and allows you to create zero trust networks, significantly improving the security of your network.

Related Content

• Cheapest WiFi 7 Access Points
• EnGenius ECW520 WiFi 7 Access Point Review
• EnGenius ECW516L Cloud Managed 2x3x3 Lite Indoor Tri-Band WiFi 7 Access Point Review
• Zyxel NWA130BE WiFi 7 Access Point Review vs Unifi U7-Pro
• Ubiquiti Unifi U7 Pro WiFi 7 Access Point Review

Specification/ Features

Hardware and Design

• Two bridged, multi-speed Ethernet ports: one 2.5 Gbit/s RJ45 and one 10 Gbit/s RJ45
• Powered by DC power supply (12 V, approximately 5 A)
• Factory-reset via a bottom-mounted button
• Front-panel LED indicates status (various colours for power-on, pairing, errors)
• Desktop form factor: approximately 138 × 80 × 190 mm, weight ≈ 627 g; enclosure made from polycarbonate
• Internal omni-directional antennas

Wireless Specifications

• Supports Wi-Fi standards from legacy (802.11a/b/g/n/ac) to modern Wi-Fi 6 (802.11ax) and Wi-Fi 7 (802.11be)
• Tri-band radios:
  • 2.4 GHz (2×2 MU-MIMO)
  • 5 GHz (2×2 MU-MIMO)
  • 6 GHz (4×4 MU-MIMO)
• Up to 8 spatial streams, with 320 MHz channel support on 6 GHz
• Maximum theoretical data rates:
  • 2.4 GHz: ~688 Mbps (40 MHz)
  • 5 GHz: ~2.88 Gbps (160 MHz)
  • 6 GHz: ~11.5 Gbps (320 MHz)
• Antenna gains (~dBi): 2.4 GHz ~5.2, 5 GHz ~6.5, 6 GHz ~6.0
• Transmit power: 2.4 GHz ~24 dBm, 5 GHz ~25 dBm, 6 GHz ~22 dBm
• Up to 10 BSSIDs per radio

Network and Security

• VLAN support (IEEE 802.1Q)
• Wireless security: WPA/WPA2/WPA3 and PPSK (Personal Pre-Shared Key) with Mixed Personal mode
• Advanced QoS with per-user rate limiting
• Guest isolation supported
• Capable of handling 300+ concurrent clients

Software Features and Configuration (via Firewalla App)

• Zero Trust & Microsegmentation:
  • VqLAN lets you group users/devices into isolated micro-networks, limiting lateral threat movement
  • Device Isolation blocks communication within a group (e.g., for guest or IoT devices)
• SSID Customisation:
  • Up to 10 SSIDs can be created, each with dedicated settings for network (LAN/VLAN), security mode, frequency bands
  • Ability to assign SSIDs to specific user/groups or VLANs
  • Each SSID can use Mixed Personal (WPA2 for 2.4/5 GHz, WPA3 for 6 GHz), WPA2/WPA3, or WPA3 only
• Personal Key (PPSK):
  • Unique personal keys per user/device on the same SSID, enabling automatic assignment to group or VLAN—even if MAC address randomised
• Mesh Capabilities:
  • AP7 D can mesh with other AP7 units (Desktop or Ceiling) using Ethernet or Wi-Fi backhaul
  • App shows mesh topology and signal-strength visualisation
• Visibility and Monitoring:
  • ‘Local Flows’ reveals device-to-device and local network traffic
  • Devices can be sorted/grouped by signal strength or connected AP
  • Device-level Wi-Fi details include SSID, channel, band, MIMO, Rx/Tx rates
• Wi-Fi Testing:
  • Offers a signal-strength test and full Wi-Fi test (SSID, BSSID, channel, AP, band, signal) to evaluate coverage
• Multi-Link Operation (MLO) (preview):
  • Enables Wi-Fi 7 devices to connect across multiple bands simultaneously, enhancing throughput and reliability
  • Requires WPA3 and specific firmware versions; legacy devices may be incompatible
• Advanced Settings per AP:
  • Manual control over frequency channel and transmit power for each band (default automatic recommended)
  • Adjustable 5 GHz channel width; DFS channels used when on automatic, but can be disabled if interference occurs
  • LED control: turn status LED on/off; “Locate This Access Point” lights LED green for identification
  • IP reservation and local domain hostname settings for each AP
• Global Wi-Fi Settings:
  • Band steering to shift devices between bands during idle
  • Maximise compatibility (default setting) for broader device support
  • Storm control to suppress broadcast/multicast floods
  • Inclusion of DFS channels on 5 GHz (default), with ability to disable
• Convenience Tools:
  • Generate QR codes for SSIDs (primary or microsegment) to simplify guest/device connection
  • View AP topology in-app, with device counts and backhaul paths

Power and Environmental

• Power draw up to ~30 W (Desktop version)
• Operating environment: 0 °C to 40 °C, humidity 5–95 % non-condensing
• Storage: −40 °C to +70 °C

Requirements and Compatibility

• Requires a Firewalla Gold or Purple device running in router mode
• App required (iOS or Android) for setup and management
• Firmware prerequisites for some features (e.g., MLO, Events)

Unboxing / Design

For something classed as an access point, this is an unusual design, with it being a desktop device that requires mains power with a DC barrel port.

However, in the context of home users, this is perhaps a better design, avoiding the need to ceiling mount and run long Ethernet cables to it. The Firewalla lacks POE, so the DC port also reduces the need for additional hardware.

You can, of course, use a normal access point on a desk, but the antennas are not designed for this, whereas the AP7 has 8 antennas that radiate all around the device to provide the best signal possible.

On the rear of the AP7, you have two Ethernet ports, one is 10GbE and the other 2.5GbE. You don’t normally see dual Ethernet ports on access points (the Zyxel NWA130BE had them), but it is something I find very useful in home or small business environments, as it allows you to daisy chain the AP to a switch or a single device.

Beyond that, the AP7 is just a white vertical box with yellow accents on the base and top. It doesn’t look quite as premium as some consumer options, but it is smaller than many premium mesh WiFi systems, and the overall design is unoffensive.

Set Up

I was sent a single AP7, so I set this up wired directly into my Firewalla Gold Plus. With the 10GbE and 2.5GbE ports, you can run a wired backhaul to other AP7s while leaving a spare port to daily chain other devices.

I think the first time I set this up, the Firewalla auto-detected the AP7. I later switched to bridge mode to use in my existing network, and when I switched back, I had to manually add it.

The manual process is simple, with the AP7 switched on and reset, it should have a flashing white LED, and you just need to go to WiFi in the app, select access points, then add. Then follow the basic set up procedure.

It will also work as a wireless mesh system, which I haven’t been able to test. The one issue with this is the triband design, with 2×2 5Ghz band, which means the wireless backhaul will be shared, and there will be significant signal loss. Only premium consumer mesh systems like the Netgear Orbi RBE973 have a dedicated 5GHz 4×4 backhaul.

Firewall Mobile App Settings and Zero Trust Features

The Firewalla mobile app serves as the exclusive configuration interface for the AP7, maintaining consistency with the broader Firewalla ecosystem. The WiFi management section provides comprehensive control over all access point functions.

Network segmentation represents the AP7’s primary differentiator from conventional access points. The VqLAN system allows the creation of isolated micro-networks that prevent lateral movement between devices, even within the same physical location. This proves particularly valuable for IoT device management, where compromised smart home devices cannot access critical network resources.

This works by allowing you to create multiple microsegments/networks per SSID. The SSID stays the same, but each microsegment has its own password, allowing you to use the same SSID for all devices (if you want) but securing it with guest access or separating things like IoT.

SSID management supports up to 10 networks, each configurable with specific security policies, frequency bands, and network assignments. The ability to map SSIDs to VLANs or VqLAN segments enables sophisticated access control without complex switch configuration.

Personal Pre-Shared Key (PPSK) functionality addresses a common enterprise requirement in home environments. Rather than sharing a single WiFi password among all users, each person or device receives unique credentials. This enables individual access tracking and simplified credential revocation without affecting other users.

The monitoring capabilities provide detailed visibility into network traffic patterns. Local flow analysis reveals device-to-device communication, helping identify unusual behaviour or security threats. Device grouping by signal strength or connected access point assists with optimisation and troubleshooting.

WiFi testing tools integrate directly into the app, providing both signal strength assessment and comprehensive connection analysis. This eliminates the need for separate WiFi analyser apps whilst ensuring compatibility with Firewalla’s specific configuration.

Quality of Service controls enable per-user bandwidth limiting, addressing common household bandwidth disputes. Combined with the segmentation features, this allows creation of dedicated networks for different user groups with appropriate performance guarantees.

Performance

In my testing environment, the AP7 delivered performance consistent with its WiFi 7 specifications. The 6GHz band provided excellent throughput when testing with compatible devices, whilst the 2.4GHz and 5GHz bands maintained good coverage throughout my test area.

Real-world performance testing showed download speeds exceeding 1 Gbps on the 6GHz band when positioned within close proximity to the access point. The 5GHz band delivered consistent performance in the 600-800 Mbps range at moderate distances, whilst 2.4GHz provided reliable coverage at extended ranges albeit with expected speed limitations.

The desktop antenna design proved effective for omnidirectional coverage. Unlike ceiling-mounted access points that focus signal patterns downward, the AP7’s radiation pattern provides more even coverage across horizontal planes. This works well in single-story environments or when positioned centrally within multi-story buildings.

Client handling capabilities appeared robust during testing with multiple devices simultaneously connected across different bands. The access point managed transitions between bands smoothly, though the effectiveness of band steering varied depending on client device sophistication.

WiFi 7 features like 320MHz channels on 6GHz functioned as expected when compatible clients were available. However, the limited availability of WiFi 7 client devices means most users won’t immediately benefit from these advanced capabilities.

The integration with Firewalla’s security features proved seamless during testing. Creating segmented networks for different device types worked reliably, with traffic isolation functioning as expected between VLANs and VqLAN segments.

Power consumption remained consistent with the 30W specification during normal operation. The DC power requirement proved manageable in desktop environments where mains power is readily available.

Price and Alternative Options

The Firewalla Access Point 7 has an RRP of $399, and at the time of writing, it was available for $368.78. Shipping is free to the UK, but you will be responsible for any import fees.

At first, I thought that was overpriced, but it probably isn’t if you look at the Unifi range:

At that price, it sits between the Unifi U7 Pro XGS at $299 and the E7 at $499. The U7 Pro XGS features 4×4 for the 5GHz band but 2×2 for the 6GHz, and a single 10GbE port.

The E7 has 4×4 for 6 and 5 GHz, and 2×2 for 2.4GHz, then a 10GbE port and 1 GbE port.

While I would regard the Unifi U7 Pro XGS as better value for money in terms of the hardware itself, I think the Access Point 7 is competitive with hardware, and you get the benefit of seamless integration with the Firewalla ecosystem.

Similar to the Firewalla Gold Plus, it is less appealing for UK buyers, as you will likely get stung with import fees.

Overall

If you are an existing Firewalla user or plan to invest in one of their routers, and you want to prioritise your home network security, then the Firewalla AP7 is an easy recommendation.

While the hardware does have a slight premium to it compared to the likes of Unifi, the seamless integration with the Firewalla system makes up for it.

I have also noticed that quite a few users on the Firewalla subreddit have ditched the U7 Pro in favour of the AP7 and say that it is far better with fewer problems. However, many of the problems of the U7 Pro were related to IoT connectivity, which appears to be resolved now.

For UK buyers, the import duty implications add significant cost that makes the device less attractive compared to locally available alternatives. The lack of official UK distribution channels also creates potential support and warranty complications.

I would recommend the AP7 for existing Firewalla users who prioritise network security and are willing to accept the ecosystem lock-in. The seamless integration and zero trust capabilities provide genuine value for security-conscious users.