Fortigate Fortiwifi and Fortiap Configuration Guide 56

FortiOS™ Handbook
FortiWiFi and FortiAP Configuration Guide

VERSION 5.6.4
FORTINET DOCUMENT LIBRARY
http://docs.fortinet.com
FORTINET VIDEO GUIDE
http://video.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
CUSTOMER SERVICE & SUPPORT
https://support.fortinet.com
http://cookbook.fortinet.com/how-to-work-with-fortinet-support/
FORTIGATE COOKBOOK
http://cookbook.fortinet.com
FORTINET TRAINING SERVICES
http://www.fortinet.com/training
FORTIGUARD CENTER
http://www.fortiguard.com
FORTICAST
http://forticast.fortinet.com
END USER LICENSE AGREEMENT

http://www.fortinet.com/doc/legal/EULA.pdf
FORTINET PRIVACY POLICY

https://www.fortinet.com/corporate/about-us/privacy.html
FEEDBACK
Email: [email protected]
April 26, 2018
FortiOS™ Handbook - FortiWiFi and FortiAP Configuration Guide
01-564-126043-20180415
TABLE OF CONTENTS
Change Log 11
Introduction 12
Before you begin 12
How this guide is organized 12
What's new in FortiOS 5.6 14
FortiOS 5.6.4 14
FortiOS 5.6.3 14
Hotspot 2.0 14
Allow admin with write permission to see plain text WiFi password (249787, 434513,
452834, 458211, 458285) 18
WiFi Health Monitor page updates (392574, 392585, 404341, 417039, 434141,
440709) 18
FortiAP LED Schedules (436227) 18
Sharing Tunnel SSIDs within a single managed AP between VDOMs as a Virtual AP
for multi-tenancy (439751) 18
30D/30E models support two normal-mode FAPs (446122) 18
MAC Bypass for Captive Portal (448296) 19
WiFi Health Monitor fixes (449341) 19
Various bug fixes (452975, 455218, 453161, 405117, 453533, 453535, 184384) 19
Configure how a FortiWiFi WiFi interface in client mode selects a WiFi band (455305) 19
FortiOS 5.6.1 20
Support for various FortiAP models (416177) (435638) (424483) 20
New Managed AP Groups and Dynamic VLAN Assignment (436267) 20
GUI support for configuring multiple pre-shared keys for SSID interfaces (406321) 20
FortiAP Bluetooth Low Energy (BLE) Scan (438274) 21
WiFi client monitor page search enhanced (440709) 22
FortiOS 5.6.0 22
Captive Portal Authentication with FortiAP in Bridge Mode (408915) 22
802.11kv(r) support (405498, 395037) 22
External Captive Portal authentication with FortiAP in Bridge Mode (403115, 384872) 22
Japan DFS support for FAP-421E/423E/S421E/S423E (402287, 401434) 23
802.3az support on WAVE2 WiFi APs (400558) 23
CLI command update made in wids-profile (400263) 23
Channel utilization, FortiPresence support on AP mode, QoS enhancement for voice
(399134, 377562) 23
FAP-U421E and FAP-U423E support (397900) 24
Minor reorganization of WiFi GUI entries (396497) 25
Multiple PSK support for WPA personal (393320, 264744) 25
Table size of qos-profile has VDOM limit (388070) 25
Add "dhcp-lease-time" setting to local-standalone-nat VAP (384229) 26
New CLI command to configure LDPC for FortiAP (383864) 26
New region code/SKU for Indonesia (382926) 26
FortiAP RMA support added (381936) 26
Support fixed-length 64-hex digit for WPA-Personal passphrase (381030) 26
Allow FortiGates to manage cloud-based FortiAPs (380150) 27
Use IPsec instead of DTLS to protect CAPWAP tunnels (379502) 27
New option added to support only one IP per one endpoint association (378207) 27
FAP-222C-K DFS support (377795) 27
Dynamic VLAN support in standalone mode (377298) 28
CLI-only features added to GUI (376891) 28
Managed AP GUI update (375376) 28
Bonjour gateway support (373659) 28
FAP421E/423E wave2 support (371374) 28
WiFi Health Monitor GUI changes (308317) 29
AP Profile GUI page updates (298266) 29
1+1 Wireless Controller HA (294656) 29
Support for duplicate SSID names on tunnel and bridge mode interfaces (278955) 30
Controlled failover between wireless controllers (249515) 30
Introduction to wireless networking 31
Wireless concepts 31
Bands and channels 31
Power 32
Antennas 32
Security 32
Whether to broadcast SSID 32
Encryption 32
Separate access for employees and guests 33
Captive portal 33
Power 33
Monitoring for rogue APs 33
Authentication 34
Wireless networking equipment 35
FortiWiFi units 35
FortiAP units 35
Automatic Radio Resource Provisioning 35
Setting ARRP timing 36
Captive portals 37
Introduction to Captive portals 37
Configuring a captive portal 37
Exemption from the captive portal 39
MAC Bypass for Captive Portal 39
Customizing captive portal pages 39
Changing images in portal messages 43
Modifying text in portal messages 43
Configuring disclaimer page for ethernet interface captive portals 44
Roaming support 44
Configuration example - Captive portal WiFi access control 44
1. Enabling HTTPS authentication 45
2. Creating the user 45
3. Creating the user group 45
4. Creating the SSID 45
5. Creating the security policy 45
6. Connecting and authorizing the FortiAP 46
7. Results 46
Configuring a WiFi LAN 47
Overview of WiFi controller configuration 47
About SSIDs on FortiWiFi units 49
Process to create a wireless network 49
Setting your geographic location 49
View all Country & Regcodes/Regulatory Domains 50
Creating a FortiAP Profile 50
Defining a wireless network interface (SSID) 52
Configuring DHCP for WiFi clients 55
Configuring security 56
Adding a MAC filter 58
Limiting the number of clients 59
Multicast enhancement 60
Configuring WiFi captive portal security - FortiGate captive portal 60
Configuring WiFi captive portal security - external server 61
Defining SSID Groups 62
Dynamic user VLAN assignment 62
VLAN assignment by RADIUS 62
VLAN assignment by VLAN pool 64
Configuring user authentication 65
WPA2 Enterprise authentication 66
WiFi Single Sign-On (WSSO) authentication 67
Assigning WiFi users to VLANs dynamically 67
MAC-based authentication 67
Authenticating guest WiFi users 68
Configuring firewall policies for the SSID 68
Configuring the built-in access point on a FortiWiFi unit 69
Access point deployment 71
Overview 71
Network topology for managed APs 71
Discovering and authorizing APs 74
Configuring the network interface for the AP unit 75
Pre-authorizing a FortiAP unit 75
Enabling and configuring a discovered AP 76
Disable automatic discovery of unknown FortiAPs 77
Automatic authorization of extension devices 77
Assigning the same profile to multiple FortiAP units 77
Overriding the FortiAP Profile 77
Accessing the FortiAP CLI through the FortiGate unit 78
Connecting to the FortiAP CLI 78
Checking and updating FortiAP unit firmware 79
Advanced WiFi controller discovery 81
Controller discovery methods 81
Wireless client load balancing for high-density deployments 83
Access point hand-off 83
Frequency hand-off or band-steering 83
Configuration 83
FortiAP Groups 84
LAN port options 84
Bridging a LAN port with an SSID 85
Bridging a LAN port with the WAN port 85
Configuring FortiAP LAN ports 86
Preventing IP fragmentation of packets in CAPWAP tunnels 87
Overriding IP fragmentation settings on a FortiAP 88
LED options 88
CAPWAP bandwidth formula 89
Enabling LLDP protocol 91
Wireless Mesh 92
Overview of Wireless Mesh 92
Wireless mesh deployment modes 93
Firmware requirements 93
Types of wireless mesh 93
Fast-roaming for mesh backhaul link 96
Configuring a meshed WiFi network 96
Creating the mesh root SSID 96
Creating the FortiAP profile 96
Configuring the mesh root FortiAP 96
Configuring the leaf mesh FortiAPs 97
Authorizing leaf APs 98
Creating security policies 99
Viewing the status of the mesh network 99
Configuring a point-to-point bridge 99
Hotspot 2.0 101
Combining WiFi and wired networks with a software switch 105
Combining WiFi and wired networks with a software switch 105
VLAN configuration 107
Additional configuration 107
FortiAP local bridging (Private Cloud-Managed AP) 107
Continued FortiAP operation when WiFi controller connection is down 110
Using bridged FortiAPs to increase scalability 110
Using Remote WLAN FortiAPs 112
Split tunneling 112
Configuring the FortiGate for remote FortiAPs 112
Override Split Tunneling 112
Creating FortiAP profiles 112
Configuring split tunneling - FortiGate GUI 113
Configuring split tunneling - FortiGate CLI 113
Overriding the split tunneling settings on a FortiAP 113
Configuring the FortiAP units 114
Preauthorizing FortiAP units 114
Features for high-density deployments 115
Power save feature 115
Broadcast packet suppression 116
Multicast to unicast conversion 116
Ignore weak or distant clients 117
Turn off 802.11b protocol 117
Disable low data rates 117
Limit power 118
Use frequency band load-balancing 118
Setting the handoff RSSI threshold 118
AP load balancing 119
Setting the AP load balance threshold 119
Application rate-limiting 119
AP Group management and dynamic VLAN assignment 120
Sharing Tunnel SSIDs within a single managed AP between VDOMs as a Virtual AP for
multi-tenancy 120
FortiAP LED Blinking 120
Wireless controller optimization for large deployment - AP image upgrade 121
Protecting the WiFi Network 122
Wireless IDS 122
Rogue AP detection 123
WIDS client deauthentication rate for DoS attacks 123
WiFi data channel encryption 123
Configuring encryption on the FortiGate unit 123
Configuring encryption on the FortiAP unit 124
Protected Management Frames and Opportunisitc Key Caching support 124
Bluetooth Low Energy (BLE) Scan 125
Wireless network monitoring 126
Monitoring wireless clients 126
Monitoring rogue APs 126
On-wire rogue AP detection technique 127
Rogue AP scanning as a background activity 127
Configuring rogue scanning 128
Using the Rogue AP Monitor 130
Suppressing rogue APs 131
Monitoring wireless network health 131
Configuring wireless network clients 133
Windows XP client 133
Windows 7 client 138
Mac OS client 142
Linux client 144
Troubleshooting 146
Checking that client received IP address and DNS server information 146
Wireless network examples 149
Basic wireless network 149
Configuring authentication for wireless users 149
Configuring the SSID 150
Adding the SSID to the FortiAP Profile 151
Configuring security policies 151
Connecting the FortiAP units 152
A more complex example 154
Scenario 154
Configuration 154
Configuring authentication for employee wireless users 154
Configuring authentication for guest wireless users 155
Configuring the SSIDs 157
Configuring the FortiAP profile 159
Configuring firewall policies 160
Connecting the FortiAP units 162
Managing a FortiAP with FortiCloud 164
FortiCloud-managed FortiAP WiFi 164
Adding your FortiAP to FortiCloud 164
Configuring the SSID 164
Configuring the AP platform profile 165
Deploying the AP with the platform profile 165
FortiCloud-managed FortiAP WiFi without a key 165
Configuring the FortiAP unit 166
Adding the FortiAP unit to your FortiCloud account 166
Using a FortiWiFi unit as a client 167
Use of client mode 167
Configuring client mode 169
Controlled AP selection support in FWF client mode 170
Support for location-based services 171
Overview 171
Configuring location tracking 171
Automatic deletion of outdated presence data 171
FortiPresence push REST API 172
Viewing device location data on the FortiGate unit 172
Troubleshooting 174
FortiAP shell command through CAPWAP control tunnel 174
Signal strength issues 175
Asymmetric power issue 175
Frequency interference 177
Throughput issues 178
Testing the link 178
Performance testing 179
Preventing IP fragmentation in CAPWAP 180
Slowness in the DTLS response 180
Connection issues 180
Client connection issues 180
FortiAP connection issues 182
General problems 185
Best practices for Layer 1 186
Best practices for Layer 2 186
Best practices for Layer 3 and above 187
Packet sniffer 188
CAPWAP packet sniffer 188
Wireless traffic packet sniffer 189
Useful debugging commands 191
Sample outputs 192
Reference 193
FortiAP web-based manager 194
System Information 194
Wireless Information 195
Wireless radio channels 196
IEEE 802.11a/n channels 196
View all Country & Regcodes/Regulatory Domains 197
WiFi event types 198
FortiAP CLI 198
Change Log
Change Log
Date Change Description
April 26, 2018 Initial FortiOS 5.6.4 release.
FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4 11

Fortinet Technologies Inc.
Introduction
Welcome and thank you for selecting Fortinet products for your network protection. This document describes how
to configure wireless networks with FortiWiFi, FortiGate, and FortiAP units.
This chapter contains the following topics:
l Before you begin

l How this guide is organized
Before you begin
Before you begin using this guide, please ensure that:
l You have administrative access to the web-based manager and/or CLI.

l The FortiGate unit is integrated into your network.
l The operation mode has been configured.
l The system time, DNS settings, administrator password, and network interfaces have been configured.
l Firmware, FortiGuard Antivirus and FortiGuard Antispam updates are completed.
l FortiGuard Analysis & Management Service is properly configured.
While using the instructions in this guide, note that administrators are assumed to be super_admin administrators
unless otherwise specified. Some restrictions will apply to other administrators.
How this guide is organized
This FortiOS Handbook chapter contains the following sections:
Introduction to wireless networking explains the basic concepts of wireless networking and how to plan your
wireless network.
Configuring a WiFi LAN explains how to set up a basic wireless network, prior to deploying access point hardware.
Access point deployment explains how to deploy access point hardware and add it to your wireless network
configuration.
Wireless Mesh explains how to configure a Wi-Fi network where access points are connected to the Wi-Fi
controller wirelessly instead of by Ethernet.
Combining WiFi and wired networks with a software switch shows how to use the FortiAP Wi-Fi-Ethernet bridge
feature.
Protecting the WiFi Network explains the Wireless Intrusion Detection System (WIDS).
Wireless network monitoring explains how to monitor your wireless clients and how to monitor other wireless
access points, potentially rogues, in your coverage area.
12 FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4

Introduction How this guide is organized
Configuring wireless network clients explains how to configure typical wireless clients to work with a WPA-
Enterprise protected network.
Wireless network examples provides two examples. The first is a simple Wi-Fi network using automatic
configuration. The second is a more complex example of a business with two Wi-Fi networks, one for employees
and another for guests or customers.
Using a FortiWiFi unit as a client explains how to use a FortiWiFi unit as a wireless client to connect to other Wi-Fi
networks. This connection can take the place of an Ethernet connection where wired access to a network or to the
Internet is not available.
Support for location-based services explains how Fortinet supports location-based services that collect
information about devices near FortiGate-managed access points, even if the devices don’t associate with the
network.
Reference provides information about Wi-Fi radio channels.

What's new in FortiOS 5.6
This chapter describes new wireless features added to FortiOS 5.6.
FortiOS 5.6.4
These features first appeared in FortiOS 5.6.4.
l "FortiAP LED Blinking" on page 120

l "Wireless controller optimization for large deployment - AP image upgrade" on page 121
FortiOS 5.6.3
Hotspot 2.0
Multiple new CLI commands have been added, under config wireless-controller, to configure Hotspot
2.0 Access Network Query Protocol (ANQP), a query and response protocol that defines seamless roaming
services offered by an AP.
Syntax
config wireless-controller hotspot20 anqp-3gpp-cellular
edit {name}
config mcc-mnc-list
edit {id}
set id {integer}
set mcc {string}
set mnc {string}
next
next
end
config wireless-controller hotspot20 anqp-ip-address-type

edit {name}
set ipv6-address-type {option}
next
end
config wireless-controller hotspot20 anqp-nai-realm

edit {name}
config nai-list
edit {name}
set encoding {enable | disable}
set nai-realm {string}
config eap-method

What's new in FortiOS 5.6 FortiOS 5.6.3
edit {index}
set index {integer}
set method {option}
config auth-param
edit {index}
set index {integer}
set id {option}
set val {option}
next
next
next
next
end
config wireless-controller hotspot20 anqp-network-auth-type

edit {name}
set auth-type {option}
set url {string}
next
end
config wireless-controller hotspot20 anqp-roaming-consortium

edit {name}
config oi-list
edit {index}
set index {integer}
set oi {string}
set comment {string}
next
next
end
config wireless-controller hotspot20 anqp-venue-name

edit {name}
config value-list
edit {index}
set index {integer}
set lang {string}
set value {string}
next
next
end
config wireless-controller hotspot20 h2qp-conn-capability

edit {name}
set icmp-port {option}
set ftp-port {option}
set ssh-port {option}
set http-port {option}
set tls-port {option}
set pptp-vpn-port {option}
set voip-tcp-port {option}
set voip-udp-port {option}
set ikev2-port {option}
set ikev2-xx-port {option}
set esp-port {option}
next

FortiOS 5.6.3 What's new in FortiOS 5.6
end
config wireless-controller hotspot20 h2qp-operator-name

edit {name}
config value-list
edit {index}
set index {integer}
set lang {string}
set value {string}
next
next
end
config wireless-controller hotspot20 h2qp-osu-provider

edit {name}
config friendly-name
edit {index}
set index {integer}
set lang {string}
set friendly-name {string}
next
set server-uri {string}
set osu-method {option}
set osu-nai {string}
config service-description
edit {service-id}
set service-id {integer}
set lang {string}
set service-description {string}
next
set icon {string}
next
end
config wireless-controller hotspot20 h2qp-wan-metric

edit {name}
set link-status {option}
set symmetric-wan-link {option}
set link-at-capacity {enable | disable}
set uplink-speed {integer}
set downlink-speed {integer}
set uplink-load {integer}
set downlink-load {integer}
set load-measurement-duration {integer}
next
end
config wireless-controller hotspot20 hs-profile

edit {name}
set access-network-type {option}
set access-network-internet {enable | disable}
set access-network-asra {enable | disable}
set access-network-esr {enable | disable}
set access-network-uesa {enable | disable}
set venue-group {option}
set venue-type {option}
set hessid {mac address}

set proxy-arp {enable | disable}

set l2tif {enable | disable}
set pame-bi {enable | disable}
set anqp-domain-id {integer}
set domain-name {string}
set osu-ssid {string}
set gas-comeback-delay {integer}
set gas-fragmentation-limit {integer}
set dgaf {enable | disable}
set deauth-request-timeout {integer}
set wnm-sleep-mode {enable | disable}
set bss-transition {enable | disable}
set venue-name {string}
set roaming-consortium {string}
set oper-friendly-name {string}
config osu-provider
edit {name}
next
set wan-metrics {string}
set network-auth {string}
set 3gpp-plmn {string}
set conn-cap {string}
set qos-map {string}
set ip-addr-type {string}
next
end
config wireless-controller hotspot20 icon

edit {name}
config icon-list
edit {name}
set lang {string}
set file {string}
set type {option}
set width {integer}
set height {integer}
next
next
end
config wireless-controller hotspot20 qos-map

edit {name}
config dscp-except
edit {index}
set index
set dscp
set up
next
config dscp-range
edit {index}
set index
set up
set low
set high
next
next

end
Allow admin with write permission to see plain text WiFi password (249787, 434513,
452834, 458211, 458285)
Add support for admins with write permission to read plain text password. Admins can view these plain text
passwords (captive-portal-radius-secret and passphrase) under config wireless-
controller vap. Note that security must be set as a WPA-personal setting.
WiFi Health Monitor page updates (392574, 392585, 404341, 417039, 434141, 440709)
The WiFi Health Monitor page list of active clients now shows their MAC address entries (similar to the WiFi
Client Monitor page), making client information easier to view when opening the Active Client widget.
FortiAP LED Schedules (436227)

Support has been added for WTP profile LED schedules.
Use the command below (led-schedule) to assign recurring firewall schedules for illuminating LEDs on the
FortiAP. This entry is only available when led-state is enabled, at which point LEDs will be visible when at
least one of the schedules is valid.
Separate multiple schedule names with a space, as configured under config firewall schedule group
and config firewall schedule recurring.
Syntax
config wireless-controller wtp-profile
edit {name}
set led-state {enable | disable}
set led-schedules <name>
next
end
Sharing Tunnel SSIDs within a single managed AP between VDOMs as a Virtual AP for
multi-tenancy (439751)
Support has been added for the ability to move a tunnel mode VAP into a VDOM, similar to an interface/VLAN in
VDOMs.
FortiAP is registered into the root VDOM. Within a customer VDOM, customer VAPs can be created/added. In the
root VDOM, the customer VAP can be added to the registered FortiAP. Any necessary firewall rules and
interfaces can be configured between the two VDOMs.
Syntax
config wireless-controller global
set wtp-share {enable | disable}
end
30D/30E models support two normal-mode FAPs (446122)

Fixed an issue that blocked FortiGate 30D and 30E models from supporting two normal-mode FortiAPs.

MAC Bypass for Captive Portal (448296)

Support has been added to provide a MAC address bypass for authenticated clients. Previously, when clients
were authenticated with bridged SSID and their MAC addresses were known, they were not redirected to the
External Captive Portal.
A new portal type has been added, under config wireless-controller vap, to provide successful MAC
authentication Captive Portal functionality.
Syntax
config wireless-controller vap
edit {name}
set portal-type {cmcc-macauth}
next
end
WiFi Health Monitor fixes (449341)

An issue has been addressed where the Client Count widget (under WiFi Health Monitor) showed wrong
options for the timeline selection.
The fixes include:
l Fixed timeline selection options to correct values.

l Updated time filter parameters with correct arguments in the Login Failures widget.
l Added local radio to AP Status widget details.
l Fixed Login Failures widget, where the SSID name was improperly formatted if it contained HTML characters.
Various bug fixes (452975, 455218, 453161, 405117, 453533, 453535, 184384)
Various fixes have been implemented to address a variety of issues:
The fixes include:
l Removed code to avoid repeated printing "parse dhcp options" after upgrade or reboot.
l Removed code that supported FAP-C221E, C226E, and C21D, as their product names changed.
l Changed the text for incorrect WiFi CLI help descriptions.
l Fixed background scan settings for FAP 222C, 223C, 321C, C220C, C225C, C23JD, and C24JE.
l Set WTP entry with "discovered" state to built-in in order to skip them, as only managed FAPs can be counted
toward FAP capacity.
Configure how a FortiWiFi WiFi interface in client mode selects a WiFi band (455305)
For an FortiWiFi WiFi interface operating in client mode, you can use the following option to configure the WiFi
band that the interface can connect to. You can configure the interface to connect to any band, just to the 5G
band or to prefer connecting to the 5G band.
Syntax
config system interface
edit {name}

set wifi-ap-band {any | 5g-preferred | 5g-only}

next
end
FortiOS 5.6.1
Support for various FortiAP models (416177) (435638) (424483)

FortiAP units FAP-U321EV, FAP-U323EV, FAP-S221E, FAP-S223E, FAP-222E, FAP-221E, and FAP-223E are
supported by FortiOS 5.6.1.
As part of this support, new CLI attributes have been added under config wireless-controller wtp-
profile to manage their profiles.
CLI syntax
edit <model>
config platform
set type <model>
end
set ap-country <code>
config radio-1
set band 802.11n
end
config radio-2
set band 802.11ac
end
next
end
New Managed AP Groups and Dynamic VLAN Assignment (436267)

The FortiGate can create FortiAP Groups, under WiFi & Switch Controller > Managed Devices > Managed
FortiAPs by selecting Create New > Managed AP Group, where multiple APs can be managed. AP grouping
allows specific profile settings to be applied to many APs all at once that belong to a certain AP group, simplifying
the administrative workload.
Note that each AP can only belong to one group.
In addition, VLANs can be assigned dynamically based on the group which an AP belongs. When defining an
SSID, under WiFi & Switch Controller > SSID , a setting called VLAN Pooling can be enabled where you
can either assign the VLAN ID of the AP group the device is connected to, to each device as it is detected, or to
always assign the same VLAN ID to a specific device. Dynamic VLAN assignment allows the same SSID to be
deployed to many APs, avoiding the need to produce multiple SSIDs.
GUI support for configuring multiple pre-shared keys for SSID interfaces (406321)
Multiple pre-shared keys can be created per SSID. When creating a new SSID, enable Multiple Pre-shared
Keys under WiFi Settings.

FortiAP Bluetooth Low Energy (BLE) Scan (438274)

The FortiGate can configure FortiAP Bluetooth Low Energy (BLE) scan, incorporating Google's BLE beacon
profile known as Eddystone, used to identify groups of devices and individual devices.
Currently, only the FAP-S221E, FAP-S223E, and FAP-222E models support this
feature.
As part of this support, new CLI attributes have been added under config wireless-controller
timers and config wireless-controller wtp-profile, including a new CLI command, config
wireless-controller ble-profile.
CLI syntax - Configure BLE profiles

config wireless-controller ble-profile
edit <name>
set comment <comment>
set advertising {ibeacon | eddystone-uid | eddystone-url}
set ibeacon-uuid <uuid>
set major-id <0 - 65535> - (default = 1000)
set minor-id <0 - 65535> - (default = 1000)
set eddystone-namespace <10-byte namespace>
set eddystone-instance <device id>
set eddystone-url <url>
set txpower <0 - 12> - (default = 0)
set beacon-interval <40 - 3500> - (default = 100)
set ble-scanning {enable | disable} - (default = disable)
next
end
Note that txpower determines the transmit power level on a scale of 0-12:
0: -21 dBm 1: -18 dBm 2: -15 dBm 3: -12 dBm 4: -9 dBm
5: -6 dBm 6: -3 dBm 7: 0 dBm 8: 1 dBm 9: 2 dBm
10: 3 dBm 11: 4 dBm 12: 5 dBm
CLI syntax - Configure BLE report intervals

config wireless-controller timers
set ble-scan-report-intv - (default = 30 sec)
end
CLI syntax - Assign BLE profiles to WTP profiles

edit <name>
set ble-profile <name>
next
end

WiFi client monitor page search enhanced (440709)

WiFi Cient Monitor page (Monitor > WiFi Client Monitor) now supports search function.
FortiOS 5.6.0
Captive Portal Authentication with FortiAP in Bridge Mode (408915)

The FortiGate can operate as a web captive portal server to serve the captive portal local bridge mode.
A new CLI command has been added under config wireless-controller vap to set the captive portal
type to CMCC, a wireless cipher.
CLI syntax
edit <name>
set portal-type { ... | cmcc}
next
end
802.11kv(r) support (405498, 395037)

New CLI commands have been added under config wireless-controller vap to set various 802.11kvr
settings, or Voice Enterprise (802.11kv) and Fast Basic Service Set (BSS) Transition (802.11r), to provide faster
and more intelligent roaming for the client.
CLI syntax
edit <name>
set voice-enterprise {enable | disable}
set fast-bss-transition {enable | disable}
set ft-mobility-domain
set ft-r0-key-lifetime [1-65535]
set ft-over-ds {enable | disable}
next
end
External Captive Portal authentication with FortiAP in Bridge Mode (403115, 384872)
New CLI commands have been added under config wireless-controller vap to set various options
for external captive portal with FortiAP in Bridge Mode. The commands set the standalone captive portal server
category, the server's domain name or IP address, secret key to access the RADIUS server, and the standalone
captive portal Access Controller (AC) name.
Note that these commands are only available when local-standalone is set to enable and security is set to
captive-portal.

CLI syntax
edit <name>
set captive-portal-category {FortiCloud | CMCC} Default is FortiCloud.
set captive-portal-radius-server <server>
set captive-portal-radius-secret <password>
set captive-portal-ac-name <name>
next
end
Japan DFS support for FAP-421E/423E/S421E/S423E (402287, 401434)

Korea and Japan Dynamic Frequency Selection (DFS) certification has been added for FAP-
421E/423E/S421E/S423E. DFS is a mechanism that allows WLANs to select a frequency that does not interfere
with certain radar systems while operating in the 5 GHz band.
802.3az support on WAVE2 WiFi APs (400558)

A new CLI command has been added under config wireless-controller wtp-profile to enable or
disable use of Energy-Efficient Ethernet (EEE) on WTP, allowing for less power consumption during periods of
low data activity.
CLI syntax
edit <profile-name>
set energy-efficient-ethernet {enable|disable}
end
CLI command update made in wids-profile (400263)

The CLI command rogue-scan under config wireless-controller wids-profile has been
changed to sensor-mode and allows easier configuration of radio sensor mode. Note that while foreign
enables radio sensor mode on foreign channels only, both enables the feature on foreign and home channels.
CLI syntax
config wireless-controller wids-profile
edit <example>
set sensor-mode {disable|foreign|both}
end
Channel utilization, FortiPresence support on AP mode, QoS enhancement for voice

(399134, 377562)
A new CLI command has been added, config wireless-controller qos-profile, to configure
quality of service (QoS) profiles where you can add WiFi multi-media (WMM) control and Differentiated Services
Code Point (DSCP) mapping.
Note that:

l call-capacity and bandwidth-admission-control are only available when call-admission-

control is set to enable.
l bandwidth-capacity is only available when bandwidth-admission-control is set to enable.
l All DSCP mapping options are only available when dscp-wmm-mapping is set to enable.
l wmm is already set to enable by default. If wmm is set to disable, the following entries are not available: wmm-
uapsd, call-admission-control, and dscp-wmm-mapping.
CLI syntax
config wireless-controller qos-profile
edit <example>
set uplink [0-2097152] Default is 0 Kbps.
set downlink [0-2097152] Default is 0 Kbps.
set uplink-sta [0-2097152] Default is 0 Kbps.
set downlink-sta [0-2097152] Default is 0 Kbps.
set burst {enable|disable} Default is disable.
set wmm {enable|disable} Default is enable.
set wmm-uapsd {enable|disable} Default is enable.
set call-admission-control {enable|disable} Default is disable.
set call-capacity [0-60] Default is 10 phones.
set bandwidth-admission-control {enable|disable} Default is disable.
set bandwidth-capacity [1-600000] Default is 2000 Kbps.
set dscp-wmm-mapping {enable|disable} Default is disable.
set dscp-wmm-vo [0-63] Default is 48 56.
set dscp-wmm-vi [0-63] Default is 32 40.
set dscp-wmm-be [0-63] Default is 0 24.
set dscp-wmm-bk [0-63] Default is 8 16.
QoS profiles can be assigned under the config wireless-controller vap command using qos-
profile.
FortiCloud managed APs can now be applied a bandwidth restriction or rate limitation based on SSID. For
instance if guest and employee SSIDs are available, you can rate limit guest access to a certain rate to
accommodate for employees. This feature also applies a rate limit based on the application in use, as APs are
application aware.
FAP-U421E and FAP-U423E support (397900)

Two Universal FortiAP models support FortiOS 5.6. Their default profiles are added under config wireless-
controller wtp-profiles, as shown below:
CLI syntax
edit "FAPU421E-default"
config platform
set type U421E
end
set ap-country US
config radio-1
set band 802.11n
end
config radio-2
set band 802.11ac

end
next
end

edit "FAPU423E-default"
config platform
set type U423E
end
set ap-country US
config radio-1
set band 802.11n
end
config radio-2
set band 802.11ac
end
next
end
Minor reorganization of WiFi GUI entries (396497)

WiFi & Switch Controller GUI entries Managed FortiAPs, SSID, FortiAP Profiles, and WIDS Profiles
have been reorganized.
Multiple PSK support for WPA personal (393320, 264744)

New CLI commands have been added, under config wireless-controller vap, to configure multiple
WiFi Protected Access Pre-Shared Keys (WPA-PSKs), as PSK is more secure without all devices having to share
the same PSK.
Note that, for the following multiple PSK related commands to become available, vdom, ssid, and
passhphrase all have to be set first.
CLI syntax
edit <example>
set mpsk {enable|disable}
set mpsk-concurrent-clients [0-65535] Default is 0.
config mpsk-key
edit key-name <example>
set passphrase <wpa-psk>
set concurrent-clients [0-65535] Default is empty.
set comment <comments>
next
end
end
Use the mpsk-concurrent-clients entry to set the maximum number of concurrent connected clients for
each mpsk entry. Use the mpsk-key configuration method to configure multiple mpsk entries.
Table size of qos-profile has VDOM limit (388070)

The command config wireless-controller qos-profile now has VDOM table limit; there is no
longer an unlimited number of entries within each VDOM.

Add "dhcp-lease-time" setting to local-standalone-nat VAP (384229)

When a Virtual Access Point (VAP) has been configured for a FortiAP, a DHCP server is automatically configured
on the FortiAP side with a hard lease time. A new CLI command under config wireless-controller
vap has been added to customize the DHCP lease time for NAT IP address. This is to solve issues where the
DHCP IP pool was exhausted when the number of clients grew too large for the lease time span.
Note that the new command, dhcp-lease-time, is only available when local-standalone is set to
enable, then setting local-standalone-nat to enable.
CLI syntax
edit <example>
set local-standalone {enable|disable}
set local-standalone-nat {enable|disable}
set dhcp-lease-time [300-8640000] Default is 2400 seconds.
end
New CLI command to configure LDPC for FortiAP (383864)

Previously, LDPC value on FortiAP could only be changed on FortiAP local CLI. Syntax has been added in
FortiOS CLI under the 'wireless-controller.vap' entry to configure the LDPC value on FortiAP.
CLI Syntax
configure wireless-controller vap
edit 1
set ldpc [enable|rx|tx|disable]
end
New region code/SKU for Indonesia (382926)

A new country region code, F, has been added to meet Indonesia's WiFi channel requirements. Indonesia
previously belonged to region code W.
FortiAP RMA support added (381936)

New CLI command fortiap added under exe replace-device to replace an old FortiAP's serial number
with a new one.
CLI Syntax
execute replace-device fortiap <old-fortiap-id> <new-fortiap-id>
Support fixed-length 64-hex digit for WPA-Personal passphrase (381030)

WPA-Personal passphrase now supports a fixed-length of 64 hexadecimal digits.

Allow FortiGates to manage cloud-based FortiAPs (380150)

FortiGates can now manage cloud-based FortiAPs using the new fapc-compatibility command under
wireless-controller setting.
If enabled, default FAP-C wtp-profiles will be added. If disabled, FAP-C related CMDB configurations will be
removed: wtp-group in vap's vlan-pool, wtp-group, ws, wtp, wtp-profile.
CLI syntax
config wireless-controller setting
set country CN
set fapc-compatibility [enable|disable]
end
You will receive an error message when trying to change country while fapc-
compatibility is enabled. You need to disable fapc-compatibility before
changing to an FAPC unsupported country.
Use IPsec instead of DTLS to protect CAPWAP tunnels (379502)

This feature is to utilize FortiAP hardware to improve the throughput of tunneled data traffic by using IPsec when
data security is enabled.
"AES-256-CBC & SHA256" algorithm and "dh_group 15" are used for both CAPWAP IPsec phase1 and phase 2.
FAP320B will not support this feature due to its limited capacity of free flash.
New option added to support only one IP per one endpoint association (378207)
When users change configuration, the radiusd will reset all configurations and refresh all logons in the kernel. All
these actions are done in the one loop. A CLI option has been added to enable/disable replacement of an old IP
address with a new IP address for the same endpoint on RADIUS accounting start.
CLI Syntax
configure user radius
edit radius-root
set rsso-ep-one-ip-only [enable|disable]
next
end
FAP-222C-K DFS support (377795)

Dynamic Frequency Selection (DFS) bands can now be configured for FortiAP 222C-K.
Note that this FortiAP model has the Korean region code (K), but ap-country under config wireless-
controller wtp-profile still needs to be set to KR.
CLI syntax
edit <K-FAP222C>

config platform
set type <222C>
end
set ap-country KR
config radio-2
set band <802.11ac>
set vap-all <disable>
set vaps "vap-vd-07"
set channel "52" "56" "60" "64" "100" "104" "108" "112" "116" "120" "124" "128"
"132" "136" "140"
end
next
end
Dynamic VLAN support in standalone mode (377298)

Dynamic VLAN is now supported in standalone mode. Previously, dynamic VLAN only worked in local bridge
mode.
CLI-only features added to GUI (376891)

Previously CLI-only features have been added to the GUI under FortiAP Profiles, Managed FortiAPs, and
SSID. Also fixed issue where the correct value is displayed when viewing the WIDS Profile notification icon
under FortiAP Profiles.
Managed AP GUI update (375376)

Upgraded Managed FortiAPs dialog page to a newer style, including icons for SSID and LAN port.
Bonjour gateway support (373659)

Bonjour gateway now supported for WiFi networks.
Syntax
config wireless-controller bonjour-profile
edit 0
set comment "comment"
config policy-list
edit 1
set description "description"
set from-vlan [0-4094] Default is 0.
set to-vlan [0-4094|all] Default is all.
set services [all|airplay|afp|bit-
torrent|ftp|ichat|itunes|printers|samba|scanners|ssh|chromecast]
next
end
next
end
FAP421E/423E wave2 support (371374)

Previously removed wave2 FAP421E and FAP423E models have been reinstated and are now supported again.
The models are available again through the CLI and GUI. These models are listed under the Platform dropdown

menu when creating a new FortiAP Profile under WiFi & Switch Controller > FortiAP Profiles.
CLI syntax
edit <example>
config platform
set type <...|421E|423E>
end
end
WiFi Health Monitor GUI changes (308317)

The Wifi Health Monitor page has been improved, including the following changes:
l Flowchart used for diagrams

l Chart used for interference and AP clients
l Removed spectrum analysis
l Added functionality to upgrade FortiAP firmware
l Added option to view both 2.4GHz and 5GHz data simultaneously
AP Profile GUI page updates (298266)

The AP Profile GUI page has been upgraded to a new style including AngularJS code.
1+1 Wireless Controller HA (294656)

Instances of failover between FortiAP units was too long and lead to extended periods of time where WiFi users
were without network connection. Because WiFi is considered a primary network connection in today's verticals
(including enterprise, retail, education, warehousing, healthcare, government, and more), it is necessary for
successful failover to occur as fast as possible.
You can now define the role of the primary and secondary controllers on the FortiAP unit, allowing the unit to
decide the order in which the FortiAP selects the FortiGate. This process was previously decided on load-based
detection, but can now be defined by each unit's pre-determined priority. In addition, heartbeat intervals have
been lowered to further improve FortiAP awareness and successful failover.
Syntax
config wireless-controller inter-controller
set inter-controller-mode {disable | l2-roaming | 1+1} Default is disable.
set inter-controller-key <password>
set inter-controller-pri {primary | secondary} Default is primary.
set fast-failover-max [3-64] Default is 10.
set fast-failover-wait [10-86400] Default is 10.
config inter-controller-peer
edit <name>
set peer-ip <ip-address>
set peer-port [1024-49150] Default is 5246.
set peer-priority {primary | secondary} Default is primary.
next
end
end

Support for duplicate SSID names on tunnel and bridge mode interfaces (278955)
When duplicate-ssid is enabled in the CLI, this feature allows VAPs to use the same SSID name in the
same VDOM. When disabled, all SSIDs in WLAN interface will be checked—if duplicate SSIDs exist, an error
message will be displayed. When duplicate-ssid is enabled in the CLI, duplicate SSID check is removed in
"Edit SSID" GUI page.
Syntax
set duplicate-ssid [enable|disable]
next
end
Controlled failover between wireless controllers (249515)

Instances of failover between FortiAP units was too long and lead to extended periods of time where WiFi users
were without network connection. Because WiFi is considered a primary network connection in today's verticals
(including enterprise, retail, education, warehousing, healthcare, government, and more), it is necessary for
successful failover to occur as fast as possible.
Administrators can now define the role of the primary and secondary controllers on the FortiAP unit, allowing the
unit to decide the order in which the FortiAP selects the FortiGate. This process was decided on load-based
detection, but can now be defined by each unit's pre-determined priority. In addition, heartbeat intervals have
been lowered to further improve FortiAP awareness and successful failover.

Introduction to wireless networking
This chapter introduces some concepts you should understand before working with wireless networks, describes
Fortinet’s wireless equipment, and then describes the factors you need to consider in planning deployment of a
wireless network.
Wireless concepts
Security
Authentication
Wireless networking equipment
Automatic Radio Resource Provisioning
Wireless concepts
Wireless networking is radio technology, subject to the same characteristics and limitations as the familiar audio
and video radio communications. Various techniques are used to modulate the radio signal with a data stream.
Bands and channels

Depending on the wireless protocol selected, you have specific channels available to you, depending on what
region of the world you are in.
l IEEE 802.11b and g protocols provide up to 14 channels in the 2.400-2.500 GHz Industrial, Scientific and Medical
(ISM) band.
l IEEE 802.11a,n (5.150-5.250, 5.250-5.350, 5.725–5.875 GHz, up to 16 channels) in portions of Unlicensed
National Information Infrastructure (U-NII) band
Note that the width of these channels exceeds the spacing between the channels. This means that there is some
overlap, creating the possibility of interference from adjacent channels, although less severe than interference on
the same channel. Truly non-overlapping operation requires the use of every fourth or fifth channel, for example
ISM channels 1, 6 and 11.
The capabilities of your wireless clients is the deciding factor in your choice of wireless protocol. If your clients
support it, 5GHz protocols have some advantages. The 5GHz band is less used than 2.4GHz and its shorter
wavelengths have a shorter range and penetrate obstacles less. All of these factors mean less interference from
other access points, including your own.
When configuring your WAP, be sure to correctly select the Geography setting to ensure that you have access
only to the channels permitted for WiFi use in your part of the world.
For detailed information about the channel assignments for wireless networks for each supported wireless
protocol, see Reference on page 193.

Security Introduction to wireless networking
Power
Wireless LANs operate on frequencies that require no license but are limited by regulations to low power. As with
other unlicensed radio operations, the regulations provide no protection against interference from other users
who are in compliance with the regulations.
Power is often quoted in dBm. This is the power level in decibels compared to one milliwatt. 0dBm is one
milliwatt, 10dBm is 10 milliwatts, 27dBm, the maximum power on Fortinet FortiAP equipment, is 500 milliwatts.
The FortiGate unit limits the actual power available to the maximum permitted in your region as selected by the
WiFi controller country setting.
Received signal strength is almost always quoted in dBm because the received power is very small. The numbers
are negative because they are less than the one milliwatt reference. A received signal strength of -60dBm is one
millionth of a milliwatt or one nanowatt.
Antennas
Transmitted signal strength is a function of transmitter power and antenna gain. Directional antennas
concentrate the signal in one direction, providing a stronger signal in that direction than would an omnidirectional
antenna.
FortiWiFi units have detachable antennas. However, these units receive regulatory approvals based on the
supplied antenna. Changing the antenna might cause your unit to violate radio regulations.
Security
There are several security issues to consider when setting up a wireless network.
Whether to broadcast SSID

It is highly recommended to broadcast the SSID. This makes connection to a wireless network easier because
most wireless client applications present the user with a list of network SSIDs currently being received. This is
desirable for a public network.
Attempting to obscure the presence of a wireless network by not broadcasting the SSID does not improve network
security. The network is still detectable with wireless network “sniffer” software. Clients search for SSIDs that they
know, leaking the SSID. Refer to RFC 3370. Also, many of the latest Broadcom drivers do not support hidden
SSID for WPA2.
Encryption
Wireless networking supports the following security modes for protecting wireless communication, listed in order
of increasing security.
None — Open system. Any wireless user can connect to the wireless network.
WEP64 — 64-bit Web Equivalent Privacy (WEP). This encryption requires a key containing 10 hexadecimal digits.
WEP128 — 128-bit WEP. This encryption requires a key containing 26 hexadecimal digits.

Introduction to wireless networking Security
WPA — 256-bit WiFi Protected Access (WPA) security. This encryption can use either the TKIP or AES encryption
algorithm and requires a key of either 64 hexadecimal digits or a text phrase of 8 to 63 characters. It is also
possible to use a RADIUS server to store a separate key for each user.
WPA2 — WPA with security improvements fully meeting the requirements of the IEEE 802.11i standard.
Configuration requirements are the same as for WPA.
For best security use the WPA2 with AES encryption and a RADIUS server to verify individual credentials for each
user. WEP, while better than no security at all, is an older algorithm that is easily compromised. With either WEP
or WAP, changing encryption passphrases on a regular basis further enhances security.
Separate access for employees and guests

Wireless access for guests or customers should be separate from wireless access for your employees. This does
not require additional hardware. Both FortiWiFi units and FortiAP units support multiple wireless LANs on the
same access point. Each of the two networks can have its own SSID, security settings, firewall policies, and user
authentication.
A good practice is to broadcast the SSID for the guest network to make it easily visible to users, but not to
broadcast the SSID for the employee network.
Two separate wireless networks are possible because multiple virtual APs can be associated with an AP profile.
The same physical APs can provide two or more virtual WLANs.
Captive portal
As part of authenticating your users, you might want them to view a web page containing your acceptable use
policy or other information. This is called a captive portal. No matter what URL the user initially requested, the
portal page is returned. Only after authenticating and agreeing to usage terms can the user access other web
resources.
For more information about captive portals, see the Captive portals chapter of the FortiOS Authentication Guide.
Power
Reducing power reduces unwanted coverage and potential interference to other WLANs. Areas of unwanted
coverage are a potential security risk. There are people who look for wireless networks and attempt to access
them. If your office WLAN is receivable out on the public street, you have created an opportunity for this sort of
activity.
Monitoring for rogue APs

It is likely that there are APs available in your location that are not part of your network. Most of these APs belong
to neighboring businesses or homes. They may cause some interference, but they are not a security threat. There
is a risk that people in your organization could connect unsecured WiFi-equipped devices to your wired network,
inadvertently providing access to unauthorized parties. The optional On-Wire Rogue AP Detection Technique
compares MAC addresses in the traffic of suspected rogues with the MAC addresses on your network. If wireless
traffic to non-Fortinet APs is also seen on the wired network, the AP is a rogue, not an unrelated AP.
Decisions about which APs are rogues are made manually on the Rogue AP monitor page. For detailed
information, see Wireless network monitoring on page 126.

Authentication Introduction to wireless networking
Suppressing rogue APs

When you have declared an AP to be a rogue, you have the option of suppressing it. To suppress and AP, the
FortiGate WiFi controller sends reset packets to the rogue AP. Also, the MAC address of the rogue AP is blocked
in the firewall policy. You select the suppression action on the Rogue AP monitor page. For more information, see
Wireless network monitoring on page 126.
Rogue suppression is available only when there is a radio dedicated to scanning. It will
not function during background scanning for spectrum analysis.
Wireless Intrusion Detection (WIDS)

You can create a WIDS profile to enable several types of intrusion detection:
l Unauthorized Device Detection

l Rogue/Interfering AP Detection
l Ad-hoc Network Detection and Containment
l Wireless Bridge Detection
l Misconfigured AP Detection
l Weak WEP Detection
l Multi Tenancy Protection
l MAC OUI Checking
For more information, see Protecting the WiFi Network on page 122.
Authentication
Wireless networks usually require authenticated access. FortiOS authentication methods apply to wireless
networks the same as they do to wired networks because authentication is applied in the firewall policy.
The types of authentication that you might consider include:
l user accounts stored on the FortiGate unit

l user accounts managed and verified on an external RADIUS, LDAP or TACACS+ server
l Windows Active Directory authentication, in which users logged on to a Windows network are transparently
authenticated to use the wireless network.
This Wireless chapter of the FortiOS Handbook will provide some information about each type of authentication,
but more detailed information is available in the Authentication chapter.
What all of these types of authentication have in common is the use of user groups to specify who is authorized.
For each wireless LAN, you will create a user group and add to it the users who can use the WLAN. In the identity-
based firewall policies that you create for your wireless LAN, you will specify this user group.
Some access points, including FortiWiFi units, support MAC address filtering. You should not rely on this alone
for authentication. MAC addresses can be “sniffed” from wireless traffic and used to impersonate legitimate
clients.

Introduction to wireless networking Wireless networking equipment
Wireless networking equipment
Fortinet produces two types of wireless networking equipment:
l FortiWiFi units, which are FortiGate units with a built-in wireless access point/client
l FortiAP units, which are wireless access points that you can control from any FortiGate unit that supports the WiFi
Controller feature.
FortiWiFi units
A FortiWiFi unit can:
l Provide an access point for clients with wireless network cards. This is called Access Point mode, which is the
default mode.
or
l Connect the FortiWiFi unit to another wireless network. This is called Client mode. A FortiWiFi unit operating in
client mode can only have one wireless interface.
or
l Monitor access points within radio range. This is called Monitoring mode. You can designate the detected access
points as Accepted or Rogue for tracking purposes. No access point or client operation is possible in this mode. But,
you can enable monitoring as a background activity while the unit is in Access Point mode.
The Products section of the Fortinet web site (www.fortinet.com) provides detailed information about the
FortiWiFi models that are currently available.
FortiAP units
FortiAP units are thin wireless access points are controlled by either a FortiGate unit or FortiCloud service.
FortiAP is a family of Indoor, Outdoor and Remote Access Point models supporting the latest single, dual, and
triple stream MIMO 802.11ac and 802.11n technology, as well as 802.11g and 802.11a.
For large deployments, some FortiAP models support a mesh mode of operation in which control and data
backhaul traffic between APs and the controller are carried on a dedicated WiFi network. Users can roam
seamlessly from one AP to another.
In dual-radio models, each radio can function as an AP or as a dedicated monitor. The monitoring function is also
available during AP operation, subject to traffic levels.
The Products section of the Fortinet web site (www.fortinet.com) provides detailed information about the FortiAP
models that are currently available.
Automatic Radio Resource Provisioning
To prevent interference between APs, the FortiOS WiFi Controller includes the Distributed Automatic Radio
Resource Provisioning (DARRP) feature. Through DARRP, each FortiAP unit autonomously and periodically
determines the channel that is best suited for wireless communications. FortiAP units to select their channel so

Automatic Radio Resource Provisioning Introduction to wireless networking
that they do not interfere with each other in large-scale deployments where multiple access points have
overlapping radio ranges.
To enable ARRP - GUI
1. Go to WiFi Controller > FortiAP Profiles and edit the profile for your device.
2. In the Radio sections (Radio 1, Radio 2, etc.), enable Radio Resource Provision.
3. Click OK.
To enable ARRP - CLI
In this example, ARRP is enabled for both radios in the FAP321C-default profile:
edit FAP321C-default
config radio-1
set darrp enable
end
config radio-2
set darrp enable
end
end
Setting ARRP timing

By default, ARRP optimization occurs at a fixed interval of 1800 seconds (30 minutes). You can change this
interval in the CLI. For example, to change the interval to 3600 seconds enter:
set darrp-optimize 3600
end
Optionally, you can schedule optimization for fixed times. This enables you to confine ARRP activity to a low-
traffic period. Setting darrp-optimize to 0, makes darrp-day and darrp-time available. For example,
here's how to set DARRP optimization for 3:00am every day:
set darrp-optimize 0
set darrp-day sunday monday tuesday wednesday thursday friday saturday
set darrp-time 03:00
end
Both darrp-day and darrp-time can accept multiple entries.

Captive portals
A captive portal is a convenient way to authenticate web users on wired or WiFi networks.
This section describes:
l Introduction to Captive portals

l Configuring a captive portal
l Customizing captive portal pages
l Configuration example - Captive portal WiFi access control
Introduction to Captive portals
You can authenticate your users on a web page that requests the user’s name and password. Until the user
authenticates successfully, the authentication page is returned in response to any HTTP request. This is called a
captive portal.
After successful authentication, the user accesses the requested URL and can access other web resources, as
permitted by security policies. Optionally, the captive portal itself can allow web access to only the members of
specified user group.
The captive portal can be hosted on the FortiGate unit or on an external authentication server. You can configure
captive portal authentication on any network interface, including WiFi and VLAN interfaces.
When a captive portal is configured on a WiFi interface, the access point initially appears open. The wireless
client can connect to the access point with no security credentials, but sees only the captive portal authentication
page.
WiFi captive portal types:
l Authentication — until the user enters valid credentials, no communication beyond the AP is permitted.
l Disclaimer + Authentication — immediately after successful authentication, the portal presents the disclaimer
page—an acceptable use policy or other legal statement—to which the user must agree before proceeding.
l Disclaimer Only — the portal presents the disclaimer page—an acceptable use policy or other legal statement—
to which the user must agree before proceeding. The authentication page is not presented.
l Email Collection — the portal presents a page requesting the user’s email address, for the purpose of contacting
the person in future. This is often used by businesses who provide free WiFi access to their customers. The
authentication page is not presented.
l MAC Bypass — when clients are authenticated against their bridged SSID and their MAC addresses are known,
they are redirected to the external captive portal.
Configuring a captive portal
Captive portals are configured on network interfaces. A WiFi interface does not exist until the WiFi SSID is
created. You can configure a WiFi captive portal at the time that you create the SSID. Afterwards, the captive
portal settings will also be available by editing the WiFi network interface in System > Network > Interfaces.

Configuring a captive portal Captive portals
On a physical (wired) network interface, you edit the interface configuration in System > Network > Interfaces
and set Security Mode to Captive Portal.
To configure a WiFi Captive Portal - web-based manager:
1. Go to WiFi Controller > WiFi Network > SSID and create your SSID.
If the SSID already exists, you can edit the SSID or you can edit the WiFi interface in System > Network >
Interfaces.
2. In Security Mode, select Captive Portal.
3. Enter
Portal Type The portal can provide authentication and/or disclaimer, or perform user
email address collection. See Introduction to Captive portals on page 37.
Authentication Portal Local - portal hosted on the FortiGate unit.
Remote - enter FQDN or IP address of external portal.
User Groups Select permitted user groups.
Exempt List Select exempt lists whose members will not be subject to captive portal
authentication.
Customize Portal Messages Click the link of the portal page that you want to modify. See "Captive
portals" on page 39.
4. Select OK.
To configure a wired Captive Portal - web-based manager:
1. Go to System > Network > Interfaces and edit the interface to which the users connect.
2. In Security Mode select Captive Portal.
3. Enter

Captive portals Customizing captive portal pages
Authentication Portal Local - portal hosted on the FortiGate unit.
Remote - enter FQDN or IP address of external portal.
User Groups Select permitted user groups or select Use Groups from Policies, which
permits the groups specified in the security policy.
Use Groups from Policies is not available in WiFi captive portals.
authentication.
Customize Portal Enable, then select Edit. See Customizing captive portal pages on page
Messages 39.
4. Select OK.
Exemption from the captive portal

A captive portal requires all users on the interface to authenticate. But some devices are not able to authenticate.
You can create an exemption list of these devices. For example, a printer might need to access the Internet for
firmware upgrades. Using the CLI, you can create an exemption list to exempt all printers from authentication.
config user security-exempt-list
edit r_exempt
config rule
edit 1
set devices printer
end
end
MAC Bypass for Captive Portal

It is possible to provide a MAC address bypass for authenticated clients.When clients are authenticated with
bridged SSID and their MAC addresses are known, they are redirected to the External Captive Portal.
A new portal type has been added, under config wireless-controller vap, to provide successful MAC
authentication Captive Portal functionality.
Syntax
edit {name}
set portal-type {cmcc-macauth}
next
end
Customizing captive portal pages
These pages are defined in replacement messages. Defaults are provided. In the web-based manager, you can
modify the default messages in the SSID configuration by selecting Customize Portal Messages. Each SSID

Customizing captive portal pages Captive portals
can have its own unique portal content.
The captive portal contains the following default web pages:
l Login page—requests user credentials
Typical modifications for this page would be to change the logo and modify some of the text.
You can change any text that is not part of the HTML code nor a special tag enclosed in double percent (%)
characters.
There is an exception to this rule. The line “Please enter your credentials to continue” is provided by the
%%QUESTION%% tag. You can replace this tag with text of your choice. Except for this item, you should not
remove any tags because they may carry information that the FortiGate unit needs.
l Login failed page—reports that the entered credentials were incorrect and enables the user to try again.

The Login failed page is similar to the Login page. It even contains the same login form. You can change any text
that is not part of the HTML code nor a special tag enclosed in double percent (%) characters.
There is an exception to this rule. The line “Firewall authentication failed. Please try again.” is provided by the
%%FAILED_MESSAGE%% tag. You can replace this tag with text of your choice. Except for this item, you should
not remove any tags because they may carry information that the FortiGate unit needs.
l Disclaimer page—is a statement of the legal responsibilities of the user and the host organization to which the
user must agree before proceeding.(WiFi or SSL VPN only)

Customizing captive portal pages Captive portals
l Declined disclaimer page—is displayed if the user does not agree to the statement on the Disclaimer page.
Access is denied until the user agrees to the disclaimer.

Changing images in portal messages

You can replace the default Fortinet logo with your organization’s logo. First, import the logo file into the
FortiGate unit and then modify the Login page code to reference your file.
To import a logo file:
1. Go to System > Config > Replacement Messages and select Manage Images.

2. Select Create New.
3. Enter a Name for the logo and select the appropriate Content Type.
The file must not exceed 24 Kilo bytes.
4. Select Browse, find your logo file and then select Open.
5. Select OK.
To specify the new logo in the replacement message:
1. Go to System > Network > Interfaces and edit the interface.

The Security Mode must be Captive Portal.
2. Select the portal message to edit.
l In SSL VPN or WiFi interfaces, in Customize Portal Messages click the link to the portal messages that you
want to edit.
l In other interfaces, make sure that Customize Portal Messages is selected, select the adjacent Edit icon,
then select the message that you want to edit.
3. In the HTML message text, find the %%IMAGE tag.
By default it specifies the Fortinet logo: %%IMAGE:logo_fw_auth%%
4. Change the image name to the one you provided for your logo.
The tag should now read, for example, %%IMAGE:mylogo%%
5. Select Save.
6. Select OK.
Modifying text in portal messages

Generally, you can change any text that is not part of the HTML code nor a special tag enclosed in double percent
(%) characters. You should not remove any tags because they may carry information that the FortiGate unit
needs. See the preceding section for any exceptions to this rule for particular pages.
To modify portal page text
1. Go to System > Network > Interfaces and edit the interface.

The SSID Security Mode must be Captive Portal.
2. Select the portal message to edit.
l In SSL VPN or WiFi interfaces, in Customize Portal Messages click the link to the portal messages that you
want to edit.
l In other interfaces, make sure that Customize Portal Messages is selected, select the adjacent Edit icon,
then select the message that you want to edit.
3. Edit the HTML message text, then select Save.
4. Select OK.

Configuration example - Captive portal WiFi access control Captive portals
Configuring disclaimer page for ethernet interface captive portals

While you can customize a disclaimer page for captive portals that connect via WiFi, the same can be done for
wired connections. However, this can only be configured on the CLI Console, and only without configuring user
groups.
When configuring a captive portal through the CLI, you may set security-groups to a specific user group.
The result of this configuration will show an authentication form to users who wish to log in to the captive portal—
not a disclaimer page. If you do not set any security-groups in your configuration, an "Allow all" status will
be in effect, and the disclaimer page will be displayed for users.
The example CLI configuration below shows setting up a captive portal interface without setting security-groups,
resulting in a disclaimer page for users:
edit "port1"
set vdom "root"
set ip 172.16.101.1 255.255.255.0
set allowaccess ping https ssh snmp http
set type physical
set explicit-web-proxy enable
set alias "LAN"
set security-mode captive-portal
set snmp-index 1
next
end
Roaming support
Client devices can maintain captive portal authentication as they roam across different APs. By maintaining a
consistent authentication, uninterrupted access to latency sensitive applications such as VoIP is ensured.
The Cloud will push a random per-AP Network encryption key to the AP. The key is 32 bytes in length, and is used
in captive portal fast roaming. All APs of an AP Network will use the same encryption key. This key is randomly
generated, and will be updated daily.
Configuration example - Captive portal WiFi access control
In this scenario, you will configure the FortiGate for captive portal access so users can log on to your WiFi
network.
You will create a user account (rgreen), add it to a user group (employees), create a captive portal SSID
(example-staff), and configure a FortiAP unit. When the user attempts to browse the Internet, they will be
redirected to the captive portal login page and asked to enter their username and password.

Captive portals Configuration example - Captive portal WiFi access control
1. Enabling HTTPS authentication
Go to User & Device > Authentication Settings.
Under Protocol Support, enable Redirect HTTP Challenge to a Secure Channel (HTTPS). This will
make sure that user credentials are communicated securely through the captive portal.
2. Creating the user
Go to User & Device > User Definition and create a Local user (rgreen).
Create additional users if needed, and assign any authentication methods.
3. Creating the user group
Go to User & Device > User Groups and create a user group (employees).
Add rgreen to the group.
4. Creating the SSID
Go to WiFi & Switch Controller > SSID and configure the wireless network.
Some FortiGate models may show the GUI path as WiFi & Switch Controller.
Enter an Interface Name (example-wifi) and IP/Network Mask.
An address range under DHCP Server will be automatically configured.
Under WiFi Settings, enter an SSID name (example-staff), set Security Mode to Captive Portal, and
add the employees user group.
5. Creating the security policy
Go to Policy & Objects > Addresses and create a new address for the SSID (example-wifi-net).
Set Subnet/IP Range to the same range set on the DHCP server in the previous step.
Set Interface to the SSID interface.
Go to Policy & Objects > IPv4 Policy and create a new policy for WiFi users to connect to the Internet.
Add both the example-wifi-net address and employees user group to Source.

Configuration example - Captive portal WiFi access control Captive portals
6. Connecting and authorizing the FortiAP
Go to Network > Interfaces and edit an available interface.
Under Address, set Addressing mode to Dedicated to Extension Device and assign it an IP address.
Connect the FortiAP unit to the configured interface, then go to WiFi & Switch Controller > Managed
FortiAPs.
The FortiAP is listed, but its State shows a greyed-out question mark — this is because it is waiting for
authorization.
Highlight the FortiAP and select Authorize.
The question mark is now replaced by a red down-arrow — this is because it is authorized, but still offline.
Go to WiFi & Switch Controller > FortiAP Profiles and edit the profile.
For each radio, enable Radio Resource Provision and select your SSID.
Go back to WiFi & Switch Controller > Managed FortiAPs to verify that the FortiAP unit is online.
7. Results
When a user attempts to connect to the wireless network, they will be redirected to the captive portal login
screen.
Members of the employees group must enter their Username and Password. The user will then be
redirected to the URL originally requested.
On the FortiGate, go to Monitor > WiFi Client Monitor to verify that the user is authenticated.

Configuring a WiFi LAN
When working with a FortiGate WiFi controller, you can configure your wireless network before you install any
access points. If you are working with a standalone FortiWiFi unit, the access point hardware is already present
but the configuration is quite similar. Both are covered in this section.
Overview of WiFi controller configuration

Setting your geographic location
Creating a FortiAP Profile
Defining a wireless network interface (SSID)
Defining SSID Groups
Dynamic user VLAN assignment
Configuring user authentication
Configuring firewall policies for the SSID
Configuring the built-in access point on a FortiWiFi unit
On FortiGate model 30D, web-based manager configuration of the WiFi controller is

disabled by default. To enable it, enter the following CLI commands:
config system global

set gui-wireless-controller enable
end
The WiFi Controller and Switch Controller are enabled through the Feature Store
(under System > Feature Select). However, they are separately enabled and
configured to display in the GUI via the CLI.
To enable both WiFi and Switch controllers, enter the following:

set wireless-controller enable
set switch-controller enable
end
To enable the GUI display for both controllers, have also been separated:
config system settings
set gui-wireless-controller enable
set gui-switch-controller enable
end
If you want to connect and authorize external APs, such as FortiAP units, see the next chapter, Access point
deployment.
Overview of WiFi controller configuration
The FortiGate WiFi controller configuration is composed of three types of object, the SSID, the AP Profile and the
physical Access Point.

Overview of WiFi controller configuration Configuring a WiFi LAN
l An SSID defines a virtual wireless network interface, including security settings. One SSID is sufficient for a
wireless network, regardless how many physical access points are provided. You might, however, want to create
multiple SSIDs to provide different services or privileges to different groups of users. Each SSID has separate
firewall policies and authentication. Each radio in an access point can support up to 8 SSIDs.
A more common use of the term SSID is for the identifier that clients must use to connect to the wireless network.
Each SSID (wireless interface) that you configure will have an SSID field for this identifier. In Managed Access
Point configurations you choose wireless networks by SSID values. In firewall policies you choose wireless
interfaces by their SSID name.
l An AP Profile defines the radio settings, such as band (802.11g for example) and channel selection. The
AP Profile names the SSIDs to which it applies. Managed APs can use automatic profile settings or you can create
AP profiles.
l Managed Access Points represent local wireless APs on FortiWiFi units and FortiAP units that the FortiGate unit
has discovered. There is one managed access point definition for each AP device. An access point definition can
use automatic AP profile settings or select a FortiAP Profile. When automatic profile settings are used, the
managed AP definition also selects the SSIDs to be carried on the AP.
Conceptual view of FortiGate WiFi controller configuration

Configuring a WiFi LAN Setting your geographic location
About SSIDs on FortiWiFi units

FortiWiFi units have a default SSID (wireless interface) named wlan. You can modify or delete this SSID as
needed. As with external APs, the built-in wireless AP can be configured to carry any SSID.
The AP settings for the built-in wireless access point are located at WiFi Controller > Local WiFi Radio. The
available operational settings are the same as those for external access points which are configured at
WiFi Controller > Managed FortiAPs.
Process to create a wireless network

To set up your wireless network, you will need to perform the following steps:
l Make sure the FortiGate wireless controller is configured for your geographic location. This ensures that the
available radio channels and radio power are in compliance with the regulations in your region.
l Optionally, if you don’t want to use automatic AP profile settings, configure a FortiAP profile, specifying the radio
settings and the SSIDs to which they apply.
l Configure one or more SSIDs for your wireless network. The SSID configuration includes DHCP and DNS settings.
l Configure the user group and users for authentication on the WLAN.
l Configure the firewall policy for the WLAN.
l Optionally, customize the captive portal.
l Configure access points.
Configuration of the built-in AP on FortiWiFi units is described in this chapter. Connection and configuration of
FortiAP units is described in the next chapter, see Access point deployment on page 71.
Setting your geographic location
The maximum allowed transmitter power and permitted radio channels for WiFi networks depend on the region in
which the network is located. By default, the WiFi controller is configured for the United States. If you are located
in any other region, you need to set your location before you begin configuring wireless networks.
To change the location setting - CLI
To change the country to France, for example, enter

set country FR
end
To see the list of country codes, enter a question mark (‘?’) instead of a country code.
Before changing the country setting, you must remove all FortiAP Profiles. To do this,
go to WiFi & Switch Controller > FortiAP Profiles.

Creating a FortiAP Profile Configuring a WiFi LAN
View all Country & Regcodes/Regulatory Domains

The following CLI command can be entered to view a list of the Country & Regcodes/Regulatory Domains
supported by Fortinet:
cw_diag -c all-countries
Below is a table showing a sample of the list displayed by entering this command:
Country-code Region-code Domain ISO-name Name
0 A FCC3 & FCCA NA NO_COUNTRY_SET
8 W NULL1 & WORLD AL ALBANIA
12 W NULL1 & WORLD DZ ALGERIA
16 A FCC3 & FCCA AS AMERICAN SAMOA
... ... ... ... ...
Creating a FortiAP Profile
A FortiAP Profile defines radio settings for a particular platform (FortiAP model). The profile also selects which
SSIDs (virtual APs) the APs will carry. FortiAP units contain two radio transceivers, making it possible, for
example, to provide both 2.4GHz 802.11b/g/n and 5GHz 802.11a/n service from the same access point. The
radios can also be used for monitoring, used for the Rogue AP detection feature.
You can modify existing FortiAP profiles or create new ones of your own.
On FortiGate model 30D, web-based manager configuration of FortiAP Profiles is

disabled by default. To enable AP profiles, enter the following CLI commands:

set gui-ap-profile enable
end
To configure a FortiAP Profile - web-based manager
1. Go to WiFi & Switch Controller > FortiAP Profiles and select Create New.

2. Enter a Name for the FortiAP Profile.
3. In Platform, select the FortiWiFi or FortiAP model to which this profile applies.
4. If split tunneling is used, in Split Tunneling Subnets, enter a comma-separated list all of the destination IP
address ranges that should not be routed through the the FortiGate WiFi controller.
5. For each radio, enter:

Configuring a WiFi LAN Creating a FortiAP Profile
Mode Select the type of mode.
Disable – radio disabled

Access Point – the platform is an access point
Dedicated Monitor – the platform is a dedicated monitor. See Wireless
network monitoring on page 126.
WIDS Profile Optionally, select a Wireless Intrusion Detection (WIDS) profile. See
Protecting the WiFi Network on page 122.
Radio Resource Select to enable the radio resource provision feature. This feature
Provision measures utilization and interference on the available channels and selects
the clearest channel at each access point. The measurement can be
repeated periodically to respond to changing conditions.
Client Load Select Frequency Handoff or AP Handoff as needed. See Access point

Balancing deployment on page 71.
Band Select the wireless protocols that you want to support. The available
choices depend on the radio’s capabilities. Where multiple protocols are
supported, the letter suffixes are combined: “802.11g/b” means 802.11g
and 802.11b.
Note that on two-radio units such as the FortiAP-221C it is not possible to

put both radios on the same band.
Channel Width Select channel width for 802.11ac or 802.11n on 5GHz.
Short Guard Select to enable the short guard interval for 802.11ac or 802.11n on 5GHz.
Interval
Channels Select the channel or channels to include. The available channels depend
on which IEEE wireless protocol you selected in Band. By default, all
available channels are enabled.
TX Power Enable automatic or manual adjustment of transmit power, specifying

Control either minimum and maximum power levelsin dBm or as a percentage.
TX Power When TX Power Control is set to Auto, the TX Power is set by default
to a range of 10-17 dBm. Set the range between 1-20 for both the lower
and upper limits.
When TX Power Control is set to Manual, the TX Power is set by

default to 100% of the maximum power permitted in your region. To
change the level, drag the slider.
SSIDs Select between Auto or Manual. Selecting Auto eliminates the need to
re-edit the profile when new SSIDs are created. However, you can still
select SSIDs individually using Manual.
Note that automatic assignment of SSIDs (Auto) is not available for

FortiAPs in Local Bridge mode. The option is hidden on both the
Managed FortiAP settings and the FortiAP Profile assigned to that AP.

Defining a wireless network interface (SSID) Configuring a WiFi LAN
Radio 1 settings are the same as Radio 2 settings except for the options for Channel.
Radio 2 settings are available only for FortiAP models with dual radios.
6. Select OK.
To configure a FortiAP Profile - CLI
This example configures a FortiAP-220B to carry all SSIDs on Radio 1 but only SSID example_wlan on Radio 2.
edit guest_prof
config platform
set type 220B
end
config radio-1
set mode ap
set band 802.11g
set vap-all enable
end
config radio-2
set mode ap
set band 802.11g
set vaps example_wlan
end
end
Defining a wireless network interface (SSID)
You begin configuring your wireless network by defining one or more SSIDs to which your users will connect.
When you create an SSID, a virtual network interface is also created with the Name you specified in the SSID
configuration. You can configure the settings of an existing SSID in either WiFi Controller > WiFi Network >
SSID or System > Network > Interface.
If a software switch interface contains an SSID (but only one), the WiFi SSID settings
are available in the switch interface settings.
To create a new SSID
1. Go to WiFi & Switch Controller > SSID and select Create New > SSID .
2. Fill in the SSID fields as described below.
To configure the settings of an existing SSID
1. Either
l Go to WiFi & Switch Controller > SSID .
or
l Go to Network > Interfaces.
WiFi interfaces list the SSID beside the interface Name.
2. Edit a WiFi interface, modifying the SSID fields as needed.

Configuring a WiFi LAN Defining a wireless network interface (SSID)
SSID fields
Interface Name Enter a name for the SSID interface.
Type WiFi SSID.
Traffic Mode Tunnel to Wireless Controller — Data for WLAN passes through WiFi Controller.
This is the default.
Local bridge with FortiAP’s Interface — FortiAP unit Ethernet and WiFi interfaces
are bridged.
Mesh Downlink — Radio receives data for WLAN from mesh backhaul SSID.
IP/Network Mask Enter the IP address and netmask for the SSID.
IPv6 Address Enter the IPv6 address. This is available only when IPv6 has been enabled on the unit.
Administrative
Select which types of administrative access are permitted on this SSID.
Access
IPv6 If you have IPv6 addresses, select the permitted IPv6 administrative access types for
Administrative this SSID.
Access
To assign IP addresses to clients, enable DHCP server. You can define IP address
ranges for a DHCP server on the FortiGate unit or relay DHCP requests to an external
server.
DHCP Server
If the unit is in transparent mode, the DHCP server settings will be unavailable.
For more information, see Configuring DHCP for WiFi clients on page 55.
Device Detection Detect connected device type. Enabled by default.
Active Scanning Enabled by default.
WiFi Settings
SSID Enter the SSID. By default, this field contains fortinet.
Security Mode Select the security mode for the wireless interface. Wireless users must use the same
security mode to be able to connect to this wireless interface. Additional security mode
options are available in the CLI. For more information, see Configuring security on
page 56.
Captive Portal – authenticates users through a customizable web page.
WPA2-Personal – WPA2 is WiFi Protected Access version 2. There is one pre-shared

key (password) that all users use.

WPA2-Personal with Captive Portal – The user will need to know the pre-shared
key and will also be authenticated through the custom portal.
WPA2-Enterprise – similar to WPA2-Personal, but is best used for enterprise

networks. Each user is separately authenticated by user name and password.
Available only when Security Mode is WPA2-Personal. Enter the encryption key
Pre-shared Key
that the clients must use.
Authentication Available only when Security Mode is WPA2-Enterprise.
Select one of the following:
RADIUS Server — Select the RADIUS server that will authenticate the clients.
Local – Select the user group(s) that can authenticate.
Available only when Security Mode is Captive Portal. Choose the captive portal
Portal Type
type. Authentication is available with or without a usage policy disclaimer notice.
Authentication Local - portal hosted on the FortiGate unit

Portal External - enter FQDN or IP address of external portal
User Groups Select permitted user groups for captive portal authentication.
authentication.
Customize Portal
Click the listed portal pages to edit them.
Messages
Redirect after Optionally, select Specific URL and enter a URL for user redirection after captive
Captive Portal portal authentication. By default, users are redirected to the URL that they originally
requested.
Allow New WiFi

Client
This option is available for local bridge SSIDs with WPA-Personal security. See
Connections
Combining WiFi and wired networks with a software switch on page 105.
When Controller
Is Down
Broadcast SSID Optionally, disable broadcast of SSID. By default, the SSID is broadcast. For more
information, see Introduction to wireless networking on page 31.
Select when the SSID is enabled. You can choose any schedule defined in Policy &
Schedule
Objects > Objects > Schedules.
Block Intra-SSID Select to enable the unit to block intra-SSID traffic.

Traffic

Select to limit the number of clients permitted to connect simultaneously. Enter the
Maximum Clients
limit value.
Split Tunneling Select to enable some subnets to remain local to the remote FortiAP. Traffic for these
networks is not routed through the WiFi Controller. Specify split-tunnel networks in the
FortAP Profile. See Split tunneling on page 112.
Optional VLAN ID Enter the ID of the VLAN this SSID belongs to. Enter 0 for non-VLAN operation.
Enable Explicit Select to enable explicit web proxy for the SSID.
Web Proxy
Listen for
RADIUS
Enable if you are using RADIUS-based Single Sign-On (SSO).
Accounting
Messages
Secondary IP Optioanally, enable and define secondary IP addresses. Administrative access can be
Address enabled on secondary interfaces.
Comments Enter a description or comment for the SSID.
To configure a virtual access point (SSID) - CLI
The example below creates an access point with SSID “example” and WPA2-Personal security. The wireless
interface is named example_wlan.
WiFi SSIDs include a schedule that determines when the WiFi network is available. The default schedule is
Always. You can choose any schedule (but not schedule group) that is defined in Policy & Objects > Objects >
Schedules.
edit example_wlan
set ssid "example"
set broadcast-ssid enable
set security wpa2-only-personal
set passphrase "hardtoguess”
set schedule always
set vdom root
end
edit example_wlan
set ip 10.10.120.1 255.255.255.0
end
Configuring DHCP for WiFi clients

Wireless clients need to have IP addresses. If you use RADIUS authentication, each user’s IP address can be
stored in the Framed-IP-Address attribute. Otherwise, you need to configure a DHCP server on the WLAN
interface to assign IP addresses to wireless clients.

To configure a DHCP server for WiFi clients - web-based manager
1. Go to WiFi & Switch Controller > SSID and edit your SSID entry.
2. In DHCP Server select Enable.
3. In Address Range, select Create New.
4. In the Starting IP and End IP fields, enter the IP address range to assign.
By default an address range is created in the same subnet as the wireless interface IP address, but not including
that address.
5. Set the Netmask to an appropriate value, such as 255.255.255.0.
6. Set the Default Gateway to Same as Interface IP.
7. Set the DNS Server to Same as System DNS.
8. If you want to restrict access to the wireless network by MAC address, see Adding a MAC filter on page 58.
9. Select OK.
To configure a DHCP server for WiFi clients - CLI
In this example, WiFi clients on the example_wlan interface are assigned addresses in the 10.10.120.2-9 range
to connect with the WiFi access point on 10.10.120.1.
config system dhcp server
edit 0
set default-gateway 10.10.120.1
set dns-service default
set interface example_wlan
set netmask 255.255.255.0
config ip-range
edit 1
set end-ip 10.10.120.9
set start-ip 10.10.120.2
end
end
You cannot delete an SSID (wireless interface) that has DHCP enabled on it.
Configuring security
Using the web-based manager, you can configure Captive Portal security or WiFi Protected Access version 2
(WPA2) security modes WPA2-Personal and WPA2-Enterprise. Using the CLI, you can also choose WPA/WPA2
modes that support both WPA version 1 and WPA version 2.
WPA2 security with a pre-shared key for authentication is called WPA2-Personal. This can work well for one
person or a small group of trusted people. But, as the number of users increases, it is difficult to distribute new
keys securely and there is increased risk that the key could fall into the wrong hands.
A more secure form of WPA2 security is WPA2-Enterprise. Users each have their own authentication credentials,
verified through an authentication server, usually RADIUS. FortiOS can also authenticate WPA2-Enterprise users
through its built-in user group functionality. FortiGate user groups can include RADIUS servers and can select
users by RADIUS user group. This makes possible Role-Based Access Control (RBAC).

By default, WPA2 security encrypts communication using Advanced Encryption Standard (AES). But some older
wireless clients support only Temporal Key Integrity Protocol (TKIP) . You can change the encryption to TKIP or
negotiable TKIP-AES in the CLI. For example, to accomodate clients with either TKIP or AES, enter:
edit example_wlan
set security wpa-personal
set passphrase "hardtoguess"
set encrypt TKIP-AES
end
Captive Portal security connects users to an open web portal defined in replacement messages. To navigate to
any location beyond the web portal, the user must pass FortiGate user authentication.
WPA-Personal security
WPA2-Personal security setup requires only the preshared key that you will provide to your clients.
To configure WPA2-Personal security - web-based manager
2. In Security Mode, select WPA2 Personal.
3. In Pre-shared Key, enter a key between 8 and 63 characters long.
4. Select OK.
To configure WPA2-Personal security - CLI

edit example_wlan
set security wpa2-personal
set passphrase "hardtoguess"
end
WPA-Enterprise security
If you will use FortiOS user groups for authentication, go to User & Device > User > User Groups and create
those groups first. The groups should be Firewall groups.
If you will use a RADIUS server to authenticate wireless clients, you must first configure the FortiGate unit to
access the RADIUS server.
To configure FortiGate unit access to the RADIUS server - web-based manager
1. Go to User & Device > RADIUS Servers and select Create New.

2. Enter a Name for the server.
3. In Primary Server Name/IP, enter the network name or IP address for the server.
4. In Primary Server Secret, enter the shared secret used to access the server.
5. Optionally, enter the information for a secondary or backup RADIUS server.
6. Select OK.
To configure the FortiGate unit to access the RADIUS server - CLI

config user radius
edit exampleRADIUS

set auth-type auto

set server 10.11.102.100
set secret aoewmntiasf
end
RADIUS Change of Authorization (CoA) support

The CoA feature enables the FortiGate to receive a client disconnect message from the RADIUS server. This is
used to disconnect clients when their time, credit or bandwidth had been used up. Enable this on the RADIUS
server using the CLI:
config user radius
edit <name>
set radius-coa enable
end
To configure WPA-Enterprise security - web-based manager
2. In Security Mode, select WPA2 Enterprise.
3. In Authentication, do one of the following:
l If you will use a RADIUS server for authentication, select RADIUS Server and then select the RADIUS server.
l If you will use a local user group for authentication, select Local and then select the user group(s) permitted to
use the wireless network.
4. Select OK.
To configure WPA-Enterprise security - CLI

edit example_wlan
set security wpa2-enterprise
set auth radius
set radius-server exampleRADIUS
end
Captive Portal security

Captive Portal security provides an access point that initially appears open. The wireless client can connect to the
AP with no security credentials. The AP responds to the client’s first HTTP request with a web page requesting
user name and password. Until the user enters valid credentials, no communication beyond the AP is permitted.
The captive portal can be hosted on the FortiGate unit, or externally. For details see
Configuring WiFi captive portal security - FortiGate captive portal on page 60
Configuring WiFi captive portal security - external server on page 61
For general information about captive portals, see the Captive Portal chapter of the Authentication Guide.
Adding a MAC filter

On each SSID, you can create a MAC address filter list to either permit or exclude a list of clients identified by
their MAC addresses.

This is actually not as secure as it appears. Someone seeking unauthorized access to your network can obtain
MAC addresses from wireless traffic and use them to impersonate legitimate users. A MAC filter list should only
be used in conjunction with other security measures such as encryption.
To configure a MAC filter - web-based manager
2. In the DHCP Server section, expand Advanced.
3. In MAC Reservation + Access Control, double-click in the Unknown MAC Addresses line and select
Assign IP or Block, as needed.
By default, unlisted MAC addresses are assigned an IP address automatically.
4. In MAC Reservation + Access Control, select Create New.
5. Enter a MAC address In the MAC field.
6. In IP or Action, select one of:
l Reserve IP — enter the IP address that is always assigned to this MAC address.
l Assign IP — an IP address is assigned to this MAC address automatically.
l Block — This MAC address will not be assigned an IP address.
7. Repeat steps 4 through 6 for each additional MAC address that you want to add.
8. Select OK.
To configure a MAC filter - CLI
1. Enter
show
2. Find the entry where interface is your WiFi interface. Edit that entry and configure the MAC filter. In this
example, the MAC address 11:11:11:11:11:11will be excluded. Unlisted MAC addresses will be assigned an IP
address automatically.
edit 3
config reserved-address
edit 1
set action block
set mac 11:11:11:11:11:11
end
set mac-acl-default-action assign
end
Limiting the number of clients

You might want to prevent overloading of your access point by limiting the number of clients who can associate
with it at the same time. Limits can be applied per SSID, per AP, or per radio.
To limit the number of clients per SSID - GUI
1. Go to WiFi & Switch Controller > SSID and edit your SSID.

2. Turn on Maximum Clients and enter the maximum number of clients in Limit Concurrent WiFi Clients.

To limit the number of clients per AP- CLI
Edit the wtp-profile (FortiAP profile), like this:

edit "FAP221C-default"
set max-clients 30
end
To limit the number of clients per radio - CLI
Edit the wtp-profile (FortiAP profile), like this:

edit "FAP221C-default"
config radio-1
set max-clients 10
end
config radio-2
set max-clients 30
end
end
Multicast enhancement
FortiOS can translate multicast traffic into unicast traffic to send to clients, maintaining its own multicast client
through IGMP snooping. You can configure this in the CLI:
edit example_wlan
set multicast-enhance enable
set me-disable-thresh 32
end
If the number of clients on the SSID is larger than me-disable-thresh, multicast enhancement is disabled.
Configuring WiFi captive portal security - FortiGate captive portal

The built-in FortiGate captive portal is simpler than an external portal. It can even be customized if needed.
To configure a WiFi Captive Portal - web-based manager:
1. Go to WiFi & Switch Controller > SSID and create your SSID.

If the SSID already exists, you can edit the SSID or you can edit the WiFi interface in Network > Interfaces.
3. Enter
email address collection. See Defining a wireless network interface (SSID)
on page 52.
Authentication Portal Local

authentication.
Customize Portal Messages Click the link of the portal page that you want to modify. For more
information see the Captive Portal chapter of the Authentication Guide.
4. Select OK.
Configuring WiFi captive portal security - external server

An external captive portal is a web page on a web server. The essential part of the web portal page is a script that
gathers the user’s logon credentials and sends back to the FortiGate a specifically-formatted POST message.
The portal page can also contain links to local information such as legal notices, terms of service and so on.
Without authenticating, the user cannot access any other information. This is sometimes called a “walled
garden”.
On the captive portal page, the user submits credentials, which the script returns to the FortiGate at the URL
https://<FGT_IP>:1000/fgtauth with data
magic=session_id&username=<username>&password=<password>.
(The magic value was provided in the initial FortiGate request to the web server.)
To ensure that credentials are communicated securely, enable the use of HTTPS for authentication:
config user setting
set auth-secure-http enable
end
To configure use of an external WiFi Captive Portal - web-based manager:
1. Go to WiFi & Switch Controller > SSID and create your SSID.

If the SSID already exists, you can edit the SSID or you can edit the WiFi interface in Network > Interfaces.
3. Enter
email address collection.
Authentication Portal External - enter the FQDN or IP address of the external portal. Typically,
this is the URL of a script. Do not include the protocol (http:// or https://)
part of the URL.
authentication.
Redirect after Captive Portal Original Request
Specific URL - enter URL

Defining SSID Groups Configuring a WiFi LAN
4. Select OK.
Defining SSID Groups
Optionally, you can define SSID Groups. An SSID Group has SSIDs as members and can be specified just like an
SSID in a FortiAP Profile.
To create an SSID Group - GUI
Go to WiFi & Switch Controller > SSID and select Create New > SSID Group. Give the group a Name and
choose Members (SSIDs, but not SSID Groups).
To create an SSID Group - CLI:

config wireless-controller vap-group
edit vap-group-name
set vaps "ssid1" "ssid2"
end
Dynamic user VLAN assignment
Clients connecting to the WiFi network can be assigned to a VLAN. You can do this with RADIUS attributes when
the user authenticates or with VLAN pooling when the client associates with a particular FortiAP. You cannot use
both of these methods at the same time.
VLAN assignment by RADIUS

You can assign each individual user to a VLAN based on information stored in the RADIUS authentication server.
If the user’s RADIUS record does not specify a VLAN ID, the user is assigned to the default VLAN for the SSID.
The RADIUS user attributes used for the VLAN ID assignment are:
IETF 64 (Tunnel Type)—Set this to VLAN.
IETF 65 (Tunnel Medium Type)—Set this to 802
IETF 81 (Tunnel Private Group ID)—Set this to the VLAN ID.
To configure dynamic VLAN assignment, you need to:
1. Configure access to the RADIUS server.

2. Create the SSID and enable dynamic VLAN assignment.
3. Create a FortiAP Profile and add the local bridge mode SSID to it.
4. Create the VLAN interfaces and their DHCP servers.
5. Create security policies to allow communication from the VLAN interfaces to the Internet.
6. Authorize the FortiAP unit and assign the FortiAP Profile to it.

Configuring a WiFi LAN Dynamic user VLAN assignment
To configure access to the RADIUS server

2. Enter a Name, the name or IP address in Primary Server IP/Name, and the server secret in Primary Server
Secret.
3. Select OK.
To create the dynamic VLAN SSID
1. Go to WiFi & Switch Controller > SSID , select Create New > SSID and enter:
Name An identifier, such as dynamic_vlan_ssid.
Traffic Mode Local bridge or Tunnel, as needed.
SSID An identifier, such as DYNSSID.
Security Mode WPA2 Enterprise
Authentication RADIUS Server. Select the RADIUS server that you configured.
2. Select OK.
3. Enable dynamic VLAN in the CLI. Optionally, you can also assign a VLAN ID to set the default VLAN for users
without a VLAN assignment.
edit dynamic_vlan_ssid
set dynamic-vlan enable
set vlanid 10
end
To create the FortiAP profile for the dynamic VLAN SSID
1. Go to WiFi & Switch Controller > FortiAP Profiles, select Create New and enter:
Name A name for the profile, such as dyn_vlan_profile.
Platform The FortiAP model you are using. If you use more than one model of
FortiAP, you will need a FortiAP Profile for each model.
Radio 1 and Radio 2
SSID Select the SSID you created (example dynamic_vlan_ssid). Do not add
other SSIDs.
2. Adjust other radio settings as needed.

3. Select OK.
To create the VLAN interfaces
1. Go to Network > Interfaces and select Create New > Interface.

2. Enter:

Dynamic user VLAN assignment Configuring a WiFi LAN
Name A name for the VLAN interface, such as VLAN100.
Interface The physical interface associated with the VLAN interface.
VLAN ID The numeric VLAN ID, for example 100.
Addressing mode Select Manual and enter the IP address / Network Mask for the virtual
interface.
DHCP Server Enable and then select Create New to create an address range.
3. Select OK.
4. Repeat the preceding steps to create other VLANs as needed.
Security policies determine which VLANs can communicate with which other interfaces. These are the simple
Firewall Address policy without authentication. Users are assigned to the appropriate VLAN when they
authenticate.
To connect and authorize the FortiAP unit
1. Connect the FortiAP unit to the FortiGate unit.

2. Go to WiFi & Switch Controller > Managed FortiAPs.
3. When the FortiAP unit is listed, double-click the entry to edit it.
4. In FortiAP Profile, select the FortiAP Profile that you created.
5. Select Authorize.
6. Select OK.
VLAN assignment by VLAN pool
In an SSID, you can define a VLAN pool. As clients associate to an AP, they are assigned to a VLAN. A VLAN pool
can
l assign a specific VLAN based on the AP's FortiAP Group, usually for network configuration reasons, or
l assign one of several available VLANs for network load balancing purposes (tunnel mode SSIDs only)
To assign a VLAN by FortiAP Group - CLI
In this example, VLAN 101, 102, or 103 is assigned depending on the AP's FortiAP Group.
edit wlan
set vlan-pooling wtp-group
config vlan-pool
edit 101
set wtp-group wtpgrp1
next
edit 102
next
edit 101
end
end
end

Configuring a WiFi LAN Configuring user authentication
Load balancing
There are two VLAN pooling methods used for load balancing:
The choice of VLAN can be based on any one of the following criteria:
l round-robin - from the VLAN pool, choose the VLAN with the smallest number of clients
l hash - choose a VLAN from the VLAN pool based on a hash of the current number of SSID clients and the number
of entries in the VLAN pool
If the VLAN pool contains no valid VLAN ID, the SSID's static VLAN ID setting is used.
To assign a VLAN by round-robin selection - CLI
In this example, VLAN 101, 102, or 103 is assigned using the round-robin method:
edit wlan
set vlan-pooling round-robin
config vlan-pool
edit 101
next
edit 102
next
edit 103
end
end
end
To assign a VLAN by hash-based selection - CLI
In this example, VLAN 101, 102, or 103 is assigned using the hash method:
edit wlan
set vlan-pooling hash
config vlan-pool
edit 101
next
edit 102
next
edit 103
end
end
end
Configuring user authentication
You can perform user authentication when the wireless client joins the wireless network and when the wireless
user communicates with another network through a firewall policy. WEP and WPA-Personal security rely on
legitimate users knowing the correct key or passphrase for the wireless network. The more users you have, the
more likely it is that the key or passphrase will become known to unauthorized people. WPA-Enterprise and
captive portal security provide separate credentials for each user. User accounts can be managed through
FortiGate user groups or an external RADIUS authentication server.

Configuring user authentication Configuring a WiFi LAN
WPA2 Enterprise authentication
Enterprise authentication can be based on the local FortiGate user database or on a remote RADIUS server.
Local authentication is essentially the same for WiFi users as it is for wired users, except that authentication for
WiFi users occurs when they associate their device with the AP. Therefore, enterprise authentication must be
configured in the SSID. WiFi users can belong to user groups just the same as wired users and security policies
will determine which network services they can access.
If your WiFi network uses WPA2 Enterprise authentication verified by a RADIUS server, you need to configure the
FortiGate unit to connect to that RADIUS server.
Configuring connection to a RADIUS server - web-based manager

2. Enter a Name for the server.
This name is used in FortiGate configurations. It is not the actual name of the server.
3. In Primary Server Name/IP, enter the network name or IP address for the server.
4. In Primary Server Secret, enter the shared secret used to access the server.
5. Optionally, enter the information for a secondary or backup RADIUS server.
6. Select OK.
To configure the FortiGate unit to access the RADIUS server - CLI

config user radius
edit exampleRADIUS
set auth-type auto
set server 10.11.102.100
set secret aoewmntiasf
end
To implement WPA2 Enterprise security, you select this server in the SSID security settings. See Configuring user
authentication on page 65.
To use the RADIUS server for authentication, you can create individual FortiGate user accounts that specify the
authentication server instead of a password, and you then add those accounts to a user group. Or, you can add
the authentication server to a FortiGate user group, making all accounts on that server members of the user
group.
Creating a wireless user group

Most wireless networks require authenticated access. To enable creation of firewall policies specific to WiFi
users, you should create at least one WiFi user group. You can add or remove users later. There are two types of
user group to consider:
l A Firewall user group can contain user accounts stored on the FortiGate unit or external authentication servers such
as RADIUS that contain and verify user credentials.
l A Fortinet Single Sign-On (FSSO) user group is used for integration with Windows Active Directory or Novell
eDirectory. The group can contain Windows or Novell user groups who will be permitted access to the wireless LAN.

Configuring a WiFi LAN Configuring user authentication
WiFi Single Sign-On (WSSO) authentication

WSSO is RADIUS-based authentication that passes the user's user group memberships to the FortiGate. For
each user, the RADIUS server must provide user group information in the Fortinet-Group-Name attribute. This
information is stored in the server's database. After the user authenticates, security policies provide access to
network services based on user groups.
1. Configure the RADIUS server to return the Fortinet-Group-Name attribute for each user.
2. Configure the FortiGate to access the RADIUS server, as described in WPA2 Enterprise authentication on page
66.
3. Create firewall user groups on the FortiGate with the same names as the user groups listed in the RADIUS
database. Leave the groups empty.
4. In the SSID choose WPA2-Enterprise authentication. In the Authentication field, select RADIUS Server and
choose the RADIUS server that you configured.
5. Create security policies as needed, using user groups (Source User(s) field) to control access.
When a user authenticates by WSSO, the firewall monitor Monitor > Firewall User Monitor) shows the
authentication method as WSSO.
Assigning WiFi users to VLANs dynamically

Some enterprise networks use Virtual LANs (VLANs) to separate traffic. In this environment, to extend network
access to WiFi users might appear to require multiple SSIDs. But it is possible to automatically assign each user
to their appropriate VLAN from a single SSID. To accomplish this requires RADIUS authentication that passes the
appropriate VLAN ID to the FortiGate by RADIUS attributes. Each user’s VLAN assignment is stored in the user
database of the RADIUS server.
1. Configure the RADIUS server to return the following attributes for each user:
Tunnel-Type (value: VLAN)
Tunnel-Medium-Type (value: IEEE-802)
Tunnel_Private-Group-Id (value: the VLAN ID for the user's VLAN)
2. Configure the FortiGate to access the RADIUS server.
3. Configure the SSID with WPA2-Enterprise authentication. In the Authentication field, select RADIUS Server
and choose the RADIUS server that you will use.
4. Create VLAN subinterfaces on the SSID interface, one for each VLAN. Set the VLAN ID of each as appropriate.
You can do this on the Network > Interfaces page.
5. Enable Dynamic VLAN assignment for the SSID. For example, if the SSID interface is "office", enter:
edit office
set dynamic-vlan enable
end
6. Create security policies for each VLAN. These policies have a WiFI VLAN subinterface as Incoming Interface
and allow traffic to flow to whichever Outgoing Interface these VLAN users will be allowed to access.
MAC-based authentication
Wireless clients can also be supplementally authenticated by MAC address. A RADIUS server stores the allowed
MAC address for each client and the wireless controller checks the MAC address independently of other
authentication methods.

Configuring firewall policies for the SSID Configuring a WiFi LAN
MAC-based authentication must be configured in the CLI. In the following example, MAC-based authentication is
added to an existing access point “vap1” to use RADIUS server hq_radius (configured on the FortiGate):
edit vap1
set radius-mac-auth enable
set radius-mac-auth-server hq_radius
end
Authenticating guest WiFi users

The FortiOS Guest Management feature enables you to easily add guest accounts to your FortiGate unit. These
accounts are authenticate guest WiFi users for temporary access to a WiFi network managed by a FortiGate unit.
To implement guest access, you need to
1. Go to User & Device > User Groups and create one or more guest user groups.
2. Go to User & Device > Guest Management to create guest accounts. You can print the guest account
credentials or send them to the user as an email or SMS message.
3. Go to WiFi & Switch Controller > SSID and configure your WiFi SSID to use captive portal authentication.
Select the guest user group(s) that you created.
Guest users can log into the WiFi captive portal with their guest account credentials until the account expires. For
more detailed information about creating guest accounts, see “Managing Guest Access” in the Authentication
chapter of the FortiOS Handbook.
Configuring firewall policies for the SSID
For users on the WiFi LAN to communicate with other networks, firewall policies are required. This section
describes creating a WiFi network to Internet policy.
Before you create firewall policies, you need to define any firewall addresses you will need.
To create a firewall address for WiFi users - web-based manager
1. Go to Policy & Objects > Addresses.

2. Select Create New, enter the following information and select OK.
Name Enter a name for the address, wifi_net for example.
Type Select Subnet.
Subnet / IP Range Enter the subnet address, 10.10.110.0/24 for example.
Interface Select the interface where this address is used, e.g., example_wifi
To create a firewall address for WiFi users - CLI

config firewall address
edit "wifi_net"
set associated-interface "example_wifi"
set subnet 10.10.110.0 255.255.255.0
end

Configuring a WiFi LAN Configuring the built-in access point on a FortiWiFi unit
To create a firewall policy - web-based manager
1. Go to Policy & Objects > IPv4 Policy and select Create New.

2. In Incoming Interface, select the wireless interface.
3. In Source Address, select the address of your WiFi network, wifi_net for example.
4. In Outgoing Interface, select the Internet interface, for example, port1.
5. In Destination Address, select All.
6. In Service, select ALL, or select the particular services that you want to allow, and then select the right arrow
button to move the service to the Selected Services list.
7. In Schedule, select always, unless you want to define a schedule for limited hours.
8. In Action, select ACCEPT.
9. Select Enable NAT.
10. Optionally, set up UTM features for wireless users.
11. Select OK.
To create a firewall policy - CLI

config firewall policy
edit 0
set srcintf "example_wifi"
set dstintf "port1"
set srcaddr "wifi_net"
set dstaddr "all"
set action accept
set schedule "always"
set service "ANY"
set nat enable
end
Configuring the built-in access point on a FortiWiFi unit
Both FortiGate and FortiWiFi units have the WiFi controller feature. If you configure a WiFi network on a
FortiWiFi unit, you can also use the built-in wireless capabilities in your WiFi network as one of the access points.
If Virtual Domains are enabled, you must select the VDOM to which the built-in access point belongs. You do this
in the CLI. For example:
set local-radio-vdom vdom1
end
To configure the FortiWiFi unit’s built-in WiFi access point
1. Go to WiFi Controller > Local WiFi Radio.

2. Make sure that Enable WiFi Radio is selected.
3. In SSID , if you do not want this AP to carry all SSIDs, select Select SSIDs and then select the required SSIDs.
4. Optionally, adjust the TX Power slider.
If you have selected your location correctly (see Configuring the built-in access point on a FortiWiFi unit on page
69), the 100% setting corresponds to the maximum power allowed in your region.

Configuring the built-in access point on a FortiWiFi unit Configuring a WiFi LAN
5. If you do not want the built-in WiFi radio to be used for rogue scanning, select Do not participate in Rogue AP
scanning.
6. Select OK.
If you want to connect external APs, such as FortiAP units, see the next chapter, Access point deployment.

Access point deployment
This chapter describes how to configure access points for your wireless network.
Overview
Network topology for managed APs
Discovering and authorizing APs
Advanced WiFi controller discovery
Wireless client load balancing for high-density deployments
FortiAP Groups
LAN port options
Preventing IP fragmentation of packets in CAPWAP tunnels
LED options
CAPWAP bandwidth formula
Overview
FortiAP units discover WiFi controllers. The administrator of the WiFi controller authorizes the FortiAP units that
the controller will manage.
In most cases, FortiAP units can find WiFi controllers through the wired Ethernet without any special
configuration. Review the following section, Access point deployment on page 71, to make sure that your method
of connecting the FortiAP unit to the WiFi controller is valid. Then, you are ready to follow the procedures in
Access point deployment on page 71.
If your FortiAP units are unable to find the WiFi controller, refer to Access point deployment on page 71 for
detailed information about the FortiAP unit’s controller discovery methods and how you can configure them.
Network topology for managed APs
The FortiAP unit can be connected to the FortiGate unit in any of the following ways:
Direct connection: The FortiAP unit is directly connected to the FortiGate unit with no switches between them.
This configuration is common for locations where the number of FortiAP’s matches up with the number of
‘internal’ ports available on the FortiGate. In this configuration the FortiAP unit requests an IP address from the
FortiGate unit, enters discovery mode and should quickly find the FortiGate WiFi controller. This is also known as
a wirecloset deployment. See "Wirecloset and Gateway deployments" below.

Network topology for managed APs Access point deployment
Wirecloset deployment
Switched Connection: The FortiAP unit is connected to the FortiGate WiFi controller by an Ethernet switch
operating in L2 switching mode or L3 routing mode. There must be a routable path between the FortiAP unit and
the FortiGate unit and ports 5246 and 5247 must be open. This is also known as a gateway deployment. See
Gateway Deployment below.

Access point deployment Network topology for managed APs
Gateway Deployment

Discovering and authorizing APs Access point deployment
Connection over WAN: The FortiGate WiFi controller is off-premises and connected by a VPN tunnel to a local
FortiGate. In this method of connectivity its best to configure each FortiAP with the static IP address of the WiFi
controller. Each FortiAP can be configured with three WiFi controller IP addresses for redundant failover. This is
also known as a datacenter remote management deployment. See Remote deployment below.
Remote deployment
Discovering and authorizing APs
After you prepare your FortiGate unit, you can connect your APs to discover them using the discovery methods
described earlier. To prepare the FortiGate unit, you need to
l Configure the network interface to which the AP will connect.

l Configure DHCP service on the interface to which the AP will connect.
l Optionally, preauthorize FortiAP units. They will begin to function when connected.
l Connect the AP units and let the FortiGate unit discover them.
l Enable each discovered AP and configure it or assign it to an AP profile.

Access point deployment Discovering and authorizing APs
Configuring the network interface for the AP unit

The interface to which you connect your wireless access point needs an IP address. No administrative access,
DNS Query service or authentication should be enabled.
To configure the interface for the AP unit - web-based manager
1. Go to Network > Interfaces and edit the interface to which the AP unit connects.
2. Set Addressing Mode to Dedicate to Extension Device.
3. Enter the IP address and netmask to use.
This FortiGate unit automatically configures a DHCP server on the interface that will assign the remaining higher
addresses up to .254 to FortiAP units. For example, if the IP address is 10.10.1.100, the FortiAP units will be
assigned 10.10.1.101 to 10.10.1.254. To maximize the available addresses, use the .1 address for the interface:
10.10.1.1, for example.
4. Select OK.
To configure the interface for the AP unit - CLI
In the CLI, you must configure the interface IP address and DHCP server separately.
edit port3
set mode static
set ip 10.10.70.1 255.255.255.0
end
edit 0
set interface "dmz"
config ip-range
edit 1
set end-ip 10.10.70.254
end
set vci-match enable
set vci-string "FortiAP"
end
The optional vci-match and vci-string fields ensure that the DHCP server will provide IP addresses only
to FortiAP units.
Pre-authorizing a FortiAP unit

If you enter the FortiAP unit information in advance, it is authorized and will begin to function when it is
connected.
To pre-authorize a FortiAP unit
1. Go to WiFi & Switch Controller > Managed FortiAPs and select Create New.

On some models the WiFi Controller menu is called WiFi & Switch Controller.
2. Enter the Serial Number of the FortiAP unit.
3. Configure the Wireless Settings as required.
4. Select OK.

Enabling and configuring a discovered AP

Within two minutes of connecting the AP unit to the FortiGate unit, the discovered unit should be listed on
WiFi Controller > Managed FortiAPs page. After you select the unit, you can authorize, edit or delete it.
Discovered access point unit
When you authorize (enable) a FortiAP unit, it is configured by default to use the default FortiAP profile
(determined by model). You can create and select a different profile if needed. The FortiAP Profile defines the
entire configuration for the AP.
To add and configure the discovered AP unit - web-based manager

This configuration also applies to local WiFi radio on FortiWiFi models.
2. Select the FortiAP unit from the list and edit it.
3. Optionally, enter a Name. Otherwise, the unit will be identified by serial number.
4. Select Authorize.
5. Select a FortiAP Profile.
6. Select OK.
The physical access point is now added to the system. If the rest of the configuration is complete, it should be
possible to connect to the wireless network through the AP.
To add the discovered AP unit - CLI
First get a list of the discovered access point unit serial numbers:
get wireless-controller wtp
Add a discovered unit and associate it with AP-profile1, for example:
config wireless-controller wtp
edit FAP22A3U10600118
set admin enable
set wtp-profile AP-profile1
end
To view the status of the added AP unit

get
The join-time field should show a time, not “N/A”. See the preceding web-based manager procedure for more
information.

Disable automatic discovery of unknown FortiAPs

By default, the FortiGate adds newly discovered FortiAPs to the Managed FortiAPs list, awaiting the
administrator's authorization. Optionally, you can disable this automatic registration function to avoid adding
unknown FortiAPs. A FortiAP will be registered and listed only if its serial number has already been added
manually to the Managed FortiAPs list. AP registration is configured on each interface.
To disable automatic discovery and registration, enter the following command:

edit port15
set ap-discover disable
end
Automatic authorization of extension devices

To simplify adding FortiAP or FortiSwitch devices to your network, you can enable automatic authorization of
devices as they are connected, instead of authorizing each one individually.
This feature is only configurable in the CLI.
To enable automatic authorization on all dedicated interfaces

set auto-auth-extension-device enable
end
To enable automatic authorization per-interface

edit <port>
set auto-auth-extension-device enable
end
Assigning the same profile to multiple FortiAP units

The same profile can now be applied to multiple managed FortiAP units at the same time. To do this, do the
following:
1. Go to WiFi & Switch Controller > Managed FortiAPs to view the AP list.

2. Select all FortiAP units you wish to apply the profile to.
3. Right click on one of the selected FortiAPs and select Assign Profile.
4. Choose the profile you wish to apply.
Overriding the FortiAP Profile

In the FortiAP configuration WiFi & Switch Controller > Managed FortiAPs, there several radio settings
under Override Radio 1 and Override Radio 2 to choose a value independently of the FortiAP Profile setting.
When each of the radios are disabled, you will see what the FortiAP Profile has each of the settings configured to.

Band The available options depend on the capability of the radio. Overriding Band
also overrides Channels. Make appropriate settings in Channels.
Channels Choose channels. The available channels depend on the Band.
TX Power Control If you enable Auto, adjust to set the power range in dBm.
If you enable Manual, adjust the slider. The 100% setting is the maximum power
permitted in your region. See Configuring a WiFi LAN on page 47.
Select between Auto or Manual. Selecting Auto eliminates the need to re-edit
SSIDs the profile when new SSIDs are created. However, you can still select SSIDs
individually using Manual.
To override radio settings in the CLI
In this example, Radio 1 is set to 802.11n on channel 11, regardless of the profile setting.
edit FP221C3X14019926
config radio-1
set override-band enable
set band 802.11n
set override-channel enable
set channel 11
end
Override settings are available for band, channel, vaps (SSIDs), and txpower.
Outside of configuring radio settings, you can also override FortiAP LED state, WAN port mode, IP
Fragmentation prevention method, spectrum analysis, split tunneling, and login password settings.
Accessing the FortiAP CLI through the FortiGate unit

Enable remote login for the FortiAP. In the FortiAP Profile for this FortiAP, enable remote access.
Connecting to the FortiAP CLI

The FortiAP unit has a CLI through which some configuration options can be set. You can access the CLI using
Telnet.
To access the FortiAP unit CLI through the FortiAP Ethernet port
1. Connect your computer to the FortiAP Ethernet interface, either directly with a cross-over cable or through a
separate switch or hub.
2. Change your computer’s IP address to 192.168.1.3
3. Telnet to IP address 192.168.1.2.
Ensure that FortiAP is in a private network with no DHCP server for the static IP address to be accessible.
4. Login with user name admin and no password.
5. Enter commands as needed.
6. Optionally, use the passwd command to assign an administrative password for better security.
7. Save the configuration by entering the following command:
cfg –c .

8. Unplug the FortiAP and then plug it back in, in order for the configuration to take effect
Accessing the FortiAP CLI through the FortiGate

After the FortiAP has been installed, physical access to the unit might be inconvenient. You can access a
connected FortiAP unit's CLI through the FortiGate unit that controls it.
To enable remote access to the FortiAP CLI
In the CLI, edit the FortiAP Profile that applies to this FortiAP.
set allowaccess telnet
end
FortiAP now supports HTTPS and SSH administrative access, as well as HTTP and
Telnet. Use the command above to set administrative access to telnet, http,
https, or ssh.
To access the FortiAP unit CLI through the FortiGate unit - GUI

2. In the list, right-click the FortiAP unit and select >_Connect to CLI.
A detached Console window opens.
3. At the FortiAP login prompt, enter admin. When you are finished using the FortiAP CLI, enter exit.
To access the FortiAP unit CLI through the FortiGate unit - CLI
1. Use the FortiGate CLI execute telnet command to access the FortiAP. For example, if the FortiAP unit IP
address is 192.168.1.2, enter:
execute telnet 192.168.1.2
2. At the FortiAP login prompt, enter admin. When you are finished using the FortiAP CLI, enter exit.
When a WiFi controller has taken control of the FortiAP unit, Telnet access to the
FortiAP unit’s CLI is no longer available.
Checking and updating FortiAP unit firmware

You can view and update the FortiAP unit’s firmware from the FortiGate unit that acts as its WiFi controller.
Checking the FortiAP unit firmware version

Go to WiFi & Switch Controller > Managed FortiAPs to view the list of FortiAP units that the FortiGate unit
can manage. The OS Version column shows the current firmware version running on each AP.

Updating FortiAP firmware from the FortiGate unit

You can update the FortiAP firmware using either the web-based manager or the CLI. Only the CLI method can
update all FortiAP units at once.
To update FortiAP unit firmware - web-based manager

2. Right-click the FortiAP unit in the list and select Upgrade Firmware.
or
Edit the FortiAP entry and select Upgrade from File in FortiAP OS Version.
3. Select Browse and locate the firmware upgrade file.
4. Select OK.
5. When the upgrade process completes, select OK.
The FortiAP unit restarts.
To update FortiAP unit firmware - CLI
1. Upload the FortiAP image to the FortiGate unit.

For example, the Firmware file is FAP_22A_v4.3.0_b0212_fortinet.out and the server IP address is
192.168.0.100.
execute wireless-controller upload-wtp-image tftp FAP_22A_v4.3.0_b0212_fortinet.out
192.168.0.100
If your server is FTP, change tftp to ftp, and if necessary add your user name and password at the
end of the command.
2. Verify that the image is uploaded:

execute wireless-controller list-wtp-image
3. Upgrade the FortiAP units:
exec wireless-controller reset-wtp all
If you want to upgrade only one FortiAP unit, enter its serial number instead of all.
Updating FortiAP firmware from the FortiAP unit

You can connect to a FortiAP unit’s internal CLI to update its firmware from a TFTP server on the same network.
This method does not require access to the wireless controller.
1. Place the FortiAP firmware image on a TFTP server on your computer.

2. Connect the FortiAP unit to a separate private switch or hub or directly connect to your computer via a cross-over
cable.
3. Change your computer’s IP address to 192.168.1.3.
4. Telnet to IP address 192.168.1.2.
This IP address is overwritten if the FortiAP is connected to a DHCP environment. Ensure that the FortiAP unit is
in a private network with no DHCP server.
5. Login with the username “admin” and no password.
6. Enter the following command.
For example, the FortiAP image file name is FAP_22A_v4.3.0_b0212_fortinet.out.
restore FAP_22A_v4.3.0_b0212_fortinet.out 192.168.1.3

Access point deployment Advanced WiFi controller discovery
Advanced WiFi controller discovery
A FortiAP unit can use any of six methods to locate a controller. By default, FortiAP units cycle through all six of
the discovery methods. In most cases there is no need to make configuration changes on the FortiAP unit.
There are exceptions. The following section describes the WiFi controller discovery methods in more detail and
provides information about configuration changes you might need to make so that discovery will work.
Controller discovery methods

There are six methods that a FortiAP unit can use to discover a WiFi controller. Below is the list of AC discovery
methods used in sequence, if the FortiAP's discovery type is set to auto:
1(static) → 2(dhcp) → 3(dns) → 7(forticloud) → 5(multicast) → 6(broadcast)

For every discovery type, FortiAP sends out discovery requests and sets a timer, an interval defined as a random
number of seconds (between 2-180, default is 5 seconds), which is set via the CLI:
CLI syntax
set discovery-interval 5
end
After the timeout is reached, FortiAP sends out another discovery request, up to a maximum of 3 times.
After about 3 - 15 seconds, if FortiAP has no AC connection, it will switch to another discovery type and repeat the
above process until the last one (broadcast) fails, which will lead to SULKING state.
After about 30 seconds, FortiAP will go into an AC_IP_DISCVER state. After the AC IP is found, it will go to IDLE
state, and will eventually go to the DISCOVERY state, and repeat the above process again.
Note that, while the process above is showcasing the auto discovery method, it's recommended to set the AC_
DISCOVERY_TYPE to your used method in order to reduce downtime.
Static IP configuration
If FortiAP and the controller are not in the same subnet, broadcast and multicast packets cannot reach the
controller. The admin can specify the controller’s static IP on the AP unit. The AP unit sends a discovery request
message in unicast to the controller. Routing must be properly configured in both directions.
To specify the controller’s IP address on a FortiAP unit

cfg –a AC_IPADDR_1="192.168.0.100"
By default, the FortiAP unit receives its IP address, netmask, and gateway address by DHCP. If you prefer, you
can assign these statically.
To assign a static IP address to the FortiAP unit

cfg -a ADDR_MODE=STATIC
cfg –a AP_IPADDR="192.168.0.100"
cfg -a AP_NETMASK="255.255.255.0"
cfg –a IPGW=192.168.0.1
cfg -c

Advanced WiFi controller discovery Access point deployment
For information about connecting to the FortiAP CLI, see Connecting to the FortiAP CLI on page 78.
DHCP
If you use DHCP to assign an IP address to your FortiAP unit, you can also provide the WiFi controller IP address
at the same time. This is useful if the AP is located remotely from the WiFi controller and other discovery
techniques will not work.
When you configure the DHCP server, configure Option 138 to specify the WiFi controller IP address. You need to
convert the address into hexadecimal. Convert each octet value separately from left to right and concatenate
them. For example, 192.168.0.1 converts to C0A80001.
If Option 138 is used for some other purpose on your network, you can use a different option number if you
configure the AP units to match.
To change the FortiAP DHCP option code
To use option code 139 for example, enter
cfg –a AC_DISCOVERY_DHCP_OPTION_CODE=139
For information about connecting to the FortiAP CLI, see Connecting to the FortiAP CLI on page 78.
DNS
The access point can discover controllers through your domain name server (DNS). For the access point to do so,
you must configure your DNS to return controller IP addresses in response. Allow DNS lookup of the hostname
configured in the AP by using the AP parameter "AC_HOSTNAME_1".
FortiCloud
The access point can discover FortiCloud by doing a DNS lookup of the hardcoded FortiCloud AP controller
hostname "apctrl1.fortinet.com". The forticloud AC discovery technique finds the AC info from apctl1.fortinet.com
using HTTPS.
FortiCloud APController: apctrl1.fortinet.com:443 208.91.113.187:443
Broadcast request
The AP unit broadcasts a discovery request message to the network and the controller replies. The AP and the
controller must be in the same broadcast domain. No configuration adjustments are required.
Multicast request
The AP unit sends a multicast discovery request and the controller replies with a unicast discovery response
message. The AP and the controller do not need to be in the same broadcast domain if multicast routing is
properly configured.
The default multicast destination address is 224.0.1.140. It can be changed through the CLI. The address must
be same on the controller and AP.
To change the multicast address on the controller

set discovery-mc-addr 224.0.1.250
end

Access point deployment Wireless client load balancing for high-density deployments
To change the multicast address on a FortiAP unit

cfg –a AC_DISCOVERY_MC_ADDR="224.0.1.250"
For information about connecting to the FortiAP CLI, see Advanced WiFi controller discovery on page 81.
Wireless client load balancing for high-density deployments
Wireless load balancing allows your wireless network to distribute wireless traffic more efficiently among wireless
access points and available frequency bands. FortiGate wireless controllers support the following types of client
load balancing:
l Access Point Hand-off - the wireless controller signals a client to switch to another access point.
l Frequency Hand-off - the wireless controller monitors the usage of 2.4GHz and 5GHz bands, and signals clients to
switch to the lesser-used frequency.
Load balancing is not applied to roaming clients.
Access point hand-off

Access point handoff wireless load balancing involves the following:
l If the load on an access point (ap1) exceeds a threshold (of for example, 30 clients) then the client with the weakest
signal will be signaled by wireless controller to drop off and join another nearby access point (ap2).
l When one or more access points are overloaded (for example, more than 30 clients) and a new client attempts to
join a wireless network, the wireless controller selects the least busy access point that is closest to the new client
and this access point is the one that responds to the client and the one that the client joins.
Frequency hand-off or band-steering

Encouraging clients to use the 5GHz WiFi band if possible enables those clients to benefit from faster
interference-free 5GHz communication. The remaining 2.4GHz clients benefit from reduced interference.
The WiFi controller probes clients to determine their WiFi band capability. It also records the RSSI (signal
strength) for each client on each band.
If a new client attempts to join the network, the controller looks up that client’s MAC address in its wireless device
table and determines if it’s a dual band device. If it is not a dual band device, then its allowed to join. If it is a dual
band device, then its RSSI on 5GHz is used to determine whether the device is close enough to an access point
to benefit from movement to 5GHz frequency.
If both conditions of 1) dual band device and 2) RSSI value is strong, then the wireless controller does not reply to
the join request of the client. This forces the client to retry a few more times and then timeout and attempt to join
the same SSID on 5GHz. Once the Controller see this new request on 5GHz, the RSSI is again measured and the
client is allowed to join. If the RSSI is below threshold, then the device table is updated and the controller forces
the client to timeout again. A client’s second attempt to connect on 2.4GHz will be accepted.
Configuration
From the web-based manager, edit a custom AP profile and select Frequency Handoff and AP Handoff as
required for each radio on the AP.

FortiAP Groups Access point deployment
From the CLI, you configure wireless client load balancing thresholds for each custom AP profile. Enable access
point hand-off and frequency hand-off separately for each radio in the custom AP profile.
edit new-ap-profile
set handoff-rssi <rssi_int>
set handoff-sta-thresh <clients_int>
config radio-1
set frequency-handoff {disable | enable}
set ap-handoff {disable | enable}
end
config radio-2
set frequency-handoff {disable | enable}
set ap-handoff {disable | enable}
end
end
Where:
l handoff-rssi is the RSSI threshold. Clients with a 5 GHz RSSI threshold over this value are load balanced to
the 5GHz frequency band. Default is 25. Range is 20 to 30.
l handoff-sta-thresh is the access point handoff threshold. If the access point has more clients than this
threshold it is considered busy and clients are changed to another access point. Default is 30, range is 5 to 25.
l frequency-handoff enable or disable frequency handoff load balancing for this radio. Disabled by default.
l ap-handoff enable or disable access point handoff load balancing for this radio. Disabled by default.
Frequency handoff must be enabled on the 5GHz radio to learn client capability.
FortiAP Groups
FortiAP Groups facilitate the application of FortiAP profiles to large numbers of FortiAPs. A FortiAP can belong to
no more than one FortiAP Group. A FortiAP Group can include only one model of FortiAP.
Through the VLAN pool feature, a FortiAP Group can be associated with a VLAN to which WiFi clients will be
assigned. For more on VLAN pool assignment, see VLAN assignment by VLAN pool.
FortiAP groups are only configurable in the CLI Console.
To create a FortiAP group - CLI
In this example, wtp-group-1 is created for a FortiAP-221C and one member device is added.
config wireless-controller wtp-group
edit wtp-group-1
set platform-type 221C
config wtp-list
edit FP221C3X14019926
end
end
LAN port options
Some FortiAP models have one or more LAN interfaces that can provide wired network access. LAN ports can be

Access point deployment LAN port options
l bridged to the incoming WAN interface

l bridged to one of the WiFi SSIDs that the FortiAP unit carries
l connected by NAT to the incoming WAN interface
There are some differences among FortiAP models.
Models like 11C and 14C have one port labeled WAN and one or more ports labeled LAN. By default, the LAN
ports are offline. You can configure LAN port operation in the FortiAP Profile in the GUI (Wireless Controller >
FortiAP Profiles) or in the CLI (config wireless-controller wtp-profile, config lan
subcommand).
Models like 320C, 320B, 112D, and 112B have two ports, labeled LAN1 and LAN2. LAN1 acts as a WAN port
connecting the FortiAP to a FortiGate or FortiCloud. By default, LAN2 is bridged to LAN1. Other modes of LAN2
operation must be enabled in the CLI:
edit <profile_name>
set wan-port-mode wan-lan
end
By default wan-port-mode is set to wan-only.
When wan-port-mode is set to wan-lan, LAN2 Port options are available in the GUI and the CLI the same as
the other FortiAP models that have labeled WAN and LAN ports.
Bridging a LAN port with an SSID

Bridging a LAN port with a FortiAP SSID combines traffic from both sources to provide a single broadcast domain
for wired and wireless users.
In this configuration
l The IP addresses for LAN clients come from the DHCP server that serves the wireless clients.
l Traffic from LAN clients is bridged to the SSID’s VLAN. Dynamic VLAN assignment for hosts on the LAN port is not
supported.
l Wireless and LAN clients are on the same network and can communicate locally, via the FortiAP.
l Any host connected to the LAN port will be taken as authenticated. RADIUS MAC authentication for hosts on the
LAN port is not supported.
For configuration instructions, see LAN port options on page 84.
Bridging a LAN port with the WAN port

Bridging a LAN port with the WAN port enables the FortiAP unit to be used as a hub which is also an access point.
In this configuration
l The IP addresses for LAN clients come from the WAN directly and will typically be in the same range as the AP
itself.
l All LAN client traffic is bridged directly to the WAN interface.
l Communication between wireless and LAN clients can only occur if a policy on the FortiGate unit allows it.
For configuration instructions, see LAN port options on page 84.

LAN port options Access point deployment
Configuring FortiAP LAN ports

You can configure FortiAP LAN ports for APs in a FortiAP Profile. A profile applies to APs that are the same model
and share the same configuration. If you have multiple models or different configurations, you might need to
create several FortiAP Profiles. For an individual AP, it is also possible to override the profile settings.
To configure FortiAP LAN ports - web-based manager
1. If your FortiAP unit has LAN ports, but no port labeled WAN (models 320C, 320B, 112D, and 112B for example),
enable LAN port options in the CLI:
edit <profile_name>
end
2. Go to WiFi & Switch Controller > FortiAP Profiles.
3. Edit the default profile for your FortiAP model or select Create New.
4. If you are creating a new profile, enter a Name and select the correct Platform (model).
5. Select SSIDs.
6. In the LAN Port section, set Mode to Bridge to and select an SSID or WAN Port as needed.
On some models with multiple LAN ports, you can set Mode to Custom and configure the LAN ports individually.
Enable each port that you want to use and select an SSID or WAN Port as needed.
7. Select OK.
Be sure to select this profile when you authorize your FortiAP units.
To configure FortiAP LAN ports - CLI
In this example, the default FortiAP-11C profile is configured to bridge the LAN port to the office SSID.
edit FAP11C-default
config lan
set port-mode bridge-to-ssid
set port-ssid office
end
end
end
In this example, the default FortiAP-28C profile is configured to bridge LAN port1 to the office SSID and to bridge
the other LAN ports to the WAN port.
edit FAP28C-default
config lan
set port1-mode bridge-to-ssid
set port1-ssid office
set port2-mode bridge-to-wan
end
end

Access point deployment Preventing IP fragmentation of packets in CAPWAP tunnels
In this example, the default FortiAP-320C profile is configured to bridge the LAN port to the office SSID.
config lan
end
end
end
To configure FortiAP unit LAN ports as a FortiAP Profile override - web-based manager

2. Select the FortiAP unit from the list and select Edit.
3. Select the FortiAP Profile, if this has not already been done.
4. In the LAN Port section, select Override.
The options for Mode are shown.
5. Set Mode to Bridge to and select an SSID or WAN Port, or NAT to WAN as needed.
On some models with multiple LAN ports, you can set Mode to Custom and configure the LAN ports individually.
Enable and configure each port that you want to use.
6. Select OK.
To configure FortiAP unit LAN ports as a FortiAP Profile override - CLI
In this example, a FortiAP unit’s configuration overrides the FortiAP Profile to bridge the LAN port to the office
SSID.
edit FP320C3X14020000
set wtp-profile FAP320C-default
set override-wan-port-mode enable
set override-lan enable
config lan
end
end
Preventing IP fragmentation of packets in CAPWAP tunnels
A common problem with controller-based WiFi networks is reduced performance due to IP fragmentation of the
packets in the CAPWAP tunnel.
Fragmentation can occur because of CAPWAP tunnel overhead increasing packet size. If the original wireless
client packets are close to the maximum transmission unit (MTU) size for the network (usually 1500 bytes for
Ethernet networks unless jumbo frames are used) the resulting CAPWAP packets may be larger than the MTU,
causing the packets to be fragmented. Fragmenting packets can result in data loss, jitter, and decreased
throughput.

LED options Access point deployment
The FortiOS/FortiAP solution to this problem is to cause wireless clients to send smaller packets to FortiAP
devices, resulting in1500-byte CAPWAP packets and no fragmentation. The following options configure CAPWAP
IP fragmentation control:
config wireless-controller wtp-profle
set ip-fragment-preventing {tcp-mss-adjust | icmp-unreachable}
set tun-mtu-uplink {0 | 576 | 1500}
set tun-mtu-downlink {0 | 576 | 1500}
end
end
By default, tcp-mss-adjust is enabled, icmp-unreachable is disabled, and tun-mtu-uplink and
tun-mtu-downlink are set to 0.
To set tun-mtu-uplink and tun-mtu-downlink, use the default TCP MTU value of 1500. This default
configuration prevents packet fragmentation because the FortiAP unit limits the size of TCP packets received
from wireless clients so the packets don’t have to be fragmented before CAPWAP encapsulation.
The tcp-mss-adjust option causes the FortiAP unit to limit the maximum segment size (MSS) of TCP
packets sent by wireless clients. The FortiAP does this by adding a reduced MSS value to the SYN packets sent
by the FortiAP unit when negotiating with a wireless client to establish a session. This results in the wireless client
sending packets that are smaller than the tun-mtu-uplink setting, so that when the CAPWAP headers are
added, the CAPWAP packets have an MTU that matches the tun-mtu-uplink size.
The icmp-unreachable option affects all traffic (UDP and TCP) between wireless clients and the FortiAP unit.
This option causes the FortiAP unit to drop packets that have the "Don't Fragment" bit set in their IP header and
that are large enough to cause fragmentation and then send an ICMP packet -- type 3 "ICMP Destination
unreachable" with code 4 "Fragmentation Needed and Don't Fragment was Set" back to the wireless controller.
This should cause the wireless client to send smaller TCP and UDP packets.
Overriding IP fragmentation settings on a FortiAP

If the FortiAP Profile settings for IP fragmentation are not appropriate for a particular FortiAP, you can override
the settings on that specific unit.
edit FAP321C3X14019926
set override-ip-fragment enable
set ip-fragment-preventing {tcp-mss-adjust | icmp-unreachable}
set tun-mtu-uplink {0 | 576 | 1500}
set tun-mtu-downlink {0 | 576 | 1500}
end
end
LED options
Optionally, the status LEDs on the FortiAP can be kept dark. This is useful in dormitories, classrooms, hotels,
medical clinics, hospitals where the lights might be distracting or annoying to occupants.
On the FortiGate, the LED state is controlled in the FortiAP Profile. By default the LEDs are enabled. The setting
is CLI-only. For example, to disable the LEDs on FortiAP-221C units controlled by the FAP221C-default profile,
enter:

Access point deployment CAPWAP bandwidth formula
set led-state disable
end
You can override the FortiAP Profile LED state setting on an individual FortiAP using the CLI. For example, to
make sure the LEDs are disabled on one specific unit, enter:
set override-led-state enable
set led-state disable
end
The LED state is also controllable from the FortiAP unit itself. By default, the FortiAP follows the FortiAP Profile
setting.
LED Schedules
Use the command below (led-schedule) to assign recurring firewall schedules for illuminating LEDs on the
FortiAP. This entry is only available when led-state is enabled, at which point LEDs will be visible when at
least one of the schedules is valid.
Separate multiple schedule names with a space, as configured under config firewall schedule group
and config firewall schedule recurring.
Syntax
edit {name}
set led-state {enable | disable}
set led-schedules <name>
next
end
CAPWAP bandwidth formula
The following section provides information on how to calculate the control plane CAPWAP traffic load in local
bridging. The formula provided can help estimate the approximate package bandwidth cost. This is important for
knowing precisely how much bandwidth is required on a WAN link for a centralized ForitGate managing hundreds
of access points.
There are multiple factors that might affect the volume of CAPWAP control traffic, including the number of
stations there are and large WiFi events.
The Ethernet/IP/UDP/CAPWAP uplink header cost should be approximately 66 bytes.
The tables below depict basic and commonly used optional CAPWAP bandwidth costs, on a per-AP basis.
Note the following:
l STA: The number of stations associated with the FortiAP.

l ARP scan: Finds hidden devices in your network.

CAPWAP bandwidth formula Access point deployment
l VAP: The number of VAPS held by the FortiAP.

l Radio: The number of radios (maximum of two) enabled by the FortiAP.
Basic per-AP CAPWAP bandwidth costs
Time Payload
Content Package bandwidth cost (bps)
(seconds) (byte)
Echo Req 30 16 (66+16)*8/30=21.86
STA scan 30 25+20*sta (66+25+20*sta)*8/30=24.26+5.3*sta
ARP scan 30 25+18*sta (66+25+18*sta)*8/30=24.26+4.8*sta
STA CAP 30 25+19*sta (66+25+19*sta)*8/30=24.26+5.1*sta
STA stats 1 25+41*sta (66+25+41*sta)*8/1=728.0+328.0*sta
VAP stats 15 40+18*vap (66+40+18*vap)*8/15=56.53+9.6*vap
Radio stats 15 25+25*radio (66+25+25*radio)*8/15=48.53+13.3*radio
Total: 908.7+343.2*sta+9.6*vap+13.3*radio
Commonly used optional per-AP CAPWAP bandwidth costs
Time
Content Payload (byte) Package bandwidth cost (bps)
(seconds)
AP scan 30 25+63*scanned- (66+25+63*scanned-ap)*8/30=24.26+16.8*scanned-ap

ap
932.96+343.2*sta+9.6*vap+13.3*radio+16.8*scanned-
Total:
ap
Enabling WIDS features, LLDP, MESH, FortiPresence, and Client Station Locating
Service can lead to additional bandwidth consumption.
Example:
There are 100 FortiAPs, with 187 stations distributed among them. Each FortiAP holds five VAPs among their
radios, and each enables two radios. The basic CAPWAP bandwidth cost would be:
908.7*100+343.2*187+9.6*5*100+13.3*2*100 = 162.51kbps
Additionally, if two FortiAPs enabled "AP scan", and suppose one scans 99 APs in each scan and the other scans
20 APs in each scan, the additional CAPWAP bandwidth cost would be:
(24.26+16.8*99)+(24.26+16.8*20) = 2 kbps

Access point deployment CAPWAP bandwidth formula
Enabling LLDP protocol

You can enable the LLDP protocol in the FortiAP Profile via the CLI. Each FortiAP using that profile can then send
back information about the switch and port that it is connected to.
To enable LLDP, enter the following:

edit <profile-name>
set lldp enable
end

Wireless Mesh
The access points of a WiFi network are usually connected to the WiFi controller through Ethernet wiring. A
wireless mesh eliminates the need for Ethernet wiring by connecting WiFi access points to the controller by radio.
This is useful where installation of Ethernet wiring is impractical.
Overview of Wireless Mesh

Configuring a meshed WiFi network
Configuring a point-to-point bridge
Overview of Wireless Mesh
The figure below shows a wireless mesh topology.
A wireless mesh is a multiple AP network in which only one FortiAP unit is connected to the wired network. The
other FortiAPs communicate with the controller over a separate backhaul SSID that is not available to regular
WiFi clients. The AP that is connected to the network by Ethernet is called the Mesh Root node. The backhaul
SSID carries CAPWAP discovery, configuration, and other communications that would usually be carried on an
Ethernet connection.
The root node can be a FortiAP unit or the built-in AP of a FortiWiFi unit. APs that serve regular WiFi clients are
called Leaf nodes. Leaf APs also carry the mesh SSID for more distant leaf nodes. A leaf node can connect to the
mesh SSID directly from the root node or from any of the other leaf nodes. This provides redundancy in case of an
AP failure.
All access points in a wireless mesh configuration must have at least one of their radios configured to provide
mesh backhaul communication. As with wired APs, when mesh APs start up they can be discovered by a
FortiGate or FortiWiFi unit WiFi controller and authorized to join the network.

Wireless Mesh Overview of Wireless Mesh
The backhaul SSID delivers the best performance when it is carried on a dedicated radio. On a two-radio FortiAP
unit, for example, the 5GHz radio could carry only the backhaul SSID while the 2.4GHz radio carries one or more
SSIDs that serve users. Background WiFi scanning is possible in this mode.
The backhaul SSID can also share the same radio with SSIDs that serve users. Performance is reduced because
the backhaul and user traffic compete for the available bandwidth. Background WiFi scanning is not available in
this mode. One advantage of this mode is that a two-radio AP can offer WiFi coverage on both bands.
Wireless mesh deployment modes

There are two common wireless mesh deployment modes:
Wireless Mesh Access points are wirelessly connected to a FortiGate or FortiWiFi unit WiFi controller.
WiFi users connect to wireless SSIDs in the same way as on non-mesh WiFi networks.
Two LAN segments are connected together over a wireless link (the backhaul SSID).
Wireless On the leaf AP, the Ethernet connection can be used to provide a wired network. Both
bridging WiFi and wired users on the leaf AP are connected to the LAN segment to which the
root AP is connected.
Firmware requirements
All FortiAP units that will be part of the wireless mesh network must be upgraded to FAP firmware version 5.0
build 003. FortiAP-222B units must have their BIOS upgraded to version 400012. The FortiWiFi or FortiGate unit
used as the WiFi controller must be running FortiOS 5.0.
Types of wireless mesh

A WiFi mesh can provide access to widely-distributed clients. The root mesh AP which is directly connected to the
WiFi controller can be either a FortiAP unit or the built-in AP of a FortiWiFi unit that is also the WiFi controller.
FortiAP units used as both mesh root AP and leaf AP

Overview of Wireless Mesh Wireless Mesh
FortiWiFi unit as root mesh AP with FortiAP units as leaf APs
An alternate use of the wireless mesh functionality is as a point-to-point relay. Both wired and WiFi users on the
leaf AP side are connected to the LAN segment on the root mesh side.

Wireless Mesh Overview of Wireless Mesh
Point-to-point wireless mesh

Configuring a meshed WiFi network Wireless Mesh
Fast-roaming for mesh backhaul link

Mesh implementations for leaf FortiAP can perform background scan when the leaf AP is associated to root.
Various options for background scanning can be configured with the CLI. See Mesh variables on page 200 for
more details.
Configuring a meshed WiFi network
You need to:
l Create the mesh root SSID.

l Create the FortiAP profile.
l Configure mesh leaf AP units.
l Configure the mesh root AP, either a FortiWiFi unit’s Local Radio or a FortiAP unit.
l Authorize the mesh branch/leaf units when they connect to the WiFi Controller.
l Create security policies.
This section assumes that the end-user SSIDs already exist.
Creating the mesh root SSID

The mesh route SSID is the radio backhaul that conveys the user SSID traffic to the leaf FortiAPs.
To configure the mesh root SSID
2. Enter a Name for the WiFi interface.
3. In Traffic Mode, select Mesh Downlink.
4. Enter the SSID .
5. Set Security Mode to WPA2 Personal and enter the Pre-shared key.
Remember the key, you need to enter it into the configurations of the leaf FortiAPs.
6. Select OK.
Creating the FortiAP profile

Create a FortiAP profile for the meshed FortiAPs. If more than one FortiAP model is involved, you need to create
a profile for each model. Typically, the profile is configured so that Radio 1 (5GHz) carries the mesh backhaul
SSID while Radio 2 (2.4GHz) carries the SSIDs to which users connect.
The radio that carries the backhaul traffic must not carry other SSIDs. Use the Select SSIDs option and choose
only the backhaul SSID. Similarly, the radio that carries user SSIDs, should not carry the backhaul. Use the Select
SSIDs option and choose the networks that you want to provide.
For more information, see Configuring a WiFi LAN on page 47.
Configuring the mesh root FortiAP

The mesh root AP can be either a FortiWiFi unit’s built-in AP or a FortiAP unit.

Wireless Mesh Configuring a meshed WiFi network
To enable a FortiWiFi unit’s Local Radio as mesh root - web-based manager
1. Go to WiFi Controller > Local WiFi Radio.

2. Select Enable WiFi Radio.
3. In SSID , select Select SSIDs, then select the mesh root SSID.
4. Optionally, adjust TX Power or select Auto Tx Power Control.
5. Select Apply.
In a network with multiple wireless controllers, make sure that each mesh root has a
unique SSID. Other controllers using the same mesh root SSID might be detected as
fake or rogue APs. Go to WiFi & Switch Controller > SSID to change the SSID.
To configure a network interface for the mesh root FortiAP unit
1. On the FortiGate unit, go to Network > Interfaces.

2. Select the interface where you will connect the FortiAP unit, and edit it.
3. Make sure that Role is LAN.
4. In Addressing mode, select Dedicated to Extension Device.
5. In IP/Network Mask, enter an IP address and netmask for the interface.
DHCP will provide addresses to connected devices. To maximize the number of available addresses, the interface
address should end with 1, for example 192.168.10.1.
6. Select OK.
At this point you can connect the mesh root FortiAP, as described next. If you are going to configure leaf FortiAPs
through the wireless controller (see "Configuring a meshed WiFi network" on page 97), it would be convenient to
leave connecting the root unit for later.
To enable the root FortiAP unit
1. Connect the root FortiAP unit’s Ethernet port to the FortiGate network interface that you configured for it.
If the root FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is
still missing after a minute or two, power cycle the root FortiAP unit and try again.
3. Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.
4. Right-click the FortiAP entry and select Authorize.
Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about
two minutes, the state changes to Online.
5. Select OK.
You might need to select Refresh a few times before the FortiAP shows as Online.
Configuring the leaf mesh FortiAPs

The FortiAP units that will serve as leaf nodes must be preconfigured. This involves changing the FortiAP unit
internal configuration.You can do this by direct connection or through the FortiGate wireless controller.

Configuring a meshed WiFi network Wireless Mesh
Method 1: Direct connection to the FortiAP
1. Connect a computer to the FortiAP unit's Ethernet port. Configure the computer's IP as 192.168.1.3.
2. Telnet to 192.168.1.2. Login as admin. By default, no password is set.
3. Enter the following commands, substituting your own SSID and password (pre-shared key):
cfg -a MESH_AP_TYPE=1
cfg -a MESH_AP_SSID=fortinet.mesh.root
cfg -a MESH_AP_PASSWD=hardtoguess
cfg -c
exit
4. Disconnect the computer.
5. Power down the FortiAP.
6. Repeat the preceding steps for each branch FortiAP.
Method 2: Connecting through the FortiGate unit
1. Connect the branch FortiAP unit’s Ethernet port to the FortiGate network interface that you configured for
FortiAPs. Connect the FortiAP unit to a power source unless POE is used.
If the FortiAP unit is not listed, wait 15 seconds and select Refresh. Repeat if necessary. If the unit is still missing
after a minute or two, power cycle the FortiAP unit and try again.
3. Select the discovered FortiAP unit and authorize it. Click Refresh every 10 seconds until the State indicator is
green.
4. Right-click the FortiAP and select >_Connect to CLI. The CLI Console window opens. Log in as "admin".
5. Enter the following commands, substituting your own SSID and password (pre-shared key):
cfg -a MESH_AP_SSID=fortinet.mesh.root
cfg -a MESH_AP_PASSWD=hardtoguess
cfg -c
exit
6. Disconnect the branch FortiAP and delete it from the Managed FortiAP list.
7. Repeat the preceding steps for each branch FortiAP.
Authorizing leaf APs

When the root FortiAP is connected and online, apply power to the pre-configured leaf FortiAPs. The leaf
FortiAPs will connect themselves wirelessly to the WiFi Controller through the mesh network. You must authorize
each unit.
1. Go to WiFi & Switch Controller > Managed FortiAPs. Periodically select Refresh until the FortiAP unit is
listed. This can take up to three minutes.
The State of the FortiAP unit should be Waiting for Authorization.
2. Right-click the FortiAP entry and choose your profile from the Assign Profile submenu.
3. Right-click the FortiAP entry and select Authorize.
Initially, the State of the FortiAP unit is Offline. Periodically click Refresh to update the status. Within about
two minutes, the state changes to Online.

Wireless Mesh Configuring a point-to-point bridge
Creating security policies

You need to create security policies to permit traffic to flow from the end-user WiFi network to the network
interfaces for the Internet and other networks. Enable NAT.
Viewing the status of the mesh network

Go to WiFi & Switch Controller > Managed FortiAPs to view the list of APs.
The Connected Via field lists the IP address of each FortiAP and uses icons to show whether the FortiAP is
connected by Ethernet or Mesh.
Ethernet
Mesh
If you mouse over the Connected Via information, a topology displays, showing how the FortiGate wireless
controller connects to the FortiAP.
Configuring a point-to-point bridge
You can create a point-to-point bridge to connect two wired network segments using a WiFi link. The effect is the
same as connecting the two network segments to the same wired switch.
You need to:

Configuring a point-to-point bridge Wireless Mesh
l Configure a backhaul link and root mesh AP as described in Configuring a point-to-point bridge on page 99.
Note: The root mesh AP for a point-to-point bridge must be a FortiAP unit, not the internal AP of a FortiWiFi unit.
l Configure bridging on the leaf AP unit.
To configure the leaf AP unit for bridged operation - FortiAP web-based manager
1. With your browser, connect to the FortiAP unit web-based manager.

You can temporarily connect to the unit’s Ethernet port and use its default address: 192.168.1.2.
2. Enter:
Operation Mode Mesh
Mesh AP SSID fortinet-ap
Mesh AP Password fortinet
Ethernet Bridge Select
3. Select Apply.
4. Connect the local wired network to the Ethernet port on the FortiAP unit.
Users are assigned IP addresses from the DHCP server on the wired network connected to the root mesh AP unit.
To configure a FortiAP unit as a leaf AP - FortiAP CLI

cfg -a MESH_AP_SSID=fortinet-ap
cfg -a MESH_AP_PASSWD=fortinet
cfg -a MESH_ETH_BRIDGE=1
cfg -c

Hotspot 2.0 Configuring a point-to-point bridge
Hotspot 2.0
Hotspot 2.0 Access Network Query Protocol (ANQP) is a query and response protocol that defines seamless
roaming services offered by an AP. The following CLI commands are available under config wireless-
controller, to configure Hotspot 2.0 ANQP.
Syntax
config wireless-controller hotspot20 anqp-3gpp-cellular
edit {name}
config mcc-mnc-list
edit {id}
set id {integer}
set mcc {string}
set mnc {string}
next
next
end
config wireless-controller hotspot20 anqp-ip-address-type

edit {name}
next
end
config wireless-controller hotspot20 anqp-nai-realm

edit {name}
config nai-list
edit {name}
set encoding {enable | disable}
config eap-method
edit {index}
set index {integer}
set method {option}
config auth-param
edit {index}
set index {integer}
set id {option}
set val {option}
next
next
next
next
end
config wireless-controller hotspot20 anqp-network-auth-type

edit {name}
set auth-type {option}
set url {string}
next
end

Configuring a point-to-point bridge Hotspot 2.0
config wireless-controller hotspot20 anqp-roaming-consortium

edit {name}
config oi-list
edit {index}
set index {integer}
set oi {string}
set comment {string}
next
next
end
config wireless-controller hotspot20 anqp-venue-name

edit {name}
config value-list
edit {index}
set index {integer}
set lang {string}
set value {string}
next
next
end
config wireless-controller hotspot20 h2qp-conn-capability

edit {name}
set icmp-port {option}
set ftp-port {option}
set ssh-port {option}
set http-port {option}
set tls-port {option}
set pptp-vpn-port {option}
set voip-tcp-port {option}
set voip-udp-port {option}
set ikev2-port {option}
set ikev2-xx-port {option}
set esp-port {option}
next
end
config wireless-controller hotspot20 h2qp-operator-name

edit {name}
config value-list
edit {index}
set index {integer}
set lang {string}
set value {string}
next
next
end
config wireless-controller hotspot20 h2qp-osu-provider

edit {name}
config friendly-name
edit {index}
set index {integer}
set lang {string}
set friendly-name {string}

Hotspot 2.0 Configuring a point-to-point bridge
next
set server-uri {string}
set osu-method {option}
set osu-nai {string}
config service-description
edit {service-id}
set service-id {integer}
set lang {string}
set service-description {string}
next
set icon {string}
next
end
config wireless-controller hotspot20 h2qp-wan-metric

edit {name}
set link-status {option}
set symmetric-wan-link {option}
set link-at-capacity {enable | disable}
set uplink-speed {integer}
set downlink-speed {integer}
set uplink-load {integer}
set downlink-load {integer}
set load-measurement-duration {integer}
next
end
config wireless-controller hotspot20 hs-profile

edit {name}
set access-network-type {option}
set access-network-internet {enable | disable}
set access-network-asra {enable | disable}
set access-network-esr {enable | disable}
set access-network-uesa {enable | disable}
set venue-group {option}
set venue-type {option}
set hessid {mac address}
set proxy-arp {enable | disable}
set l2tif {enable | disable}
set pame-bi {enable | disable}
set anqp-domain-id {integer}
set domain-name {string}
set osu-ssid {string}
set gas-comeback-delay {integer}
set gas-fragmentation-limit {integer}
set dgaf {enable | disable}
set deauth-request-timeout {integer}
set wnm-sleep-mode {enable | disable}
set bss-transition {enable | disable}
set venue-name {string}
set roaming-consortium {string}
set oper-friendly-name {string}
config osu-provider
edit {name}
next
set wan-metrics {string}

Configuring a point-to-point bridge Hotspot 2.0
set network-auth {string}

set 3gpp-plmn {string}
set conn-cap {string}
set qos-map {string}
set ip-addr-type {string}
next
end
config wireless-controller hotspot20 icon

edit {name}
config icon-list
edit {name}
set lang {string}
set file {string}
set type {option}
set width {integer}
set height {integer}
next
next
end
config wireless-controller hotspot20 qos-map

edit {name}
config dscp-except
edit {index}
set index
set dscp
set up
next
config dscp-range
edit {index}
set index
set up
set low
set high
next
next
end

Combining WiFi and wired networks with a software switch

FortiAP local bridging (Private Cloud-Managed AP)
Using bridged FortiAPs to increase scalability
A WiFi network can be combined with a wired LAN so that WiFi and wired clients are on the same subnet. This is
a convenient configuration for users. Note that software switches are only available if your FortiGate is in
Interface mode.
Wireless Mesh features cannot be used in conjunction with this configuration because
they enable the FortiAP Local Bridge option.
To create the WiFi and wired LAN configuration, you need to:
l Configure the SSID so that traffic is tunneled to the WiFi controller.

l Configure a software switch interface on the FortiGate unit with the WiFi and internal network interface as
members.
l Configure Captive Portal security for the software switch interface.
To configure the SSID - web-based manager
1. Go to WiFi & Switch Controller > SSID and select Create New.

2. Enter:
Interface name A name for the new WiFi interface, homenet_if for example.
Traffic Mode Tunnel to Wireless Controller
SSID The SSID visible to users, homenet for example.
Security Mode Configure security as you would for a regular WiFi network.
Data Encryption
Preshared Key
3. Select OK.
4. Go to WiFi & Switch Controller > Managed FortiAPs, select the FortiAP unit for editing.
5. Authorize the FortiAP unit.
The FortiAP unit can carry regular SSIDs in addition to the Bridge SSID.

Combining WiFi and wired networks with a software switch Combining WiFi and wired networks with a software switch
To configure the SSID - CLI
This example creates a WiFi interface “homenet_if” with SSID “homenet” using WPA-Personal security,
passphrase “Fortinet1”.
edit "homenet_if "
set vdom "root"
set ssid "homenet "
set passphrase "Fortinet1"
end
edit FAP22B3U11005354
set admin enable
set vaps "homenet_if "
end
To configure the FortiGate software switch - web-based manager
1. Go to Network > Interfaces and select Create New > Interface.

2. Enter:
Interface Name A name for the new interface, homenet_nw for example.
Type Software Switch
Physical Interface Members Add homenet_if and the internal network interface.
Addressing mode Select Manual and enter an address, for example

172.16.96.32/255.255.255.0
DHCP Server Enable and configure an address range for clients.
Security Mode Select Captive Portal. Add the permitted User Groups.
3. Select OK.
To configure the FortiGate unit - CLI

edit homenet_nw
set ip 172.16.96.32 255.255.255.0
set type switch
set security-mode captive-portal
set security-groups "Guest-group"
end
edit homenet_nw
set member "homenet_if" "internal"
end

Combining WiFi and wired networks with a software switch FortiAP local bridging (Private Cloud-Managed AP)
VLAN configuration
If your environment uses VLAN tagging, you assign the SSID to a specific VLAN in the CLI. For example, to
assign the homenet_if interface to VLAN 100, enter:
edit "homenet_if "
set vlanid 100
end
Additional configuration
The configuration described above provides communication between WiFi and wired LAN users only. To provide
access to other networks, create appropriate firewall policies between the software switch and other interfaces.
FortiAP local bridging (Private Cloud-Managed AP)
A FortiAP unit can provide WiFi access to a LAN, even when the wireless controller is located remotely. This
configuration is useful for the following situations:
l Installations where the WiFI controller is remote and most of the traffic is local or uses the local Internet gateway
l Wireless-PCI compliance with remote WiFi controller
l Telecommuting, where the FortiAP unit has the WiFi controller IP address pre-configured and broadcasts the office
SSID in the user’s home or hotel room. In this case, data is sent in the wireless tunnel across the Internet to the
office and you should enable encryption using DTLS.

FortiAP local bridging (Private Cloud-Managed AP) Combining WiFi and wired networks with a software switch
Remotely-managed FortiAP providing WiFi access to local network
On the remote FortiGate wireless controller, the WiFi SSID is created with the Bridge with FortiAP Interface
option selected. In this mode, no IP addresses are configured. The FortiAP unit’s WiFi and Ethernet interfaces
behave as a switch. WiFi client devices obtain IP addresses from the same DHCP server as wired devices on the
LAN.
The Local Bridge feature cannot be used in conjunction with Wireless Mesh features.
Block-Intra-SSID Traffic is available in Bridge mode. This is useful in

hotspotdeployments managed by a central FortiGate, but would also be useful in
cloud deployments. Previously, this was only supported in Tunnel mode.
To configure a FortiAP local bridge - web-based manager
2. Enter:
Interface name A name for the new WiFi interface.
Traffic Mode Local bridge with FortiAP's Interface
SSID The SSID visible to users.

Combining WiFi and wired networks with a software switch FortiAP local bridging (Private Cloud-Managed AP)
Security Mode Configure security as you would for a regular WiFi network.
Data Encryption
Preshared Key
3. Select OK.
4. Go to WiFi & Switch Controller > Managed FortiAPs and select the FortiAP unit for editing.
5. Authorize the FortiAP unit.
The FortiAP unit can carry regular SSIDs in addition to the Bridge SSID.
SSID configured for Local Bridge operation
To configure a FortiAP local bridge - CLI
This example creates a WiFi interface “branchbridge” with SSID “LANbridge” using WPA-Personal security,
passphrase “Fortinet1”.
edit "branchbridge"
set vdom "root"
set ssid "LANbridge"
set local-bridging enable
end
set admin enable
set vaps "branchbridge"
end

Using bridged FortiAPs to increase scalability Combining WiFi and wired networks with a software switch
Note that:
l Disabling local-bridging forcefully disables local-standalone. Also,

disabling either local-bridging or local-standalone forcefully disables
intra-vap-privacy.
l Enabling intra-vap-privacy forcefully disables local-standalone.
l Enabling local-standalone forcefully enables local-bridging also.
Continued FortiAP operation when WiFi controller connection is down

The wireless controller, or the connection to it, might occasionally become unavailable. During such an outage,
clients already associated with a bridge mode FortiAP unit continue to have access to the WiFi and wired
networks. Optionally, the FortiAP unit can also continue to authenticate users if the SSID meets these conditions:
l Traffic Mode is Local bridge with FortiAP’s Interface.

In this mode, the FortiAP unit does not send traffic back to the wireless controller.
l Security Mode is WPA2 Personal.
These modes do not require the user database. In WPA2 Personal authentication, all clients use the same pre-
shared key which is known to the FortiAP unit.
l Allow New WiFi Client Connections When Controller is down is enabled.
This field is available only if the other conditions have been met.
The “LANbridge” SSID example would be configured like this in the CLI:
edit "branchbridge"
set vdom "root"
set ssid "LANbridge"
set local-bridging enable
set local-authentication enable
end
Using bridged FortiAPs to increase scalability
The FortiGate wireless controller can support more FortiAP units in local bridge mode than in the normal mode.
But this is only true if you configure some of your FortiAP units to operate in remote mode, which supports only
local bridge mode SSIDs.
The Managed FortAP page (WiFi & Switch Controller > Managed FortiAPs) shows at the top right the
current number of Managed FortiAPs and the maximum number that can be managed, “5/64” for example. The
maximum number, however, is true only if all FortiAP units operate in remote mode. For more detailed
information, consult the Maximum Values Table. For each FortiGate model, there are two maximum values for
managed FortiAP units: the total number of FortiAPs and the number of FortiAPs that can operate in normal
mode.

Combining WiFi and wired networks with a software switch Using bridged FortiAPs to increase scalability
To configure FortiAP units for remote mode operation
1. Create at least one SSID with Traffic Mode set to Local bridge with FortiAP's Interface.
2. Create a custom AP profile that includes only local bridge SSIDs.
3. Configure each managed FortiAP unit to use the custom AP profile. You also need to set the FortiAP unit’s wtp-
mode to remote, which is possible only in the CLI. The following example uses the CLI both to set wtp-mode
and select the custom AP profile:
set wtp-mode remote
set wtp-profile 220B_bridge
end

Using Remote WLAN FortiAPs
Remote WLAN FortiAP models enable you to provide a pre-configured WiFi access point to a remote or traveling
employee. Once plugged in at home or in a hotel room, the FortiAP automatically discovers the enterprise
FortiGate WiFi controller over the Internet and broadcasts the same wireless SSID used in the corporate office.
Communication between the WiFi controller and the FortiAP is secure, eliminating the need for a VPN.
Split tunneling
By default, all traffic from the remote FortiAP is sent to the FortiGate WiFi controller. If split tunneling is
configured, only traffic destined for the corporate office networks is routed to the FortiGate unit. Other general
Internet traffic is routed unencrypted through the local gateway. Split tunneling avoids loading the FortiGate unit
with unnecessary traffic and allows direct access to local private networks at the FortiAP's location even if the
connection to the WiFi controller goes down.
Note: Split tunneling in WiFi networks differs in implementation from split tunneling in VPN configurations.
By default, split tunneling options are not visible in the FortiGate GUI. You can make these options visible using
the following CLI command:
set gui-fortiap-split-tunneling enable
end
Split tunneling is configured in Managed FortiAPs, FortiAP Profiles, and enabled in the SSID .
Configuring the FortiGate for remote FortiAPs
This section assumes that you have already defined SSIDs and now want to make them available to remote
FortiAPs.
l Create FortiAP profiles for the Remote LAN FortiAP models

l If split tunneling will be used
l configure override split tunneling in Managed FortiAPs
l enable Split Tunneling in the SSID
l configure the split tunnel networks in the FortiAP profile
Override Split Tunneling

Go to WiFi & Switch Controller > Managed FortiAPs and edit your managed APs. When preconfiguring the
AP to connect to your FortiGate WiFi controller, you can choose to override split tunneling, optionally including
the local subnet of the FortiAP.
Creating FortiAP profiles

If you were not already using Remote LAN FortiAP models, you will need to create FortiAP profiles for them. In
the FortiAP profile, you specify the SSIDs that the FortiAP will broadcast. For more information, see "Creating a
FortiAP Profile" on page 50.

Using Remote WLAN FortiAPs Configuring the FortiGate for remote FortiAPs
Configuring split tunneling - FortiGate GUI

Go to WiFi & Switch Controller > SSID and edit your SSID. In the WiFi Settings section, enable Split
Tunneling.
Go to WiFi Controller > FortiAP Profiles and edit the FortiAP Profile(s) that apply to the AP types used in the
WiFi network. In the Split Tunneling section, enable Include Local Subnet and Split Tunneling Subnet(s),
where you can enter a list all of the destination IP address ranges that should not be routed through the the
FortiGate WiFi controller. Packets for these destinations will instead be routed through the remote gateway local
to the FortiAP.
The list of split tunneling subnets includes public Internet destinations and private subnets local to the FortiAP.
Split tunneling public Internet destinations reduces traffic through the FortiGate unit. Split tunneling local private
subnets allows these networks to be accessible to the client behind the FortiAP. Otherwise, private network IP
destinations are assumed to be behind the FortiGate WiFi controller.
Configuring split tunneling - FortiGate CLI

In this example, split tunneling is configured on the example-ssid WiFi network. On FortiAP model 21D, traffic
destined for the 192.168.x.x range will not be routed through the FortiGate WiFi controller. This private IP
address range is typically used as a LAN by home routers.
edit example-ssid
set split-tunneling enable
end

edit FAP21D-default
set split-tunneling-acl-local-ap-subnet enable
config split-tunneling-acl
edit 1
set dest-ip 192.168.0.0 255.255.0.0
end
end
To enter multiple subnets, create a split-tunneling-acl entry for each one.
Overriding the split tunneling settings on a FortiAP

If the FortiAP Profile split tunneling settings are not appropriate for a particular FortiAP, you can override the
settings on that unit.
set override-split-tunnel enable
set split-tunneling-acl-local-ap-subnet enable
config split-tunneling-acl
edit 1
set dest-ip 192.168.10.0 255.255.255.0
end
end

Configuring the FortiAP units Using Remote WLAN FortiAPs
Configuring the FortiAP units
Prior to providing a Remote WLAN FortiAP unit to an employee, you need to preconfigure the AP to connect to
your FortiGate WiFi controller.
To pre-configure a FortiAP
1. Connect the FortiAP to the FortiGate unit.

2. Go to WiFi & Switch Controller > Managed FortiAPs and wait for the FortiAP to be listed. Click Refresh
periodically to see the latest information. Note the Connected Via IP address.
3. Go to Dashboard. In the CLI Console, log into the FortiAP CLI.
For example, if the IP address is 192.168.1.4, enter:
exec telnet 192.168.1.4
Enter admin at the login prompt. By default, no password is set.
4. Enter the following commands to set the FortiGate WiFi controller IP address. This should be the FortiGate
Internet-facing IP address, in this example 172.20.120.142.
cfg -a AC_IPADDR_1=172.20.120.142
cfg -c
5. Enter exit to log out of the FortiAP CLI.
Preauthorizing FortiAP units
By preauthorizing FortiAP units, you facilitate their automatic authorization on the network. Also, you can assign
each unit a unique name, such as the employee's name, for easier tracking.
1. Go to WiFi & Switch Controller > Managed FortiAPs and create a new entry.
2. Enter the Serial Number of the FortiAP unit and give it a Name. Select the appropriate FortiAP Profile.
3. Click OK.
Repeat this process for each FortiAP.

Features for high-density deployments
High-density environments such as auditoriums, classrooms, and meeting rooms present a challenge to WiFi
providers. When a large number of mobile devices try to connect to a WiFi network, difficulties arise because of
the limited number of radio channels and interference between devices.
FortiOS and FortiAP devices provide several tools to mitigate the difficulties of high-density environments.
Power save feature
Occasionally, voice calls can become disrupted. One way to alleviate this issue is by controlling the power save
feature, or to disable it altogether.
Manually configure packet transmit optimization settings by entering the following command:
edit <name>
config <radio-1> | <radio-2>
set transmit-optimize {disable | power-save | aggr-limit | retry-limit | sendbar}
l disable: Disable transmit optimization.
l power-save: Mark a client as power save mode if excessive transmit retries happen.
l aggr-limit: Set aggregation limit to a lower value when data rate is low.
l retry-limit: Set software retry limit to a lower value when data rate is low.
l send-bar: Do not send BAR frame too often.
11n radio powersave optimization

The following powersave-optimize parameters (under config radio) are used for 11n radios to optimize
system performance for specific situations.
l tim: Set traffic indication map (TIM) bit for client in power save mode. TIM bit mask indicates to any sleeping
listening stations if the AP has any buffered frames present. If enabled, the AP will always indicate to the connected
client that there is a packet waiting in the AP, so it will help to prevent the client from entering a sleep state.
l ac-vo: Use Access Category (AC) Voice (VO) priority to send packets in the power save queue. AC VO is one of the
highest classes/priority levels used to ensure quality of service (QoS). If enabled, when a client returns from a sleep
state, the AP will send its buffered packet using a higher priority queue, instead of the normal priority queue.
l no-obss-scan: Do not put Overlapping Basic Service Set (OBSS), or high-noise (i.e. non-802.11), scan IE into a
Beacon or Probe Response frame.
l no-11b-rate: Do not send frame using 11b data rate.
l client-rate-follow: Adapt transmitting PHY rate with receiving PHY rate from client. If enabled, the AP will
integrate the current client's transmission PHY rate into its rate adaptation algorithm for transmitting.

Broadcast packet suppression Features for high-density deployments
Broadcast packet suppression
Broadcast packets are sent at a low data rate in WiFi networks, consuming valuable air time. Some broadcast
packets are unnecessary or even potentially detrimental to the network and should be suppressed.
ARP requests and replies could allow clients to discover each other's IP addresses. On most WiFi networks, intra-
client communication is not allowed, so these ARP requests are of no use, but they occupy air time.
DHCP (upstream) should be allowed so that clients can request an IP address using DHCP.
DHCP (downstream) should be suppressed because it would allow a client to provide DHCP service to other
clients. Only the AP should do this.
NetBIOS is a Microsoft Windows protocol for intra-application communication. Usually this is not required in high-
density deployments.
IPv6 broadcast packets can be suppressed if your network uses IPv4 addressing.
You can configure broadcast packet suppression in the CLI. The following options are available for broadcast
suppression:
edit <name>
set broadcast-suppression {dhcp-up | dhcp-down | dhcp-starvation | arp-known | arp-
unknown | arp-reply | arp-poison | arp-proxy | netbios-ns | netbios-ds | ipv6 |
all-other-mc | all-other-bc}
end
dhcp-starvation helps prevent clients from depleting the DHCP address pool by making multiple requests.
arp-poison helps prevent clients from spoofing ARP messages.
Because of all these specific multicast and broadcast packet types, the two options all-other-mc and all-
other-bc help suppress multicast (mc) and broadcast (bc) packets that are not covered by any of the specific
options.
Multicast to unicast conversion
Multicast data such as streaming audio or video are sent at a low data rate in WiFi networks. This causes them to
occupy considerable air time. FortiOS provides a multicast enhancement option that converts multicast streams
to unicast. A unicast stream is sent to each client at high data rate that makes more efficient use of air time. You
can configure multicast-to-unicast conversion in the CLI:
edit <vap_name>
set multicast-enhance enable
end

Features for high-density deployments Ignore weak or distant clients
Ignore weak or distant clients
Clients beyond the intended coverage area can have some impact on your high-density network. Your APs will
respond to these clients' probe signals, consuming valuable air time. You can configure your WiFi network to
ignore weak signals that most likely come from beyond the intended coverage area. The settings are available in
the CLI:
edit <vap_name>
set probe-resp-suppression enable
set probe-resp-threshold <level_int>
end
vap_name is the SSID name.

probe-resp-threshold is the signal strength in dBm below which the client is ignored. The range is -95 to -
20dBm. The default level is -80dBm.
Turn off 802.11b protocol
By disabling support for the obsolete 802.11b protocol, you can reduce the air time that data frames occupy.
These signals will now be sent at a minimum of 6Mbps, instead of 1Mbps. You can set this for each radio in the
FortiAP profile, using the CLI:
edit <name_string>
config radio-1
set powersave-optimize no-11b-rate
end
Disable low data rates
Each of the 802.11 protocols supports several data rates. By disabling the lowest rates, air time is conserved,
allowing the channel to serve more users. You can set the available rates for each 802.11 protocol: a, b, g, n, ac.
Data rates set as Basic are mandatory for clients to support. Other specified rates are supported.
The 802.11 a, b, and g protocols are specified by data rate. 802.11a can support 6,9,12, 18, 24, 36, 48, and 54
Mb/s. 802.11b/g can support 1, 2, 5.5, 6, 9,12, 18, 24, 36, 48, 54 Mb/s. Basic rates are specified with the suffix
"basic", "12-basic" for example. The capabilities of expected client devices need to be considered when deciding
the lowest Basic rate.
The 802.11n and ac protocols are specified by the Modulation and Coding Scheme (MCS) Index and the number
of spatial streams.
l 802.11n with 1 or 2 spatial streams can support mcs0/1, mcs1/1, mcs2/1, mcs3/1, mcs4/1, mcs5/1, mcs6/1,
mcs7/1,mcs8/2,mcs9/2, mcs10/2, mcs11/2, mcs12/2, mcs13/2, mcs14/2, mcs15/2.
l 802.11n with 3 or 4 spatial streams can support mcs16/3, mcs17/3, mcs18/3, mcs19/3, mcs20/3, mcs21/3,
mcs22/3, mcs23/3, mcs24/4, mcs25/4, mcs26/4, mcs27/4, mcs28/4, mcs29/4, mcs30/4, mcs31/4.

Limit power Features for high-density deployments
l 802.11ac with 1 or 2 spatial streams can support mcs0/1, mcs1/1, mcs2/1, mcs3/1, mcs4/1, mcs5/1, mcs6/1,
mcs7/1, mcs8/1, mcs9/1, mcs0/2, mcs1/2, mcs2/2, mcs3/2, mcs4/2, mcs5/2, mcs6/2, mcs7/2, mcs8/2, mcs9/2.
l 802.11ac with 3 or 4 spatial streams can support mcs0/3, mcs1/3, mcs2/3, mcs3/3, mcs4/3, mcs5/3, mcs6/3,
mcs7/3, mcs8/3, mcs9/3, mcs0/4, mcs1/4, mcs2/4, mcs3/4, mcs4/4, mcs5/4, mcs6/4, mcs7/4, mcs8/4, mcs9/4
Here are some examples of setting basic and supported rates.
edit <vap_name>
set rates-11a 12-basic 18 24 36 48 54
set rates-11bg 12-basic 18 24 36 48 54
set rates-11n-ss34 mcs16/3 mcs18/3 mcs20/3 mcs21/3 mcs22/3 mcs23/3 mcs24/4 mcs25/4
set rates-11ac-ss34 mcs0/3 mcs1/3 mcs2/3 mcs9/4 mcs9/3
end
Limit power
High-density deployments usually cover a small area that has many clients. Maximum AP signal power is usually
not required. Reducing the power reduces interference between APs. Fortinet recommends that you use FortiAP
automatic power control. You can set this in the FortiAP profile.
1. Go to WiFi & Switch Controller > FortiAP Profiles and edit the profile for your AP model.
2. For each radio, enable Auto TX Power Control and set the TX Power Low and TX Power High levels. The
default range of 10 to 17dBm is recommended.
Use frequency band load-balancing
In a high-density environment is important to make the best use of the two WiFi bands, 2.4GHz and 5GHz. The
5GHz band has more non-overlapping channels and receives less interference from non-WiFi devices, but not all
devices support it. Clients that are capable of 5GHz operation should be encouraged to use 5GHz rather than the
2.4GHz band.
To load-balance the WiFi bands, you enable Frequency Handoff in the FortiAP profile. In the FortiGate web-
based manager, go to WiFi & Switch Controller > FortiAP Profiles and edit the relevant profile. Or, you can
use the CLI:
config radio-1
set frequency-handoff enable
end
The FortiGate wireless controller continuously performs a scan of all clients in the area and records their signal
strength (RSSI) on each band. When Frequency Handoff is enabled, the AP does not reply to clients on the
2.4GHz band that have sufficient signal strength on the 5GHz band. These clients can associate only on the
5GHz band. Devices that support only 2.4GHz receive replies and associate with the AP on the 2.4GHz band.
Setting the handoff RSSI threshold

The FortiAP applies load balancing to a client only if the client has a sufficient signal level on 5GHz. The
minimum signal strength threshold is set in the FortiAP profile, but is accessible only through the CLI:

Features for high-density deployments AP load balancing

set handoff-rssi 25
end
handoff-rssi has a range of 20 to 30. RSSI is a relative measure. The higher the number, the stronger the
signal.
AP load balancing
The performance of an AP is degraded if it attempts to serve too many clients. In high-density environments,
multiple access points are deployed with some overlap in their coverage areas. The WiFi controller can manage
the association of new clients with APs to prevent overloading.
To load-balance between APs, enable AP Handoff in the FortiAP profile. In the FortiGate web-based manager,
go to WiFi & Switch Controller > FortiAP Profiles and edit the relevant profile. Or, you can use the CLI:
config radio-1
set ap-handoff enable
end
When an AP exceeds the threshold (the default is 30 clients), the overloaded AP does not reply to a new client
that has a sufficient signal at another AP.
Setting the AP load balance threshold

The thresholds for AP handoff are set in the FortiAP profile, but is accessible only through the CLI:
set handoff-sta-thresh 30
set handoff-rssi 25
end
handoff-sta-thresh sets the number of clients at which AP load balancing begins. It has a range of 5 to 35.
handoff-rssi Sets the minimum signal strength that a new client must have at an alternate AP for the
overloaded AP to ignore the client. It has a range of 20 to 30. RSSI is a relative measure. The higher the number,
the stronger the signal.
Application rate-limiting
To prevent particular application types from consuming too much bandwidth, you can use the FortiOS Application
Control feature.
1. Go to Security Profiles > Application Control.

You can use the default profile or create a new one.
2. Click the category, select Traffic Shaping and then select the priority for the category.
Repeat for each category to be controlled.
3. Select Apply.
4. Go to Policy & Objects > IPv4 Policy and edit your WiFi security policy.

AP Group management and dynamic VLAN assignment Features for high-density deployments
5. In Security Profiles, set Application Control ON and select the security profile that you edited.
6. Select OK.
AP Group management and dynamic VLAN assignment
The FortiGate can create FortiAP Groups, under WiFi & Switch Controller > Managed Devices > Managed
FortiAPs by selecting Create New > Managed AP Group, where multiple APs can be managed. AP grouping
allows specific profile settings to be applied to many APs all at once that belong to a certain AP group, simplifying
the administrative workload.
Note that each AP can only belong to one group.
In addition, VLANs can be assigned dynamically based on the group which an AP belongs. When defining an
SSID, under WiFi & Switch Controller > SSID , a setting called VLAN Pooling can be enabled where you
can either assign the VLAN ID of the AP group the device is connected to, to each device as it is detected, or to
always assign the same VLAN ID to a specific device. Dynamic VLAN assignment allows the same SSID to be
deployed to many APs, avoiding the need to produce multiple SSIDs.
Sharing Tunnel SSIDs within a single managed AP between VDOMs as a Virtual

AP for multi-tenancy
This feature provides the ability to move a tunnel mode VAP into a VDOM, similar to an interface/VLAN in
VDOMs. FortiAP is registered into the root VDOM.
Within a customer VDOM, customer VAPs can be created/added. In the root VDOM, the customer VAP can be
added to the registered FortiAP. Any necessary firewall rules and interfaces can be configured between the two
VDOMs.
Syntax
set wtp-share {enable | disable}
end
FortiAP LED Blinking
This feature allows the administrator to select a FortiAP from the FortiCloud WebUI and set its LED status to
blink in order to help the administrator find that FortiAP in an environment consisting of many APs.
FortiAP-112D, 221C, 223C, 224D, 320C, and 321C (using v5.6.2 B0489) can support LED Blinking.
Syntax
execute wireless-controller led-blink <wtp-id> {on | on 10 | off}

Features for high-density deployments Wireless controller optimization for large deployment - AP image upgrade
Wireless controller optimization for large deployment - AP image upgrade
This feature allows the administrator to configure a FortiAP to download the WTP image at join time.
Syntax
set image-download {enable | disable}
end

Protecting the WiFi Network
Wireless IDS
WiFi data channel encryption
Protected Management Frames and Opportunisitc Key Caching support
Wireless IDS
The FortiGate Wireless Intrusion Detection System (WIDS) monitors wireless traffic for a wide range of security
threats by detecting and reporting on possible intrusion attempts. When an attack is detected the FortiGate unit
records a log message.
You can create a WIDS profile to enable these types of intrusion detection:
l Asleap Attack—ASLEAP is a tool used to perform attacks against LEAP authentication.

l Association Frame Flooding—A Denial of Service attack using a large number of association requests. The default
detection threshold is 30 requests in 10 seconds.
l Authentication Frame Flooding—A Denial of Service attack using a large number of association requests. The
default detection threshold is 30 requests in 10 seconds.
l Broadcasting De-authentication—This is a type of Denial of Service attack. A flood of spoofed de-authentication
frames forces wireless clients to de-athenticate, then re-authenticate with their AP.
l EAPOL Packet Flooding—Extensible Authentication Protocol over LAN (EAPOL) packets are used in WPA and
WPA2 authentication. Flooding the AP with these packets can be a denial of service attack. Several types of EAPOL
packets are detected: EAPOL-FAIL, EAPOL-LOGOFF, EAPOL-START, EAPOL-SUCC.
l Invalid MAC OUI—Some attackers use randomly-generated MAC addresses. The first three bytes of the MAC
address are the Organizationally Unique Identifier (OUI), administered by IEEE. Invalid OUIs are logged.
l Long Duration Attack—To share radio bandwidth, WiFi devices reserve channels for brief periods of time.
Excessively long reservation periods can be used as a denial of service attack. You can set a threshold between
1000 and 32 767 microseconds. The default is 8200.
l Null SSID Probe Response—When a wireless client sends out a probe request, the attacker sends a response with
a null SSID. This causes many wireless cards and devices to stop responding.
l Spoofed De-authentication—Spoofed de-authentication frames are a denial of service attack. They cause all clients
to disconnect from the AP.
l Weak WEP IV Detection—A primary means of cracking WEP keys is by capturing 802.11 frames over an extended
period of time and searching for patterns of WEP initialization vectors (IVs) that are known to be weak. WIDS
detects known weak WEP IVs in on-air traffic.
l Wireless Bridge—WiFi frames with both the fromDS and ToDS fields set indicate a wireless bridge. This will also
detect a wireless bridge that you intentionally configured in your network.
You can enable wireless IDS by selecting a WIDS Profile in your FortiAP profile.
To create a WIDS Profile
1. Go to WiFi & Switch Controller > WIDS Profiles.

2. Select a profile to edit or select Create New.

Protecting the WiFi Network WiFi data channel encryption
3. Select the types of intrusion to protect against.

By default, all types are selected.
4. Select Apply.
You can also configure a WIDS profile in the CLI using the config wireless-controller wids-
profile command.
Rogue AP detection
The WIDS profile includes settings for detection of unauthorized (rogue) access points in your wireless network.
For more information, see Wireless network monitoring on page 126.
WIDS client deauthentication rate for DoS attacks

As part of mitigating a Denial of Service (DoS) attack, the FortiGate sends deauthentication packets to unknown
clients. In an aggressive attack, this deauthentication activity can prevent the processing of packets from valid
clients. A WIDS Profile option in the CLI limits the deauthentication rate.
edit default
set deauth-unknown-src-thresh <1-65535>
end
The value set is a measure of the number of deathorizations per second. 0 means no limit. The default is 10.
WiFi data channel encryption
Optionally, you can apply DTLS encryption to the data channel between the wireless controller and FortiAP units.
This enhances security.
There are data channel encryption settings on both the FortiGate unit and the FortiAP units. At both ends, you
can enable Clear Text, DTLS encryption, or both. The settings must agree or the FortiAP unit will not be able to
join the WiFi network. By default, both Clear Text and DTLS-encrypted communication are enabled on the
FortiAP unit, allowing the FortiGate setting to determine whether data channel encryption is used. If the
FortiGate unit also enables both Clear Text and DTLS, Clear Text is used.
Data channel encryption settings are located in the FortiAP profile. By default, only Clear Text is supported.
Data channel encryption is software-based and can affect performance. Verify that the
system meets your performance requirements with encryption enabled.
Configuring encryption on the FortiGate unit

You can use the CLI to configure data channel encryption.
Enabling encryption
In the CLI, the wireless wtp-profile command contains a new field, dtls-policy, with options
clear-text and dtls-enabled. To enable encryption in profile1 for example, enter:

Protected Management Frames and Opportunisitc Key Caching support Protecting the WiFi Network
edit profile1
set dtls-policy dtls-enabled
end
Configuring encryption on the FortiAP unit

The FortiAP unit has its own settings for data channel encryption.
Enabling CAPWAP encryption - FortiAP web-based manager

1. On the System Information page, in WTP Configuration > AC Data Channel Security, select one of:
l Clear Text
l DTLS Enabled
l Clear Text or DTLS Enabled (default)
2. Select Apply.
Enabling encryption - FortiAP CLI

You can set the data channel encryption using the AP_DATA_CHAN_SEC variable: 'clear', or 'ipsec', or 'dtls'.
For example, to set security to DTLS and then save the setting, enter:
cfg -a AP_DATA_CHAN_SEC=dtls
cfg -c
Protected Management Frames and Opportunisitc Key Caching support
Protected Management Frames (PMF) protect some types of management frames like deauthorization,
disassociation and action frames. This feature, now mandatory on WiFi certified 802.1ac devices, prevents
attackers from sending plain deauthorization/disassociation frames to disrupt or tear down a
connection/association. PMF is a Wi-Fi Alliance specification based on IEEE 802.11w.
To facilitate faster roaming client roaming, you can enable Opportunistic Key Caching (OKC) on your WiFi
network. When a client associates with an AP, its PMK identifier is sent to all other APs on the network. This
eliminates the need for an already-authenticated client to repeat the full EAP exchange process when it roams to
another AP on the same network.
Use of PMF and OKC on an SSID is configurable only in the CLI:

edit <vap_name>
set pmf {disable | enable | optional}
set pmf-assoc-comeback-timeout <integer>
set pmf-sa-query-retry-timeout <integer>
set okc {disable | enable}
next
end
When pmf is set to optional, it is considered enabled, but will allow clients that do not use PMF. When pmf
is set to enable, PMF is required by all clients.

Protecting the WiFi Network Protected Management Frames and Opportunisitc Key Caching support
Bluetooth Low Energy (BLE) Scan

The FortiGate can configure FortiAP Bluetooth Low Energy (BLE) scan, incorporating Google's BLE beacon
profile known as Eddystone, used to identify groups of devices and individual devices.
Currently, only the FAP-S221E, FAP-S223E, and FAP-222E models support this
feature.
Use the following syntax to configure BLE profiles, configure BLE report intervals, and assign BLE profiles to
WTP profiles.
CLI syntax - Configure BLE profiles

config wireless-controller ble-profile
edit <name>
set advertising {ibeacon | eddystone-uid | eddystone-url}
set ibeacon-uuid <uuid>
set major-id <0 - 65535> - (default = 1000)
set minor-id <0 - 65535> - (default = 1000)
set eddystone-namespace <10-byte namespace>
set eddystone-instance <device id>
set eddystone-url <url>
set txpower <0 - 12> - (default = 0)
set beacon-interval <40 - 3500> - (default = 100)
set ble-scanning {enable | disable} - (default = disable)
next
end
Note that txpower determines the transmit power level on a scale of 0-12:
0: -21 dBm 1: -18 dBm 2: -15 dBm 3: -12 dBm 4: -9 dBm
5: -6 dBm 6: -3 dBm 7: 0 dBm 8: 1 dBm 9: 2 dBm
10: 3 dBm 11: 4 dBm 12: 5 dBm
CLI syntax - Configure BLE report intervals

set ble-scan-report-intv - (default = 30 sec)
end
CLI syntax - Assign BLE profiles to WTP profiles

edit <name>
set ble-profile <name>
next
end

Wireless network monitoring
You can monitor both your wireless clients and other wireless networks that are available in your coverage area.
Monitoring wireless clients

Monitoring rogue APs
Monitoring wireless network health
Monitoring wireless clients
To view connected clients on a FortiWiFi unit
1. Go to Monitor > Client Monitor.

The following information is displayed:
SSID The SSID that the client connected to.
FortiAP The serial number of the FortiAP unit to which the client connected.
User User name
IP The IP address assigned to the wireless client.
Device
Auth The type of authentication used.
Channel WiFi radio channel in use.
Bandwidth Tx/Rx Client received and transmitted bandwidth, in Kbps.
Signal Strength / Noise The signal-to-noise ratio in deciBels calculated from signal strength and
noise level.
Signal Strength
Association Time How long the client has been connected to this access point.
Results can be filtered. Select the filter icon on the column you want to filter. Enter the values to
include or select NOT if you want to exclude the specified values.
Monitoring rogue APs
The access point radio equipment can scan for other available access points, either as a dedicated monitor or in
idle periods during AP operation.

Wireless network monitoring Monitoring rogue APs
Discovered access points are listed in Monitor > Rogue AP Monitor. You can then mark them as either
Accepted or Rogue access points. This designation helps you to track access points. It does not affect anyone’s
ability to use these access points.
It is also possible to suppress rogue APs. See Monitoring rogue APs on page 126.
On-wire rogue AP detection technique

Other APs that are available in the same area as your own APs are not necessarily rogues. A neighboring AP that
has no connection to your network might cause interference, but it is not a security threat. A rogue AP is an
unauthorized AP connected to your wired network. This can enable unauthorized access. When rogue AP
detection is enabled, the On-wire column in the Rogue AP Monitor list shows a green up-arrow on detected
rogues.
Rogue AP monitoring of WiFi client traffic builds a table of WiFi clients and the Access Points that they are
communicating through. The FortiGate unit also builds a table of MAC addresses that it sees on the LAN. The
FortiGate unit’s on-wire correlation engine constantly compares the MAC addresses seen on the LAN to the MAC
addresses seen on the WiFi network.
There are two methods of Rogue AP on-wire detection operating simultaneously: Exact MAC address match and
MAC adjacency.
Exact MAC address match

If the same MAC address is seen on the LAN and on the WiFi network, this means that the wireless client is
connected to the LAN. If the AP that the client is using is not authorized in the FortiGate unit configuration, that
AP is deemed an ‘on-wire’ rogue. This scheme works for non-NAT rogue APs.
MAC adjacency
If an access point is also a router, it applies NAT to WiFi packets. This can make rogue detection more difficult.
However, an AP’s WiFi interface MAC address is usually in the same range as its wired MAC address. So, the
MAC adjacency rogue detection method matches LAN and WiFi network MAC addresses that are within a
defined numerical distance of each other. By default, the MAC adjacency value is 7. If the AP for these matching
MAC addresses is not authorized in the FortiGate unit configuration, that AP is deemed an ‘on-wire’ rogue.
Limitations
On-wire rogue detection has some limitations. There must be at least one WiFi client connected to the suspect
AP and continuously sending traffic. If the suspect AP is a router, its WiFi MAC address must be very similar to its
Ethernet port MAC address.
Logging
Information about detected rogue APs is logged and uploaded to your FortiAnalyzer unit, if you have one. By
default, rogue APs generate an alert level log, unknown APs generate a warning level log. This log information
can help you with PCI-DSS compliance requirements.
Rogue AP scanning as a background activity

Each WiFi radio can perform monitoring of radio channels in its operating band while acting as an AP. It does this
by briefly switching from AP to monitoring mode. By default, a scan period starts every 300 seconds. Each second

Monitoring rogue APs Wireless network monitoring
a different channel is monitored for 20ms until all channels have been checked.
During heavy AP traffic, it is possible for Spectrum Analysis background scanning to cause lost packets when the
radio switches to monitoring. To reduce the probability of lost packets, you can set the CLI ap-bgscan-idle
field to delay the switch to monitoring until the AP has been idle for a specified period. This means that heavy AP
traffic may slow background scanning.
The following CLI example configures default background rogue scanning operation except that it sets ap-
bgscan-idle to require 100ms of AP inactivity before scanning the next channel.
edit ourprofile
config radio-1
set wids-profile ourwidsprofile
set spectrum-analysis enable
end
end
edit ourwidsprofile
set ap-scan enable
set rogue-scan enable
set ap-bgscan-period 300
set ap-bgscan-intv 1
set ap-bgscan-duration 20
set ap-bgscan-idle 100
end
Configuring rogue scanning

All APs using the same FortiAP Profile share the same rogue scanning settings, unless override is configured.
To enable rogue AP scanning with on-wire detection - web-based manager

On some models, the menu is WiFi & Switch Controller.
2. Select an existing WIDS Profile and edit it, or select Create New.
3. Make sure that Enable Rogue AP Detection is selected.
4. Select Enable On-Wire Rogue AP Detection.
5. Optionally, enable Auto Suppress Rogue APs in Foreground Scan.
6. Select OK.
To enable the rogue AP scanning feature in a custom AP profile - CLI

edit FAP220B-default
set ap-scan enable
set rogue-scan enable
end
Exempting an AP from rogue scanning

By default, if Rogue AP Detection is enabled, it is enabled on all managed FortiAP units. Optionally, you can
exempt an AP from scanning. You should be careful about doing this if your organization must perform scanning
to meet PCI-DSS requirements.

Wireless network monitoring Monitoring rogue APs
To exempt an AP from rogue scanning

2. Create a new WIDS profile and disable Rogue AP detection.
3. Go to WiFi & Switch Controller > FortiAP Profiles and edit the profile you wish to exempt from rogue
scanning.
4. Assign the WIDS profile created in step 2.
MAC adjacency
You can adjust the maximum WiFi to Ethernet MAC difference used when determining whether an suspect AP is
a rogue.
To adjust MAC adjacency
For example, to change the adjacency to 8, enter

set rogue-scan-mac-adjacency 8
end

Monitoring rogue APs Wireless network monitoring
Using the Rogue AP Monitor

Go to Monitor > Rogue AP Monitor to view the list of other wireless access points that are receivable at your
location.
Information Columns
Actual columns displayed depends on Column Settings.
Rogue AP — Use this status for unauthorized APs that On-wire status indicates are
attached to your wired networks.
Accepted AP — Use this status for APs that are an authorized part of your network or
State are neighboring APs that are not a security threat. To see accepted APs in the list,
select Show Accepted.
Unclassified — This is the initial status of a discovered AP. You can change an AP back
to unclassified if you have mistakenly marked it as Rogue or Accepted.
Online Active AP
Status
Inactive AP
Active ad-hoc WiFi device
Inactive ad-hoc WiFi device
SSID The wireless service set identifier (SSID) or network name for the wireless interface.
Security The type of security currently being used.

Type
Channel The wireless radio channel that the access point uses.
MAC The MAC address of the Wireless interface.

Address
Vendor
The name of the vendor.
Info
Signal The relative signal strength of the AP. Mouse over the symbol to view the signal-to-noise
Strength ratio.
Detected
The name or serial number of the AP unit that detected the signal.
By
On-wire A green up-arrow indicates a suspected rogue, based on the on-wire detection technique. A
red down-arrow indicates AP is not a suspected rogue.
First Seen How long ago this AP was first detected.

Wireless network monitoring Suppressing rogue APs
Last Seen How long ago this AP was last detected.
Rate Data rate in bps.
To change the Online Status of an AP, right-click it and select Mark Accepted or Mark Rogue.
In addition to monitoring rogue APs, you can actively prevent your users from connecting to them. When
suppression is activated against an AP, the FortiGate WiFi controller sends deauthentication messages to the
rogue AP’s clients, posing as the rogue AP, and also sends deauthentication messages to the rogue AP, posing
as its clients. This is done using the monitoring radio.
Before enabling this feature, verify that operation of Rogue Suppression is compliant
with the applicable laws and regulations of your region.
To enable rogue AP suppression, you must enable monitoring of rogue APs with the on-wire detection technique.
See “Monitoring rogue APs”. The monitoring radio must be in the Dedicated Monitor mode.
To activate AP suppression against a rogue AP
1. Go to Monitor > Rogue AP Monitor.

2. When you see an AP listed that is a rogue detected “on-wire”, select it and then select Mark > Mark Rogue.
3. To suppress an AP that is marked as a rogue, select it and then select Suppress AP.
To deactivate AP suppression
1. Go to Monitor > Rogue AP Monitor.

2. Select the suppressed rogue AP and then select Suppress AP > Unsuppress AP.
Monitoring wireless network health
To view the wireless health dashboard, go to Monitor > WiFi Health Monitor.
The wireless health dashboard provides a comprehensive view of the health of your network’s wireless
infrastructure. The dashboard includes widgets to display
l AP Status - Active, Down or missing, up for over 24 hours, rebooted in past 24 hours
l Client Count Over Time - viewable for past hour, day, or 30 days
l Top Client Count Per-AP - separate widgets for 2.4GHz and 5GHz bands
l Top Wireless Interference - separate widgets for 2.4GHz and 5GHz bands, requires spectrum analysis to be
enabled on the radios
l Login Failures Information

Monitoring wireless network health Wireless network monitoring
The list of active clients also shows MAC address entries (similar to the WiFi Client Monitor page), making
client information easy to view when opening the Active Client widget.

Configuring wireless network clients
This chapter shows how to configure typical wireless network clients to connect to a wireless network with WPA-
Enterprise security.
Windows XP client
Windows 7 client
Mac OS client
Linux client
Troubleshooting
Windows XP client
To configure the WPA-Enterprise network connection
1. In the Windows Start menu, go to Control Panel > Network Connections > Wireless Network Connection
or select the wireless network icon in the Notification area of the Taskbar. A list of available networks is displayed.

Windows XP client Configuring wireless network clients
If you are already connected to another wireless network, the Connection Status window displays.
Select View Wireless Networks on the General tab to view the list.
If the network broadcasts its SSID, it is listed. But do not try to connect until you have completed the
configuration step below. Because the network doesn’t use the Windows XP default security
configuration, configure the client’s network settings manually before trying to connect.
2. You can configure the WPA-Enterprise network to be accessible from the View Wireless Networks window even
if it does not broadcast its SSID.
3. Select Change Advanced Settings and then select the Wireless Networks tab.
Any existing networks that you have already configured are listed in the Preferred Networks list.

Configuring wireless network clients Windows XP client
4. Select Add and enter the following information:
Network Name (SSID) The SSID for your wireless network
Network Authentication WPA2
Data Encryption AES
5. If this wireless network does not broadcast its SSID, select Connect even if this network is not broadcasting
so that the network will appear in the View Wireless Networks list.

Windows XP client Configuring wireless network clients
6. Select the Authentication tab.
7. In EAP Type, select Protected EAP (PEAP).

8. Make sure that the other two authentication options are not selected.

Configuring wireless network clients Windows XP client
9. Select Properties.
10. Make sure that Validate server certificate is selected.

11. Select the server certificate Entrust Root Certification Authority.
12. In Select Authentication Method, select Secured Password (EAP-MSCHAPv2).
13. Ensure that the remaining options are not selected.
14. Select Configure.
15. If your wireless network credentials are the same as your Windows logon credentials, select Automatically use
my Windows logon name and password. Otherwise, make sure that this option is not selected.
16. Select OK. Repeat until you have closed all of the Wireless Network Connection Properties windows.

Windows 7 client Configuring wireless network clients
To connect to the WPA-Enterprise wireless network
1. Select the wireless network icon in the Notification area of the Taskbar.
2. In the View Wireless Networks list, select the network you just added and then select Connect.
You might need to log off of your current wireless network and refresh the list.
3. When the following popup displays, click on it.
4. In the Enter Credentials window, enter your wireless network User name, Password, and Logon domain (if
applicable). Then, select OK.
In future, Windows will automatically send your credentials when you log on to this network.
Windows 7 client
1. In the Windows Start menu, go to Control Panel > Network and Internet > Network and Sharing Center >
Manage Wireless Networks or select the wireless network icon in the Notification area of the Taskbar. A list of
available networks is displayed.

Configuring wireless network clients Windows 7 client
2. Do one of the following:

l If the wireless network is listed (it broadcasts its SSID), select it from the list.
l Select Add > Manually create a network profile.

Windows 7 client Configuring wireless network clients
3. Enter the following information and select Next.
Network name Enter the SSID of the wireless network.

(Required only if you selected Add.)
Security type WPA2-Enterprise
Encryption type AES
Start this connection Select

automatically
Connect even if the Select

network is not
broadcasting.
The Wireless Network icon will display a popup requesting that you click to enter credentials for the
network. Click on the popup notification.
4. In the Enter Credentials window, enter your wireless network User name, Password, and Logon domain (if
applicable). Then, select OK.
5. Select Change connection settings.
6. On the Connection tab, select Connect automatically when this network is in range.
7. On the Security tab, select the Microsoft PEAP authentication method and then select Settings.

Configuring wireless network clients Windows 7 client
8. Make sure that Validate server certificate is selected.

9. Select the server certificate Entrust Root Certification Authority.
10. In Select Authentication Method, select Secured Password (EAP-MSCHAPv2).
11. Select Configure.
12. If your wireless network credentials are the same as your Windows logon credentials, select Automatically use
my Windows logon name and password. Otherwise, make sure that this option is not selected.
13. Ensure that the remaining options are not selected.
14. Select OK. Repeat until you have closed all of the Wireless Network Properties windows.

Mac OS client Configuring wireless network clients
Mac OS client
To configure network preferences
1. Right-click the AirPort icon in the toolbar and select Open Network Preferences.
2. Select Advanced and then select the 802.1X tab.
3. If there are no Login Window Profiles in the left column, select the + button and then select Add Login Window
Profile.
4. Select the Login Window Profile and then make sure that both TTLS and PEAP are selected in Authentication.
To configure the WPA-Enterprise network connection
1. Select the AirPort icon in the toolbar.

l If the network is listed, select the network from the list.
l Select Connect to Other Network.
One of the following windows opens, depending on your selection.

Configuring wireless network clients Mac OS client
3. Enter the following information and select OK or Join:
Network name Enter the SSID of your wireless network. (Other network only)
Wireless Security WPA Enterprise
802.1X Automatic
Username Enter your logon credentials for the wireless network.

Password
Remember this network Select.
You are connected to the wireless network.
Mac OS supports only PEAP with MSCHAPv2 authentication and therefore can
authenticate only to a RADIUS server, not an LDAP or TACACS+ server

Linux client Configuring wireless network clients
Linux client
This example is based on the Ubuntu 10.04 Linux wireless client.
To connect to a WPA-Enterprise network
1. Select the Network Manager icon to view the Wireless Networks menu.
Wireless networks that broadcast their SSID are listed in the Available section of the menu. If the list is long, it is
continued in the More Networks submenu.
l Select the network from the list (also check More Networks).
l Select Connect to Hidden Wireless Network.
One of the following windows opens, depending on your selection.

Configuring wireless network clients Linux client
3. Enter the following information:
Connection Leave as New. (Hidden network only)
Network name Enter the SSID of your wireless network. (Hidden network only)
Wireless Security WPA & WPA2 Enterprise
Authentication Protected EAP (PEAP) for RADIUS-based authentication
Tunneled TLS for TACACS+ or LDAP-based authentication
Anonymous identity This is not required.
CA Certificate If you want to validate the AP’s certificate, select the Entrust Root
Certification Authority root certificate. The default location for the
certificate is /usr/share/ca-certificates/mozilla/.
PEAP version Automatic (applies only to PEAP)
Inner authentication MSCHAPv2 for RADIUS-based authentication
PAP or CHAP for TACACS+ or LDAP-based authentication
Username Enter your logon credentials for the wireless network.

Password

Troubleshooting Configuring wireless network clients
4. If you did not select a CA Certificate above, you are asked to do so. Select Ignore.
5. Select Connect. You are connected to the wireless network.
To connect to a WPA-Enterprise network
1. Select the Network Manager icon to view the Wireless Networks menu.
2. Select the network from the list (also check More Networks).
If your network is not listed (but was configured), select Connect to Hidden Wireless Network, select your
network from the Connection drop-down list, and then select Connect.
Troubleshooting
Using tools provided in your operating system, you can find the source of common wireless networking problems.
Checking that client received IP address and DNS server information
Windows XP
1. Double-click the network icon in the taskbar to display the Wireless Network Connection Status window.
Check that the correct network is listed in the Connection section.
2. Select the Support tab.
Check that the Address Type is Assigned by DHCP. Check that the IP Address, Subnet Mask, and
Default Gateway values are valid.
3. Select Details to view the DNS server addresses.
The listed address should be the DNS serves that were assigned to the WAP. Usually a wireless network that
provides access to the private LAN is assigned the same DNS servers as the wired private LAN. A wireless network
that provides guest or customer users access to the Internet is usually assigned public DNS servers.
4. If any of the addresses are missing, select Repair.
If the repair procedure doesn’t correct the problem, check your network settings.
Mac OS
1. From the Apple menu, open System Preferences > Network.
2. Select AirPort and then select Configure.

Configuring wireless network clients Troubleshooting
3. On the Network page, select the TCP/IP tab.
4. If there is no IP address or the IP address starts with 169, select Renew DHCP Lease.
5. To check DNS server addresses, open a terminal window and enter the following command:
cat /etc/resolv.conf
Check the listed nameserver addresses. A network for employees should us the wired private LAN
DNS server. A network for guests should specify a public DNS server.
Linux
This example is based on the Ubuntu 10.04 Linux wireless client.

Troubleshooting Configuring wireless network clients
1. Right-click the Network Manager icon and select Connection Information.
2. Check the IP address, and DNS settings. If they are incorrect, check your network settings.

Wireless network examples
This chapter provides an example wireless network configuration.
Basic wireless network

A more complex example
Basic wireless network
This example uses automatic configuration to set up a basic wireless network.
To configure this wireless network, you must:
l Configure authentication for wireless users

l Configure the SSID (WiFi network interface)
l Add the SSID to the FortiAP Profile
l Configure the firewall policy
l Configure and connect FortiAP units
Configuring authentication for wireless users

You need to configure user accounts and add the users to a user group. This example shows only one account,
but multiple accounts can be added as user group members.
To configure a WiFi user - web-based manager
1. Go to User & Device > User Definition and select Create New.

2. Select Local User and then click Next.
3. Enter a User Name and Password and then click Next.
4. Click Next.
5. Make sure that Enable is selected and then click Create.
To configure the WiFi user group - web-based manager
1. Go to User & Device > User Groups and select Create New.

2. Enter the following information and then select OK:
Name wlan_users
Type Firewall
Members Add users.
To configure a WiFi user and the WiFi user group - CLI

config user user
edit "user01"

Basic wireless network Wireless network examples
set type password

set passwd "asdf12ghjk"
end
config user group
edit "wlan_users"
set member "user01"
end
Configuring the SSID

First, establish the SSID (network interface) for the network. This is independent of the number of physical access
points that will be deployed. The network assigns IP addresses using DHCP.
To configure the SSID - web-based manager
2. Enter the following information and select OK:
Interface Name example_wifi_if
IP/Network Mask 10.10.110.1/24
Administrative Access Ping (to assist with testing)
DHCP Server Enable
Address Range 10.10.110.2 - 10.10.110.199
Netmask 255.255.255.0
Default Gateway Same As Interface IP
DNS Server Same as System DNS
SSID example_wifi
Security Mode WPA2 Enterprise
Authentication Local, select wlan_users user group.
Leave other settings at their default values.
To configure the SSID - CLI

edit example_wifi_if
set ssid "example_wifi"
set broadcast-ssid enable
set security wpa-enterprise
set auth usergroup
set usergroup wlan_users
set schedule always
end

Wireless network examples Basic wireless network
edit example_wifi_if
set ip 10.10.110.1 255.255.255.0
end
edit 0
set interface "example_wifi_if"
config ip-range
edit 1
set end-ip 10.10.110.199
end
end
Adding the SSID to the FortiAP Profile

The radio portion of the FortiAP configuration is contained in the FortiAP Profile. By default, there is a profile for
each platform (FortiAP model). You can create additional profiles if needed. The SSID needs to be specified in
the profile.
To add the SSID to the FortiAP Profile - web-based manager
1. Go to WiFi & Switch Controller > FortiAP Profiles and edit the profile for your model of FortiAP unit.
2. In Radio 1 and Radio 2, add example_wifi in SSID .
3. Select OK.
Configuring security policies

A security policy is needed to enable WiFi users to access the Internet on port1. First you create firewall address
for the WiFi network, then you create the example_wifi to port1 policy.
To create a firewall address for WiFi users - web-based manager

2. Select Create New > Address, enter the following information and select OK.
Name wlan_user_net
Type IP/Netmask
Subnet / IP Range 10.10.110.0/24
Interface example_wifi_if
Show in Address List Enabled
To create a firewall address for WiFi users - CLI

config firewall address
edit "wlan_user_net"
set associated-interface "example_wifi_if"
set subnet 10.10.110.0 255.255.255.0

Basic wireless network Wireless network examples
end
To create a security policy for WiFi users - web-based manager
1. Go to Policy & Objects > IPv4 Policyand select Create New.

Incoming Interface example_wifi_if
Source Address wlan_user_net
Outgoing Interface port1
Destination Address All
Schedule always
Service ALL
Action ACCEPT
NAT ON. Select Use Destination Interface Address (default).
To create a firewall policy for WiFi users - CLI

edit 0
set srcintf "example_wifi"
set dstintf "port1"
set srcaddr "wlan_user_net"
set dstaddr "all"
set schedule always
set service ALL
set action accept
set nat enable
end
Connecting the FortiAP units

You need to connect each FortiAP unit to the FortiGate unit, wait for it to be recognized, and then assign it to the
AP Profile. But first, you must configure the interface to which the FortiAP units connect and the DHCP server that
assigns their IP addresses.
In this example, the FortiAP units connect to port 3 and are controlled through IP addresses on the
192.168.8.0/24 network.
1. Go to Network > Interfaces and edit the port3 interface.

2. Set the Addressing mode to Dedicated to Extension Device and set the IP/Network Mask to
192.168.8.1/255.255.255.0.
3. Select OK.

Wireless network examples Basic wireless network
This procedure automatically configures a DHCP server for the AP units.

edit port3
set mode static
set ip 192.168.8.1 255.255.255.0
end
To configure the DHCP server for AP units - CLI

edit 0
set interface port3
config exclude-range
edit 1
set end-ip 192.168.8.1
end
config ip-range
edit 1
set end-ip 192.168.8.254
end
end
To connect a FortiAP unit - web-based manager

2. Connect the FortiAP unit to port 3.
3. Periodically select Refresh while waiting for the FortiAP unit to be listed.
Recognition of the FortiAP unit can take up to two minutes.
If FortiAP units are connected but cannot be recognized, try disabling VCI-Match in the DHCP server settings.
4. When the FortiAP unit is listed, select the entry to edit it.
The Edit Managed Access Point window opens.
5. In State, select Authorize.
6. In FortiAP Profile, select the default profile for the FortiAP model.
7. Select OK.
8. Repeat Steps 2 through 8 for each FortiAP unit.
To connect a FortiAP unit - CLI

2. Enter
3. Wait 30 seconds, then enter get.

Retry the get command every 15 seconds or so until the unit is listed, like this:
== [ FAP22B3U10600118 ]

A more complex example Wireless network examples
wtp-id: FAP22B3U10600118
4. Edit the discovered FortiAP unit like this:

set admin enable
end
A more complex example
This example creates multiple networks and uses custom AP profiles.
Scenario
In this example, Example Co. provides two wireless networks, one for its employees and the other for customers
or other guests of its business. Guest users have access only to the Internet, not to the company’s private
network. The equipment for these WiFi networks consists of FortiAP-220B units controlled by a FortiGate unit.
The employee network operates in 802.11n mode on both the 2.4GHz and 5GHz bands. Client IP addresses are
in the 10.10.120.0/24 subnet, with 10.10.120.1 the IP address of the WAP. The guest network also operates in
802.11n mode, but only on the 2.4GHz band. Client IP addresses are on the 10.10.115.0/24 subnet, with
10.10.115.1 the IP address of the WAP.
On FortiAP-220B units, the 802.11n mode also supports 802.11g and 802.11b clients on the 2.4GHz band and
802.11a clients on the 5GHz band.
The guest network WAP broadcasts its SSID, the employee network WAP does not.
The employees network uses WPA-Enterprise authentication through a FortiGate user group. The guest network
features a captive portal. When a guest first tries to connect to the Internet, a login page requests logon
credentials. Guests use numbered guest accounts authenticated by RADIUS. The captive portal for the guests
includes a disclaimer page.
In this example, the FortiAP units connect to port 3 and are assigned addresses on the 192.168.8.0/24 subnet.
Configuration
To configure these wireless networks, you must:
l Configure authentication for wireless users

l Configure the SSIDs (network interfaces)
l Configure the AP profile
l Configure the WiFi LAN interface and a DHCP server
l Configure firewall policies
Configuring authentication for employee wireless users

Employees have user accounts on the FortiGate unit. This example shows creation of one user account, but you
can create multiple accounts and add them as members to the user group.

Wireless network examples A more complex example
To configure a WiFi user - web-based manager
1. Go to User & Device > User Definition and select Create New.

2. Select Local User and then click Next.
3. Enter a User Name and Password and then click Next.
4. Click Next.
5. Make sure that Enable is selected and then click Create.
To configure the user group for employee access - web-based manager

Name employee-group
Type Firewall
Members Add users.
To configure a WiFi user and the user group for employee access - CLI
config user user
edit "user01"
set type password
set passwd "asdf12ghjk"
end
config user group
edit "employee-group"
set member "user01"
end
The user authentication setup will be complete when you select the employee-group in the SSID configuration.
Configuring authentication for guest wireless users

Guests are assigned temporary user accounts created on a RADIUS server. The RADIUS server stores each
user’s group name in the Fortinet-Group-Name attribute. Wireless users are in the group named “wireless”.
The FortiGate unit must be configured to access the RADIUS server.
To configure the FortiGate unit to access the guest RADIUS server - web-based manager

Name guestRADIUS
Primary Server IP/Name 10.11.102.100
Primary Server Secret grikfwpfdfg
Secondary Server IP/Name Optional

Secondary Server Secret Optional
Authentication Scheme Use default, unless server requires otherwise.
To configure the FortiGate unit to access the guest RADIUS server - CLI
config user radius
edit guestRADIUS
set auth-type auto
set server 10.11.102.100
set secret grikfwpfdfg
end
To configure the user group for guest access - web-based manager

Name guest-group
Type Firewall
Members Leave empty.
3. Select Create new.

4. Enter:
Remote Server Select guestRADIUS.
Groups Select wireless
5. Select OK.
To configure the user group for guest access - CLI

config user group
edit "guest-group"
set member "guestRADIUS"
config match
edit 0
set server-name "guestRADIUS"
set group-name "wireless"
end
end
The user authentication setup will be complete when you select the guest-group user group in the SSID
configuration.

Configuring the SSIDs

First, establish the SSIDs (network interfaces) for the employee and guest networks. This is independent of the
number of physical access points that will be deployed. Both networks assign IP addresses using DHCP.
To configure the employee SSID - web-based manager
Interface Name example_inc
IP/Netmask 10.10.120.1/24
Enable DHCP Enable
Address Range 10.10.120.2 - 10.10.120.199
Netmask 255.255.255.0
Default Gateway Same As Interface IP
SSID example_inc
Security Mode WPA/WPA2-Enterprise
Authentication Select Local, then select employee-group.
To configure the employee SSID - CLI

edit example_inc
set ssid "example_inc"
set security wpa-enterprise
set auth usergroup
set usergroup employee-group
set schedule always
end
edit example_inc
set ip 10.10.120.1 255.255.255.0
end
edit 0
set interface example_inc

config ip-range
edit 1
set end-ip 10.10.120.199
end
set lease-time 7200
end
To configure the example_guest SSID - web-based manager
1. Go to WiFi & Switch Controller > SSID and select Create New.

Name example_guest
IP/Netmask 10.10.115.1/24
Enable DHCP Enable
Address Range 10.10.115.2 - 10.10.115.50
Netmask 255.255.255.0
Default Gateway Same as Interface IP
SSID example_guest
Security Mode Captive Portal
Portal Type Authentication
Authentication Portal Local
User Groups Select guest-group
To configure the example_guest SSID - CLI

edit example_guest
set ssid "example_guest"
set security captive-portal
set selected-usergroups guest-group
set schedule always
end
edit example_guest
set ip 10.10.115.1 255.255.255.0
end
edit 0


set interface "example_guest"
config ip-range
edit 1
set end-ip 10.10.115.50
end
set lease-time 7200
end
Configuring the FortiAP profile

The FortiAP Profile defines the radio settings for the networks. The profile provides access to both Radio 1
(2.4GHz) and Radio 2 (5GHz) for the employee virtual AP, but provides access only to Radio 1 for the guest
virtual AP.
To configure the FortiAP Profile - web-based manager
1. Go to WiFi & Switch Controller > FortiAP Profiles and select Create New.

Name example_AP
Platform FAP220B
Radio 1
Mode Access Point
Band 802.11n
Channel Select 1, 6, and 11.
Tx Power 100%
SSID Select SSIDs and select example_inc and example_guest.
Radio 2
Mode Access Point
Band 802.11n_5G
Channel Select all.
Tx Power 100%
SSID Select SSIDs and select example_inc.
To configure the AP Profile - CLI

edit "example_AP"
config platform

set type 220B

end
config radio-1
set ap-bgscan enable
set band 802.11n
set channel "1" "6" "11"
set vaps "example_inc" "example_guest"
end
config radio-2
set ap-bgscan enable
set band 802.11n-5G
set channel "36" "40" "44" "48" "149" "153" "157" "161" "165"
set vaps "example_inc"
end
Configuring firewall policies

Identity-based firewall policies are needed to enable the WLAN users to access the Internet on Port1. First you
create firewall addresses for employee and guest users, then you create the firewall policies.
To create firewall addresses for employee and guest WiFi users

Address Name employee-wifi-net
Type Subnet / IP Range
Interface example_inc
Address Name guest-wifi-net
Type Subnet / IP Range
Interface example_guest
To create firewall policies for employee WiFi users - web-based manager

Incoming Interface example_inc
Source Address employee-wifi-net

Destination Address all
Schedule always
Service ALL
Action ACCEPT
NAT Enable NAT
3. Optionally, select security profile for wireless users.

4. Select OK.
5. Repeat steps 1 through 4 but select Internal as the Destination Interface/Zone to provides access to the
ExampleCo private network.
To create firewall policies for employee WiFi users - CLI

edit 0
set srcintf "employee_inc"
set dstintf "port1"
set srcaddr "employee-wifi-net"
set dstaddr "all"
set action accept
set service "ANY"
set nat enable
set service "ANY"
next
edit 0
set srcintf "employee_inc"
set dstintf "internal"
set srcaddr "employee-wifi-net"
set dstaddr "all"
set action accept
set service "ANY"
set nat enable
set service "ANY"
end
To create a firewall policy for guest WiFi users - web-based manager

Incoming Interface example_guest
Source Address guest-wifi-net

Schedule always
Service ALL
Action ACCEPT
NAT Enable NAT
3. Optionally, select UTM and set up UTM features for wireless users.
4. Select OK.
To create a firewall policy for guest WiFi users - CLI

edit 0
set srcintf "example_guest"
set dstintf "port1"
set srcaddr "guest-wifi-net"
set dstaddr "all"
set action accept
set service "ANY"
set nat enable
end
Connecting the FortiAP units

You need to connect each FortiAP-220A unit to the FortiGate unit, wait for it to be recognized, and then assign it
to the AP Profile. But first, you must configure the interface to which the FortiAP units connect and the DHCP
server that assigns their IP addresses.
In this example, the FortiAP units connect to port 3 and are controlled through IP addresses on the
192.168.8.0/24 network.
1. Go to Network > Interfaces and edit the port3 interface.

2. Set the Addressing mode to Dedicated to Extension Device and set the IP/Netmask to
192.168.8.1/255.255.255.0.
This step automatically configures a DHCP server for the AP units.
3. Select OK.

edit port3
set mode static
set ip 192.168.8.1 255.255.255.0
end

To configure the DHCP server for AP units - CLI

edit 0
set interface port3
config ip-range
edit 1
set end-ip 192.168.8.9
end
end
To connect a FortiAP-220A unit - web-based manager

3. Periodically select Refresh while waiting for the FortiAP unit to be listed.
Recognition of the FortiAP unit can take up to two minutes.
If there is persistent difficulty recognizing FortiAP units, try disabling VCI-Match in the DHCP server settings.
4. When the FortiAP unit is listed, select the entry to edit it.
The Edit Managed Access Point window opens.
5. In State, select Authorize.
6. In the AP Profile, select [Change] and then select the example_AP profile.
7. Select OK.
To connect a FortiAP-220A unit - CLI

2. Enter:
3. Wait 30 seconds, then enter get.

Retry the get command every 15 seconds or so until the unit is listed, like this:
== [ FAP22A3U10600118 ]
wtp-id: FAP22A3U10600118
4. Edit the discovered FortiAP unit like this:

set admin enable
set wtp-profile example_AP
end

Managing a FortiAP with FortiCloud
This chapter provides a few FortiCloud-managed FortiAP configuration examples.
FortiCloud-managed FortiAP WiFi

FortiCloud-managed FortiAP WiFi without a key
You can register for a free FortiCloud account at www.forticloud.com.
For a video tutorial of how to configure and manage a FortiAP-S device from FortiCloud, follow the link below:
l How to configure and Manage FortiAP-S from FortiCloud
FortiCloud-managed FortiAP WiFi
In this example, you use FortiCloud to configure a single FortiAP-221C, creating a working WiFi network without
a FortiGate unit.
FortiCloud remote management is supported on FortiAP models 221C and 320C.
For this configuration, the FortiAP-221C unit is running version 5.2 firmware. You will create a simple network
that uses WPA-Personal authentication.
To create the WiFi network without a FortiGate unit, you must:
l Add your FortiAP to FortiCloud

l Configure the SSID
l Configure the AP platform profile
l Deploy the AP with the profile
Adding your FortiAP to FortiCloud

You need to add the FortiAP unit to your FortiCloud account. This is done through a unique key that can be found
under the FortiAP unit.
To add a FortiAP to FortiCloud
1. Connect the FortiAP Ethernet interface to a network that provides access to the Internet.
2. Open a web browser and navigate to the FortiCloud main page and select + AP Network.
3. Enter an AP Network Name and AP Password. This password is used to locally log in to the AP as the
administrator. It will be set to all APs in this AP network.
4. Set the correct Time Zone and select Submit.
Configuring the SSID

You must establish the SSID (network interface) for the WiFi network.

Managing a FortiAP with FortiCloud FortiCloud-managed FortiAP WiFi without a key
To configure the SSID
1. Select the FortiAP you just created from the home page. You will then be prompted to add an SSID for the
AP Network.
In the interface, this is under Configure > SSIDs.
2. In Access Control, enter the name of your SSID, set Authentication to WPA2-Personal, enter the Pre-
shared Key, and select Next.
3. In Security, enable security features as required (select from AntiVirus, Intrusion Prevention, Block Botnet,
Web Access, and Application Control) and select Next.
4. In Availability, make sure to leave 5 GHz enabled, configure a schedule as required, and select Next.
5. Review your SSID in Preview, then select Apply.
Configuring the AP platform profile

The radio portion of the FortiAP configuration is contained in the FortiAP platform profile. By default, there is a
profile for each platform (FortiAP model). The SSID needs to be specified in the profile.
To configure the AP profile
1. Go to Configure > AP Profile and edit the AP Profile for your FortiAP model (mouse-over the AP Profile to
reveal the Edit button).
2. Enable the SSID configured earlier for both Radio 1 and Radio 2, for 5GHz coverage.
Deploying the AP with the platform profile

With the SSID and platform profile configured, you must deploy the AP by entering the FortiCloud key for the
FortiAP.
To deploy the AP
1. Go to Configure > Deploy APs. Here you will be prompted to enter the FortiCloud key, which can be found on
the same label as the FortiAP unit's serial number, and select Submit.
If you have a FortiAP model that does not include a FortiCloud key, you can still add
the device to the network. To learn how, see the FortiCloud-managed FortiAP WiFi
without a key configuration.
2. In Set Platform Profiles, select the platform profile you created earlier and select Next.
3. Follow the rest of the deployment wizard. Select Submit when completed.
You will now be able to connect to the wireless network and browse the Internet. On the FortiCloud website, go to
Monitor > Report where you can view monitoring information such as Traffic by Period, Client Count by
Period, and more.
FortiCloud-managed FortiAP WiFi without a key
You can manage your FortiAP-based wireless network with FortiCloud even if your FortiAP has no FortiCloud key.

FortiCloud-managed FortiAP WiFi without a key Managing a FortiAP with FortiCloud
For this example, you will need to have already pre-configured your FortiAP unit with your FortiCloud account
credentials. For more information on how to do this, or if your FortiAP has a FortiCloud key (on the serial number
label), see the FortiCloud-managed FortiAP WiFi configuration.
To create the WiFi network without a FortiCloud key, you must:
l Configure the FortiAP unit

l Add the FortiAP unit to your FortiCloud account
l Configure the FortiAP
Configuring the FortiAP unit

You need to connect and configure the FortiAP unit through the web-based manager of the FortiGate.
To configure the FortiAP unit - web-based manager
1. Connect your computer to the FortiAP Ethernet port. The FortiAP’s default IP address is 192.168.1.2. The
computer should have an address on the same subnet, 192.168.1.3 for example.
2. Using a browser, log in to the FortiAP as admin. Leave the password field empty.
3. In WTP-Configuration, select FortiCloud and enter your FortiCloud credentials. Select Apply.
The FortiAP is now ready to connect to FortiCloud via the Internet.
Adding the FortiAP unit to your FortiCloud account

The FortiAP must be added to the FortiCloud account that has a WiFi network already configured for it.
For an example of creating a WiFi network on FortiCloud, see FortiCloud-managed FortiAP WiFi on page 164.
To add the FortiAP to FortiCloud
1. Connect the FortiAP Ethernet cable to a network that connects to the Internet.
Restore your computer to its normal network configuration and log on to FortiCloud.
2. From the Home screen, go to Inventory > AP Inventory. Your FortiAP should be listed.
3. Then go back to the Home screen, select your AP network, and go to Deploy APs.
4. Select your listed FortiAP and select Next.
5. Make sure your platform profile is selected from the dropdown menu, and select Next.
6. In Preview, select Deploy.
The device will now appear listed under Access Points.
You will now be able to connect to the wireless network and browse the Internet. On the FortiCloud website, go to
Monitor > Report where you can view monitoring information such as Traffic by Period, Client Count by
Period, and more.

Using a FortiWiFi unit as a client
A FortiWiFi unit by default operates as a wireless access point. But a FortiWiFi unit can also operate as a wireless
client, connecting the FortiGate unit to another wireless network.
Use of client mode

Configuring client mode
Use of client mode
In client mode, the FortiWiFi unit connects to a remote WiFi access point to access other networks or the
Internet. This is most useful when the FortiWiFi unit is in a location that does not have a wired infrastructure.
For example, in a warehouse where shipping and receiving are on opposite sides of the building, running cables
might not be an option due to the warehouse environment. The FortiWiFi unit can support wired users using its
Ethernet ports and can connect to another access point wirelessly as a client. This connects the wired users to the
network using the 802.11 WiFi standard as a backbone.
Note that in client mode the FortiWiFi unit cannot operate as an AP. WiFi clients cannot see or connect to the
FortiWifi unit in Client mode.

Use of client mode Using a FortiWiFi unit as a client
FortiWiFi unit in Client mode

Using a FortiWiFi unit as a client Configuring client mode
Configuring client mode
To set up the FortiAP unit as a WiFi client, you must use the CLI. Before you do this, be sure to remove any AP
WiFi configurations such as SSIDs, DHCP servers, policies, and so on.
To configure wireless client mode
1. Change the WiFi mode to client.

In the CLI, enter the following commands:
set wireless-mode client
end
Respond “y” when asked if you want to continue. The FortiWiFi unit will reboot.
2. Configure the WiFi interface settings.

For example, to configure the client for WPA-Personal authentication on the our_wifi SSID with passphrase
justforus, enter the following in the CLI:
edit wifi
set mode dhcp
config wifi-networks
edit 0
set wifi-ssid our_wifi
set wifi-security wpa-personal
set wifi-passphrase "justforus"
end
end
The WiFi interface client_wifi will receive an IP address using DHCP.
3. Configure a wifi to port1 policy.

You can use either CLI or web-based manager to do this. The important settings are:
Incoming Interface (srcintf) wifi
Source Address (srcaddr) all
Outgoing Interface (dstintf) port1

(dstaddr)
Schedule always
Service ALL
Action ACCEPT
Enable NAT Selected

Configuring client mode Using a FortiWiFi unit as a client
Controlled AP selection support in FWF client mode

Use the following CLI commands to provide a more controlled AP selection method (supported in FortiWiFi client
mode).
Syntax
edit {name}
set wifi-ap-band {any | 5g-preferred | 5g-only}
next
end

Support for location-based services
FortiOS supports location-based services by collecting information about WiFi devices near FortiGate-managed
access points, even if the devices don’t associate with the network.
Overview
Configuring location tracking
Viewing device location data on the FortiGate unit
Overview
WiFi devices broadcast packets as they search for available networks. The FortiGate WiFi controller can collect
information about the interval, duration, and signal strength of these packets. The Euclid Analytics service uses
this information to track the movements of the device owner. A typical application of this technology is to analyze
shopper behavior in a shopping center. Which stores do people walk past? Which window displays do they stop to
look at? Which stores do they enter and how long do they spend there? The shoppers are not personally
identified, each is known only by the MAC address of their WiFi device.
After enabling location tracking on the FortiGate unit, you can confirm that the feature is working by using a
specialized diagnostic command to view the raw tracking data. The Euclid Analytics service obtains the same
data in its proprietary format using a JSON inquiry through the FortiGate unit’s web-based manager interface.
Configuring location tracking
You can enable location tracking in any FortiAP profile, using the CLI. Location tracking is part of location-based
services. Set the station-locate field to enable. For example:
edit "FAP220B-locate"
set ap-country US
config platform
set type 220B
end
config lbs
set station-locate enable
end
end
Automatic deletion of outdated presence data

The FortiGate generates a log entry only the first time that station-locate detects a mobile client. No log is
generated for clients that have been detected before. To log repeat client visits, previous station presence data
must be deleted (flushed). The sta-locate-timer can flush this data periodically. The default period is 1800
seconds (30 minutes). The timer can be set to any value between 1 and 86400 seconds (24 hours). A setting of 0
disables the flush, meaning a client is logged only on the very first visit.
The timer is one of the wireless controller timers and it can be set in the CLI. For example:

Viewing device location data on the FortiGate unit Support for location-based services

set sta-locate-timer 1800
end
The sta-locate-timer should not be set to less than the sta-capability-timer (default 30 seconds) because that
could cause duplicate logs to be generated.
FortiPresence push REST API

When the FortiGate is located on a private IP network, the FortiPresence server cannot poll the FortiGate for
information. Instead, the FortiGate must be configured to push the information to the FortiPresence server.
Enter the following command:

edit "FP223B-GuestWiFi"
config lbs
set fortipresence {enable | disable}
set fortipresence-server <ip-address> Default is 3000.
set fortipresence-port <port>
set fortipresence-secret <password>
set fortipresence-project <name>
set fortipresence-frequency <5-65535> Default is 30.
set fortipresence-rogue {enable | disable} Enable/disable reporting of Rogue APs.
set fortipresence-unassoc {enable | disable} Enable/disable reporting of unassociated
devices.
end
end
Viewing device location data on the FortiGate unit
You can use the FortiGate CLI to list located devices. This is mainly useful to confirm that the location data
feature is working, You can also reset device location data.
To list located devices

diag wireless-controller wlac -c sta-locate
To reset device location data

diag wireless-controller wlac -c sta-locate-reset
Example output
The following output shows data for three WiFi devices.
FWF60C3G11004319 # diagnose wireless-controller wlac -c sta-locate
sta_mac vfid rid base_mac freq_lst frm_cnt frm_fst frm_last intv_sum intv2_sum intv3_
sum intv_min intv_max signal_sum signal2_sum signal3_sum sig_min sig_max sig_fst
sig_last ap
00:0b:6b:22:82:61 0
FAP22B3U11005354 0 0 00:09:0f:f1:bb:e4 5745 257 708 56 651 1836 6441 0 12 -21832
1855438 -157758796 -88 -81 -84 -88 0

Support for location-based services Viewing device location data on the FortiGate unit
00:db:df:24:1a:67 0
FAP22B3U11005354 0 0 00:09:0f:f1:bb:e4 5745 42 1666 41 1625 97210 5831613 0 60 -3608
310072 -26658680 -90 -83 -85 -89 0
10:68:3f:50:22:29 0
FAP22B3U11005354 0 0 00:09:0f:f1:bb:e4 5745 102 1623 58 1565 94136 5664566 0 60 -8025
631703 -49751433 -84 -75 -78 -79 0
The output for each device appears on two lines. The first line contains only the device MAC address and the
VLAN ID. The second line begins with the ID (serial number) of the FortiWiFi or FortiAP unit that detected the
device, the AP’s MAC address, and then the fields that the Euclid service uses. Because of its length, this line
wraps around and displays as multiple lines.

Troubleshooting
In the following section, you will learn basic troubleshooting techniques for a secure Fortinet wireless LAN
including:
l strategies for troubleshooting Fortinet wireless devices

l how to avoid common misconfigurations
l solutions to connectivity issues
l capturing and analyzing wireless traffic
l wireless debug commands
The goal of this document is to provide you with practical knowledge that you can use to troubleshoot the FortiOS
wireless controller and FortiAP devices. This includes how to use tools and apply CLI commands for maintenance
and troubleshooting of your wireless network infrastructure, analyze problems per OSI layer, explore diagnostics
for commissioning issues regarding at-client and access point connectivity problems, and understand the packet
sniffer technique as a strong troubleshooting tool.
The content is divided as follows:
FortiAP shell command through CAPWAP control tunnel

Signal strength issues
Throughput issues
Connection issues
General problems
Packet sniffer
Useful debugging commands
FortiAP shell command through CAPWAP control tunnel
Very often, the FortiAP in the field is behind a NAT device, and access to the FortiAP through Telnet or SSH is not
available. As a troubleshooting enhancement, this feature allows an AP shell command up to 127-bytes sent to
the FAP, and FAP will run this command, and return the results to the controller using the CAPWAP tunnel.
The maximum output from a command is limited to 4M, and the default output size is set to 32K.
The FortiAP will only report running results to the controller after the command is finished. If a new command is
sent to the AP before the previous command is finished, the previous command will be canceled.
Enter the following:

diag w-c wlac wtpcmd wtp_ip wtp_port cmd [cmd-to-ap] cmd: run,show,showhex,clr,r&h,r&sh
l cmd-to-ap: any shell commands, but AP will not report results until the command is finished on the AP
l run: controller sends the ap-cmd to the FAP to run
l show: show current results reported by the AP in text
l showhex: show current results reported by the AP in hex
l clr: clear reported results

Troubleshooting Signal strength issues
l r&s: run/show
l r&sh: run/showhex
Signal strength issues
Poor signal strength is possibly the most common customer complaint. Below you will learn where to begin
identifying and troubleshooting poor signal strength, and learn what information you can obtain from the
customer to help resolve signal strength issues.
Asymmetric power issue

Asymmetric power issues are a typical problem. Wireless is two-way communication; high power access points
(APs) can usually transmit a long distance, however, the client's ability to transmit is usually not equal to that of
the AP and, as such, cannot return transmission if the distance is too far.
Measuring signal strength in both directions

To solve an asymmetric power issue, measure the signal strength in both directions. APs usually have enough
power to transmit long distances, but sometimes battery-powered clients have a reply signal that has less power,
and therefore the AP cannot detect their signal.
It is recommended that you match the transmission power of the AP to the least powerful wireless client—around
10 decibels per milliwatt (dBm) for iPhones and 14dBm for most laptops.
Even if the signal is strong enough, other devices may be emitting radiation as well, causing interference. To
identify the difference, read the client Rx strength from the FortiGate GUI (under Monitor > WiFi Client
Monitor) or CLI.
The Signal Strength/Noise value provides the received signal strength indicator (RSSI) of the wireless client.
For example, A value of -85dBm to -95dBm is equal to about 10dB levels; this is not a desirable signal strength.
In the following screenshot, one of the clients is at 18dB, which is getting close to the perimeter of its range.

Signal strength issues Troubleshooting
The Signal Strength/Noise value received from the FortiAP by clients, and vice versa,
should be within the range of -20dBm to -65dBm.
You can also confirm the transmission (Tx) power of the controller on the AP profile (wtp-profile) and the
FortiAP (iwconfig), and check the power management (auto-Tx) options.
Controller configured transmitting power - CLI:

config <radio>
show
(the following output is limited to power levels)
auto-power-level : enable
auto-power-high : 17
auto-power-low : 10
Actual FortiAP transmitting power - CLI:

iwconfig wlan00
Result:
wlan00 IEEE 802.11ng ESSID:"signal-check"
Mode:Master Frequency:2.412 GHz Access Point:<MAC add>
Bit Rate:130 Mb/s Tx-Power=28 dBm
Using FortiPlanner PRO with a site survey

The most thorough method to solve signal strength issues is to perform a site survey. To this end, Fortinet offers
the FortiPlanner, downloadable at http://www.fortinet.com/resource_center/product_downloads.html.

Troubleshooting Signal strength issues
Sample depiction of a site survey using FortiPlanner
The site survey provides you with optimal placement for your APs based on the variables in your environment.
You must provide the site survey detailed information including a floor plan (to scale), structural materials, and
more. It will allow you to place the APs on the map and adjust the radio bands and power levels while providing
you with visual wireless coverage.
Below is a list of mechanisms for gathering further information on the client for Rx strength. The goal is to see
how well the client is receiving the signal from the AP. You can also verify FortiAP signal strength on the client
using WiFi client utilities, or third party utilities such as InSSIDer or MetaGeek Chanalyzer. You can get similar
tools from the app stores on Android and iOS devices.
l Professional Site Survey software (Ekahau, Airmagnet survey Pro, FortiPlanner)

l InSSIDer
l On Windows: “netsh wlan show networks mode=bssid” (look for the BSSID, it's in % not in dBm!)
l On MacOS: Use the “airport” command:
“/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport” airport –s |
grep <the_bssid> (live scan each time)
l On Droid: WiFiFoFum
Frequency interference
If the wireless signal seems to be strong but then periodically drops, this may be a symptom of frequency
interference. Frequency interference is when another device also emits radio frequency using the same channel,
co-channel, or adjacent channel, thereby overpowering or corrputing your signal. This is a common problem on a
2.4GHz network.
There are two types of interference: coherent and non-coherent.

Throughput issues Troubleshooting
l Coherent interference: a result of another device using the same channel as your AP, or poor planning of a
wireless infrastructure (perhaps the other nearby APs are using the same channel or the signal strength is too high).
l Non-coherent interference: a result of other radio signals such as bluetooth, microwave, cordless phone, or (as in
medical environments) x-ray machines.
Most common and simple solution for frequency interference is to change your operation channel. Typically, the
channel can be set from 1 to 11 for the broadcast frequency, although you should always use channels 1, 6, and
11 on the 2.4GHz band.
Another solution, if it's appropriate for your location, is to use the 5GHz band instead.
MetaGeek Chanalyzer
You can perform a site survey using spectrum analysis at various points in your environment looking for signal
versus interference/noise. MetaGeek Chanalyzer is an example of a third party utility which shows a noise
threshold.
Note that a signal of -95dBm or less will be ignored by Fortinet wireless adapters.
Throughput issues
Sometimes communication issues can be caused by low performance.
Testing the link

You can identify delays or lost packets by sending ping packets from your wireless client. If there is more than
10ms of delay, there may be a problem with your wireless deployment, such as:
l a weak transmit signal from the client (the host does not reach the AP)
l the AP utilization is too high (your AP could be saturated with connected clients)
l interference (third party signal could degrade your AP or client's ability to detect signals between them)
l weak transmit power from the AP (the AP does not reach the host) -- not common in a properly deployed network,
unless the client is too far away

Troubleshooting Throughput issues
Keep in mind that water will also cause a reduction in radio signal strength for those making use out of outdoor
APs or wireless on a boat.
Performance testing
If the FortiAP gives bad throughput to the client, the link may drop. The throughput or performance can be
measured on your smartphone with third party applications tool such as iPerf and jPerf.
Measuring file transfer speed

Another way to get a sense of your throughput issues is to measure the speed of a file transfer on your network.
Create a test file at a specific size and measure the speed at which Windows measures the transfer. The
command below will create a 50MB file.
l fsutil file createnew test.txt 52428800
The following image shows a network transfer speed of just over 24Mbps. The theoretical speed of 802.11g is
54Mbps, which is what this client is using. A wireless client is never likely to see the theoretical speed.
TKIP limitation
If you find that throughput is a problem, avoid WPA security encrypted with Temporal Key Integrity Protocol
(TKIP) as it supports communications only at 54Mbps. Use WPA-2 AES instead.
Speeds are very much based on what the client computer can handle as well. The maximum client connection
rate of 130Mbps is for 2.4GHz on a 2x2, or 300Mbps for 5Ghz on a 2x2 (using shortguard and channel bonding
enabled).
If you want to get more than 54Mbps with 802.11n, do not use legacy TKIP, use CCMP instead. This is standard
for legacy compatibility.

Connection issues Troubleshooting
Preventing IP fragmentation in CAPWAP

TKIP is not the only possible source of decreased throughput. When a wireless client sends jumbo frames using a
CAPWAP tunnel, it can result in data loss, jitter, and decreased throughput.
Using the following commands you can customize the uplink rates and downlink rates in the CAPWAP tunnel to
prevent fragmentation and avoid data loss.
edit new-wtp
set ip-fragment-preventing [tcp-mss-adjust | icmp-unreachable]
set tun-mtu-uplink [0 | 576 | 1500]
set tun-mtu-downlink [0 | 576 | 1500]
end
end
The default value is 0, however the recommended value will depend on the type of traffic. For example, IPsec in
tunnel mode has 52 bytes of overhead, so you might use 1400 or less for uplink and downlink.
Slowness in the DTLS response

It's important to know all the elements involved in the CAPWAP association:
l Request
l Response
l DTLS
l Join
l Configuration
All of these are bidirectional. So if the DTLS response is slow, this might be the result of a configuration error.
This issue can also be caused by a certificate during discovery response. You can read more about this in RFC
5416.
Connection issues
If the client has a connectivity issue that is not due to signal strength, the solution varies by the symptom.
Client connection issues

1. If client is unable to connect to FortiAP:
l Make sure the client’s security and authentication settings match with FortiAP and check the certificates as
well.
l Try upgrading the Wi-Fi adapter driver and FortiGate/FortiAP firmware.
l If other clients can connect, it could be interoperability; run debug commands and sniffer packets.
l Look for rogue suppression by sniffing the wireless traffic and looking for the disconnect in the output (using the
AP or wireless packet sniffer).
l Try changing the IEEE protocol from 802.11n to 802.11bg or 802.11a only.
2. If the client drops and reconnects:

Troubleshooting Connection issues
l The client might be de-authenticating periodically. Check the sleep mode on the client.
l The issue could be related to power-saver settings. The client may need to udpate drivers.
l The issue could also be caused by flapping between APs. Check the roaming sensitivity settings on the client or
the preferred wireless network settings on the client—if another WiFi network is available, the client may
connect to it if it is a preferred network. Also, check the DHCP configuration as it may be an IP conflict.
3. If the client drops and never connects:
l It could have roamed to another SSID, so check the standby and sleep modes.
l You may need to bring the interface up and down.
4. If the client connects, but no IP address is acquired by the client:
l Check the DHCP configuration and the network.
l It could be a broadcast issue, so check the WEP encryption key and set a static IP address and VLANs.
Debug
You should also enable client debug on the controller for problematic clients to see the stage at which the client
fails to connect. Try to connect from the problematic client and run the following debug command, which allows
you to see the four-way handshake of the client association:
diagnose wireless-controller wlac sta_filter <client MAC address> 2
Example of a successful client connection:
The following is a sample debug output for the above command, with successful association/DHCP phases and
PSK key exchange (identified in color):
FG600B3909600253 #
91155.197 <ih> IEEE 802.11 mgmt::assoc_req <== 30:46:9a:f9:fa:34 vap signal-check rId 0
wId 0 00:09:0f:f3:20:45
91155.197 <ih> IEEE 802.11 mgmt::assoc_resp ==> 30:46:9a:f9:fa:34 vap signal-check rId 0
wId 0 00:09:0f:f3:20:45 resp 0
91155.197 <cc> STA_CFG_REQ(15) sta 30:46:9a:f9:fa:34 add ==> ws (0-192.168.35.1:5246) rId
0 wId 0
91155.197 <dc> STA add 30:46:9a:f9:fa:34 vap signal-check ws (0-192.168.35.1:5246) rId 0
wId 0 bssid 00:09:0f:f3:20:45 NON-AUTH
91155.197 <cc> STA add 30:46:9a:f9:fa:34 vap signal-check ws (0-192.168.35.1:5246) rId 0
wId 0 00:09:0f:f3:20:45 sec WPA2 AUTO auth 0
91155.199 <cc> STA_CFG_RESP(15) 30:46:9a:f9:fa:34 <== ws (0-192.168.35.1:5246) rc 0
(Success)
91155.199 <eh> send 1/4 msg of 4-Way Handshake
91155.199 <eh> send IEEE 802.1X ver=1 type=3 (EAPOL_KEY) data len=95 replay cnt 1
91155.199 <eh> IEEE 802.1X (EAPOL 99B) ==> 30:46:9a:f9:fa:34 ws (0-192.168.35.1:5246) rId
0 wId 0 00:09:0f:f3:20:45
91155.217 <eh> IEEE 802.1X (EAPOL 121B) <== 30:46:9a:f9:fa:34 ws (0-192.168.35.1:5246) rId
0 wId 0 00:09:0f:f3:20:45
91155.217 <eh> recv IEEE 802.1X ver=1 type=3 (EAPOL_KEY) data len=117
91155.217 <eh> recv EAPOL-Key 2/4 Pairwise replay cnt 1
91155.218 <eh> send 3/4 msg of 4-Way Handshake
91155.218 <eh> send IEEE 802.1X ver=1 type=3 (EAPOL_KEY) data len=175 replay cnt 2
91155.218 <eh> IEEE 802.1X (EAPOL 179B) ==> 30:46:9a:f9:fa:34 ws (0-192.168.35.1:5246) rId
0 wId 0 00:09:0f:f3:20:45
91155.223 <eh> IEEE 802.1X (EAPOL 99B) <== 30:46:9a:f9:fa:34 ws (0-192.168.35.1:5246) rId
0 wId 0 00:09:0f:f3:20:45
91155.223 <eh> recv IEEE 802.1X ver=1 type=3 (EAPOL_KEY) data len=95
91155.223 <eh> recv EAPOL-Key 4/4 Pairwise replay cnt 2

91155.223 <dc> STA chg 30:46:9a:f9:fa:34 vap signal-check ws (0-192.168.35.1:5246) rId 0

wId 0 bssid 00:09:0f:f3:20:45 AUTH
91155.224 <cc> STA chg 30:46:9a:f9:fa:34 vap signal-check ws (0-192.168.35.1:5246) rId 0
wId 0 00:09:0f:f3:20:45 sec WPA2 AUTO auth 1
91155.224 <cc> STA_CFG_REQ(16) sta 30:46:9a:f9:fa:34 add key (len=16) ==> ws (0-
192.168.35.1:5246) rId 0 wId 0
91155.226 <cc> STA_CFG_RESP(16) 30:46:9a:f9:fa:34 <== ws (0-192.168.35.1:5246) rc 0
(Success)
91155.226 <eh> ***pairwise key handshake completed*** (RSN)
91155.257 <dc> DHCP Request server 0.0.0.0 <== host ADMINFO-FD4I2HK mac 30:46:9a:f9:fa:34
ip 172.16.1.16
91155.258 <dc> DHCP Ack server 172.16.1.1 ==> host mac 30:46:9a:f9:fa:34 ip 172.16.1.16
mask 255.255.255.0 gw 172.16.1.1
where:
l orange represents the association phase,

l blue represents the PSK exchange,
l and green represents the DHCP phase.
It is important to note the messages for a correct association phase, four-way handshake, and DHCP phase.
Checking WiFi password

Admins can view plain text passwords (captive-portal-radius-secret and passphrase) under
config wireless-controller vap.
Note that security must be set as a WPA-personal setting.
FortiAP connection issues

Clients are not the only device that can fail to connect, of course. A communication problem could arise from the
FortiAP.
Some examples include:
l The FortiAP is not connecting to the wireless controller.

l One FortiAP intermittently disconnects and re-connects.
l All FortiAPs intermittently disconnect and re-connect.
l Unable to Telnet to FortiAP from controller/administrator workstation.
In the above cases:
l Check networking on the distribution system for all related FortiAPs.

l Check the authorization status of managed APs from the wireless controller.
l Restart the cw_acd process (Note: All APs will drop if you do this, and you may be troubleshooting just one AP).
l Check the controller crash log for any wireless controller daemon crash using the following command:
diagnose debug crashlog read
Debug
For a quick assessment of the association communication between the controller and the FortiAP, run the
following sniffer command to see if you can verify that the AP is communicating to the controller by identifying the
CAPWAP communication:
diagnose sniff packet <interface_name> “port 5246” 4

Troubleshooting Connection issues
If you do not see this communication, then you can investigate the network or the settings on the AP to see why it
is not reaching the controller.
The following command allows you to collect verbose output from the sniff that can be converted to a PCAP and
viewed in Wireshark.
diagnose sniff packet <interface_name> “port 5246” 6 o l
The image below shows the beginning of the AP's association to the controller. You can see the discovery
Request and Response at the top.
Throughout debugging it is recommended to:
l Enable Telnet login to the FortiAP device so that you can log in and issue local debugging commands:
edit "<FortiAP_serial_number>"
set override-allowaccess {disable|enable}
set allowaccess {telnet | http | https | ssh}
end
l Try to connect to the wireless controller from the problematic FortiAP to verify routes exist.
l Enable wtp (FortiAP) debugging on the wireless controller for problematic FortiAPs to determine the point at which
the FortiAP fails to connect:
diag wireless-controller wlac wtp_filter FP112B3X13000193 0-192.168.6.8:5246 2
(replace the serial number and IP address of the FortiAP)
di de console timestamp en
di de application cw_acd 0x7ff
di de en

Example of a successful AP and controller association:
The previous debug command provides similar output to the sample debug message below for a successful
association between the FortiAP and the wireless controller. This includes the elements of the CAPWAP protocol;
the Request, Response, DTLS, Join, and Configuration (identified in color). All of these are bi-directional, so if
the DTLS response is slow, it may be an example of a configuration error.
56704.575 <msg> DISCOVERY_REQ (12) <== ws (0-192.168.35.1:5246)
56704.575 <msg> DISCOVERY_RESP (12) ==> ws (0-192.168.35.1:5246)
56707.575 <msg> DISCOVERY_REQ (13) <== ws (0-192.168.35.1:5246)
56707.575 <msg> DISCOVERY_RESP (13) ==> ws (0-192.168.35.1:5246)
56709.577 <aev> - CWAE_INIT_COMPLETE ws (0-192.168.35.1:5246)
56709.577 <aev> - CWAE_LISTENER_THREAD_READY ws (0-192.168.35.1:5246)
56709.577 <fsm> old CWAS_START(0) ev CWAE_INIT_COMPLETE(0) new CWAS_IDLE(1)
56709.577 <fsm> old CWAS_IDLE(1) ev CWAE_LISTENER_THREAD_READY(1) new CWAS_DTLS_SETUP(4)
56709.623 <aev> - CWAE_DTLS_PEER_ID_RECV ws (0-192.168.35.1:5246)
56709.623 <aev> - CWAE_DTLS_AUTH_PASS ws (0-192.168.35.1:5246)
56709.623 <aev> - CWAE_DTLS_ESTABLISHED ws (0-192.168.35.1:5246)
56709.623 <fsm> old CWAS_DTLS_SETUP(4) ev CWAE_DTLS_PEER_ID_RECV(7) new CWAS_DTLS_
AUTHORIZE(2)
56709.623 <fsm> old CWAS_DTLS_AUTHORIZE(2) ev CWAE_DTLS_AUTH_PASS(3) new CWAS_DTLS_CONN(5)
56709.623 <fsm> old CWAS_DTLS_CONN(5) ev CWAE_DTLS_ESTABLISHED(8) new CWAS_JOIN(7)
56709.625 <msg> JOIN_REQ (14) <== ws (0-192.168.35.1:5246)
56709.625 <aev> - CWAE_JOIN_REQ_RECV ws (0-192.168.35.1:5246)
56709.626 <fsm> old CWAS_JOIN(7) ev CWAE_JOIN_REQ_RECV(12) new CWAS_JOIN(7)
56709.629 <msg> CFG_STATUS (15) <== ws (0-192.168.35.1:5246)
56709.629 <aev> - CWAE_CFG_STATUS_REQ ws (0-192.168.35.1:5246)
56709.629 <fsm> old CWAS_JOIN(7) ev CWAE_CFG_STATUS_REQ(13) new CWAS_CONFIG(8)
56710.178 <msg> CHG_STATE_EVENT_REQ (16) <== ws (0-192.168.35.1:5246)
56710.178 <aev> - CWAE_CHG_STATE_EVENT_REQ_RECV ws (0-192.168.35.1:5246)
56710.178 <fsm> old CWAS_CONFIG(8) ev CWAE_CHG_STATE_EVENT_REQ_RECV(23) new CWAS_DATA_
CHAN_SETUP(10)
56710.220 <aev> - CWAE_DATA_CHAN_CONNECTED ws (0-192.168.35.1:5246)
56710.220 <msg> DATA_CHAN_KEEP_ALIVE <== ws (0-192.168.35.1:5246)
56710.220 <aev> - CWAE_DATA_CHAN_KEEP_ALIVE_RECV ws (0-192.168.35.1:5246)
56710.220 <msg> DATA_CHAN_KEEP_ALIVE ==> ws (0-192.168.35.1:5246)
56710.220 <fsm> old CWAS_DATA_CHAN_SETUP(10) ev CWAE_DATA_CHAN_CONNECTED(32) new CWAS_
DATA_CHECK(11)
56710.220 <aev> - CWAE_DATA_CHAN_VERIFIED ws (0-192.168.35.1:5246)
56710.220 <fsm> old CWAS_DATA_CHECK(11) ev CWAE_DATA_CHAN_KEEP_ALIVE_RECV(35) new CWAS_
DATA_CHECK(11)
56710.220 <fsm> old CWAS_DATA_CHECK(11) ev CWAE_DATA_CHAN_VERIFIED(36) new CWAS_RUN(12)
56710.228 <msg> WTP_EVENT_REQ (17) <== ws (0-192.168.35.1:5246)
56710.228 <aev> - CWAE_WTP_EVENT_REQ_RECV ws (0-192.168.35.1:5246)
56710.228 <fsm> old CWAS_RUN(12) ev CWAE_WTP_EVENT_REQ_RECV(42) new CWAS_RUN(12)
56710.230 <msg> CFG_UPDATE_RESP (1) <== ws (0-192.168.35.1:5246) rc 0 (Success)
56710.230 <aev> - CWAE_CFG_UPDATE_RESP_RECV ws (0-192.168.35.1:5246)
56710.230 <fsm> old CWAS_RUN(12) ev CWAE_CFG_UPDATE_RESP_RECV(37) new CWAS_RUN(12)
56710.232 <msg> CFG_UPDATE_RESP (2) <== ws (0-192.168.35.1:5246) rc 0 (Success)
56710.232 <aev> - CWAE_CFG_UPDATE_RESP_RECV ws (0-192.168.35.1:5246)
56710.232 <fsm> old CWAS_RUN(12) ev CWAE_CFG_UPDATE_RESP_RECV(37) new CWAS_RUN(12)

Troubleshooting General problems

56712.253 < . > AC (2) -> WTP (0-192.168.35.1:5246) State: CWAS_RUN (12) accept 3 live 3
dbg 00000000 pkts 12493 0
dbg 00000000 pkts 12493 0
dbg 00000000 pkts 12493 0
56719.253 <aev> - CWAE_AC_ECHO_INTV_TMR_EXPIRE ws (0-192.168.35.1:5246)
56719.253 <fsm> old CWAS_RUN(12) ev CWAE_AC_ECHO_INTV_TMR_EXPIRE(39) new CWAS_RUN(12)
56719.576 <msg> ECHO_REQ (21) <== ws (0-192.168.35.1:5246)
56719.576 <aev> - CWAE_ECHO_REQ_RECV ws (0-192.168.35.1:5246)
56719.577 <fsm> old CWAS_RUN(12) ev CWAE_ECHO_REQ_RECV(27) new CWAS_RUN(12)
where:
l orange represents the Discovery phase,

l blue indicates that the control channels have been established using DTLS,
l green represents the access point Discovery and Join phase,
l purple represents the Clear Text channel,
l and pink indicates that the FortiAP successfully connected to the wireless controller.
General problems
Not all WiFi problems are related to signal strength, interference, or misconfiguration. The following OSI model
identifies some of the more common issues per layer.
Best practices for troubleshooting vary depending on the affected layer (see below).
Common sources of wireless issues

General problems Troubleshooting
Best practices for Layer 1

Common physical layer issues include:
l Weak received signal,

l WiFi capability: 802.11b, 1x1, 2x2,
l Co-channel WiFi interference,
l Side band WiFi interference,
l Non 802.11 noise (microwave ovens...).
To avoid physical layer issues:
l Determine RST (Receiver Sensitivity Threshold) for your device, or use -70dBm as a rule of thumb.
l Match AP TX output power to the client TX output power.
l Note: iPhone TX power is only 10dBm.
l Use DFS (Dynamic Frequency Selection) for high performance data 20/40 MHz.
l Use 5GHz UNII-1 & 3 (Non-DFS) bands with static channel assignment for latency-sensitive applications.
l Do not use 40MHz channels in 2.4 GHz band (channel bonding is not allowed in FortiOS).
Best practices for Layer 2

Common data link (MAC) layer issues include:
l Too many clients on a single channel (CSMA/CA) backoff,

l Too many high-priority traffic clients (WMM),
l Incorrect password or encryption settings,
l Too many beacons (in dense installs).
To avoid data link layer issues:
l Only use CCMP/AES (WPA2) encryption (not TKIP).

l In high density deployments, turn off SSID broadcast or turn down SSID rates. Review and possibly reduce the
beacon interval.
l Determine the best cell size for applications:
l For few users and low bandwidth latency sensitive applications, use high transmit power to create larger cells.
l For high performance/high capacity installations, use lower transmit power to create smaller cells (set
FortiPlanner at 10dBm TX power), but bear in mind that this will require more roaming.
Cells and co-channel interference

In high density deployments, multiple APs are used, and each one services an area called a cell. However, these
cells can cause interference with each other. This is a common problem. The radio signal from one AP interferes
with, or cancels out, the radio signal from another AP.
In the following diagram, note the interference zone created by one radio, causing interference on its
neighbouring APs.
The interference zone can be twice the radius of the signal, and the signal at its edge can be -67dBm.

Troubleshooting General problems
Reducing co-channel interference
For best results, use a 'honeycomb' pattern as a deployment strategy. The idea is to stagger repeated channels
furthest from each other to avoid interference.
Best practices for Layer 3 and above

For TCP/IP layers and above, a common source of latency, or slowness in the wireless traffic, is too many
broadcasts or multicasts. These types of issues can result from non-business and/or unwanted traffic.
To resolve issues at the TCP/IP layer and above:

Packet sniffer Troubleshooting
l Identify business-critical applications.

l Use Application Control, Web Filtering, Traffic Shaping, and QoS to prioritize applications.
l Identify unwanted traffic, high-bandwidth web-related traffic, and use Security Profiles.
l Use the traffic shaper on a policy to rate-limit this traffic.
These configurations are performed directly on the FortiGate.
Packet sniffer
Capturing the traffic between the controller and the FortiAP can help you identify most FortiAP and client
connection issues.
This section describes the following recommended packet sniffing techniques:
l CAPWAP packet sniffer

l Wireless traffic packet sniffer
CAPWAP packet sniffer

The first recommended technique consists of sniffing the CAPWAP traffic.
l Enable plain control on the controller and on the FortiAP to capture clear control traffic on UDP port 5246.
l On the controller:
diagnose wireless-controller wlac plain-ctl <FortiAP_serial_number> 1
Result:
WTP 0-FortiAP2223X11000107 Plain Control: enabled
l On the FortiAP:
cw_diag plain-ctl 1
Result:
Current Plain Control: enabled
Note that some issues are related to the keep-alive for control and data channel.
l Data traffic on UDP port 5247 is not encrypted. The data itself is encrypted by the wireless security mechanism.
Data traffic is helpful to troubleshoot most of the issues related to station association, EAP authentication,
WPA key exchange, roaming, and FortiAP configuration.
You can also set up a host or server to which you can forward the CAPWAP traffic:
1. Configure the host/server to which CAPWAP traffic is forwarded:

diagnose wireless-controller wlac sniff-cfg <Host_IP_address> 88888
Result:
Current Sniff Server: 192.168.25.41, 23352
2. Choose which traffic to capture, the interface to which the FortiAP is connected, and the FortiAP’s serial number:
diagnose wireless-controller wlac sniff <interface_name> <FortiAP_serial_number> 2
Result:

Troubleshooting Packet sniffer
WTP 0-FortiAP2223X11000107 Sniff: intf port2 enabled (control and data message)
In the above syntax, the '2' captures the control and data message—'1' would capture only the control
message, and '0' would disable it.
3. Run Wireshark on the host/server to capture CAPWAP traffic from the controller.
l Decode the traffic as IP to check inner CAPWAP traffic.
Example CAPWAP packet capture
The following image shows an example of a CAPWAP packet capture, where you can see: the Layer 2 header;
the sniffed traffic encapsulated into Internet Protocol for transport; CAPWAP encapsulated into UDP for sniffer
purpose and encapsulated into IP; CAPWAP control traffic on UDP port 5246; and CAPWAP payload.
Wireless traffic packet sniffer

The second recommended technique consists of sniffing the wireless traffic directly 'on the air' using your FortiAP.
Wireless traffic packet capture

Packet captures are useful for troubleshooting all wireless client related issues because you can verify data rate
and 802.11 parameters, such as radio capabilities, and determine issues with wireless signal strength,
interference, or congestion on the network.
A radio can only capture one frequency at a time; one of the radios is set to sniffer mode depending on the traffic
or channel required. You must use two FortiAPs to capture both frequencies at the same time.
l Set a radio on the FortiAP to monitor mode.

Packet sniffer Troubleshooting
iwconfig wlan10
Result:
wlan10 IEEE 802.11na ESSID:""
Mode:Monitor Frequency:5.18 GHz Access Point: Not-Associated
l The capture file is stored under the temp directory as wl_sniff.pcap

/tmp/wl_sniff.cap
l Remember that the capture file is only stored temporarily. If you want to save it, upload it to a TFTP server
before rebooting or changing the radio settings.
l The command cp wl_sniff.cap newname.pcap allows you to rename the file.
l Rather than TFTP the file, you can also log in to the AP and retrive the file via the web interface. Move the file
using the command: mv name /usr/www
You can verify the file was moved using the command cd/usr/www and then browsing to: <fortiAP_
IP>/filename
Syntax
The following syntax demonstrates how to set the radio to sniffer mode (configurable from the CLI only). Sniffer
mode provides options to filter for specific traffic to capture. Notice that you can determine the buffer size, which
channel to sniff, the AP's MAC address, and select if you want to sniff the beacons, probes, controls, and data
channels.
configure wireless-controller wtp-profile
edit <profile_name>
configure <radio>
set mode sniffer
set ap-sniffer-bufsize 32
set ap-sniffer-chan 1
set ap-sniffer-addr 00:00:00:00:00:00
set ap-sniffer-mgmt-beacon enable
set ap-sniffer-mgmt-probe enable
set ap-sniffer-mgmt-other enable
set ap-sniffer-ctl enable
set ap-sniffer-data enable
end
end
Once you've performed the previous CLI configuration, you'll be able to see the packet sniffer mode selected in
the GUI dashboard under WiFi & Switch Controller > FortiAP Profiles and WiFi & Switch Controller >
Managed FortiAPs. Bear in mind that if you change the mode from the GUI, you'll have to return to the CLI to
re-enable the Sniffer mode.
To disable the sniffer profile in the CLI, use the following commands:
edit <profile_name>
config <radio>
set ap-sniffer-mgmt-beacon disable
set ap-sniffer-mgmt-probe disable
set ap-sniffer-mgmt-other disable
set ap-sniffer-ctl disable
set ap-sniffer-data disable
end

Troubleshooting Useful debugging commands
end
If you change the radio mode before sending the file wl_sniff.cap to an external
TFTP, the file will be deleted and you will lose your packet capture.
Example AP packet capture
The following image shows an example of the AP packet capture. Note the capture header showing channel 36;
the beacon frame; the source, destination, and BSSID of the beacon frame; and the SSID of the beacon frame.
Useful debugging commands
For a comprehensive list of useful debug options you can use the following help commands on the controller:
diagnose wireless-controller wlac help
(this command lists the options available that pertain to the wireless controller)
diagnose wireless-controller wlwtp help

(this command lists the options available that pertain to the AP)

Useful debugging commands Troubleshooting
Sample outputs
Syntax
diagnose wireless-controller wlac -c vap
(this command lists the information about the virtual access point, including its MAC address, the BSSID, its
SSID, the interface name, and the IP address of the APs that are broadcasting it)
Result:
bssid ssid intf vfid:ip-port rId wId
00:09:0f:d6:cb:12 Office Office ws (0-192.168.3.33:5246) 0 0
00:09:0f:e6:6b:12 Office Office ws (0-192.168.1.61:5246) 0 0
06:0e:8e:27:dc:48 Office Office ws (0-192.168.3.36:5246) 0 0
0a:09:0f:d6:cb:12 public publicAP ws (0-192.168.3.33:5246) 0 1
Syntax
diagnose wireless-controller wlac -c darrp
(this command lists the information pertaining to the radio resource provisioning statistics, including the
AP serial number, the number of channels set to choose from, and the operation channel. Note that the 5GHz
band is not available on these APs listed)
Result:
wtp_id rId base_mac index nr_chan vfid 5G oper_chan age
FAP22A3U10600400 0 00:09:0f:d6:cb:12 0 3 0 No 1 87588
FW80CM3910601176 0 06:0e:8e:27:dc:48 1 3 0 No 6 822

Reference
This chapter provides some reference information pertaining to wireless networks.
FortiAP web-based manager

Wireless radio channels
WiFi event types
FortiAP CLI

FortiAP web-based manager Reference
FortiAP web-based manager
You can access the FortiAP unit’s built-in web-based manager. This is useful to adjust settings that are not
available through the FortiGate unit’s WiFi Controller. Logging into the FortiAP web-based manager is similar to
logging into the FortiGate web-based manager.
System Information
Status
The Status section provides information about the FortiAP unit.
You can:
l Select Change to change the Host Name.

l Select Update in Firmware Version to upload a new FortiAP firmware file from your computer.
l Select Change Password to change the administrator password.
l Select Backup to save the current FortiAP configuration as a file on your computer.
l Select Restore to load a configuration into your FortiAP unit from a file on your computer.
Network Configuration
Select DHCP or select Static and specify the IP address, netmask, and gateway IP address. Administrative
Access settings affect access after the FortiAP has been authorized. By default, HTTP access needed to access
the FortiAP web-based manager is enabled, but Telnet access is not enabled.
Connectivity
These settings determine how the FortiAP unit connects to the FortiGate WiFi controller.

Reference FortiAP web-based manager
Uplink Ethernet - wired connection to the FortiGate unit (default)
Mesh - WiFi mesh connection
Ethernet with mesh backup support
Mesh AP SSID Enter the SSID of the mesh root. Default: fortinet.mesh.root
Mesh AP Enter password for the mesh SSID.

Password
Bridge the mesh SSID to the FortiAP Ethernet port.

Ethernet Bridge
This is available only whe Uplink is Mesh.
WTP Configuration
AC Discovery Type settings affect how the FortiAP unit discovers a FortiGate WiFi controller. By default, this is
set to Auto which causes the FortiAP unit to cycle through all of the discovery methods until successful. For more
information see Controller discovery methods.
AC Discovery Static, DHCP, DNS, Broadcast, Multicast, Auto

Type
AC Control Port Default port is 5246.
AC IP Address 1 You enter up to three WiFi controller IP addresses for static discovery. Routing must
AC IP Address 2 be properly configured in both directions.
AC IP Address 3
AC Host Name 1
As an alternetive to AC IP addresses, you can enter their fully qualified domain names
AC Host Name 2
(FQDNs).
AC Host Name 3
AC Discovery 224.0.1.140
Multicast
Address
AC Discovery
When using DHCP discovery, you can configure the DHCP server to provide the
DHCP Option
controller address. By default the FortiAP unit expects this in option 138.
Code
AC Data Channel Security by default accepts either DTLS-encrypted or clear text data communication with the
WiFi controller. You can change this setting to require encryption or to use clear text only.
Wireless Information
The Wireless Information page provides current information about the operation of the radios and the type Uplink
in use.

Wireless radio channels Reference
Wireless radio channels
IEEE 802.11a/n channels

The following table lists the channels supported on FortiWiFi products that support the IEEE 802.11a and
802.11n wireless standards. 802.11a is available on FortiWiFi models 60B and higher. 802.11n is available on
FortiWiFi models 80CM and higher.
All channels are restricted to indoor usage except in the Americas, where both indoor and outdoor use is
permitted on channels 52 through 64 in the United States.
IEEE 802.11a/n (5-GHz Band) channel numbers
Regulatory Areas
Channel number Frequency (MHz)
Americas Europe Taiwan Singapore Japan
34 5170 •
36 5180 • • •
38 5190
40 5200 • • • •
42 5210
44 5220 • • • •
46 5230
48 5240 • • • •
149 5745 • • •
153 5765 • • •
157 5785 • • •
161 5805 • • •
165 5825 • •
IEEE 802.11b/g/n channel numbers

The following table lists IEEE 802.11b/g/n channels. All FortiWiFi units support 802.11b and 802.11g. Newer
models also support 802.11n.

Reference Wireless radio channels
Mexico is included in the Americas regulatory domain. Channels 1 through 8 are for indoor use only. Channels 9
through 11 can be used indoors and outdoors. You must make sure that the channel number complies with the
regulatory standards of Mexico.
IEEE 802.11b/g/n (2.4-GHz Band) channel numbers
Regulatory Areas
Channel number Frequency (MHz)
Americas EMEA Israel Japan
1 2412 • • indoor •
2 2417 • • indoor •
3 2422 • • indoor •
4 2427 • • indoor •
5 2432 • • • •
6 2437 • • • •
7 2442 • • • •
8 2447 • • • •
9 2452 • • • •
10 2457 • • • •
11 2462 • • • •
12 2467 • • •
13 2472 • • •
14 2484 b only
View all Country & Regcodes/Regulatory Domains

The following CLI command can be entered to view a list of the Country & Regcodes/Regulatory Domains
supported by Fortinet:
cw_diag -c all-countries
Below is a table showing a sample of the list displayed by entering this command:
0 A FCC3 & FCCA NA NO_COUNTRY_SET

WiFi event types Reference
8 W NULL1 & WORLD AL ALBANIA
12 W NULL1 & WORLD DZ ALGERIA
16 A FCC3 & FCCA AS AMERICAN SAMOA
... ... ... ... ...
WiFi event types
Event type Description
rogue-ap-detected A rogue AP has been detected (generic).
rogue-ap-off-air A rogue AP is no longer detected on the RF side.
rogue-ap-on-wire A rogue AP has been detected on wire side (connected to AP or controller L2

network).
rogue-ap-off-wire A rogue AP is no longer detected on wire.
rogue-ap-on-air A rogue AP has been detected on the RF side.
fake-ap-detected A rogue AP broadcasting on the same SSIDs that you have in your managed APs
has been detected.
fake-ap-on-air The above fake AP was detected on the RF side.
FortiAP CLI
The FortiAP CLI controls radio and network operation through the use of variables manipulated with the cfg
command. There are also diagnostic commands.
The cfg command include the following
cfg -s List variables.
cfg -a var=value Add or change a variable value.
cfg -c Commit the change to flash.
cfg -x Reset settings to factory defaults.

Reference FortiAP CLI
cfg -r var Remove variable.
cfg -e Export variables.
cfg -h Display help for all commands.
The configuration variables are:
Var Description and Values
AC_CTL_PORT WiFi Controller control (CAPWAP) port. Default 5246.
Data channel security.
0 - Clear text
AC_DATA_CHAN_SEC
1 - DTLS (encrypted)
2 - Accept either DTLS or clear text (default)
AC_DISCOVERY_TYPE 1 - Static. Specify WiFi Controllers
2 - DHCP
3 - DNS
5 - Broadcast
6 - Multicast
0 - Cycle through all of the discovery types until successful.
These variables set the FortiAP unit IP address, netmask

AP_IPADDR and default gateway when ADDR_MODE is STATIC.
AP_NETMASK
IPGW Default 192.168.1.2 255.255.255.0, gateway
192.168.1.1.
AC_HOSTNAME_1 WiFi Controller host names for static discovery.

AC_HOSTNAME_2
AC_HOSTNAME_3
AC_IPADDR_1
AC_IPADDR_2 WiFi Controller IP addresses for static discovery.
AC_IPADDR_3
AC_DISCOVERY_DHCP_OPTION_CODE Option code for DHCP server. Default 138.
Multicast address for controller discovery. Default

AC_DISCOVERY_MC_ADDR
224.0.1.140.

FortiAP CLI Reference
ADDR_MODE How the FortiAP unit obtains its IP address and netmask.
DHCP - FortiGate interface assigns address.
STATIC - Specify in AP_IPADDR and AP_NETMASK.
Default is DHCP.
Administrative timeout in minutes. Applies to Telnet and

ADMIN_TIMEOUT
web-based manager sessions. Default is 5 minutes.
AP_MGMT_VLAN_ID Non-zero value applies VLAN ID for unit management.

Default: 0.
FortiAP operating mode.
0 - Thin AP (default)
AP_MODE
2 - Unmanaged Site Survey mode. See SURVEY
variables.
BAUD_RATE Console data rate: 9600, 19200, 38400, 57600, or 115200

baud.
DNS Server for clients. If ADDR_MODE is DHCP the DNS

DNS_SERVER
server is automatically assigned.
FIRMWARE_UPGRADE Default is 0.
Access to FortiAP web-based manager

HTTP_ALLOW
1 - Yes (default), 0 - No.
LED_STATE Enable/disable status LEDs.

0 - LEDs enabled, 1 - LEDs disabled, 2 - follow AC setting.
LOGIN_PASSWD Administrator login password. By default this is empty.
STP_MODE Spanning Tree Protocol. 0 is off. 1 is on.
By default (value 0), Telnet access is closed when the

TELNET_ALLOW FortiAP unit is authorized. Set value to 1 to keep Telnet
always available.
WTP_LOCATION Optional string describing AP location.
Mesh variables

MESH_AP_BGSCAN Enable or disable background mesh root AP scan.
0 - Disabled
1 - Enabled
If the root AP's signal is weak, and lower than the

received signal strength indicator (RSSI) threshold, the
WiFi driver will immediately start a new round scan and
MESH_AP_BGSCAN_RSSI ignore the configured MESH_AP_BGSCAN_PERIOD
delays. Set the value between 0-127.
After the new round scan is finished, a scan done event is

passed to wtp daemon to trigger roaming.
MESH_AP_BGSCAN_PERIOD Time in seconds that a delay period occurs between

scans. Set the value between 1-3600.
MESH_AP_BGSCAN_IDLE Time in milliseconds. Set the value between 0-1000.
MESH_AP_BGSCAN_INTV Time in milliseconds between channel scans. Set the

value between 200-16000.
Time in milliseconds that the radio will continue scanning

MESH_AP_BGSCAN_DUR
the channel. Set the value between 10-200.
MESH_AP_SCANCHANLIST Specify those channels to be scanned.
Type of communication for backhaul to controller:
0 - Ethernet (default)
MESH_AP_TYPE
1 - WiFi mesh
2 - Ethernet with mesh backup support
MESH_AP_SSID SSID for mesh backhaul. Default: fortinet.mesh.root
MESH_AP_BSSID WiFi MAC address
MESH_AP_PASSWD Pre-shared key for mesh backhaul.
1 - Bridge mesh WiFi SSID to FortiAP Ethernet port. This

can be used for point-to-point bridge configuration. This is
MESH_ETH_BRIDGE available only when MESH_AP_TYPE =1.
0 - No WiFi-Ethernet bridge (default).

MESH_MAX_HOPS Maximum number of times packets can be passed from

node to node on the mesh. Default is 4.
The following factors are summed and the FortiAP associates with the lowest scoring mesh AP.
MESH_SCORE_HOP_WEIGHT Multiplier for number of mesh hops from root. Default 50.
MESH_SCORE_CHAN_WEIGHT AP total RSSI multiplier. Default 1.
MESH_SCORE_RATE_WEIGHT Beacon data rate multiplier. Default 1.
Band weight (0 for 2.4GHz, 1 for 5GHz) multiplier. Default

MESH_SCORE_BAND_WEIGHT
100.
MESH_SCORE_RSSI_WEIGHT AP channel RSSI multiplier. Default 100.
Survey variables
SURVEY_SSID SSID to broadcast in site survey mode (AP_MODE=2).
SURVEY_TX_POWER Transmitter power in site survey mode (AP_MODE=2).
SURVEY_CH_24 Site survey transmit channel for the 2.4Ghz band (default
6).
Site survey transmit channel for the 5Ghz band (default

SURVEY_CH_50
36).
SURVEY_BEACON_INTV Site survey beacon interval. Default 100msec.
Previously, FortiAP accepted Telnet and HTTP connection to any virtual interfaces
that have an IP address. For security reasons, Telnet and HTTP access are now
limited to br0 or br.vlan for AP_MGMT_VLAN_ID.
Diagnose commands include:
cw_diag help Display help for all diagnose commands.
cw_diag uptime Show daemon uptime.
cw_diag --tlog <on|off> Turn on/off telnet log message.
cw_diag --clog <on|off> Turn on/off console log message.
cw_diag baudrate [9600 | 19200 | Set the console baud rate.

38400 | 57600 | 115200]

cw_diag plain-ctl [0|1] Show or change current plain control setting.
cw_diag sniff-cfg ip port Set sniff server ip and port.
cw_diag sniff [0|1|2] Enable/disable sniff packet.
cw_diag stats wl_intf Show wl_intf status.
cw_diag admin-timeout [30] Set shell idle timeout in minutes.
cw_diag -c wtp-cfg Show current wtp config parameters in control plane.
cw_diag -c radio-cfg Show current radio config parameters in control plane.
cw_diag -c vap-cfg Show current vaps in control plane.
cw_diag -c ap-rogue Show rogue APs pushed by AC for on-wire scan.
cw_diag -c sta-rogue Show rogue STAs pushed by AC for on-wire scan.
cw_diag -c arp-req Show scanned arp requests.
cw_diag -c ap-scan Show scanned APs.
cw_diag -c sta-scan Show scanned STAs.
cw_diag -c sta-cap Show scanned STA capabilities.
cw_diag -c wids Show scanned WIDS detections.
cw_diag -c darrp Show darrp radio channel.
cw_diag -c mesh Show mesh status.
cw_diag -c mesh-veth-acinfo Show mesh veth ac info, and mesh ether type.
cw_diag -c mesh-veth-vap Show mesh veth vap.
cw_diag -c mesh-veth-host Show mesh veth host.
cw_diag -c mesh-ap Show mesh ap candidates.
cw_diag -c scan-clr-all Flush all scanned AP/STA/ARPs.
cw_diag -c ap-suppress Show suppressed APs.
cw_diag -c sta-deauth De-authenticate an STA.

Link aggregation can also be set in the CLI. Link aggregation is used to combine
multiple network connections in parallel in order to increase throughput beyond what
a single connection could sustain.
l FortiAP 320B and 320C models are supported.

l FortiAP 112B and 112D models cannot support link aggregation.
l NPI FAP-S3xxCR and "wave2" FAP/FAP-S models will have link aggregation feature
via synchronization with regular FortiAP trunk build.

Copyright© (Undefined variable: FortinetVariables.CopyrightYear) Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain
other marks are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law
trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were
attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other
conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or
implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified
product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such
binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s
internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any
forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or
implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be
applicable.

Fortigate Fortiwifi and Fortiap Configuration Guide 56

Uploaded by

Copyright:

Available Formats

Fortigate Fortiwifi and Fortiap Configuration Guide 56

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Fortigate Fortiwifi and Fortiap Configuration Guide 56

Uploaded by

Copyright:

Available Formats

FortiOS™ Handbook

FortiWiFi and FortiAP Configuration Guide

END USER LICENSE AGREEMENT

FORTINET PRIVACY POLICY

April 26, 2018

FortiOS™ Handbook - FortiWiFi and FortiAP Configuration Guide

Date Change Description

April 26, 2018 Initial FortiOS 5.6.4 release.

FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4 11

This chapter contains the following topics:

l Before you begin

Before you begin

Before you begin using this guide, please ensure that:

l You have administrative access to the web-based manager and/or CLI.

How this guide is organized

This FortiOS Handbook chapter contains the following sections:

12 FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4

Reference provides information about Wi-Fi radio channels.

FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4 13

This chapter describes new wireless features added to FortiOS 5.6.

These features first appeared in FortiOS 5.6.4.

l "FortiAP LED Blinking" on page 120

These features first appeared in FortiOS 5.6.3.

config wireless-controller hotspot20 anqp-ip-address-type

config wireless-controller hotspot20 anqp-nai-realm

14 FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4

config wireless-controller hotspot20 anqp-network-auth-type

config wireless-controller hotspot20 anqp-roaming-consortium

config wireless-controller hotspot20 anqp-venue-name

config wireless-controller hotspot20 h2qp-conn-capability

FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4 15

config wireless-controller hotspot20 h2qp-operator-name

config wireless-controller hotspot20 h2qp-osu-provider

config wireless-controller hotspot20 h2qp-wan-metric

config wireless-controller hotspot20 hs-profile

16 FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4

set proxy-arp {enable | disable}

config wireless-controller hotspot20 icon

config wireless-controller hotspot20 qos-map

FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4 17

FortiAP LED Schedules (436227)

30D/30E models support two normal-mode FAPs (446122)

18 FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4

MAC Bypass for Captive Portal (448296)

WiFi Health Monitor fixes (449341)

The fixes include:

l Fixed timeline selection options to correct values.

The fixes include:

FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4 19

set wifi-ap-band {any | 5g-preferred | 5g-only}

These features first appeared in FortiOS 5.6.1.

Support for various FortiAP models (416177) (435638) (424483)

New Managed AP Groups and Dynamic VLAN Assignment (436267)

Note that each AP can only belong to one group.

20 FortiWiFi and FortiAP Configuration Guide for FortiOS 5.6.4

FortiAP Bluetooth Low Energy (BLE) Scan (438274)

CLI syntax - Configure BLE profiles

0: -21 dBm 1: -18 dBm 2: -15 dBm 3: -12 dBm 4: -9 dBm

5: -6 dBm 6: -3 dBm 7: 0 dBm 8: 1 dBm 9: 2 dBm