Stackvora.tech

FortiAP Wireless Deployment Guide

Deploying FortiAP (Fortinet Access Point) devices involves integrating them seamlessly with a FortiGate firewall, which acts as the WLAN controller. This…

Deploying FortiAP (Fortinet Access Point) devices involves integrating them seamlessly with a FortiGate firewall, which acts as the WLAN controller. This guide covers the essential steps for initial setup, configuration, and best practices for common deployment scenarios, focusing on FortiOS versions 7.0 and later.

FortiAP Discovery and Authorization

For a FortiAP to be managed by a FortiGate, it must first be discovered and then authorized. This process typically relies on the FortiAP being able to reach the FortiGate's management interface.

Layer 2 Discovery

In a Layer 2 network, the FortiAP broadcasts discovery requests. If the FortiGate and FortiAP are on the same subnet, the FortiGate will automatically detect the AP. The FortiAP's default management IP is typically obtained via DHCP. If no DHCP server is present, it will default to 192.168.1.1, but this scenario is rare in production environments as APs need network connectivity.

To view discovered FortiAPs:

diagnose wireless-controller wlac -d discovery
get wireless-controller wtp <FortiAP_serial_number>

Once discovered, the FortiAP appears in the FortiGate GUI under WiFi & Switch Controller > Managed FortiAPs. Right-click the discovered AP and select Authorize.

Layer 3 Discovery (FortiAP Controller Discovery Protocol - FACP)

When the FortiAP is on a different subnet than the FortiGate, Layer 3 discovery methods are necessary. FACP uses UDP port 5246 for communication.

  • DHCP Option 138: The most robust method. Configure your DHCP server to provide the FortiGate's IP address (or a list of IP addresses) as option 138.
    • For Windows Server DHCP: Create a custom option 138, type "IP Address", and enter the FortiGate's management IP.
    • For FortiGate DHCP Server:
      • config system dhcp server
    edit <DHCP_server_ID>
        set dns-service default
        set default-gateway <gateway_IP>
        set netmask <netmask>
        set ip-range <start_IP> <end_IP>
        set fortigate-controller-ip <FortiGate_IP_for_AP_management>
        set interface <interface_name>
    next
end
  • DNS Resolution: Configure DNS to resolve fortiap.fortinet.com to the FortiGate's management IP address. This is less common for internal deployments but useful for FortiAPs deployed in remote sites.
  • Static Controller IP: Manually configure the FortiAP's controller IP. This is generally only used for troubleshooting or highly specific deployments where DHCP/DNS are not viable. Access the FortiAP's CLI (requires direct connection) and use: 
    config system ap
    set ac_ip_1 <FortiGate_IP_address>
    set ac_ip_2 <FortiGate_secondary_IP_address> (optional)
    set ac_port <FortiGate_FACP_port, default 5246>
    set discovery_type static
    set ap_mode normal
    end
execute reboot

After successful discovery and authorization, the FortiAP will show a "Managed" status in the GUI.

SSID Configuration and Security

Creating SSIDs (Service Set Identifiers) on the FortiGate defines the wireless networks clients will connect to.

Creating a New SSID

  1. Navigate to WiFi & Switch Controller > SSIDs.
  2. Click Create New.
  3. Name: A descriptive name for your SSID (e.g., "Corp_Internal_WLAN").
  4. Interface: Select WiFi & Switch Controller SSID.
  5. Type: Usually Local bridge for standard deployments (traffic bridged locally on the AP to the wired network) or Tunnel if you want all wireless traffic tunneled back to the FortiGate for centralized policy enforcement and potentially different VLAN assignment. Tunnel mode requires more FortiGate CPU resources.
  6. VLAN ID: For "Local bridge" mode, this is the VLAN tag that the AP will apply to wireless traffic before sending it to the wired switch. Ensure this VLAN is allowed on the AP's switch port. For "Tunnel" mode, this VLAN is typically defined on the FortiGate's tunnel interface.
  7. SSID: The actual broadcast name clients will see (e.g., "Corporate_Wireless").
  8. Security Mode:
    • WPA2-PSK: Common for internal networks, requiring a pre-shared key.
    • WPA2-Enterprise: For larger deployments, integrates with RADIUS servers (e.g., FortiAuthenticator, Microsoft NPS) for user/device authentication (802.1X).
    • Open: For guest networks (often combined with a captive portal).
  9. Configure other settings like Broadcast SSID, MAC Filtering, and Guest Portal if needed.

For WPA2-Enterprise, you'll need to configure a RADIUS server profile under User & Authentication > RADIUS Servers first, then select it in the SSID settings.

FortiAP Profiles

FortiAP Profiles allow you to group common settings and apply them to multiple FortiAPs, simplifying management and ensuring consistency. A profile includes radio settings, transmit power, channel selection, and assigned SSIDs.

Creating or Modifying a FortiAP Profile

  1. Go to WiFi & Switch Controller > FortiAP Profiles.
  2. You can modify the default profiles or create new ones. It's best practice to create specific profiles rather than modifying "default."
  3. Name: A descriptive name (e.g., "Indoor_2.4GHz_5GHz", "Outdoor_AP_Profile").
  4. Platform: Select the FortiAP model(s) this profile applies to. If using different models (e.g., FAP-421E and FAP-221E), you might need separate profiles or ensure compatibility.
  5. Radio 1 (2.4GHz) & Radio 2 (5GHz) settings:
    • Mode: Access Point.
    • Channel: Auto is generally sufficient for internal networks, but for high-density environments, manual channel planning (e.g., 1, 6, 11 for 2.4GHz; non-overlapping DFS channels for 5GHz) is recommended to minimize interference.
    • Transmit Power: Auto or manually set to optimize coverage and reduce co-channel interference. Start with medium power (e.g., 50-75%) and adjust based on site survey.
    • SSIDs: Select the SSIDs you created earlier that should be broadcast on this radio.
  6. Configure advanced settings like Rogue AP detection, DFS channel sensitivity, and load balancing if required.

Example CLI for a FortiAP profile:

config wireless-controller wtp-profile
    edit "My_Indoor_Profile"
        set platform "FortiAP-U"
        config radio-1
            set band 2.4ghz
            set mode ap
            set vap-id "Corp_Internal_WLAN" "Guest_WLAN"
            set channel auto
            set power-level 100
        end
        config radio-2
            set band 5ghz
            set mode ap
            set vap-id "Corp_Internal_WLAN" "Guest_WLAN"
            set channel auto
            set power-level 75
        end
        set handoff-sta-thresh 25 (clients below -80dBm RSSI are encouraged to roam)
    next
end

Assigning Profiles to FortiAPs

After creating SSIDs and FortiAP profiles, the final step is to assign the desired profile to your authorized FortiAPs.

  1. Navigate to WiFi & Switch Controller > Managed FortiAPs.
  2. Select the FortiAP(s) you want to configure.
  3. Click Edit or right-click and select Edit.
  4. In the FortiAP Profile dropdown, select the profile you created (e.g., "My_Indoor_Profile").
  5. Click OK.

The FortiAP will receive the new configuration and reboot if necessary. Monitor its status to ensure it comes online and starts broadcasting the SSIDs.

Firewall Policies for Wireless Traffic

For wireless clients to access network resources or the internet, appropriate firewall policies must be configured on the FortiGate.

Go to Policy & Objects > Firewall Policy and create new policies:

  1. Internal Wireless to Internet:
    • Name: Allow_Wireless_to_Internet
    • Incoming Interface: The internal FortiGate interface for the wireless SSID (e.g., wifi.corp.internal if using tunnel mode, or the VLAN interface for local bridge mode).
    • Outgoing Interface: Your WAN interface.
    • Source: Address object for your wireless subnet.
    • Destination: all
    • Service: ALL or specific services (e.g., HTTP, HTTPS, DNS).
    • Action: ACCEPT
    • NAT: Enable NAT if clients need to access the internet.
  2. Guest Wireless with Captive Portal:
    • Requires a separate SSID with a captive portal configured.
    • Policy to allow initial access to DNS and the FortiGate's captive portal page (TCP 10000 by default).
    • After authentication, a second policy allows access to the internet, potentially with bandwidth limits or web filtering profiles.

Common Pitfalls and Troubleshooting

  • FortiAP Stuck in "Discover" or "Offline" State:
    • Verify network connectivity between FortiAP and FortiGate (ping from AP to FG, and vice-versa).
    • Check firewall policies on the FortiGate for FACP traffic (UDP 5246).
    • Confirm DHCP option 138 or DNS resolution is correctly configured for Layer 3 discovery.
    • Check FortiGate logs (log wireless-controller event) for discovery issues.
  • SSID Not Broadcasting:
    • Ensure the FortiAP is authorized and in "Managed" state.
    • Verify the SSID is enabled in the FortiAP profile and assigned to the correct radio.
    • Check FortiAP physical location and interference if using manual channels.
  • Clients Cannot Connect or Get IP Address:
    • Check the DHCP server configuration for the wireless VLAN/subnet.
    • Verify VLAN tagging on the switch port connected to the FortiAP. The switch port should be configured as a trunk port allowing the management VLAN and all wireless client VLANs.
    • For Local Bridge mode, ensure the FortiGate has an interface or sub-interface in the same VLAN as the wireless clients, and it's acting as the default gateway/DHCP relay.
  • Poor Performance / Coverage:
    • Conduct a site survey to optimize AP placement and transmit power.
    • Avoid overlapping channels, especially in 2.4GHz.
    • Consider increasing client-side handoff thresholds in the FortiAP profile (handoff-sta-thresh) to encourage clients to roam to stronger APs.
    • Check for sources of interference (e.g., microwave ovens, cordless phones for 2.4GHz; radar for DFS channels).
  • FortiAP Firmware Mismatch:
    • FortiAPs automatically download firmware from the FortiGate. If an AP is stuck downloading or has issues, check the FortiGate's internet connectivity and the AP's connectivity to the FortiGate.
    • A FortiGate running FortiOS 7.0.x will manage FortiAP firmware specific to that version. For example, a FortiAP running FAP_4.x firmware can only be managed by a FortiGate running FortiOS 6.x.x. Check the FortiAP compatibility matrix for your specific FortiOS version.

Back to the knowledge base · Ask the AI assistant