Onboard a FortiAP via FortiGate

FortiAP devices provide robust wireless access managed directly by a FortiGate firewall. This integrated approach simplifies network architecture,…

FortiAP devices provide robust wireless access managed directly by a FortiGate firewall. This integrated approach simplifies network architecture, centralizes policy enforcement, and streamlines management for small deployments to large, distributed enterprises. This article details the process of connecting and configuring a FortiAP (specifically models like FAP-221E, FAP-431F, or FAP-U433F running FortiAP OS 6.4.x or 7.0.x) to a FortiGate (running FortiOS 6.4.x or 7.0.x), ensuring proper discovery, authorization, and basic wireless service provision.

Physical Connection and Initial Discovery

The FortiAP requires a network connection to the FortiGate, typically via a Power over Ethernet (PoE) enabled switch port or a dedicated PoE injector if the FortiGate itself does not have PoE ports. For direct FortiLink deployments, connect the AP to a FortiLink-enabled port on the FortiGate (e.g., typically ports like "internal" or "a," "b," etc., on lower-end models, or dedicated FortiLink ports on larger units).

  • Direct Connection to FortiLink Port: If your FortiGate has a FortiLink interface (common on models like FortiGate 60E/F, 100F, 200F), connect the FortiAP directly to one of these ports. These ports are pre-configured to provide DHCP services and act as a FortiLink aggregation point for FortiSwitches and FortiAPs.
  • Connection via Managed Switch: For larger deployments or when FortiLink ports are unavailable/insufficient, connect the FortiAP to a PoE-enabled port on a switch. This switch port must be configured to be on the same VLAN as the FortiGate's FortiLink interface or a dedicated AP management interface. Ensure DHCP is available on this VLAN, with the FortiGate acting as the DHCP server.
  • Power Requirements: Verify the FortiAP's power requirements. For example, a FortiAP-221E typically requires 802.3af PoE, while a high-performance FAP-431F might require 802.3at PoE+ or even 802.3bt (UPOE/PoE++). Mismatched power can lead to unstable operation or reduced radio performance.

Upon successful power-up and network connectivity, the FortiAP will attempt to discover a FortiGate controller. It uses a hierarchy of discovery methods, including DHCP Option 138, DNS lookup for "fortigate.yourdomain.com", and broadcast/multicast discovery. Once discovered, the FortiGate will list the FortiAP under WiFi & Switch Controller > Managed FortiAPs.

FortiGate Configuration: FortiLink Interface

Before connecting, ensure your FortiGate's FortiLink interface is properly configured. This is crucial for DHCP services and FortiAP management traffic.

config system interface
    edit "fortilink"
        set ip 169.254.1.1 255.255.255.0
        set allowaccess ping https ssh http telnet fgfm capwap
        set type physical
        set fortilink enable
    next
end

config system dhcp server
    edit 1
        set dns-service default
        set default-gateway 169.254.1.1
        set netmask 255.255.255.0
        set interface "fortilink"
        set ip-range start-ip 169.254.1.2 end-ip 169.254.1.254
        set lease-time 600
    next
end

The set allowaccess capwap is critical for FortiAP communication. The IP address (e.g., 169.254.1.1) serves as the default gateway for FortiAPs connected to this segment.

Authorizing the FortiAP

Once the FortiAP appears in the FortiGate GUI under WiFi & Switch Controller > Managed FortiAPs, it will typically show a status of "Discovered" or "Pending." You must explicitly authorize it.

  1. Navigate to WiFi & Switch Controller > Managed FortiAPs.
  2. Locate the FortiAP in the list. Its serial number and model will be displayed.
  3. Select the FortiAP and click "Authorize" in the toolbar.
  4. A prompt will appear asking to assign an AP profile. For initial setup, you might select a default profile or create a new one. Click "OK."

After authorization, the FortiAP's status will change to "Online," indicating it has successfully joined the FortiGate and downloaded its initial configuration. If the status remains "Pending" or "Offline," investigate connectivity and CAPWAP tunnel issues (see Troubleshooting section).

Configuring AP Profiles and SSIDs

AP profiles define the operational parameters for your FortiAPs, including radio settings, SSIDs, security, and more. It's best practice to create distinct profiles for different AP models or deployment scenarios.

Creating an AP Profile

  1. Go to WiFi & Switch Controller > FortiAP Profiles.
  2. Click "Create New."
  3. Provide a descriptive name (e.g., FAP221E-Office-Profile).
  4. Select the appropriate FortiAP model (e.g., FAP221E). This ensures that only relevant radio options are presented.
  5. Configure the following sections:
    • Radio 1 (2.4 GHz) & Radio 2 (5 GHz): Set Channel (e.g., "Auto"), Transmit Power (e.g., "Auto" or specific mW/dBm values like 20dBm for 2.4GHz and 17dBm for 5GHz to avoid co-channel interference), and Mode (e.g., "802.11n/ax" for 2.4GHz, "802.11ac/ax" for 5GHz).
    • SSID: This is where you link the Virtual APs (SSIDs) to the profile. Click "Create New" under the "SSID" section.
  6. Click "OK" to save the AP profile.

Creating an SSID (Virtual AP)

Each SSID defines a wireless network broadcast by your FortiAPs.

  1. Go to WiFi & Switch Controller > SSID.
  2. Click "Create New."
  3. Name: A unique name for the SSID (e.g., Corp_WiFi).
  4. Traffic Mode:
    • Tunnel: All client traffic is encapsulated in a CAPWAP tunnel and sent to the FortiGate for processing. This centralizes policy enforcement and allows for seamless roaming across APs. This is the most common and recommended mode for secure enterprise networks.
    • Bridge: Client traffic is bridged directly to the local wired network segment on the AP itself. The FortiGate only manages the AP, not client traffic directly. Use with caution, as it bypasses central FortiGate policies for wireless clients.
    • Mesh: For meshing scenarios, where APs wirelessly extend network coverage.
  5. VLAN ID: Assign a specific VLAN ID (e.g., 10) for this SSID's client traffic. This VLAN must be configured on the FortiGate and its downstream switches. For tunnel mode, the FortiGate encapsulates this VLAN within the CAPWAP tunnel.
  6. Security Mode: Choose your desired security:
    • Open: No encryption. Not recommended.
    • WPA2-PSK: Pre-Shared Key (e.g., MyStrongP@ssw0rd!).
    • WPA2-Enterprise: Requires a RADIUS server for 802.1X authentication.
    • WPA3-SAE: Stronger encryption, requires WPA3-compatible clients.
    • WPA3-Enterprise: WPA3 with 802.1X.
  7. Schedule, WMM, Guest Portal: Configure as needed.
  8. Click "OK."

Applying the AP Profile to an Authorized AP

After creating the AP profile and SSIDs, assign the profile to your authorized FortiAP.

  1. Navigate to WiFi & Switch Controller > Managed FortiAPs.
  2. Select the FortiAP you wish to configure.
  3. In the "AP Profile" column, click "Edit" or the existing profile name.
  4. Select the newly created AP profile (e.g., FAP221E-Office-Profile) from the dropdown list.
  5. Click "Apply."

The FortiAP will receive the updated configuration, reboot if necessary, and start broadcasting the configured SSIDs.

Firewall Policies for Wireless Clients

For wireless clients in tunnel mode to access network resources or the internet, you need to create appropriate firewall policies on the FortiGate.

config firewall policy
    edit 0
        set name "Wireless_to_Internet"
        set srcintf "VLAN10_Interface"  # Or "ssid_Corp_WiFi" if using explicit SSID interface
        set dstintf "wan1"             # Your internet-facing interface
        set srcaddr "all"
        set dstaddr "all"
        set service "ALL"
        set action accept
        set nat enable
    next
end

If you configured the SSID with VLAN ID 10, ensure there's a FortiGate interface (physical or VLAN sub-interface) assigned to this VLAN (e.g., VLAN10_Interface). The FortiGate acts as the gateway for wireless clients on this VLAN.

Verification and Troubleshooting

CLI Verification

Access the FortiGate CLI to verify the FortiAP status and CAPWAP tunnels.

# diagnose wireless-controller wlac -c wtp
Total WTPs: 1
NAME        WTP_ID  MODEL    SOFTWARE           STATUS  TUNNEL_UP TUNNEL_DWN TUNNEL_LOG
FAP221E     1       FAP221E  v6.4.8 build1407   Online  0s        0s         0s
        radio 1 (2.4GHz) - on, profile default-2.4G
        radio 2 (5GHz) - on, profile default-5G

# diagnose wireless-controller wlac -c radio
WTP_ID WTP_NAME RADIO_ID TYPE BAND STATE      SSID(s)
1      FAP221E  1        ap   2.4G Online     Corp_WiFi
1      FAP221E  2        ap   5G   Online     Corp_WiFi

# diagnose wireless-controller wlac -c vap
WTP_ID WTP_NAME RADIO_ID SSID             VAP_ID WLAN_ID STATE
1      FAP221E  1        Corp_WiFi        0      0       UP
1      FAP221E  2        Corp_WiFi        1      0       UP

The STATUS: Online and TUNNEL_UP/TUNNEL_DWN times (should be 0s for a stable connection) are key indicators. STATE: UP for VAPs (Virtual APs/SSIDs) confirms they are broadcasting.

Common Pitfalls

  • AP stuck in "Pending" or "Offline":
    • Connectivity: Check physical cable, PoE status, and switch port configuration. Ensure the AP is powered on.
    • IP Address: Verify the FortiAP obtains an IP address from the FortiGate's DHCP server (check DHCP lease table on FortiGate).
    • CAPWAP Port Blocker: Ensure UDP ports 5246 (CAPWAP data) and 5247 (CAPWAP control) are not blocked by any firewalls between the AP and the FortiGate. The FortiLink interface usually handles this automatically.
    • FortiGate CAPWAP Configuration: Ensure set allowaccess capwap is enabled on the FortiLink interface (or the interface the AP connects to).
    • FortiAP OS Version: While FortiAPs are generally backward compatible, very old FortiAP OS versions might not discover newer FortiGate models without an initial upgrade.
  • Wireless Clients cannot connect or get IP:
    • Incorrect SSID password: Double-check the PSK or RADIUS settings.
    • No DHCP for wireless VLAN: Ensure the FortiGate (or an upstream DHCP server) is providing DHCP services for the VLAN assigned to the SSID.
    • Firewall Policy: Verify that a firewall policy exists allowing traffic from the wireless client VLAN to its desired destination (e.g., Internet, internal servers).
    • Incorrect VLAN Tagging: If using bridge mode or a complex VLAN setup, ensure the VLAN IDs are correctly configured on the FortiGate and intermediate switches.
  • Poor Wireless Performance:
    • Channel Overlap: Manually adjust channels or use the FortiGate's automatic channel assignment. Avoid using default channels (e.g., 6 on 2.4GHz) if other APs are nearby.
    • Transmit Power: Adjust TX power to avoid excessive overlap or dead zones. Lower power can improve cell edge performance and reduce interference.
    • AP Placement: Ensure adequate AP density for coverage and capacity.
    • Correct FortiAP Model: Ensure the deployed FortiAP models are suitable for the environment and client density (e.g., high-density areas require higher-end APs).

Back to the knowledge base · Ask the AI assistant