FortiAP CLI configuration and diagnostics commands

The FortiAP CLI controls radio and network operations through the use of variables manipulated with the configuration and diagnostics commands.

For details about accessing the FortiAP CLI, see FortiAP CLI access.

Configuration commands

Command	Description
`cfg -s`	List variables for most popular settings and also the ones that are not using default values.
`cfg -a var=value`	Add or change a variable value.
`cfg -c`	Commit the change to flash.
`cfg -x`	Reset settings to factory defaults.
`cfg -r var`	Remove variable.
`cfg -e`	Export variables.
`cfg -h`	Display help for all configuration commands and a complete list of configuration variables.

Configuration variables

Variable	Description and value
`AC_CTL_PORT`	WiFi Controller control (CAPWAP) port. Default: 5246.
`AC_DATA_CHAN_SEC`	Data channel security. 0 - Clear text 1 - DTLS (encrypted) 2 - Accept either DTLS or clear text (default)
`AC_DISCOVERY_TYPE`	0 - Auto - Cycle through all of the discovery types until successful. 1 - Static. Specify WiFi Controllers 2 - DHCP 3 - DNS 5 - Broadcast 6 - Multicast 7- FortiCloud
`AC_HOSTNAME_1` `AC_HOSTNAME_2` `AC_HOSTNAME_3`	WiFi Controller host names for static discovery.
`AC_IPADDR_1` `AC_IPADDR_2` `AC_IPADDR_3`	WiFi Controller IP addresses for static discovery.
`AC_DISCOVERY_DHCP_OPTION_CODE`	Option code for DHCP server. Default: 138.
`AC_DISCOVERY_MC_ADDR`	Multicast address for controller discovery. Default: 224.0.1.140.
`ADDR_MODE`	How the FortiAP unit obtains its IP address and netmask. DHCP - FortiGate interface assigns address. STATIC - Specify in AP_IPADDR and AP_NETMASK. Default: DHCP.
`ADMIN_TIMEOUT`	Administrative timeout in minutes. Applies to GUI sessions. Default: 5 minutes.
`AP_IPADDR` `AP_NETMASK` `IPGW`	These variables set the FortiAP unit IP address, netmask and default gateway when ADDR_MODE is STATIC. Default for AP_IPADDR: 192.168.1.2 . Default for AP_NETMASK: 255.255.255.0. Default for IPGW: 192.168.1.1.
`ALLOW_HTTPS`	0 - https disable 1 - https enable 2 - controlled by AC Default: 2.
`ALLOW_SSH`	0 - SSH disable 1 - SSH enable 2 - controlled by AC Default: 2.
`AP_MGMT_VLAN_ID`	Non-zero value applies VLAN ID for unit management. See Reserved VLAN IDs. Default: 0.
`AP_MODE`	FortiAP operating mode. 0 - Thin AP 2 - Unmanaged Site Survey mode. See SURVEY variables. Default: 0.
`BAUD_RATE`	Console data rate: 9600, 19200, 38400, 57600, or 115200 baud. Default: 9600.
`DNS_SERVER`	DNS Server for clients. If ADDR_MODE is DHCP the DNS server is automatically assigned.
`FAP_ETHER_TRUNK`	Configure port behavior on FortiAP-U models. 0 - Dummy Switch. Default mode. 1 - Ether Hardware Bonding. Support Static Ethernet Channel Bonding on LAN1 and LAN2 ports. Only available on select FortiAP-U models. 2 - Ether 802.3ad Bonding. Support IEEE 802.3ad Link Aggregation Control Protocol (LACP) on LAN1 and LAN2 ports. 3 - Enable WAN-LAN. Supports configuration of a second WAN port as a LAN (WAN-LAN mode configuration).
`FIRMWARE_UPGRADE`	Default: 0.
`LED_STATE`	Enable/disable status LEDs. 0 - LEDs enabled 1 - LEDs disabled 2 - follow AC setting
`LOGIN_PASSWD`	Administrator login password. By default this is empty.
`STP_MODE`	Spanning Tree Protocol. 0 - off 1 - on
`WANLAN_MODE`	Configure port behavior on FortiAP, FortiAP-S, and FortiAP-W2 models. WAN-ONLY - Default mode WAN-LAN - Bridges the LAN port to the incoming WAN interface AGGREGATE - Enables link aggregation
`WTP_LOCATION`	Optional string describing AP location.
Mesh variables
`MESH_AP_BGSCAN`	Enable or disable background mesh root AP scan. 0 - Disabled 1 - Enabled
`MESH_AP_BGSCAN_RSSI`	If the signal of the root AP is weak, and lower than the received signal strength indicator (RSSI) threshold, the WiFi driver immediately starts a new round scan and ignores the configured `MESH_AP_BGSCAN_PERIOD` delays. Set the value between 0 and 127. After the new round scan is finished, a scan done event is passed to wtp daemon to trigger roaming.
`MESH_AP_BGSCAN_PERIOD`	Time in seconds that a delay period occurs between scans. Set the value between 1 and 3600.
`MESH_AP_BGSCAN_IDLE`	Time in milliseconds. Set the value between 0 and 1000.
`MESH_AP_BGSCAN_INTV`	Time in milliseconds between channel scans. Set the value between 200 and 16000.
`MESH_AP_BGSCAN_DUR`	Time in milliseconds that the radio will continue scanning the channel. Set the value between 10 and 200.
`MESH_AP_SCANCHANLIST`	Specify those channels to be scanned.
`MESH_AP_TYPE`	Type of communication for backhaul to controller: 0 - Ethernet 1 - WiFi mesh 2 - Ethernet with mesh backup support Default: 0.
`MESH_AP_SSID`	SSID for mesh backhaul. Default: fortinet.mesh.root.
`MESH_AP_BSSID`	WiFi MAC address.
`MESH_AP_PASSWD`	Pre-shared key for mesh backhaul.
`MESH_ETH_BRIDGE`	1 - Bridge mesh WiFi SSID to FortiAP Ethernet port. This can be used for point-to-point bridge configuration. This is available only when MESH_AP_TYPE =1. 0 - No WiFi-Ethernet bridge Default: 0.
`MESH_MAX_HOPS`	Maximum number of times packets can be passed from node to node on the mesh. Default: 4.
The following factors are summed and the FortiAP associates with the lowest scoring mesh AP.
`MESH_SCORE_HOP_WEIGHT`	Multiplier for number of mesh hops from root. Default: 50.
`MESH_SCORE_CHAN_WEIGHT`	AP total RSSI multiplier. Default: 1.
`MESH_SCORE_RATE_WEIGHT`	Beacon data rate multiplier. Default: 1.
`MESH_SCORE_BAND_WEIGHT`	Band weight (0 for 2.4 GHz, 1 for 5 GHz) multiplier. Default: 100.
`MESH_SCORE_RSSI_WEIGHT`	AP channel RSSI multiplier. Default: 100.
Survey variables
`SURVEY_SSID`	SSID to broadcast in site survey mode (AP_MODE=2).
`SURVEY_TX_POWER`	Transmitter power in site survey mode (AP_MODE=2).
`SURVEY_CH_24`	Site survey transmit channel for the 2.4 GHz band. Default: 6.
`SURVEY_CH_50`	Site survey transmit channel for the 5 GHz band. Default: 36.
`SURVEY_BEACON_INTV`	Site survey beacon interval. Default: 100 ms.

Diagnostics commands

Command	Description
`cw_diag admin-timeout [30]`	Set the shell idle timeout in minutes.
`cw_diag baudrate [9600 \| 19200 \| 38400 \| 57600 \| 115200]`	Set the console baud rate.
`cw_diag help`	Display help for all diagnostics commands.
`cw_diag plain-ctl [0\|1]`	Show or change the current plain control setting.
`cw_diag sniff [0\|1\|2]`	Enable or disable the sniff packet.
`cw_diag sniff-cfg ip port`	Set the sniff server IP and port.
`cw_diag stats wl_intf`	Show the wl_intf status.
`cw_diag uptime`	Show daemon uptime.
`cw_diag -c ap-scan`	Show scanned APs.
`cw_diag -c ap-suppress`	Show suppressed APs.
`cw_diag -c arp-req`	Show scanned arp requests.
`cw_diag -c atf`	Show Air Time Fairness information at the FortiAP level.
`cw_diag -c ble-scan`	Show scanned Bluetooth Low Energy (BLE) devices that are reported to FortiPresence.
`cw_diag -c darrp`	Show the DARRP radio channel.
`cw_diag -c fortipresence`	Show FortiPresence statistics including reported BLE devices.
`cw_diag -c k-qos wlan00`	Verify that the vmn-dscp-marking values are pushed to FortiAP.
`cw_diag -c mesh`	Show the mesh status.
`cw_diag -c mesh-ap`	Show the mesh ap candidates.
`cw_diag -c mesh-veth-acinfo`	Show the mesh veth ac info, and mesh ether type.
`cw_diag -c mesh-veth-host`	Show the mesh veth host.
`cw_diag -c mesh-veth-vap`	Show the mesh veth vap.
`cw_diag -c radio-cfg`	Show the current radio config parameters in the control plane.
`cw_diag -c scan-clr-all`	Flush all scanned AP/STA/ARPs.
`cw_diag -c snmp`	Show configuration details for SNMP support.
`cw_diag -c sta-cap`	Show scanned STA capabilities.
`cw_diag -c sta-deauth`	De-authenticate an STA.
`cw_diag -c sta-scan`	Show scanned STAs.
`cw_diag -c vap-cfg`	Show the current VAPs in the control plane.
`cw_diag -c vlan-probe-cmd action(0:start 1:stop 2:clear) intf [start-vlan end-vlan retries timeout]`	Start the VLAN probe. Example command: cw_diag -c vlan-probe-cmd 0 eth0 2 300 3 10 Example output: VLAN probing: start intf [eth0] vlan range[2,300] retries[3] timeout[10] ...
`cw_diag -c vlan-probe-rpt`	Show the VLAN probe report.
`cw_diag -c wids`	Show scanned WIDS detections.
`cw_diag -c wtp-cfg`	Show the current wtp config parameters in the control plane.
`cw_diag --clog <on\|off>`	Turn on or off console log message.

FortiAP CLI configuration and diagnostics commands

The FortiAP CLI controls radio and network operations through the use of variables manipulated with the configuration and diagnostics commands.

For details about accessing the FortiAP CLI, see FortiAP CLI access.

Configuration commands

Command	Description
`cfg -s`	List variables for most popular settings and also the ones that are not using default values.
`cfg -a var=value`	Add or change a variable value.
`cfg -c`	Commit the change to flash.
`cfg -x`	Reset settings to factory defaults.
`cfg -r var`	Remove variable.
`cfg -e`	Export variables.
`cfg -h`	Display help for all configuration commands and a complete list of configuration variables.

Configuration variables

Variable	Description and value
`AC_CTL_PORT`	WiFi Controller control (CAPWAP) port. Default: 5246.
`AC_DATA_CHAN_SEC`	Data channel security. 0 - Clear text 1 - DTLS (encrypted) 2 - Accept either DTLS or clear text (default)
`AC_DISCOVERY_TYPE`	0 - Auto - Cycle through all of the discovery types until successful. 1 - Static. Specify WiFi Controllers 2 - DHCP 3 - DNS 5 - Broadcast 6 - Multicast 7- FortiCloud
`AC_HOSTNAME_1` `AC_HOSTNAME_2` `AC_HOSTNAME_3`	WiFi Controller host names for static discovery.
`AC_IPADDR_1` `AC_IPADDR_2` `AC_IPADDR_3`	WiFi Controller IP addresses for static discovery.
`AC_DISCOVERY_DHCP_OPTION_CODE`	Option code for DHCP server. Default: 138.
`AC_DISCOVERY_MC_ADDR`	Multicast address for controller discovery. Default: 224.0.1.140.
`ADDR_MODE`	How the FortiAP unit obtains its IP address and netmask. DHCP - FortiGate interface assigns address. STATIC - Specify in AP_IPADDR and AP_NETMASK. Default: DHCP.
`ADMIN_TIMEOUT`	Administrative timeout in minutes. Applies to GUI sessions. Default: 5 minutes.
`AP_IPADDR` `AP_NETMASK` `IPGW`	These variables set the FortiAP unit IP address, netmask and default gateway when ADDR_MODE is STATIC. Default for AP_IPADDR: 192.168.1.2 . Default for AP_NETMASK: 255.255.255.0. Default for IPGW: 192.168.1.1.
`ALLOW_HTTPS`	0 - https disable 1 - https enable 2 - controlled by AC Default: 2.
`ALLOW_SSH`	0 - SSH disable 1 - SSH enable 2 - controlled by AC Default: 2.
`AP_MGMT_VLAN_ID`	Non-zero value applies VLAN ID for unit management. See Reserved VLAN IDs. Default: 0.
`AP_MODE`	FortiAP operating mode. 0 - Thin AP 2 - Unmanaged Site Survey mode. See SURVEY variables. Default: 0.
`BAUD_RATE`	Console data rate: 9600, 19200, 38400, 57600, or 115200 baud. Default: 9600.
`DNS_SERVER`	DNS Server for clients. If ADDR_MODE is DHCP the DNS server is automatically assigned.
`FAP_ETHER_TRUNK`	Configure port behavior on FortiAP-U models. 0 - Dummy Switch. Default mode. 1 - Ether Hardware Bonding. Support Static Ethernet Channel Bonding on LAN1 and LAN2 ports. Only available on select FortiAP-U models. 2 - Ether 802.3ad Bonding. Support IEEE 802.3ad Link Aggregation Control Protocol (LACP) on LAN1 and LAN2 ports. 3 - Enable WAN-LAN. Supports configuration of a second WAN port as a LAN (WAN-LAN mode configuration).
`FIRMWARE_UPGRADE`	Default: 0.
`LED_STATE`	Enable/disable status LEDs. 0 - LEDs enabled 1 - LEDs disabled 2 - follow AC setting
`LOGIN_PASSWD`	Administrator login password. By default this is empty.
`STP_MODE`	Spanning Tree Protocol. 0 - off 1 - on
`WANLAN_MODE`	Configure port behavior on FortiAP, FortiAP-S, and FortiAP-W2 models. WAN-ONLY - Default mode WAN-LAN - Bridges the LAN port to the incoming WAN interface AGGREGATE - Enables link aggregation
`WTP_LOCATION`	Optional string describing AP location.
Mesh variables
`MESH_AP_BGSCAN`	Enable or disable background mesh root AP scan. 0 - Disabled 1 - Enabled
`MESH_AP_BGSCAN_RSSI`	If the signal of the root AP is weak, and lower than the received signal strength indicator (RSSI) threshold, the WiFi driver immediately starts a new round scan and ignores the configured `MESH_AP_BGSCAN_PERIOD` delays. Set the value between 0 and 127. After the new round scan is finished, a scan done event is passed to wtp daemon to trigger roaming.
`MESH_AP_BGSCAN_PERIOD`	Time in seconds that a delay period occurs between scans. Set the value between 1 and 3600.
`MESH_AP_BGSCAN_IDLE`	Time in milliseconds. Set the value between 0 and 1000.
`MESH_AP_BGSCAN_INTV`	Time in milliseconds between channel scans. Set the value between 200 and 16000.
`MESH_AP_BGSCAN_DUR`	Time in milliseconds that the radio will continue scanning the channel. Set the value between 10 and 200.
`MESH_AP_SCANCHANLIST`	Specify those channels to be scanned.
`MESH_AP_TYPE`	Type of communication for backhaul to controller: 0 - Ethernet 1 - WiFi mesh 2 - Ethernet with mesh backup support Default: 0.
`MESH_AP_SSID`	SSID for mesh backhaul. Default: fortinet.mesh.root.
`MESH_AP_BSSID`	WiFi MAC address.
`MESH_AP_PASSWD`	Pre-shared key for mesh backhaul.
`MESH_ETH_BRIDGE`	1 - Bridge mesh WiFi SSID to FortiAP Ethernet port. This can be used for point-to-point bridge configuration. This is available only when MESH_AP_TYPE =1. 0 - No WiFi-Ethernet bridge Default: 0.
`MESH_MAX_HOPS`	Maximum number of times packets can be passed from node to node on the mesh. Default: 4.
The following factors are summed and the FortiAP associates with the lowest scoring mesh AP.
`MESH_SCORE_HOP_WEIGHT`	Multiplier for number of mesh hops from root. Default: 50.
`MESH_SCORE_CHAN_WEIGHT`	AP total RSSI multiplier. Default: 1.
`MESH_SCORE_RATE_WEIGHT`	Beacon data rate multiplier. Default: 1.
`MESH_SCORE_BAND_WEIGHT`	Band weight (0 for 2.4 GHz, 1 for 5 GHz) multiplier. Default: 100.
`MESH_SCORE_RSSI_WEIGHT`	AP channel RSSI multiplier. Default: 100.
Survey variables
`SURVEY_SSID`	SSID to broadcast in site survey mode (AP_MODE=2).
`SURVEY_TX_POWER`	Transmitter power in site survey mode (AP_MODE=2).
`SURVEY_CH_24`	Site survey transmit channel for the 2.4 GHz band. Default: 6.
`SURVEY_CH_50`	Site survey transmit channel for the 5 GHz band. Default: 36.
`SURVEY_BEACON_INTV`	Site survey beacon interval. Default: 100 ms.

Diagnostics commands

Command	Description
`cw_diag admin-timeout [30]`	Set the shell idle timeout in minutes.
`cw_diag baudrate [9600 \| 19200 \| 38400 \| 57600 \| 115200]`	Set the console baud rate.
`cw_diag help`	Display help for all diagnostics commands.
`cw_diag plain-ctl [0\|1]`	Show or change the current plain control setting.
`cw_diag sniff [0\|1\|2]`	Enable or disable the sniff packet.
`cw_diag sniff-cfg ip port`	Set the sniff server IP and port.
`cw_diag stats wl_intf`	Show the wl_intf status.
`cw_diag uptime`	Show daemon uptime.
`cw_diag -c ap-scan`	Show scanned APs.
`cw_diag -c ap-suppress`	Show suppressed APs.
`cw_diag -c arp-req`	Show scanned arp requests.
`cw_diag -c atf`	Show Air Time Fairness information at the FortiAP level.
`cw_diag -c ble-scan`	Show scanned Bluetooth Low Energy (BLE) devices that are reported to FortiPresence.
`cw_diag -c darrp`	Show the DARRP radio channel.
`cw_diag -c fortipresence`	Show FortiPresence statistics including reported BLE devices.
`cw_diag -c k-qos wlan00`	Verify that the vmn-dscp-marking values are pushed to FortiAP.
`cw_diag -c mesh`	Show the mesh status.
`cw_diag -c mesh-ap`	Show the mesh ap candidates.
`cw_diag -c mesh-veth-acinfo`	Show the mesh veth ac info, and mesh ether type.
`cw_diag -c mesh-veth-host`	Show the mesh veth host.
`cw_diag -c mesh-veth-vap`	Show the mesh veth vap.
`cw_diag -c radio-cfg`	Show the current radio config parameters in the control plane.
`cw_diag -c scan-clr-all`	Flush all scanned AP/STA/ARPs.
`cw_diag -c snmp`	Show configuration details for SNMP support.
`cw_diag -c sta-cap`	Show scanned STA capabilities.
`cw_diag -c sta-deauth`	De-authenticate an STA.
`cw_diag -c sta-scan`	Show scanned STAs.
`cw_diag -c vap-cfg`	Show the current VAPs in the control plane.
`cw_diag -c vlan-probe-cmd action(0:start 1:stop 2:clear) intf [start-vlan end-vlan retries timeout]`	Start the VLAN probe. Example command: cw_diag -c vlan-probe-cmd 0 eth0 2 300 3 10 Example output: VLAN probing: start intf [eth0] vlan range[2,300] retries[3] timeout[10] ...
`cw_diag -c vlan-probe-rpt`	Show the VLAN probe report.
`cw_diag -c wids`	Show scanned WIDS detections.
`cw_diag -c wtp-cfg`	Show the current wtp config parameters in the control plane.
`cw_diag --clog <on\|off>`	Turn on or off console log message.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

FortiWiFi and FortiAP Configuration Guide

FortiAP CLI configuration and diagnostics commands

FortiAP CLI configuration and diagnostics commands

Configuration commands

Configuration variables

Diagnostics commands

FortiAP CLI configuration and diagnostics commands

FortiAP CLI configuration and diagnostics commands

Configuration commands

Configuration variables

Diagnostics commands