Fortinet Document Library

Version:

Version:

Version:

Version:


Table of Contents

FortiWiFi and FortiAP Configuration Guide

Download PDF
Copy Link

Creating a FortiAP profile

A FortiAP profile defines radio settings for a particular platform (FortiAP model). The profile also selects which SSIDs (virtual APs) the APs will carry as well as the traffic mode. FortiAP units contain two or more radio transceivers, making it possible to provide both 2.4 GHz 802.11b/g/n and 5 GHz 802.11a/n service from the same access point. The radios can also be used for monitoring accepted or rogue APs through the Rogue AP detection feature.

You can modify existing FortiAP profiles or create new ones of your own.

Note

On FortiGate model 30D, GUI configuration of FortiAP Profiles is disabled by default. To enable AP profiles, enter the following CLI commands:

config system settings
  set gui-ap-profile enable
end

To configure a FortiAP profile - GUI
  1. Go to WiFi & Switch Controller > FortiAP Profiles and select Create New.
  2. Enter a Name for the FortiAP Profile.
  3. In Platform, select the FortiWiFi or FortiAP model to which this profile applies.
  4. Select the Country/Region for the FortiAP Profile.
  5. If split tunneling is used, in Split Tunneling Subnets, enter a comma-separated list of all the destination IP address ranges that should not be routed through the FortiGate WiFi controller.
  6. In Client Load Balancing, select a handoff type as needed (see Wireless client load balancing for high-density deployments).
  7. For each radio, enter:
  8. Mode

    Select the type of mode:

    • Disabled – the radio is disabled.
    • Access Point – the platform is an access point.
    • Dedicated Monitor – the platform is a dedicated monitor. See Wireless network monitoring.

    WIDS Profile

    Optionally, select a Wireless Intrusion Detection (WIDS) profile. See Wireless network protection.

    Radio Resource
    Provision

    Select to enable the distributed radio resource provisioning (DARRP) feature. This feature measures utilization and interference on the available channels and selects the clearest channel at each access point. The measurement can be repeated periodically to respond to changing conditions.

    Band

    Select the wireless protocols that you want to support. The available choices depend on the radio’s capabilities. Where multiple protocols are supported, the letter suffixes are combined: “802.11g/b” means 802.11g and 802.11b.

    Note that on two-radio units such as the FortiAP-221C it is not possible to put both radios on the same band.

    Channel Width

    Select channel width for 802.11ac or 802.11n on 5 GHz.

    Short Guard
    Interval

    Select to enable the short guard interval for 802.11ac or 802.11n on 5 GHz.

    Channels

    Select the channel or channels to include. The available channels depend on which IEEE wireless protocol you selected in Band. By default, all available channels are enabled.

    TX Power
    Control

    Enable automatic or manual adjustment of transmit power.

    • Auto – the TX Power is set by default to a range of 10-17 dBm. Set the range between 1 and 20 for both the lower and upper limits.
    • Manual – the TX Power is set by default to 100% of the maximum power permitted in your region. To change the level, drag the slider.

    TX Power

    Specify either the minimum and maximum TX power levels in dBm or as a percentage.

    SSIDs

    Select a traffic mode for SSIDs.

    • Tunnel – available tunnel-mode SSIDs are automatically assigned to this radio.
    • Bridge – available bridge-mode SSIDs are automatically assigned to this radio.
    • Manual – manually select which available SSIDs and SSID groups to assign to this radio.

    Monitor channel utilization

    Select to enable monitoring channel utilization.

    Radio 1 settings are the same as Radio 2 settings except for the options for Channel.

    Radio 2 settings are available only for FortiAP models with dual radios.

  9. Click OK.
To configure a FortiAP profile - CLI

This example configures a FortiAP-220B to carry all SSIDs on Radio 1 but only SSID example_wlan on Radio 2.

config wireless-controller wtp-profile

edit guest_prof

config platform

set type 220B

end

config radio-1

set mode ap

set band 802.11g

set vap-all tunnel

end

config radio-2

set mode ap

set band 802.11g

set vaps-all manual

set vaps example_wlan

end

end

 

To enable DARRP - CLI

To prevent interference between APs, the FortiOS WiFi Controller includes the Distributed Automatic Radio Resource Provisioning (DARRP) feature. Through DARRP, each FortiAP unit autonomously and periodically determines the channel that is best suited for wireless communications. FortiAP units to select their channel so that they do not interfere with each other in large-scale deployments where multiple access points have overlapping radio ranges.

In this example, DARRP is enabled for both radios in the FAP321C-default profile:

config wireless-controller wtp-profile

edit FAP321C-default

config radio-1

set darrp enable

end

config radio-2

set darrp enable

end

end

To set DARRP timing - CLI

By default, DARRP optimization occurs at a fixed interval of 1800 seconds (30 minutes). You can change this interval in the CLI at the VDOM level. For example, to change the interval to 3600 seconds enter:

config wireless-controller setting

set darrp-optimize 3600

end

 

Optionally, you can schedule optimization for fixed times. This enables you to confine DARRP activity to a low-traffic period. Setting darrp-optimize to 0, makes darrp-day and darrp-time available. For example, here's how to set DARRP optimization for 3:00 am every day:

config wireless-controller setting

set darrp-optimize 0

set darrp-day sunday monday tuesday wednesday thursday friday saturday

set darrp-time 03:00

end

Both darrp-day and darrp-time can accept multiple entries.

Creating a FortiAP profile

A FortiAP profile defines radio settings for a particular platform (FortiAP model). The profile also selects which SSIDs (virtual APs) the APs will carry as well as the traffic mode. FortiAP units contain two or more radio transceivers, making it possible to provide both 2.4 GHz 802.11b/g/n and 5 GHz 802.11a/n service from the same access point. The radios can also be used for monitoring accepted or rogue APs through the Rogue AP detection feature.

You can modify existing FortiAP profiles or create new ones of your own.

Note

On FortiGate model 30D, GUI configuration of FortiAP Profiles is disabled by default. To enable AP profiles, enter the following CLI commands:

config system settings
  set gui-ap-profile enable
end

To configure a FortiAP profile - GUI
  1. Go to WiFi & Switch Controller > FortiAP Profiles and select Create New.
  2. Enter a Name for the FortiAP Profile.
  3. In Platform, select the FortiWiFi or FortiAP model to which this profile applies.
  4. Select the Country/Region for the FortiAP Profile.
  5. If split tunneling is used, in Split Tunneling Subnets, enter a comma-separated list of all the destination IP address ranges that should not be routed through the FortiGate WiFi controller.
  6. In Client Load Balancing, select a handoff type as needed (see Wireless client load balancing for high-density deployments).
  7. For each radio, enter:
  8. Mode

    Select the type of mode:

    • Disabled – the radio is disabled.
    • Access Point – the platform is an access point.
    • Dedicated Monitor – the platform is a dedicated monitor. See Wireless network monitoring.

    WIDS Profile

    Optionally, select a Wireless Intrusion Detection (WIDS) profile. See Wireless network protection.

    Radio Resource
    Provision

    Select to enable the distributed radio resource provisioning (DARRP) feature. This feature measures utilization and interference on the available channels and selects the clearest channel at each access point. The measurement can be repeated periodically to respond to changing conditions.

    Band

    Select the wireless protocols that you want to support. The available choices depend on the radio’s capabilities. Where multiple protocols are supported, the letter suffixes are combined: “802.11g/b” means 802.11g and 802.11b.

    Note that on two-radio units such as the FortiAP-221C it is not possible to put both radios on the same band.

    Channel Width

    Select channel width for 802.11ac or 802.11n on 5 GHz.

    Short Guard
    Interval

    Select to enable the short guard interval for 802.11ac or 802.11n on 5 GHz.

    Channels

    Select the channel or channels to include. The available channels depend on which IEEE wireless protocol you selected in Band. By default, all available channels are enabled.

    TX Power
    Control

    Enable automatic or manual adjustment of transmit power.

    • Auto – the TX Power is set by default to a range of 10-17 dBm. Set the range between 1 and 20 for both the lower and upper limits.
    • Manual – the TX Power is set by default to 100% of the maximum power permitted in your region. To change the level, drag the slider.

    TX Power

    Specify either the minimum and maximum TX power levels in dBm or as a percentage.

    SSIDs

    Select a traffic mode for SSIDs.

    • Tunnel – available tunnel-mode SSIDs are automatically assigned to this radio.
    • Bridge – available bridge-mode SSIDs are automatically assigned to this radio.
    • Manual – manually select which available SSIDs and SSID groups to assign to this radio.

    Monitor channel utilization

    Select to enable monitoring channel utilization.

    Radio 1 settings are the same as Radio 2 settings except for the options for Channel.

    Radio 2 settings are available only for FortiAP models with dual radios.

  9. Click OK.
To configure a FortiAP profile - CLI

This example configures a FortiAP-220B to carry all SSIDs on Radio 1 but only SSID example_wlan on Radio 2.

config wireless-controller wtp-profile

edit guest_prof

config platform

set type 220B

end

config radio-1

set mode ap

set band 802.11g

set vap-all tunnel

end

config radio-2

set mode ap

set band 802.11g

set vaps-all manual

set vaps example_wlan

end

end

 

To enable DARRP - CLI

To prevent interference between APs, the FortiOS WiFi Controller includes the Distributed Automatic Radio Resource Provisioning (DARRP) feature. Through DARRP, each FortiAP unit autonomously and periodically determines the channel that is best suited for wireless communications. FortiAP units to select their channel so that they do not interfere with each other in large-scale deployments where multiple access points have overlapping radio ranges.

In this example, DARRP is enabled for both radios in the FAP321C-default profile:

config wireless-controller wtp-profile

edit FAP321C-default

config radio-1

set darrp enable

end

config radio-2

set darrp enable

end

end

To set DARRP timing - CLI

By default, DARRP optimization occurs at a fixed interval of 1800 seconds (30 minutes). You can change this interval in the CLI at the VDOM level. For example, to change the interval to 3600 seconds enter:

config wireless-controller setting

set darrp-optimize 3600

end

 

Optionally, you can schedule optimization for fixed times. This enables you to confine DARRP activity to a low-traffic period. Setting darrp-optimize to 0, makes darrp-day and darrp-time available. For example, here's how to set DARRP optimization for 3:00 am every day:

config wireless-controller setting

set darrp-optimize 0

set darrp-day sunday monday tuesday wednesday thursday friday saturday

set darrp-time 03:00

end

Both darrp-day and darrp-time can accept multiple entries.