After the FortiAP joins a FortiGate, a CAPWAP tunnel is established between the FortiGate and FortiAP.
There are two channels inside the CAPWAP tunnel:
- The control channel for managing traffic, which is always encrypted by DTLS.
- The data channel for carrying client data packets, which can be configured to be encrypted or not.
The default setting for
clear-text, meaning it is non-encrypted. There are two settings available to encrypt the data channel:
config wireless-controller wtp-profile edit "FortiAP-profile-name" set dtls-policy clear-text|dtls-enabled|ipsec-vpn next end
Of the three settings,
clear-text has the highest possible data throughput. Furthermore, FortiGates with hardware acceleration chips can offload CAPWAP data traffic in
clear-text and achieve much higher throughput performance (see CAPWAP Offloading).
You can only configure the data channel using the CLI.
When data security is not a major concern, we recommend that you set the data channel to non-encrypted. For example, when the FortiGate and FortiAP are operating in an internal network.
To set the data channel to non-encrypted using the CLI
config wireless-controller wtp-profile edit "FortiAP-profile-name" set dtls-policy clear-text next end
When the FortiGate and FortiAP are in different networks, and the data channel might transit through a public network, we recommend that you encrypt the data channel to protect your data with either DTLS or IPsec VPN.
To encrypt the data channel with DTLS using the CLI
config wireless-controller wtp-profile edit "FortiAP-profile-name" set dtls-policy dtls-enabled set dtls-in-kernel disable|enable next end
set dtls-in-kernel is only available after
dtls-policy is set to
dtls-enabled. When you enable
dtls-in-kernel, the FortiAP OS kernel processes the traffic encryption and decryption, which could provide better throughput performance. DTLS encryption cannot be hardware-accelerated on the FortiGate so when DTLS is enabled, data throughput performance is significantly lower than with
To encrypt the data channel with IPsec VPN using the CLI
config wireless-controller wtp-profile edit "FortiAP-profile-name" set dtls-policy ipsec-vpn next end
This automatically establishes an IPsec VPN tunnel between the FortiGate and FortiAP that carries CAPWAP data packets. FortiGates with NP6 chips can offload CAPWAP data traffic in IPsec, so this encryption option has better throughput performance than DTLS. Because there is no built-in hardware acceleration chip, the FortiAP is considered the performance bottleneck in this scenario.