Advanced Wireless Features

By default, the FortiGate GUI hides advanced features to simplify the site layout. You can go to System > Feature Visibility to enable different types advanced features, including Advanced Wireless Features.

After enabling Advanced Wireless Features, several entries in the Navigation bar will change names.

• Operations Profiles Entry: FortiAP, QoS, and FortiAP Configuration.

• Connectivity Profiles Entry: MPSK and Bonjour.

• Protection Profiles Entry: WIDS and L3 Firewall (also known as L3 Access Control List configurations for FortiAPs).

• Additional advanced options for wireless features under the SSIDs and WiFi Settings entries are visible.

  • SSIDs > Edit Interface: Voice-Enterprise, Multiband operation, Fast BSS transition, Probe response suppression, Sticky client removal, multicast enhancement, IGMP snooping, Radio sensitivity, Airtime weight, QoS profile, and L3 firewall profile.

  • WiFi Settings: Duplicate SSID, DARRP, Phishing SSID detection, and SNMP settings.

Note that this guide is intended to be used when Advanced Wireless Features is disabled, and therefore uses the default entry names. If a topic covers a feature that requires Advanced Wireless Features to be enabled, it will specify users must first enable Advanced Wireless Features.

To enable Advanced Wireless Features - GUI

1. From the FortiOS GUI, go to System > Feature Visibility.

2. Under the Additional Features column, locate and enable Advanced Wireless Features.

   

3. Click Apply.

   The Navigation bar reloads with the new features visible.

To enable Advanced Wireless Features - CLI:

config system settings
    set gui-advanced-wireless-features enable
end

Operations Profiles Entry

When you enable Advanced Wireless Features, FortiAP Profiles is renamed to Operation Profiles and contains additional tabs that enable you to manage QoS and FortiAP Configuration profiles.

FortiAP Profile Advanced Settings

When you create or edit a FortiAP profile, you can configure additional advanced settings.

These fields correspond to the following CLI settings:

config wireless-controller wtp-profile

  edit <name>

    set dtls-policy {option1}, {option2}, …

    set max-clients {integer}

    set handoff-rssi {integer}

    set handoff-sta-thresh {integer}

    set led-state [enable|disable]

    set led-schedules <name1>, <name2>, ...

QoS Profiles

You can create or edit Quality of Service (QoS) profiles by clicking the QoS Profiles tab.

Click Create new to create a QoS profile.

These fields correspond to the following CLI settings:

config wireless-controller qos-profile

edit <name>

  set comment {string}

  set uplink {integer}

  set downlink {integer}

  set uplink-sta {integer}

  set downlink-sta {integer}

  set burst [enable|disable]

  set wmm [enable|disable]

  set wmm-uapsd [enable|disable]

  set call-admission-control [enable|disable]

  set call-capacity {integer}

  set bandwidth-admission-control [enable|disable]

  set bandwidth-capacity {integer}

  set dscp-wmm-mapping [enable|disable]

  set dscp-wmm-vo <id1>, <id2>, …

  set dscp-wmm-vi <id1>, <id2>, …

  set dscp-wmm-be <id1>, <id2>, …

  set dscp-wmm-bk <id1>, <id2>, …

  set wmm-dscp-marking [enable|disable]

  set wmm-vo-dscp {integer}

  set wmm-vi-dscp {integer}

  set wmm-be-dscp {integer}

  set wmm-bk-dscp {integer}

FortiAP Configuration Profiles

You can create or edit FortiAP Configuration Profile for managing local FortiAP configuration by clicking the FortiAP Configuration Profiles tab.

Click Create new to create a FortiAP Configuration profile.

These fields correspond to the following CLI settings:

config wireless-controller apcfg-profile

  edit <name>

    set comment {var-string}

    set ap-family [fap|fap-u|...]

    config command-list

      edit <id>

      set name {string}

      set type [non-password|password]

      set value {string} / set passwd-value {password}

    set ac-timer {integer}

    set ac-type [default|specify|...]

    set ac-ip {ipv4-address}

    set ac-port {integer}

Connectivity Profiles Entry

You can access Connectivity Profiles to manage your MPSK and Bonjour profiles.

MPSK Profiles

After you click Connectivity Profile, the MPSK Profiles tab loads by default. From there you can create or edit MPSK profiles to manage multiple pre-shared keys.

Click Create new to create an MPSK profile.

From there you can create and add MPSK groups and determine how you want to add your MPSK keys.

These fields correspond to the following CLI settings:

config wireless-controller mpsk-profile

  edit <name>

    set mpsk-concurrent-clients {integer}

    config mpsk-group

      edit <name>

      set vlan-type [no-vlan|fixed-vlan]

      set vlan-id {integer}

      config mpsk-key

        edit <name>

        set comment {var-string}

        set passphrase {password}

        set mac {mac-address}

        set concurrent-client-limit-type [default|unlimited|...]

        set concurrent-clients {integer}

        set mpsk-schedules <name1>, <name2>, …

Bonjour Profiles

Bonjour is Apple's zero configuration networking protocol. Bonjour profiles allow APs and FortiAPs to connect to networks using Bonjour. You can create or edit Bonjour profiles by clicking the Bonjour Profiles tab.

Click Create new to create a Bonjour profile.

From there you can create and add policies that determine which services you want to advertise across the network.

These fields correspond to the following CLI settings:

config wireless-controller bonjour-profile

  edit <name>

  set comment {string}

  config policy-list

    edit <policy-id>

    set description {string}

    set from-vlan {string}

    set to-vlan {string}

    set services {option1}, {option2}, …

Protection Profiles Entry

When you enable Advanced Wireless Features, WIDS Profiles is renamed to Protection Profiles and contains additional tabs that enable you to manage L3 Firewall Profiles.

WIDS Profiles

After you click Protection Profiles, the WIDS Profiles tab loads by default. From there you can create or edit WIDS profiles to configure the type of security threats you want to monitor.

L3 Firewall Profile

You can create or edit L3 Firewall Profiles to configure the WiFi bridge access control list by clicking the L3 Firewall Profiles tab.

Click Create new to create a L3 Firewall profile.

From there, you can create IPv4 or IPv6 rule lists to allow or deny traffic that matches the configured policy.

These fields correspond to the following CLI settings:

config wireless-controller access-control-list

  edit <name>

    set comment {string}

    config layer3-ipv4-rules

      edit <rule-id>

        set comment {string}

        set srcaddr {user}

        set srcport {integer}

        set dstaddr {user}

        set dstport {integer}

        set protocol {integer}

        set action [allow|deny]

    config layer3-ipv6-rules

      edit <rule-id>

        set comment {string}

        set srcaddr {user}

        set srcport {integer}

        set dstaddr {user}

        set dstport {integer}

        set protocol {integer}

        set action [allow|deny]

Advanced SSID options

When you create or edit an SSID, you can configure additional advanced settings.

These fields correspond to the following CLI settings:

config wireless-controller vap
  edit <name>

    set voice-enterprise [disable|enable]

    set mbo [disable|enable]

    set fast-bss-transition [disable|enable]

    set probe-resp-suppression [enable|disable]

    set sticky-client-remove [enable|disable]

    set multicast-enhance [enable|disable]

    set igmp-snooping [enable|disable]

    set radio-sensitivity [enable|disable]

    set atf-weight {integer}

    set qos-profile {string}

    set access-control-list {string}

Advanced WiFi Settings options

More options are exposed on WiFi Settings page, including Duplicate SSID, DARRP related settings, Phishing SSID detection setting, and SNMP settings.

These fields correspond to the following CLI settings:

config wireless-controller setting

  set duplicate-ssid [enable|disable]

  set darrp-optimize {integer}

  set darrp-optimize-schedules <name1>, <name2>, …

  set phishing-ssid-detect [enable|disable]

config wireless-controller snmp

  set engine-id {string}

  set contact-info {string}

  set trap-high-cpu-threshold {integer}

  set trap-high-mem-threshold {integer}

  config user

    edit <name>

      set status [enable|disable]

      set queries [enable|disable]

      set trap-status [enable|disable]

      set security-level [no-auth-no-priv|auth-no-priv|...]

      set auth-proto [md5|sha]

      set auth-pwd {password}

      set priv-proto [aes|des|...]

      set priv-pwd {password}

      set notify-hosts {ipv4-address}

  config community

    edit <id>

      set name {string}

      set status [enable|disable]

      set query-v1-status [enable|disable]

      set query-v2c-status [enable|disable]

      set trap-v1-status [enable|disable]

      set trap-v2c-status [enable|disable]

      config hosts

        edit <id>

          set ip {user}