After the FortiAP joins a FortiGate, a CAPWAP tunnel is established between the FortiGate and FortiAP.
There are two channels inside the CAPWAP tunnel:
- The control channel for managing traffic, which is always encrypted by DTLS.
- The data channel for carrying client data packets, which can be configured to be encrypted or not.
The default setting for
clear-text, meaning it is non-encrypted. The following settings are available to encrypt the data channel:
config wireless-controller wtp-profile edit "FortiAP-profile-name" set dtls-policy clear-text|dtls-enabled|ipsec-vpn|ipsec-vpn-sn next end
Of these settings,
clear-text has the highest possible data throughput. Furthermore, FortiGates with hardware acceleration chips can offload CAPWAP data traffic in
clear-text and achieve much higher throughput performance (see CAPWAP Offloading).
You can only configure the data channel using the CLI.
When data security is not a major concern, we recommend that you set the data channel to non-encrypted. For example, when the FortiGate and FortiAP are operating in an internal network.
config wireless-controller wtp-profile edit "FortiAP-profile-name" set dtls-policy clear-text next end
There are data channel encryption settings on both the FortiGate unit and the FortiAP units. The settings must agree or the FortiAP unit will not be able to join the WiFi network. For more instructions on how to configure encryption on a FortiAP unit, see WiFi data channel encryption
When the FortiGate and FortiAP are in different networks, and the data channel might transit through a public network, we recommend that you encrypt the data channel to protect your data with either DTLS or IPsec VPN.
config wireless-controller wtp-profile edit "FortiAP-profile-name" set dtls-policy dtls-enabled set dtls-in-kernel disable|enable next end
set dtls-in-kernel is only available after
dtls-policy is set to
dtls-enabled. When you enable
dtls-in-kernel, the FortiAP OS kernel processes the traffic encryption and decryption, which could provide better throughput performance. DTLS encryption cannot be hardware-accelerated on the FortiGate so when DTLS is enabled, data throughput performance is significantly lower than with
config wireless-controller wtp-profile edit "FortiAP-profile-name" set dtls-policy ipsec-vpn|ipsec-vpn-sn next end
This automatically establishes an IPsec VPN tunnel between the FortiGate and FortiAP that carries CAPWAP data packets. FortiGates with NP6 chips can offload CAPWAP data traffic in IPsec, so this encryption option has better throughput performance than DTLS. Because there is no built-in hardware acceleration chip, the FortiAP is considered the performance bottleneck in this scenario.
Optionally, you can use the
ipsec-vpn-sn policy instead. It also establishes an IPsec VPN tunnel between the FortiGate and FortiAP that carries CAPWAP data packets, but it includes the FortiAP serial number within this tunnel.