Optimizing memory storage by limiting monitoring data

You can optimize memory storage in the FortiGate wireless controller and improve CAPWAP stability by limiting the data stored from rogue APs, station capabilities, rogue stations and Bluetooth devices.

CLI commands

The following CLI commands limit the amount of information stored in the FortiGate.

config wireless-controller global
  set max-sta-cap <integer>
  set max-sta-cap-wtp <integer>
  set max-rogue-ap <integer>
  set max-rogue-ap-wtp <integer>
  set max-rogue-sta <integer>
  set max-ble-device <integer>
end

max-sta-cap	Maximum number of station cap stored on the controller (default = 0).
max-sta-cap-wtp	Maximum number of station cap's wtp info stored on the controller (1 - 8, default = 8).
max-rogue-ap	Maximum number of rogue APs stored on the controller (default = 0).
max-rogue-ap-wtp	Maximum number of rogue AP's wtp info stored on the controller (1 - 16, default = 16).
max-rogue-sta	Maximum number of rogue stations stored on the controller (default = 0).
max-ble-device	Maximum number of BLE devices stored on the controller (default = 0).

The following CLI commands have been added to clean up data and reduce the amount of information stored in the FortiGate.

config wireless-controller timer
  set sta-cap-cleanup <integer>
  set rogue-ap-cleanup <integer>
  set rogue-sta-cleanup <integer>
  set ble-device-cleanup <integer>
end

sta-cap-cleanup	Time period in minutes to keep station capability data after it is gone (default = 0).
rogue-ap-cleanup	Time period in minutes to keep rogue AP after it is gone (default = 0).
rogue-sta-cleanup	Time period in minutes to keep rogue station after it is gone (default = 0).
ble-device-cleanup	Time period in minutes to keep BLE device after it is gone (default = 60).

If 0 is set, it means there is no limit placed.

Example memory optimization configuration:

1. Using the FortiGate CLI, enter diagnose wireless-controller wlac -c stats to check the number of rogue APs.

   diagnose wireless-controller wlac -c stats
   cw_rbtts_sta_cap_tree                   : cnt=524416     mem=(     248B,     130MB) tmo=0      max_cnt=524416,524416
   cw_sta_cap_wtp_tree                     : cnt=668740     mem=(     296B,     197MB)
   cw_rbtts_ap_rogue_tree                  : cnt=8511       mem=(     560B,       4MB) tmo=0      max_cnt=65664,65664
   cw_ap_rogue_wtp_tree                    : cnt=133761     mem=(     408B,      54MB)
   cw_rbtts_sta_rogue_tree                 : cnt=6177       mem=(     232B,       1MB) tmo=0      max_cnt=528384,528384
   cw_ble_dev_tree                         : cnt=1920       mem=(     232B,       0MB) tmo=60     max_cnt=131200,131200

   The number of rogue APs is 8511.

2. Check the current amount of memory used in the FortiGate:

   get system performance status 
   ......
   Memory: 49539060k total, 26111804k used (52.7%), 22613800k free (45.6%), 813456k freeable (1.7%)
   ......

   The amount of memory used is 52.7%.

3. Configure the FortiGate CLI to set maximum limits and timers on stored data:

   config wireless-controller global
     set max-sta-cap 10
     set max-sta-cap-wtp 1
     set max-rogue-ap 10
     set max-rogue-ap-wtp 1
     set max-rogue-sta 10
     set max-ble-device 10
   end
   config wireless-controller timer
     set sta-cap-cleanup 2
     set rogue-ap-cleanup 2
     set rogue-sta-cleanup 2
     set ble-device-cleanup 2
   end

4. Verify that rogue AP limits are successful configured by using diagnose wireless-controller wlac -c stats.

   diagnose wireless-controller wlac -c stats
   cw_rbtts_sta_cap_tree                   : cnt=10         mem=(     248B,       0MB) tmo=2      max_cnt=10,524416
   cw_sta_cap_wtp_tree                     : cnt=10         mem=(     296B,       0MB)
   cw_rbtts_ap_rogue_tree                  : cnt=10         mem=(     560B,       0MB) tmo=2      max_cnt=10,65664
   cw_ap_rogue_wtp_tree                    : cnt=10         mem=(     408B,       0MB)
   cw_rbtts_sta_rogue_tree                 : cnt=3          mem=(     232B,       0MB) tmo=2      max_cnt=10,528384
   cw_ble_dev_tree                         : cnt=10         mem=(     232B,       0MB) tmo=2      max_cnt=10,131200

   The number of rogue APs decreased to 10, the same as the maximum number set.

5. Check the current memory used:

   get system performance status
   ......
   Memory: 49539060k total, 25568512k used (51.6%), 23156900k free (46.7%), 813648k freeable (1.7%)
   ......

   The amount of memory used decreased to 51.6%.

To verify cleanup timers:

This example verifies the cleanup timer configured for rogue-ap-cleanup. In this example, the rogue AP's data should be cleaned up after 2 minutes.

1. Verify that the cleanup timers are successfully configured with diagnose wireless-controller wlac -c ap-rogue.

   diagnose wireless-controller wlac -c ap-rogue
   CMWP AP: vf                bssid ssid       ch rate  sec            signal noise  age   sta mac              wtp cnt   ici   b
   w sgi band                  freq(MHz)
   UNNN AP: 1     e0:23:ff:4a:83:c0 FOS_Device 6  286   WPA2 Enterprise   -31 -95    2     00:00:00:00:00:00    1   /1   none   2
   0 0  11AXGHE20               -
    N              FP234FTF21003786 FOS_Device 6  286   WPA2 Enterprise   -31 -95    2     10.131.0.120:5246 -2  11

   In this example, the FortiAP was turned off after 2 seconds when the age was at 2.

2. Enter diagnose wireless-controller wlac -c ap-rogue again to check the rogue AP data.

   diag wir wlac -c ap-rogue
   CMWP AP: vf               bssid ssid        ch  rate  sec            signal noise  age   sta mac              wtp cnt   ici   b
   w sgi band                 freq(MHz)
   UNNN AP: 1    e0:23:ff:4a:83:c0 FOS_Device  6   286   WPA2 Enterprise   -31 -95    122   00:00:00:00:00:00    1   /1   none   2
   0 0  11AXGHE20               -
    N             FP234FTF21003786 FOS_Device  6   286   WPA2 Enterprise   -31 -95    122   10.131.0.120:5246 -2  11

   The rogue AP age is now 122 (or 122 seconds). The rogue AP data was held for 2 minutes, matching the value set under rogue-ap-cleanup. After 2 minutes have elapsed, the data will no longer be stored.