Disabling FortiAP port access

If your FortiAP is located in an easily accessible location, you can disable the serial console port and USB port to prevent intruders from physically accessing the FortiAP.

To disable console login:

config wireless-controller wtp-profile

edit <profile>

set console-login disable

next

end

By default, console login is enabled in WTP profiles. When the console access is changed, all managed FortiAPs using the profile are rebooted.

You can confirm console login is disabled by logging into the FortiAP with the SSH connection.

FortiAP-433F # wcfg | grep console-login

console-login : disabled

To disable the USB port:

config wireless-controller wtp-profile
  edit <profile>
    set usb-port disable
  next
end

The USB port can be disabled when the FortiAP input power mode status is full. Use cw_diag power to check the power mode status.

You can confirm the USB port is disabled with the following diagnostics command:

diag wireless-controller wlac -c wtp FP433GTY22002014 | grep usb
    usb port : disabled(enabled from AC)
    usb port oper : disabled