Fortinet black logo

CLI Reference

config wireless-controller vap

config wireless-controller vap

Configure Virtual Access Points (VAPs).

config wireless-controller vap

Description: Configure Virtual Access Points (VAPs).

edit <name>

set fast-roaming [enable|disable]

set external-fast-roaming [enable|disable]

set mesh-backhaul [enable|disable]

set atf-weight {integer}

set max-clients {integer}

set max-clients-ap {integer}

set ssid {string}

set broadcast-ssid [enable|disable]

set security [open|captive-portal|...]

set pmf [disable|enable|...]

set pmf-assoc-comeback-timeout {integer}

set pmf-sa-query-retry-timeout {integer}

set okc [disable|enable]

set voice-enterprise [disable|enable]

set fast-bss-transition [disable|enable]

set ft-mobility-domain {integer}

set ft-r0-key-lifetime {integer}

set ft-over-ds [disable|enable]

set sae-groups {option1}, {option2}, ...

set owe-groups {option1}, {option2}, ...

set owe-transition [disable|enable]

set owe-transition-ssid {string}

set eapol-key-retries [disable|enable]

set tkip-counter-measure [enable|disable]

set external-web {string}

set external-web-format [auto-detect|no-query-string|...]

set external-logout {string}

set mac-auth-bypass [enable|disable]

set radius-mac-auth [enable|disable]

set radius-mac-auth-server {string}

set radius-mac-auth-usergroups <name1>, <name2>, ...

set auth [psk|radius|...]

set encrypt [TKIP|AES|...]

set keyindex {integer}

set key {password}

set passphrase {password}

set sae-password {password}

set radius-server {string}

set acct-interim-interval {integer}

set local-standalone [enable|disable]

set local-standalone-nat [enable|disable]

set ip {ipv4-classnet-host}

set dhcp-lease-time {integer}

set local-bridging [enable|disable]

set local-lan [allow|deny]

set local-authentication [enable|disable]

set usergroup <name1>, <name2>, ...

set portal-message-override-group {string}

config portal-message-overrides

Description: Individual message overrides.

set auth-disclaimer-page {string}

set auth-reject-page {string}

set auth-login-page {string}

set auth-login-failed-page {string}

end

set portal-type [auth|auth+disclaimer|...]

set selected-usergroups <name1>, <name2>, ...

set security-exempt-list {string}

set security-redirect-url {string}

set intra-vap-privacy [enable|disable]

set schedule <name1>, <name2>, ...

set ldpc [disable|rx|...]

set high-efficiency [enable|disable]

set target-wake-time [enable|disable]

set mpsk [enable|disable]

set mpsk-concurrent-clients {integer}

config mpsk-key

Description: List of multiple PSK entries.

edit <key-name>

set passphrase {password}

set concurrent-clients {string}

set comment {var-string}

set mpsk-schedules <name1>, <name2>, ...

next

end

set split-tunneling [enable|disable]

set vlanid {integer}

set vlan-auto [enable|disable]

set dynamic-vlan [enable|disable]

set captive-portal-radius-server {string}

set captive-portal-radius-secret {password}

set captive-portal-macauth-radius-server {string}

set captive-portal-macauth-radius-secret {password}

set captive-portal-ac-name {string}

set captive-portal-session-timeout-interval {integer}

set multicast-rate [0|6000|...]

set multicast-enhance [enable|disable]

set broadcast-suppression {option1}, {option2}, ...

set me-disable-thresh {integer}

set mu-mimo [enable|disable]

set probe-resp-suppression [enable|disable]

set probe-resp-threshold {string}

set radio-sensitivity [enable|disable]

set quarantine [enable|disable]

set radio-5g-threshold {string}

set radio-2g-threshold {string}

set vlan-pooling [wtp-group|round-robin|...]

config vlan-pool

Description: VLAN pool.

edit <id>

set wtp-group {string}

next

end

set dhcp-option82-insertion [enable|disable]

set dhcp-option82-circuit-id-insertion [style-1|style-2|...]

set dhcp-option82-remote-id-insertion [style-1|disable]

set ptk-rekey [enable|disable]

set ptk-rekey-intv {integer}

set gtk-rekey [enable|disable]

set gtk-rekey-intv {integer}

set eap-reauth [enable|disable]

set eap-reauth-intv {integer}

set qos-profile {string}

set hotspot20-profile {string}

set primary-wag-profile {string}

set secondary-wag-profile {string}

set tunnel-echo-interval {integer}

set tunnel-fallback-interval {integer}

set rates-11a {option1}, {option2}, ...

set rates-11bg {option1}, {option2}, ...

set rates-11n-ss12 {option1}, {option2}, ...

set rates-11n-ss34 {option1}, {option2}, ...

set rates-11ac-ss12 {option1}, {option2}, ...

set rates-11ac-ss34 {option1}, {option2}, ...

set utm-profile {string}

set address-group {string}

set mac-filter [enable|disable]

set mac-filter-policy-other [allow|deny]

config mac-filter-list

Description: Create a list of MAC addresses for MAC address filtering.

edit <id>

set mac {mac-address}

set mac-filter-policy [allow|deny]

next

end

next

end

config wireless-controller vap

Parameter

Description

Type

Size

fast-roaming

Enable/disable fast-roaming, or pre-authentication, where supported by clients .

option

-

Option

Description

enable

Enable fast-roaming, or pre-authentication.

disable

Disable fast-roaming, or pre-authentication.

external-fast-roaming

Enable/disable fast roaming or pre-authentication with external APs not managed by the FortiGate .

option

-

Option

Description

enable

Enable fast roaming or pre-authentication with external APs.

disable

Disable fast roaming or pre-authentication with external APs.

mesh-backhaul

Enable/disable using this VAP as a WiFi mesh backhaul . This entry is only available when security is set to a WPA type or open.

option

-

Option

Description

enable

Enable mesh backhaul.

disable

Disable mesh backhaul.

atf-weight

Airtime weight in percentage .

integer

Minimum value: 0 Maximum value: 100

max-clients

Maximum number of clients that can connect simultaneously to the VAP .

integer

Minimum value: 0 Maximum value: 4294967295

max-clients-ap

Maximum number of clients that can connect simultaneously to the VAP per AP radio .

integer

Minimum value: 0 Maximum value: 4294967295

ssid

IEEE 802.11 service set identifier (SSID) for the wireless interface. Users who wish to use the wireless network must configure their computers to access this SSID name.

string

Maximum length: 32

broadcast-ssid

Enable/disable broadcasting the SSID .

option

-

Option

Description

enable

Enable broadcasting the SSID.

disable

Disable broadcasting the SSID.

security

Security mode for the wireless interface .

option

-

Option

Description

open

Open.

captive-portal

Captive portal.

wep64

WEP 64-bit.

wep128

WEP 128-bit.

wpa-personal

WPA/WPA2 personal.

wpa-personal+captive-portal

WPA/WPA2 personal with captive portal.

wpa-enterprise

WPA/WPA2 enterprise.

wpa-only-personal

WPA personal.

wpa-only-personal+captive-portal

WPA personal with captive portal.

wpa-only-enterprise

WPA enterprise.

wpa2-only-personal

WPA2 personal.

wpa2-only-personal+captive-portal

WPA2 personal with captive portal.

wpa2-only-enterprise

WPA2 enterprise.

wpa3-enterprise

WPA3 enterprise.

wpa3-sae

WPA3 SAE.

wpa3-sae-transition

WPA3 SAE transition.

owe

Opportunistic wireless encryption.

osen

OSEN.

pmf

Protected Management Frames .

option

-

Option

Description

disable

Disable PMF completely.

enable

Enable PMF but deny clients without PMF.

optional

Enable PMF and allow clients without PMF.

pmf-assoc-comeback-timeout

Protected Management Frames .

integer

Minimum value: 1 Maximum value: 20

pmf-sa-query-retry-timeout

Protected Management Frames .

integer

Minimum value: 1 Maximum value: 5

okc

Enable/disable Opportunistic Key Caching .

option

-

Option

Description

disable

Disable Opportunistic Key Caching (OKC).

enable

Enable Opportunistic Key Caching (OKC).

voice-enterprise

Enable/disable 802.11k and 802.11v assisted Voice-Enterprise roaming .

option

-

Option

Description

disable

Disable 802.11k and 802.11v assisted Voice-Enterprise roaming.

enable

Enable 802.11k and 802.11v assisted Voice-Enterprise roaming.

fast-bss-transition

Enable/disable 802.11r Fast BSS Transition .

option

-

Option

Description

disable

Disable 802.11r Fast BSS Transition (FT).

enable

Enable 802.11r Fast BSS Transition (FT).

ft-mobility-domain

Mobility domain identifier in FT .

integer

Minimum value: 1 Maximum value: 65535

ft-r0-key-lifetime

Lifetime of the PMK-R0 key in FT, 1-65535 minutes.

integer

Minimum value: 1 Maximum value: 65535

ft-over-ds

Enable/disable FT over the Distribution System (DS).

option

-

Option

Description

disable

Disable FT over the Distribution System (DS).

enable

Enable FT over the Distribution System (DS).

sae-groups

SAE-Groups.

option

-

Option

Description

19

DH Group 19.

20

DH Group 20.

21

DH Group 21.

owe-groups

OWE-Groups.

option

-

Option

Description

19

DH Group 19.

20

DH Group 20.

21

DH Group 21.

owe-transition

Enable/disable OWE transition mode support.

option

-

Option

Description

disable

Disable OWE transition mode support.

enable

Enable OWE transition mode support.

owe-transition-ssid

OWE transition mode peer SSID.

string

Maximum length: 32

eapol-key-retries

Enable/disable retransmission of EAPOL-Key frames .

option

-

Option

Description

disable

Disable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2).

enable

Enable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2).

tkip-counter-measure

Enable/disable TKIP counter measure.

option

-

Option

Description

enable

Enable TKIP counter measure.

disable

Disable TKIP counter measure.

external-web

URL of external authentication web server.

string

Maximum length: 127

external-web-format

URL query parameter detection .

option

-

Option

Description

auto-detect

Automatically detect if "external-web" URL has any query parameter.

no-query-string

"external-web" URL does not have any query parameter.

partial-query-string

"external-web" URL has some query parameters.

external-logout

URL of external authentication logout server.

string

Maximum length: 127

mac-auth-bypass

Enable/disable MAC authentication bypass.

option

-

Option

Description

enable

Enable MAC authentication bypass.

disable

Disable MAC authentication bypass.

radius-mac-auth

Enable/disable RADIUS-based MAC authentication of clients .

option

-

Option

Description

enable

Enable RADIUS-based MAC authentication.

disable

Disable RADIUS-based MAC authentication.

radius-mac-auth-server

RADIUS-based MAC authentication server.

string

Maximum length: 35

radius-mac-auth-usergroups <name>

Selective user groups that are permitted for RADIUS mac authentication.

User group name.

string

Maximum length: 79

auth

Authentication protocol.

option

-

Option

Description

psk

Use a single Pre-shard Key (PSK) to authenticate all users.

radius

Use a RADIUS server to authenticate clients.

usergroup

Use a firewall usergroup to authenticate clients.

encrypt

Encryption protocol to use (only available when security is set to a WPA type).

option

-

Option

Description

TKIP

Use TKIP encryption.

AES

Use AES encryption.

TKIP-AES

Use TKIP and AES encryption.

keyindex

WEP key index .

integer

Minimum value: 1 Maximum value: 4

key

WEP Key.

password

Not Specified

passphrase

WPA pre-shared key (PSK) to be used to authenticate WiFi users.

password

Not Specified

sae-password

WPA3 SAE password to be used to authenticate WiFi users.

password

Not Specified

radius-server

RADIUS server to be used to authenticate WiFi users.

string

Maximum length: 35

acct-interim-interval

WiFi RADIUS accounting interim interval .

integer

Minimum value: 60 Maximum value: 86400

local-standalone

Enable/disable AP local standalone .

option

-

Option

Description

enable

Enable AP local standalone.

disable

Disable AP local standalone.

local-standalone-nat

Enable/disable AP local standalone NAT mode.

option

-

Option

Description

enable

Enable AP local standalone NAT mode.

disable

Disable AP local standalone NAT mode.

ip

IP address and subnet mask for the local standalone NAT subnet.

ipv4-classnet-host

Not Specified

dhcp-lease-time

DHCP lease time in seconds for NAT IP address.

integer

Minimum value: 300 Maximum value: 8640000

local-bridging

Enable/disable bridging of wireless and Ethernet interfaces on the FortiAP .

option

-

Option

Description

enable

Enable AP local VAP to Ethernet bridging.

disable

Disable AP local VAP to Ethernet bridging.

local-lan

Allow/deny traffic destined for a Class A, B, or C private IP address .

option

-

Option

Description

allow

Allow traffic destined for a Class A, B, or C private IP address.

deny

Deny traffic destined for a Class A, B, or C private IP address.

local-authentication

Enable/disable AP local authentication.

option

-

Option

Description

enable

Enable AP local authentication.

disable

Disable AP local authentication.

usergroup <name>

Firewall user group to be used to authenticate WiFi users.

User group name.

string

Maximum length: 79

portal-message-override-group

Replacement message group for this VAP (only available when security is set to a captive portal type).

string

Maximum length: 35

portal-type

Captive portal functionality. Configure how the captive portal authenticates users and whether it includes a disclaimer.

option

-

Option

Description

auth

Portal for authentication.

auth+disclaimer

Portal for authentication and disclaimer.

disclaimer

Portal for disclaimer.

email-collect

Portal for email collection.

cmcc

Portal for CMCC.

cmcc-macauth

Portal for CMCC and MAC authentication.

auth-mac

Portal for authentication and MAC authentication.

external-auth

Portal for external portal authentication.

selected-usergroups <name>

Selective user groups that are permitted to authenticate.

User group name.

string

Maximum length: 79

security-exempt-list

Optional security exempt list for captive portal authentication.

string

Maximum length: 35

security-redirect-url

Optional URL for redirecting users after they pass captive portal authentication.

string

Maximum length: 127

intra-vap-privacy

Enable/disable blocking communication between clients on the same SSID .

option

-

Option

Description

enable

Enable intra-SSID privacy.

disable

Disable intra-SSID privacy.

schedule <name>

Firewall schedules for enabling this VAP on the FortiAP. This VAP will be enabled when at least one of the schedules is valid. Separate multiple schedule names with a space.

Schedule name.

string

Maximum length: 35

ldpc

VAP low-density parity-check (LDPC) coding configuration.

option

-

Option

Description

disable

Disable LDPC.

rx

Enable LDPC when receiving traffic.

tx

Enable LDPC when transmitting traffic.

rxtx

Enable LDPC when both receiving and transmitting traffic.

high-efficiency

Enable/disable 802.11ax high efficiency .

option

-

Option

Description

enable

Enable 802.11ax high efficiency.

disable

Disable 802.11ax high efficiency.

target-wake-time

Enable/disable 802.11ax target wake time .

option

-

Option

Description

enable

Enable 802.11ax target wake time.

disable

Disable 802.11ax target wake time.

mpsk

Enable/disable multiple PSK authentication.

option

-

Option

Description

enable

Enable multiple PSK authentication

disable

Disable multiple PSK authentication

mpsk-concurrent-clients

Maximum number of concurrent clients that connect using the same passphrase in multiple PSK authentication .

integer

Minimum value: 0 Maximum value: 65535

split-tunneling

Enable/disable split tunneling .

option

-

Option

Description

enable

Enable split tunneling.

disable

Disable split tunneling.

vlanid

Optional VLAN ID.

integer

Minimum value: 0 Maximum value: 4094

vlan-auto

Enable/disable automatic management of SSID VLAN interface.

option

-

Option

Description

enable

Enable automatic management of SSID VLAN interface.

disable

Disable automatic management of SSID VLAN interface.

dynamic-vlan

Enable/disable dynamic VLAN assignment.

option

-

Option

Description

enable

Enable dynamic VLAN assignment.

disable

Disable dynamic VLAN assignment.

captive-portal-radius-server

Captive portal RADIUS server domain name or IP address.

string

Maximum length: 63

captive-portal-radius-secret

Secret key to access the RADIUS server.

password

Not Specified

captive-portal-macauth-radius-server

Captive portal external RADIUS server domain name or IP address.

string

Maximum length: 63

captive-portal-macauth-radius-secret

Secret key to access the macauth RADIUS server.

password

Not Specified

captive-portal-ac-name

Local-bridging captive portal ac-name.

string

Maximum length: 35

captive-portal-session-timeout-interval

Session timeout interval .

integer

Minimum value: 0 Maximum value: 864000

multicast-rate

Multicast rate .

option

-

Option

Description

0

Use the default multicast rate.

6000

6 Mbps.

12000

12 Mbps.

24000

24 Mbps.

multicast-enhance

Enable/disable converting multicast to unicast to improve performance .

option

-

Option

Description

enable

Enable multicast enhancement.

disable

Disable multicast enhancement.

broadcast-suppression

Optional suppression of broadcast messages. For example, you can keep DHCP messages, ARP broadcasts, and so on off of the wireless network.

option

-

Option

Description

dhcp-up

Suppress broadcast uplink DHCP messages.

dhcp-down

Suppress broadcast downlink DHCP messages.

dhcp-starvation

Suppress broadcast DHCP starvation req messages.

dhcp-ucast

Convert downlink broadcast DHCP messages to unicast messages.

arp-known

Suppress broadcast ARP for known wireless clients.

arp-unknown

Suppress broadcast ARP for unknown wireless clients.

arp-reply

Suppress broadcast ARP reply from wireless clients.

arp-poison

Suppress ARP poison messages from wireless clients.

arp-proxy

Reply ARP requests for wireless clients as a proxy.

netbios-ns

Suppress NetBIOS name services packets with UDP port 137.

netbios-ds

Suppress NetBIOS datagram services packets with UDP port 138.

ipv6

Suppress IPv6 packets.

all-other-mc

Suppress all other multicast messages.

all-other-bc

Suppress all other broadcast messages.

me-disable-thresh

Disable multicast enhancement when this many clients are receiving multicast traffic.

integer

Minimum value: 2 Maximum value: 256

mu-mimo

Enable/disable Multi-user MIMO .

option

-

Option

Description

enable

Enable Multi-user MIMO.

disable

Disable Multi-user MIMO.

probe-resp-suppression

Enable/disable probe response suppression .

option

-

Option

Description

enable

Enable probe response suppression.

disable

Disable probe response suppression.

probe-resp-threshold

Minimum signal level/threshold in dBm required for the AP response to probe requests .

string

Maximum length: 7

radio-sensitivity

Enable/disable software radio sensitivity .

option

-

Option

Description

enable

Enable software radio sensitivity.

disable

Disable software radio sensitivity.

quarantine

Enable/disable station quarantine .

option

-

Option

Description

enable

Enable station quarantine.

disable

Disable station quarantine.

radio-5g-threshold

Minimum signal level/threshold in dBm required for the AP response to receive a packet in 5G band.

string

Maximum length: 7

radio-2g-threshold

Minimum signal level/threshold in dBm required for the AP response to receive a packet in 2.4G band .

string

Maximum length: 7

vlan-pooling

Enable/disable VLAN pooling, to allow grouping of multiple wireless controller VLANs into VLAN pools . When set to wtp-group, VLAN pooling occurs with VLAN assignment by wtp-group.

option

-

Option

Description

wtp-group

Enable VLAN pooling with VLAN assignment by wtp-group.

round-robin

Enable VLAN pooling with round-robin VLAN assignment.

hash

Enable VLAN pooling with hash-based VLAN assignment.

disable

Disable VLAN pooling.

dhcp-option82-insertion

Enable/disable DHCP option 82 insert .

option

-

Option

Description

enable

Enable DHCP option 82 insert.

disable

Disable DHCP option 82 insert.

dhcp-option82-circuit-id-insertion

Enable/disable DHCP option 82 circuit-id insert .

option

-

Option

Description

style-1

ASCII string composed of AP-MAC;SSID;SSID-TYPE. For example, "xx:xx:xx:xx:xx:xx;wifi;s".

style-2

ASCII string composed of AP-MAC. For example, "xx:xx:xx:xx:xx:xx".

disable

Disable DHCP option 82 circuit-id insert.

dhcp-option82-remote-id-insertion

Enable/disable DHCP option 82 remote-id insert .

option

-

Option

Description

style-1

ASCII string in the format "xx:xx:xx:xx:xx:xx" containing MAC address of client device.

disable

Disable DHCP option 82 remote-id insert.

ptk-rekey

Enable/disable PTK rekey for WPA-Enterprise security.

option

-

Option

Description

enable

Enable PTK rekey for WPA-Enterprise security.

disable

Disable PTK rekey for WPA-Enterprise security.

ptk-rekey-intv

PTK rekey interval .

integer

Minimum value: 1800 Maximum value: 864000

gtk-rekey

Enable/disable GTK rekey for WPA security.

option

-

Option

Description

enable

Enable GTK rekey for WPA security.

disable

Disable GTK rekey for WPA security.

gtk-rekey-intv

GTK rekey interval .

integer

Minimum value: 1800 Maximum value: 864000

eap-reauth

Enable/disable EAP re-authentication for WPA-Enterprise security.

option

-

Option

Description

enable

Enable EAP re-authentication for WPA-Enterprise security.

disable

Disable EAP re-authentication for WPA-Enterprise security.

eap-reauth-intv

EAP re-authentication interval .

integer

Minimum value: 1800 Maximum value: 864000

qos-profile

Quality of service profile name.

string

Maximum length: 35

hotspot20-profile

Hotspot 2.0 profile name.

string

Maximum length: 35

primary-wag-profile

Primary wireless access gateway profile name.

string

Maximum length: 35

secondary-wag-profile

Secondary wireless access gateway profile name.

string

Maximum length: 35

tunnel-echo-interval

The time interval to send echo to both primary and secondary tunnel peers .

integer

Minimum value: 1 Maximum value: 65535

tunnel-fallback-interval

The time interval for secondary tunnel to fall back to primary tunnel .

integer

Minimum value: 0 Maximum value: 65535

rates-11a

Allowed data rates for 802.11a.

option

-

Option

Description

1

1 Mbps supported rate.

1-basic

1 Mbps BSS basic rate.

2

2 Mbps supported rate.

2-basic

2 Mbps BSS basic rate.

5.5

5.5 Mbps supported rate.

5.5-basic

5.5 Mbps BSS basic rate.

11

11 Mbps supported rate.

11-basic

11 Mbps BSS basic rate.

6

6 Mbps supported rate.

6-basic

6 Mbps BSS basic rate.

9

9 Mbps supported rate.

9-basic

9 Mbps BSS basic rate.

12

12 Mbps supported rate.

12-basic

12 Mbps BSS basic rate.

18

18 Mbps supported rate.

18-basic

18 Mbps BSS basic rate.

24

24 Mbps supported rate.

24-basic

24 Mbps BSS basic rate.

36

36 Mbps supported rate.

36-basic

36 Mbps BSS basic rate.

48

48 Mbps supported rate.

48-basic

48 Mbps BSS basic rate.

54

54 Mbps supported rate.

54-basic

54 Mbps BSS basic rate.

rates-11bg

Allowed data rates for 802.11b/g.

option

-

Option

Description

1

1 Mbps supported rate.

1-basic

1 Mbps BSS basic rate.

2

2 Mbps supported rate.

2-basic

2 Mbps BSS basic rate.

5.5

5.5 Mbps supported rate.

5.5-basic

5.5 Mbps BSS basic rate.

11

11 Mbps supported rate.

11-basic

11 Mbps BSS basic rate.

6

6 Mbps supported rate.

6-basic

6 Mbps BSS basic rate.

9

9 Mbps supported rate.

9-basic

9 Mbps BSS basic rate.

12

12 Mbps supported rate.

12-basic

12 Mbps BSS basic rate.

18

18 Mbps supported rate.

18-basic

18 Mbps BSS basic rate.

24

24 Mbps supported rate.

24-basic

24 Mbps BSS basic rate.

36

36 Mbps supported rate.

36-basic

36 Mbps BSS basic rate.

48

48 Mbps supported rate.

48-basic

48 Mbps BSS basic rate.

54

54 Mbps supported rate.

54-basic

54 Mbps BSS basic rate.

rates-11n-ss12

Allowed data rates for 802.11n with 1 or 2 spatial streams.

option

-

Option

Description

mcs0/1

Data rate for MCS index 0 with 1 spatial stream.

mcs1/1

Data rate for MCS index 1 with 1 spatial stream.

mcs2/1

Data rate for MCS index 2 with 1 spatial stream.

mcs3/1

Data rate for MCS index 3 with 1 spatial stream.

mcs4/1

Data rate for MCS index 4 with 1 spatial stream.

mcs5/1

Data rate for MCS index 5 with 1 spatial stream.

mcs6/1

Data rate for MCS index 6 with 1 spatial stream.

mcs7/1

Data rate for MCS index 7 with 1 spatial stream.

mcs8/2

Data rate for MCS index 8 with 2 spatial streams.

mcs9/2

Data rate for MCS index 9 with 2 spatial streams.

mcs10/2

Data rate for MCS index 10 with 2 spatial streams.

mcs11/2

Data rate for MCS index 11 with 2 spatial streams.

mcs12/2

Data rate for MCS index 12 with 2 spatial streams.

mcs13/2

Data rate for MCS index 13 with 2 spatial streams.

mcs14/2

Data rate for MCS index 14 with 2 spatial streams.

mcs15/2

Data rate for MCS index 15 with 2 spatial streams.

rates-11n-ss34

Allowed data rates for 802.11n with 3 or 4 spatial streams.

option

-

Option

Description

mcs16/3

Data rate for MCS index 16 with 3 spatial streams.

mcs17/3

Data rate for MCS index 17 with 3 spatial streams.

mcs18/3

Data rate for MCS index 18 with 3 spatial streams.

mcs19/3

Data rate for MCS index 19 with 3 spatial streams.

mcs20/3

Data rate for MCS index 20 with 3 spatial streams.

mcs21/3

Data rate for MCS index 21 with 3 spatial streams.

mcs22/3

Data rate for MCS index 22 with 3 spatial streams.

mcs23/3

Data rate for MCS index 23 with 3 spatial streams.

mcs24/4

Data rate for MCS index 24 with 4 spatial streams.

mcs25/4

Data rate for MCS index 25 with 4 spatial streams.

mcs26/4

Data rate for MCS index 26 with 4 spatial streams.

mcs27/4

Data rate for MCS index 27 with 4 spatial streams.

mcs28/4

Data rate for MCS index 28 with 4 spatial streams.

mcs29/4

Data rate for MCS index 29 with 4 spatial streams.

mcs30/4

Data rate for MCS index 30 with 4 spatial streams.

mcs31/4

Data rate for MCS index 31 with 4 spatial streams.

rates-11ac-ss12

Allowed data rates for 802.11ac/ax with 1 or 2 spatial streams.

option

-

Option

Description

mcs0/1

Data rate for MCS index 0 with 1 spatial stream.

mcs1/1

Data rate for MCS index 1 with 1 spatial stream.

mcs2/1

Data rate for MCS index 2 with 1 spatial stream.

mcs3/1

Data rate for MCS index 3 with 1 spatial stream.

mcs4/1

Data rate for MCS index 4 with 1 spatial stream.

mcs5/1

Data rate for MCS index 5 with 1 spatial stream.

mcs6/1

Data rate for MCS index 6 with 1 spatial stream.

mcs7/1

Data rate for MCS index 7 with 1 spatial stream.

mcs8/1

Data rate for MCS index 8 with 1 spatial stream.

mcs9/1

Data rate for MCS index 9 with 1 spatial stream.

mcs10/1

Data rate for MCS index 10 with 1 spatial stream.

mcs11/1

Data rate for MCS index 11 with 1 spatial stream.

mcs0/2

Data rate for MCS index 0 with 2 spatial streams.

mcs1/2

Data rate for MCS index 1 with 2 spatial streams.

mcs2/2

Data rate for MCS index 2 with 2 spatial streams.

mcs3/2

Data rate for MCS index 3 with 2 spatial streams.

mcs4/2

Data rate for MCS index 4 with 2 spatial streams.

mcs5/2

Data rate for MCS index 5 with 2 spatial streams.

mcs6/2

Data rate for MCS index 6 with 2 spatial streams.

mcs7/2

Data rate for MCS index 7 with 2 spatial streams.

mcs8/2

Data rate for MCS index 8 with 2 spatial streams.

mcs9/2

Data rate for MCS index 9 with 2 spatial streams.

mcs10/2

Data rate for MCS index 10 with 2 spatial streams.

mcs11/2

Data rate for MCS index 11 with 2 spatial streams.

rates-11ac-ss34

Allowed data rates for 802.11ac/ax with 3 or 4 spatial streams.

option

-

Option

Description

mcs0/3

Data rate for MCS index 0 with 3 spatial streams.

mcs1/3

Data rate for MCS index 1 with 3 spatial streams.

mcs2/3

Data rate for MCS index 2 with 3 spatial streams.

mcs3/3

Data rate for MCS index 3 with 3 spatial streams.

mcs4/3

Data rate for MCS index 4 with 3 spatial streams.

mcs5/3

Data rate for MCS index 5 with 3 spatial streams.

mcs6/3

Data rate for MCS index 6 with 3 spatial streams.

mcs7/3

Data rate for MCS index 7 with 3 spatial streams.

mcs8/3

Data rate for MCS index 8 with 3 spatial streams.

mcs9/3

Data rate for MCS index 9 with 3 spatial streams.

mcs10/3

Data rate for MCS index 10 with 3 spatial streams.

mcs11/3

Data rate for MCS index 11 with 3 spatial streams.

mcs0/4

Data rate for MCS index 0 with 4 spatial streams.

mcs1/4

Data rate for MCS index 1 with 4 spatial streams.

mcs2/4

Data rate for MCS index 2 with 4 spatial streams.

mcs3/4

Data rate for MCS index 3 with 4 spatial streams.

mcs4/4

Data rate for MCS index 4 with 4 spatial streams.

mcs5/4

Data rate for MCS index 5 with 4 spatial streams.

mcs6/4

Data rate for MCS index 6 with 4 spatial streams.

mcs7/4

Data rate for MCS index 7 with 4 spatial streams.

mcs8/4

Data rate for MCS index 8 with 4 spatial streams.

mcs9/4

Data rate for MCS index 9 with 4 spatial streams.

mcs10/4

Data rate for MCS index 10 with 4 spatial streams.

mcs11/4

Data rate for MCS index 11 with 4 spatial streams.

utm-profile

UTM profile name.

string

Maximum length: 35

address-group

Address group ID.

string

Maximum length: 35

mac-filter

Enable/disable MAC filtering to block wireless clients by mac address.

option

-

Option

Description

enable

Enable MAC filtering.

disable

Disable MAC filtering.

mac-filter-policy-other

Allow or block clients with MAC addresses that are not in the filter list.

option

-

Option

Description

allow

Allow clients with MAC addresses that are not in the filter list.

deny

Block clients with MAC addresses that are not in the filter list.

config portal-message-overrides

Parameter

Description

Type

Size

auth-disclaimer-page

Override auth-disclaimer-page message with message from portal-message-overrides group.

string

Maximum length: 35

auth-reject-page

Override auth-reject-page message with message from portal-message-overrides group.

string

Maximum length: 35

auth-login-page

Override auth-login-page message with message from portal-message-overrides group.

string

Maximum length: 35

auth-login-failed-page

Override auth-login-failed-page message with message from portal-message-overrides group.

string

Maximum length: 35

config mpsk-key

Parameter

Description

Type

Size

passphrase

WPA Pre-shared key.

password

Not Specified

concurrent-clients

Number of clients that can connect using this pre-shared key.

string

Maximum length: 15

comment

Comment.

var-string

Maximum length: 255

mpsk-schedules <name>

Firewall schedule for MPSK passphrase. The passphrase will be effective only when at least one schedule is valid.

Schedule name.

string

Maximum length: 35

config vlan-pool

Parameter

Description

Type

Size

wtp-group

WTP group name.

string

Maximum length: 35

config mac-filter-list

Parameter

Description

Type

Size

mac

MAC address.

mac-address

Not Specified

mac-filter-policy

Deny or allow the client with this MAC address.

option

-

Option

Description

allow

Allow the client with this MAC address.

deny

Block the client with this MAC address.

config wireless-controller vap

Configure Virtual Access Points (VAPs).

config wireless-controller vap

Description: Configure Virtual Access Points (VAPs).

edit <name>

set fast-roaming [enable|disable]

set external-fast-roaming [enable|disable]

set mesh-backhaul [enable|disable]

set atf-weight {integer}

set max-clients {integer}

set max-clients-ap {integer}

set ssid {string}

set broadcast-ssid [enable|disable]

set security [open|captive-portal|...]

set pmf [disable|enable|...]

set pmf-assoc-comeback-timeout {integer}

set pmf-sa-query-retry-timeout {integer}

set okc [disable|enable]

set voice-enterprise [disable|enable]

set fast-bss-transition [disable|enable]

set ft-mobility-domain {integer}

set ft-r0-key-lifetime {integer}

set ft-over-ds [disable|enable]

set sae-groups {option1}, {option2}, ...

set owe-groups {option1}, {option2}, ...

set owe-transition [disable|enable]

set owe-transition-ssid {string}

set eapol-key-retries [disable|enable]

set tkip-counter-measure [enable|disable]

set external-web {string}

set external-web-format [auto-detect|no-query-string|...]

set external-logout {string}

set mac-auth-bypass [enable|disable]

set radius-mac-auth [enable|disable]

set radius-mac-auth-server {string}

set radius-mac-auth-usergroups <name1>, <name2>, ...

set auth [psk|radius|...]

set encrypt [TKIP|AES|...]

set keyindex {integer}

set key {password}

set passphrase {password}

set sae-password {password}

set radius-server {string}

set acct-interim-interval {integer}

set local-standalone [enable|disable]

set local-standalone-nat [enable|disable]

set ip {ipv4-classnet-host}

set dhcp-lease-time {integer}

set local-bridging [enable|disable]

set local-lan [allow|deny]

set local-authentication [enable|disable]

set usergroup <name1>, <name2>, ...

set portal-message-override-group {string}

config portal-message-overrides

Description: Individual message overrides.

set auth-disclaimer-page {string}

set auth-reject-page {string}

set auth-login-page {string}

set auth-login-failed-page {string}

end

set portal-type [auth|auth+disclaimer|...]

set selected-usergroups <name1>, <name2>, ...

set security-exempt-list {string}

set security-redirect-url {string}

set intra-vap-privacy [enable|disable]

set schedule <name1>, <name2>, ...

set ldpc [disable|rx|...]

set high-efficiency [enable|disable]

set target-wake-time [enable|disable]

set mpsk [enable|disable]

set mpsk-concurrent-clients {integer}

config mpsk-key

Description: List of multiple PSK entries.

edit <key-name>

set passphrase {password}

set concurrent-clients {string}

set comment {var-string}

set mpsk-schedules <name1>, <name2>, ...

next

end

set split-tunneling [enable|disable]

set vlanid {integer}

set vlan-auto [enable|disable]

set dynamic-vlan [enable|disable]

set captive-portal-radius-server {string}

set captive-portal-radius-secret {password}

set captive-portal-macauth-radius-server {string}

set captive-portal-macauth-radius-secret {password}

set captive-portal-ac-name {string}

set captive-portal-session-timeout-interval {integer}

set multicast-rate [0|6000|...]

set multicast-enhance [enable|disable]

set broadcast-suppression {option1}, {option2}, ...

set me-disable-thresh {integer}

set mu-mimo [enable|disable]

set probe-resp-suppression [enable|disable]

set probe-resp-threshold {string}

set radio-sensitivity [enable|disable]

set quarantine [enable|disable]

set radio-5g-threshold {string}

set radio-2g-threshold {string}

set vlan-pooling [wtp-group|round-robin|...]

config vlan-pool

Description: VLAN pool.

edit <id>

set wtp-group {string}

next

end

set dhcp-option82-insertion [enable|disable]

set dhcp-option82-circuit-id-insertion [style-1|style-2|...]

set dhcp-option82-remote-id-insertion [style-1|disable]

set ptk-rekey [enable|disable]

set ptk-rekey-intv {integer}

set gtk-rekey [enable|disable]

set gtk-rekey-intv {integer}

set eap-reauth [enable|disable]

set eap-reauth-intv {integer}

set qos-profile {string}

set hotspot20-profile {string}

set primary-wag-profile {string}

set secondary-wag-profile {string}

set tunnel-echo-interval {integer}

set tunnel-fallback-interval {integer}

set rates-11a {option1}, {option2}, ...

set rates-11bg {option1}, {option2}, ...

set rates-11n-ss12 {option1}, {option2}, ...

set rates-11n-ss34 {option1}, {option2}, ...

set rates-11ac-ss12 {option1}, {option2}, ...

set rates-11ac-ss34 {option1}, {option2}, ...

set utm-profile {string}

set address-group {string}

set mac-filter [enable|disable]

set mac-filter-policy-other [allow|deny]

config mac-filter-list

Description: Create a list of MAC addresses for MAC address filtering.

edit <id>

set mac {mac-address}

set mac-filter-policy [allow|deny]

next

end

next

end

config wireless-controller vap

Parameter

Description

Type

Size

fast-roaming

Enable/disable fast-roaming, or pre-authentication, where supported by clients .

option

-

Option

Description

enable

Enable fast-roaming, or pre-authentication.

disable

Disable fast-roaming, or pre-authentication.

external-fast-roaming

Enable/disable fast roaming or pre-authentication with external APs not managed by the FortiGate .

option

-

Option

Description

enable

Enable fast roaming or pre-authentication with external APs.

disable

Disable fast roaming or pre-authentication with external APs.

mesh-backhaul

Enable/disable using this VAP as a WiFi mesh backhaul . This entry is only available when security is set to a WPA type or open.

option

-

Option

Description

enable

Enable mesh backhaul.

disable

Disable mesh backhaul.

atf-weight

Airtime weight in percentage .

integer

Minimum value: 0 Maximum value: 100

max-clients

Maximum number of clients that can connect simultaneously to the VAP .

integer

Minimum value: 0 Maximum value: 4294967295

max-clients-ap

Maximum number of clients that can connect simultaneously to the VAP per AP radio .

integer

Minimum value: 0 Maximum value: 4294967295

ssid

IEEE 802.11 service set identifier (SSID) for the wireless interface. Users who wish to use the wireless network must configure their computers to access this SSID name.

string

Maximum length: 32

broadcast-ssid

Enable/disable broadcasting the SSID .

option

-

Option

Description

enable

Enable broadcasting the SSID.

disable

Disable broadcasting the SSID.

security

Security mode for the wireless interface .

option

-

Option

Description

open

Open.

captive-portal

Captive portal.

wep64

WEP 64-bit.

wep128

WEP 128-bit.

wpa-personal

WPA/WPA2 personal.

wpa-personal+captive-portal

WPA/WPA2 personal with captive portal.

wpa-enterprise

WPA/WPA2 enterprise.

wpa-only-personal

WPA personal.

wpa-only-personal+captive-portal

WPA personal with captive portal.

wpa-only-enterprise

WPA enterprise.

wpa2-only-personal

WPA2 personal.

wpa2-only-personal+captive-portal

WPA2 personal with captive portal.

wpa2-only-enterprise

WPA2 enterprise.

wpa3-enterprise

WPA3 enterprise.

wpa3-sae

WPA3 SAE.

wpa3-sae-transition

WPA3 SAE transition.

owe

Opportunistic wireless encryption.

osen

OSEN.

pmf

Protected Management Frames .

option

-

Option

Description

disable

Disable PMF completely.

enable

Enable PMF but deny clients without PMF.

optional

Enable PMF and allow clients without PMF.

pmf-assoc-comeback-timeout

Protected Management Frames .

integer

Minimum value: 1 Maximum value: 20

pmf-sa-query-retry-timeout

Protected Management Frames .

integer

Minimum value: 1 Maximum value: 5

okc

Enable/disable Opportunistic Key Caching .

option

-

Option

Description

disable

Disable Opportunistic Key Caching (OKC).

enable

Enable Opportunistic Key Caching (OKC).

voice-enterprise

Enable/disable 802.11k and 802.11v assisted Voice-Enterprise roaming .

option

-

Option

Description

disable

Disable 802.11k and 802.11v assisted Voice-Enterprise roaming.

enable

Enable 802.11k and 802.11v assisted Voice-Enterprise roaming.

fast-bss-transition

Enable/disable 802.11r Fast BSS Transition .

option

-

Option

Description

disable

Disable 802.11r Fast BSS Transition (FT).

enable

Enable 802.11r Fast BSS Transition (FT).

ft-mobility-domain

Mobility domain identifier in FT .

integer

Minimum value: 1 Maximum value: 65535

ft-r0-key-lifetime

Lifetime of the PMK-R0 key in FT, 1-65535 minutes.

integer

Minimum value: 1 Maximum value: 65535

ft-over-ds

Enable/disable FT over the Distribution System (DS).

option

-

Option

Description

disable

Disable FT over the Distribution System (DS).

enable

Enable FT over the Distribution System (DS).

sae-groups

SAE-Groups.

option

-

Option

Description

19

DH Group 19.

20

DH Group 20.

21

DH Group 21.

owe-groups

OWE-Groups.

option

-

Option

Description

19

DH Group 19.

20

DH Group 20.

21

DH Group 21.

owe-transition

Enable/disable OWE transition mode support.

option

-

Option

Description

disable

Disable OWE transition mode support.

enable

Enable OWE transition mode support.

owe-transition-ssid

OWE transition mode peer SSID.

string

Maximum length: 32

eapol-key-retries

Enable/disable retransmission of EAPOL-Key frames .

option

-

Option

Description

disable

Disable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2).

enable

Enable retransmission of EAPOL-Key frames (message 3/4 and group message 1/2).

tkip-counter-measure

Enable/disable TKIP counter measure.

option

-

Option

Description

enable

Enable TKIP counter measure.

disable

Disable TKIP counter measure.

external-web

URL of external authentication web server.

string

Maximum length: 127

external-web-format

URL query parameter detection .

option

-

Option

Description

auto-detect

Automatically detect if "external-web" URL has any query parameter.

no-query-string

"external-web" URL does not have any query parameter.

partial-query-string

"external-web" URL has some query parameters.

external-logout

URL of external authentication logout server.

string

Maximum length: 127

mac-auth-bypass

Enable/disable MAC authentication bypass.

option

-

Option

Description

enable

Enable MAC authentication bypass.

disable

Disable MAC authentication bypass.

radius-mac-auth

Enable/disable RADIUS-based MAC authentication of clients .

option

-

Option

Description

enable

Enable RADIUS-based MAC authentication.

disable

Disable RADIUS-based MAC authentication.

radius-mac-auth-server

RADIUS-based MAC authentication server.

string

Maximum length: 35

radius-mac-auth-usergroups <name>

Selective user groups that are permitted for RADIUS mac authentication.

User group name.

string

Maximum length: 79

auth

Authentication protocol.

option

-

Option

Description

psk

Use a single Pre-shard Key (PSK) to authenticate all users.

radius

Use a RADIUS server to authenticate clients.

usergroup

Use a firewall usergroup to authenticate clients.

encrypt

Encryption protocol to use (only available when security is set to a WPA type).

option

-

Option

Description

TKIP

Use TKIP encryption.

AES

Use AES encryption.

TKIP-AES

Use TKIP and AES encryption.

keyindex

WEP key index .

integer

Minimum value: 1 Maximum value: 4

key

WEP Key.

password

Not Specified

passphrase

WPA pre-shared key (PSK) to be used to authenticate WiFi users.

password

Not Specified

sae-password

WPA3 SAE password to be used to authenticate WiFi users.

password

Not Specified

radius-server

RADIUS server to be used to authenticate WiFi users.

string

Maximum length: 35

acct-interim-interval

WiFi RADIUS accounting interim interval .

integer

Minimum value: 60 Maximum value: 86400

local-standalone

Enable/disable AP local standalone .

option

-

Option

Description

enable

Enable AP local standalone.

disable

Disable AP local standalone.

local-standalone-nat

Enable/disable AP local standalone NAT mode.

option

-

Option

Description

enable

Enable AP local standalone NAT mode.

disable

Disable AP local standalone NAT mode.

ip

IP address and subnet mask for the local standalone NAT subnet.

ipv4-classnet-host

Not Specified

dhcp-lease-time

DHCP lease time in seconds for NAT IP address.

integer

Minimum value: 300 Maximum value: 8640000

local-bridging

Enable/disable bridging of wireless and Ethernet interfaces on the FortiAP .

option

-

Option

Description

enable

Enable AP local VAP to Ethernet bridging.

disable

Disable AP local VAP to Ethernet bridging.

local-lan

Allow/deny traffic destined for a Class A, B, or C private IP address .

option

-

Option

Description

allow

Allow traffic destined for a Class A, B, or C private IP address.

deny

Deny traffic destined for a Class A, B, or C private IP address.

local-authentication

Enable/disable AP local authentication.

option

-

Option

Description

enable

Enable AP local authentication.

disable

Disable AP local authentication.

usergroup <name>

Firewall user group to be used to authenticate WiFi users.

User group name.

string

Maximum length: 79

portal-message-override-group

Replacement message group for this VAP (only available when security is set to a captive portal type).

string

Maximum length: 35

portal-type

Captive portal functionality. Configure how the captive portal authenticates users and whether it includes a disclaimer.

option

-

Option

Description

auth

Portal for authentication.

auth+disclaimer

Portal for authentication and disclaimer.

disclaimer

Portal for disclaimer.

email-collect

Portal for email collection.

cmcc

Portal for CMCC.

cmcc-macauth

Portal for CMCC and MAC authentication.

auth-mac

Portal for authentication and MAC authentication.

external-auth

Portal for external portal authentication.

selected-usergroups <name>

Selective user groups that are permitted to authenticate.

User group name.

string

Maximum length: 79

security-exempt-list

Optional security exempt list for captive portal authentication.

string

Maximum length: 35

security-redirect-url

Optional URL for redirecting users after they pass captive portal authentication.

string

Maximum length: 127

intra-vap-privacy

Enable/disable blocking communication between clients on the same SSID .

option

-

Option

Description

enable

Enable intra-SSID privacy.

disable

Disable intra-SSID privacy.

schedule <name>

Firewall schedules for enabling this VAP on the FortiAP. This VAP will be enabled when at least one of the schedules is valid. Separate multiple schedule names with a space.

Schedule name.

string

Maximum length: 35

ldpc

VAP low-density parity-check (LDPC) coding configuration.

option

-

Option

Description

disable

Disable LDPC.

rx

Enable LDPC when receiving traffic.

tx

Enable LDPC when transmitting traffic.

rxtx

Enable LDPC when both receiving and transmitting traffic.

high-efficiency

Enable/disable 802.11ax high efficiency .

option

-

Option

Description

enable

Enable 802.11ax high efficiency.

disable

Disable 802.11ax high efficiency.

target-wake-time

Enable/disable 802.11ax target wake time .

option

-

Option

Description

enable

Enable 802.11ax target wake time.

disable

Disable 802.11ax target wake time.

mpsk

Enable/disable multiple PSK authentication.

option

-

Option

Description

enable

Enable multiple PSK authentication

disable

Disable multiple PSK authentication

mpsk-concurrent-clients

Maximum number of concurrent clients that connect using the same passphrase in multiple PSK authentication .

integer

Minimum value: 0 Maximum value: 65535

split-tunneling

Enable/disable split tunneling .

option

-

Option

Description

enable

Enable split tunneling.

disable

Disable split tunneling.

vlanid

Optional VLAN ID.

integer

Minimum value: 0 Maximum value: 4094

vlan-auto

Enable/disable automatic management of SSID VLAN interface.

option

-

Option

Description

enable

Enable automatic management of SSID VLAN interface.

disable

Disable automatic management of SSID VLAN interface.

dynamic-vlan

Enable/disable dynamic VLAN assignment.

option

-

Option

Description

enable

Enable dynamic VLAN assignment.

disable

Disable dynamic VLAN assignment.

captive-portal-radius-server

Captive portal RADIUS server domain name or IP address.

string

Maximum length: 63

captive-portal-radius-secret

Secret key to access the RADIUS server.

password

Not Specified

captive-portal-macauth-radius-server

Captive portal external RADIUS server domain name or IP address.

string

Maximum length: 63

captive-portal-macauth-radius-secret

Secret key to access the macauth RADIUS server.

password

Not Specified

captive-portal-ac-name

Local-bridging captive portal ac-name.

string

Maximum length: 35

captive-portal-session-timeout-interval

Session timeout interval .

integer

Minimum value: 0 Maximum value: 864000

multicast-rate

Multicast rate .

option

-

Option

Description

0

Use the default multicast rate.

6000

6 Mbps.

12000

12 Mbps.

24000

24 Mbps.

multicast-enhance

Enable/disable converting multicast to unicast to improve performance .

option

-

Option

Description

enable

Enable multicast enhancement.

disable

Disable multicast enhancement.

broadcast-suppression

Optional suppression of broadcast messages. For example, you can keep DHCP messages, ARP broadcasts, and so on off of the wireless network.

option

-

Option

Description

dhcp-up

Suppress broadcast uplink DHCP messages.

dhcp-down

Suppress broadcast downlink DHCP messages.

dhcp-starvation

Suppress broadcast DHCP starvation req messages.

dhcp-ucast

Convert downlink broadcast DHCP messages to unicast messages.

arp-known

Suppress broadcast ARP for known wireless clients.

arp-unknown

Suppress broadcast ARP for unknown wireless clients.

arp-reply

Suppress broadcast ARP reply from wireless clients.

arp-poison

Suppress ARP poison messages from wireless clients.

arp-proxy

Reply ARP requests for wireless clients as a proxy.

netbios-ns

Suppress NetBIOS name services packets with UDP port 137.

netbios-ds

Suppress NetBIOS datagram services packets with UDP port 138.

ipv6

Suppress IPv6 packets.

all-other-mc

Suppress all other multicast messages.

all-other-bc

Suppress all other broadcast messages.

me-disable-thresh

Disable multicast enhancement when this many clients are receiving multicast traffic.

integer

Minimum value: 2 Maximum value: 256

mu-mimo

Enable/disable Multi-user MIMO .

option

-

Option

Description

enable

Enable Multi-user MIMO.

disable

Disable Multi-user MIMO.

probe-resp-suppression

Enable/disable probe response suppression .

option

-

Option

Description

enable

Enable probe response suppression.

disable

Disable probe response suppression.

probe-resp-threshold

Minimum signal level/threshold in dBm required for the AP response to probe requests .

string

Maximum length: 7

radio-sensitivity

Enable/disable software radio sensitivity .

option

-

Option

Description

enable

Enable software radio sensitivity.

disable

Disable software radio sensitivity.

quarantine

Enable/disable station quarantine .

option

-

Option

Description

enable

Enable station quarantine.

disable

Disable station quarantine.

radio-5g-threshold

Minimum signal level/threshold in dBm required for the AP response to receive a packet in 5G band.

string

Maximum length: 7

radio-2g-threshold

Minimum signal level/threshold in dBm required for the AP response to receive a packet in 2.4G band .

string

Maximum length: 7

vlan-pooling

Enable/disable VLAN pooling, to allow grouping of multiple wireless controller VLANs into VLAN pools . When set to wtp-group, VLAN pooling occurs with VLAN assignment by wtp-group.

option

-

Option

Description

wtp-group

Enable VLAN pooling with VLAN assignment by wtp-group.

round-robin

Enable VLAN pooling with round-robin VLAN assignment.

hash

Enable VLAN pooling with hash-based VLAN assignment.

disable

Disable VLAN pooling.

dhcp-option82-insertion

Enable/disable DHCP option 82 insert .

option

-

Option

Description

enable

Enable DHCP option 82 insert.

disable

Disable DHCP option 82 insert.

dhcp-option82-circuit-id-insertion

Enable/disable DHCP option 82 circuit-id insert .

option

-

Option

Description

style-1

ASCII string composed of AP-MAC;SSID;SSID-TYPE. For example, "xx:xx:xx:xx:xx:xx;wifi;s".

style-2

ASCII string composed of AP-MAC. For example, "xx:xx:xx:xx:xx:xx".

disable

Disable DHCP option 82 circuit-id insert.

dhcp-option82-remote-id-insertion

Enable/disable DHCP option 82 remote-id insert .

option

-

Option

Description

style-1

ASCII string in the format "xx:xx:xx:xx:xx:xx" containing MAC address of client device.

disable

Disable DHCP option 82 remote-id insert.

ptk-rekey

Enable/disable PTK rekey for WPA-Enterprise security.

option

-

Option

Description

enable

Enable PTK rekey for WPA-Enterprise security.

disable

Disable PTK rekey for WPA-Enterprise security.

ptk-rekey-intv

PTK rekey interval .

integer

Minimum value: 1800 Maximum value: 864000

gtk-rekey

Enable/disable GTK rekey for WPA security.

option

-

Option

Description

enable

Enable GTK rekey for WPA security.

disable

Disable GTK rekey for WPA security.

gtk-rekey-intv

GTK rekey interval .

integer

Minimum value: 1800 Maximum value: 864000

eap-reauth

Enable/disable EAP re-authentication for WPA-Enterprise security.

option

-

Option

Description

enable

Enable EAP re-authentication for WPA-Enterprise security.

disable

Disable EAP re-authentication for WPA-Enterprise security.

eap-reauth-intv

EAP re-authentication interval .

integer

Minimum value: 1800 Maximum value: 864000

qos-profile

Quality of service profile name.

string

Maximum length: 35

hotspot20-profile

Hotspot 2.0 profile name.

string

Maximum length: 35

primary-wag-profile

Primary wireless access gateway profile name.

string

Maximum length: 35

secondary-wag-profile

Secondary wireless access gateway profile name.

string

Maximum length: 35

tunnel-echo-interval

The time interval to send echo to both primary and secondary tunnel peers .

integer

Minimum value: 1 Maximum value: 65535

tunnel-fallback-interval

The time interval for secondary tunnel to fall back to primary tunnel .

integer

Minimum value: 0 Maximum value: 65535

rates-11a

Allowed data rates for 802.11a.

option

-

Option

Description

1

1 Mbps supported rate.

1-basic

1 Mbps BSS basic rate.

2

2 Mbps supported rate.

2-basic

2 Mbps BSS basic rate.

5.5

5.5 Mbps supported rate.

5.5-basic

5.5 Mbps BSS basic rate.

11

11 Mbps supported rate.

11-basic

11 Mbps BSS basic rate.

6

6 Mbps supported rate.

6-basic

6 Mbps BSS basic rate.

9

9 Mbps supported rate.

9-basic

9 Mbps BSS basic rate.

12

12 Mbps supported rate.

12-basic

12 Mbps BSS basic rate.

18

18 Mbps supported rate.

18-basic

18 Mbps BSS basic rate.

24

24 Mbps supported rate.

24-basic

24 Mbps BSS basic rate.

36

36 Mbps supported rate.

36-basic

36 Mbps BSS basic rate.

48

48 Mbps supported rate.

48-basic

48 Mbps BSS basic rate.

54

54 Mbps supported rate.

54-basic

54 Mbps BSS basic rate.

rates-11bg

Allowed data rates for 802.11b/g.

option

-

Option

Description

1

1 Mbps supported rate.

1-basic

1 Mbps BSS basic rate.

2

2 Mbps supported rate.

2-basic

2 Mbps BSS basic rate.

5.5

5.5 Mbps supported rate.

5.5-basic

5.5 Mbps BSS basic rate.

11

11 Mbps supported rate.

11-basic

11 Mbps BSS basic rate.

6

6 Mbps supported rate.

6-basic

6 Mbps BSS basic rate.

9

9 Mbps supported rate.

9-basic

9 Mbps BSS basic rate.

12

12 Mbps supported rate.

12-basic

12 Mbps BSS basic rate.

18

18 Mbps supported rate.

18-basic

18 Mbps BSS basic rate.

24

24 Mbps supported rate.

24-basic

24 Mbps BSS basic rate.

36

36 Mbps supported rate.

36-basic

36 Mbps BSS basic rate.

48

48 Mbps supported rate.

48-basic

48 Mbps BSS basic rate.

54

54 Mbps supported rate.

54-basic

54 Mbps BSS basic rate.

rates-11n-ss12

Allowed data rates for 802.11n with 1 or 2 spatial streams.

option

-

Option

Description

mcs0/1

Data rate for MCS index 0 with 1 spatial stream.

mcs1/1

Data rate for MCS index 1 with 1 spatial stream.

mcs2/1

Data rate for MCS index 2 with 1 spatial stream.

mcs3/1

Data rate for MCS index 3 with 1 spatial stream.

mcs4/1

Data rate for MCS index 4 with 1 spatial stream.

mcs5/1

Data rate for MCS index 5 with 1 spatial stream.

mcs6/1

Data rate for MCS index 6 with 1 spatial stream.

mcs7/1

Data rate for MCS index 7 with 1 spatial stream.

mcs8/2

Data rate for MCS index 8 with 2 spatial streams.

mcs9/2

Data rate for MCS index 9 with 2 spatial streams.

mcs10/2

Data rate for MCS index 10 with 2 spatial streams.

mcs11/2

Data rate for MCS index 11 with 2 spatial streams.

mcs12/2

Data rate for MCS index 12 with 2 spatial streams.

mcs13/2

Data rate for MCS index 13 with 2 spatial streams.

mcs14/2

Data rate for MCS index 14 with 2 spatial streams.

mcs15/2

Data rate for MCS index 15 with 2 spatial streams.

rates-11n-ss34

Allowed data rates for 802.11n with 3 or 4 spatial streams.

option

-

Option

Description

mcs16/3

Data rate for MCS index 16 with 3 spatial streams.

mcs17/3

Data rate for MCS index 17 with 3 spatial streams.

mcs18/3

Data rate for MCS index 18 with 3 spatial streams.

mcs19/3

Data rate for MCS index 19 with 3 spatial streams.

mcs20/3

Data rate for MCS index 20 with 3 spatial streams.

mcs21/3

Data rate for MCS index 21 with 3 spatial streams.

mcs22/3

Data rate for MCS index 22 with 3 spatial streams.

mcs23/3

Data rate for MCS index 23 with 3 spatial streams.

mcs24/4

Data rate for MCS index 24 with 4 spatial streams.

mcs25/4

Data rate for MCS index 25 with 4 spatial streams.

mcs26/4

Data rate for MCS index 26 with 4 spatial streams.

mcs27/4

Data rate for MCS index 27 with 4 spatial streams.

mcs28/4

Data rate for MCS index 28 with 4 spatial streams.

mcs29/4

Data rate for MCS index 29 with 4 spatial streams.

mcs30/4

Data rate for MCS index 30 with 4 spatial streams.

mcs31/4

Data rate for MCS index 31 with 4 spatial streams.

rates-11ac-ss12

Allowed data rates for 802.11ac/ax with 1 or 2 spatial streams.

option

-

Option

Description

mcs0/1

Data rate for MCS index 0 with 1 spatial stream.

mcs1/1

Data rate for MCS index 1 with 1 spatial stream.

mcs2/1

Data rate for MCS index 2 with 1 spatial stream.

mcs3/1

Data rate for MCS index 3 with 1 spatial stream.

mcs4/1

Data rate for MCS index 4 with 1 spatial stream.

mcs5/1

Data rate for MCS index 5 with 1 spatial stream.

mcs6/1

Data rate for MCS index 6 with 1 spatial stream.

mcs7/1

Data rate for MCS index 7 with 1 spatial stream.

mcs8/1

Data rate for MCS index 8 with 1 spatial stream.

mcs9/1

Data rate for MCS index 9 with 1 spatial stream.

mcs10/1

Data rate for MCS index 10 with 1 spatial stream.

mcs11/1

Data rate for MCS index 11 with 1 spatial stream.

mcs0/2

Data rate for MCS index 0 with 2 spatial streams.

mcs1/2

Data rate for MCS index 1 with 2 spatial streams.

mcs2/2

Data rate for MCS index 2 with 2 spatial streams.

mcs3/2

Data rate for MCS index 3 with 2 spatial streams.

mcs4/2

Data rate for MCS index 4 with 2 spatial streams.

mcs5/2

Data rate for MCS index 5 with 2 spatial streams.

mcs6/2

Data rate for MCS index 6 with 2 spatial streams.

mcs7/2

Data rate for MCS index 7 with 2 spatial streams.

mcs8/2

Data rate for MCS index 8 with 2 spatial streams.

mcs9/2

Data rate for MCS index 9 with 2 spatial streams.

mcs10/2

Data rate for MCS index 10 with 2 spatial streams.

mcs11/2

Data rate for MCS index 11 with 2 spatial streams.

rates-11ac-ss34

Allowed data rates for 802.11ac/ax with 3 or 4 spatial streams.

option

-

Option

Description

mcs0/3

Data rate for MCS index 0 with 3 spatial streams.

mcs1/3

Data rate for MCS index 1 with 3 spatial streams.

mcs2/3

Data rate for MCS index 2 with 3 spatial streams.

mcs3/3

Data rate for MCS index 3 with 3 spatial streams.

mcs4/3

Data rate for MCS index 4 with 3 spatial streams.

mcs5/3

Data rate for MCS index 5 with 3 spatial streams.

mcs6/3

Data rate for MCS index 6 with 3 spatial streams.

mcs7/3

Data rate for MCS index 7 with 3 spatial streams.

mcs8/3

Data rate for MCS index 8 with 3 spatial streams.

mcs9/3

Data rate for MCS index 9 with 3 spatial streams.

mcs10/3

Data rate for MCS index 10 with 3 spatial streams.

mcs11/3

Data rate for MCS index 11 with 3 spatial streams.

mcs0/4

Data rate for MCS index 0 with 4 spatial streams.

mcs1/4

Data rate for MCS index 1 with 4 spatial streams.

mcs2/4

Data rate for MCS index 2 with 4 spatial streams.

mcs3/4

Data rate for MCS index 3 with 4 spatial streams.

mcs4/4

Data rate for MCS index 4 with 4 spatial streams.

mcs5/4

Data rate for MCS index 5 with 4 spatial streams.

mcs6/4

Data rate for MCS index 6 with 4 spatial streams.

mcs7/4

Data rate for MCS index 7 with 4 spatial streams.

mcs8/4

Data rate for MCS index 8 with 4 spatial streams.

mcs9/4

Data rate for MCS index 9 with 4 spatial streams.

mcs10/4

Data rate for MCS index 10 with 4 spatial streams.

mcs11/4

Data rate for MCS index 11 with 4 spatial streams.

utm-profile

UTM profile name.

string

Maximum length: 35

address-group

Address group ID.

string

Maximum length: 35

mac-filter

Enable/disable MAC filtering to block wireless clients by mac address.

option

-

Option

Description

enable

Enable MAC filtering.

disable

Disable MAC filtering.

mac-filter-policy-other

Allow or block clients with MAC addresses that are not in the filter list.

option

-

Option

Description

allow

Allow clients with MAC addresses that are not in the filter list.

deny

Block clients with MAC addresses that are not in the filter list.

config portal-message-overrides

Parameter

Description

Type

Size

auth-disclaimer-page

Override auth-disclaimer-page message with message from portal-message-overrides group.

string

Maximum length: 35

auth-reject-page

Override auth-reject-page message with message from portal-message-overrides group.

string

Maximum length: 35

auth-login-page

Override auth-login-page message with message from portal-message-overrides group.

string

Maximum length: 35

auth-login-failed-page

Override auth-login-failed-page message with message from portal-message-overrides group.

string

Maximum length: 35

config mpsk-key

Parameter

Description

Type

Size

passphrase

WPA Pre-shared key.

password

Not Specified

concurrent-clients

Number of clients that can connect using this pre-shared key.

string

Maximum length: 15

comment

Comment.

var-string

Maximum length: 255

mpsk-schedules <name>

Firewall schedule for MPSK passphrase. The passphrase will be effective only when at least one schedule is valid.

Schedule name.

string

Maximum length: 35

config vlan-pool

Parameter

Description

Type

Size

wtp-group

WTP group name.

string

Maximum length: 35

config mac-filter-list

Parameter

Description

Type

Size

mac

MAC address.

mac-address

Not Specified

mac-filter-policy

Deny or allow the client with this MAC address.

option

-

Option

Description

allow

Allow the client with this MAC address.

deny

Block the client with this MAC address.