Technical Tip: How to collect logs and config to assist TAC in debugging issues on FortiAP WiFi

1. Provide the affected user's MAC address.
2. Approximate timestamp of the issue (this info will help review the relevant logs).
3. 'fap-tech' command output from the FortiAP CLI access as shown below: 

fap-tech  <----- Output contains details such as the FortiAP model, firmware version, SSIDs, radio settings, WiFi station stats, kernel crash, and crash records.

Navigate to FortiGate GUI, go under WiFi & Switch Controller -> Managed FortiAPs -> 'Right-Click' -> Connect to CLI  and type the 'fap-tech' command on the FortiAP CLI as shown below:

Note:

Connect to 'CLI' or 'SSH' access to the FortiAP works only when 'SSH' is enabled in the 'Operational Profiles' or 'FortiAP profile' as shown below:

     4. Collect the 'klog' from the FortiAP using CLI/SSH access. The klog contains ARP/Authentication/DHCP logs:

cfg -a ADMIN_TIMEOUT=0
cfg -c
klog

Duplicate the WiFi connectivity issue a couple of times while the klog is running, and then stop the log using Windows 'Ctrl+C' keys.

5. Collect 'don/ton' logs from the FortiAP CLI/SSH access. The don/ton logs contain CAPWAP cwWtpd daemon logs:

    

   cfg -a ADMIN_TIMEOUT=0
   cfg -c
   don
   ton

    

   After collecting the logs disable the logs:

    

   doff
   toff

   
   

    

6. Download and attach 'Logs' from the affected FortiAP by navigating to Diagnostics and Tools as shown below:

    

   

    

   

    

7. Download and attach 'WiFi Events' logs from the FortiGate GUI by navigating to Logs and Report -> System Events, select WiFi Events from the drop-down menu, and select Memory to download current logs as shown below:

    

   

    

8. Download and attach the latest FortiGate config backup to review the current wireless-controller config:

    

   

9. Download and attach the 'diagnose debug report' output from the FortiGate CLI to check if there's any wireless-daemon cw_acd crash record, CPU/Memory usage spikes on the FortiGate:
   
   
10. Refer to the following articles for the steps to collect FortiGate Wireless Station-logs and RADIUS wpad 7 debug logs on the FortiGate:
    • Collecting FortiGate station log for a wireless client when there is a VDOM Configured
    • Debugging RADIUS authentication issues on the FortiAP WiFi managed by FortiGate