It is not considered good practice to use a 'hidden' SSID because the beacon frame is sent with an empty SSID field by the FortiAP. With a sniffer, it is possible to capture the association request from devices that are going to connect, which must include this string. These frames, by their nature, are not encrypted and can be captured easily.
Additionally, this behavior is expected. In the situation of using a 'hidden' SSID, the only way clients can discover the network is to use active scanning, where the data of the 'hidden' SSID is visible. See Technical Tip: Wireless Roaming for more information.
For iOS, the use of hidden networks is completely discouraged. After some time, the device marks the network as inoperative and does not attempt to connect again. It will not detect the network because the beacon does not have the visible field. This is documented by the device manufacturer. See if the Mac device does not connect to the internet over Wi-Fi and Recommended settings for Wi-Fi routers and access points for more information.
Hiding the network name does not prevent it from being detected or protect it against unauthorized access. Due to the way devices search and connect to Wi-Fi networks, using a hidden network can expose information that can be used to identify users and the hidden networks used. To ensure secure access to the network, use the appropriate security settings. Also see Apple Platform Deployment Wi-Fi settings for more information.
When using active scanning, all machines send probes. This behavior is worse for enterprise wireless networks because of the number of wireless clients periodically advertising the non-broadcast network name. For example, in an enterprise wireless network that consists of 20 wireless APs and 500 wireless laptops, broadcasting APs periodically advertise the enterprise wireless network name only within the range of the wireless APs. If the wireless APs are configured as non-broadcast, each of the 500 laptops periodically advertises the enterprise wireless network name, regardless of its location. It will flood the RF environment with those frames.
See Non-broadcast Wireless Networks with Microsoft Windows for more information.
Hidden SSIDs usually delay the network connection time and affect network roaming performance. Their use is not recommended by Fortinet TAC in enterprise networks.
Consider using other security alternatives for users, such as 802.1X with WPA-Enterprise.
| 
