Troubleshooting Tip: Fixing sticky client issues on FortiAP WiFi connected to FortiGate

Description

This article describes how to fix sticky client issues on a FortiAP WiFi connected to FortiGate. 

Scope

FortiAP v6.4 and above.

Solution

The primary focus of an implementation with FortiAP connected to FortiGate is to maintain strong RSSI clients to connect to the nearest FortiAP. The higher the RSSI, the better the modulation the client can use, therefore leading to better performance overall. However, a good design must be performed before enabling 'sticky-client-remove'. This is because if there is a good design in place, there will be no need to de-authenticate Weak RSSI-based clients and deny connection to the SSID temporarily until the WiFi client RSSI signal strength improves.

Enabling 'sticky-client-remove' in wireless environments, where a good design and/or predictive survey has not been performed, is not recommended as it might create more unexpected disconnections. It is highly recommended to perform a correct predictive survey and design the RF environment according to each customer's coverage and capacity requirements. See Technical Tip: RF Design for Wireless networks for further details on how to perform a predictive survey and why it is important. A sticky client is a very common design issue as can be read here: Troubleshooting Tip: Common Wi-Fi tuning issues and how to contact Fortinet TAC for guidance.

If sticky-client-remove is enabled, the FortiAP will send a de-authentication frame to the client when the client's RSSI falls below the configured sticky-client-2g|5g|6g-threshold, and a FortiGate event log will be generated.

Default settings are:

• -79 dBm for 2.4GHz frequency.

• -76 dBm for 5GHz frequency.

• -76 dBm for 6GHz frequency.

The sticky client problem occurs if a client remains connected to a faraway FortiAP with a weaker signal (RSSI value). This results in degraded wireless network speed due to factors such as low data rate, interference, more airtime by sticky clients, etc.

Typical RSSI values:

Received Signal Strength Indicator (RSSI) is an estimated signal strength indicator on the WiFi client to tell how well a device can hear, detect, and receive signals from any Wireless Access Point. An RSSI closer to 0 is stronger, and closer to –100 is weaker.

Strong RSSI values range from -65 and above (for example, -50, -40 values and above values are considered stronger WiFi client signal strength values).

Weak RSSI values range: from -72 and below (for example, -75, -80, and below values are considered weaker WiFi client RSSI values).

This solution is to remove weak RSSI-based clients from the SSID. When the feature is enabled, the weak RSSI user will be de-authenticated and will not be accepted on the SSID until the WiFi client RSSI improves.

To configure sticky-client-remove in the CLI, run the following:

config wireless-controller vap
    edit <vap-name>
        set sticky-client-remove enable|disable
        set sticky-client-threshold-2g <minimum RSSI (dbm) required to maintain connection> (-95 to -20, default = -76)
        set sticky-client-threshold-5g <minimum RSSI (dbm) required to maintain connection> (-95 to -20, default = -76)
    end
end

Typically, the -70 to -76 RSSI threshold range is considered a safer value.

To check if the sticky client is enabled, run the following CLI command on the FortiAP:

vcfg | grep -ie Radio -ie "sticky client"

To verify if the client has been removed due to the sticky-client-remove feature, check the FortiGate or the FortiAP WiFi event logs. For example:

1: date=2020-xx-xx time=xx:xx:01 logid="0104043xx7" type="event" subtype="wireless" level="notice" vd="root" eventtime=158274114161xx1879 tz="-0800" logdesc="Wireless client denied" sn="FPxxxxxxx03" ap=" FPxxxxxxx03" vap="VAP_profile" ssid="SSID_Name " stamac="xx:xx:xx:xx:xx:xx" radioid=2 channel=100 security="WPA2 Personal" encryption="AES" action="client-denial" reason="STA denied on WTP due to low RSSI" msg="Client xx:xx:xx:xx:xx:xx denied due to low rssi. client rssi -85dBm, threshold rssi -76dBm" remotewtptime="1557.250156"

Run the following command on the FortiAP CLI to check the sticky client behavior in real-time:

klog | grep -ie RSSI -ie deauth

[ 856.477122] Client a6:c8:b4:40:c3:bf(avg RSSI=23, cnt=94) de-authed due to insufficient RSSI
[ 856.477139] [MLME] cpu1 vap-00(wlan00): [a6:c8:b4:40:c3:bf] wlan_mlme_deauth_request reason 1.

Press Ctrl + C at any time to stop the log prints.

Related documents:

• wireless-controller vap

• Advanced Wireless Features

• Technical Tip: How to collect logs and config to assist TAC in debugging issues on FortiAP WiFi

• Signal strength issues

• Technical Tip: Understanding the sticky client threshold behavior