Technical Tip: How to disable CAPWAP offloading for FortiAPs without disrupting wireless traffic

It is possible to disable FortiAP CAPWAP offloading globally on the FortiGate by running the following commands:

config system npu

    set capwap-offload disable

end

execute wireless-controller restart-acd

When the last command is run, all wireless traffic will be disrupted temporarily as the wireless daemon restarts. Instead, it is possible to disable the offloading by enabling DTLS encryption for the CAPWAP traffic on the FortiAP profile.

This will not disrupt traffic.

To apply this change, run the following commands:

config wireless-controller wtp-profile
    edit "profile-name"
        set dtls-policy dtls-enabled
    next
end

Note.

On NP7-based platforms, CAPWAP offloading is not supported for legacy FortiAP models. To address related issues, consider disabling CAPWAP offloading. Refer to the following document to verify which FortiAP models and firmware versions are compatible with NP7 CAPWAP offloading: capwap-offload {disable | enable}.