FortiAnalyzer only shows FortiAP and WIFI clients using tunnel mode interfaces

Question

I've noticed a FortiAnalzyer 200D 5.4.4 only shows FortiAPs managed by a FortiGate that have tunnel mode interfaces. And even for those FAPs, it only shows wifi clients connected to the tunnel mode interfaces, not the local bridge interfaces.

So for one FortiGate (5.4.5) with two FAPs (5.4.3), it doesn't even show the FAP that only uses local bridge interfaces, or any of those wifi clients, even though both FAPs and all WIFI clients show up in the FGT's WIFI Monitor.

The FAZ also only shows the SSID's for the FGT that match to tunnel interfaces, not local bridge interfaces.

Is this a known issue? Any way to work around this? It's frustrating to only see a quarter of the wifi clients connected when looking at the FortiAnalyzer. Having to jump back to the FortiGate to see all wifi clients and events isn't a good option.

Thanks in advance for any pointers on this.

tanr · Answer

Looks like this has been broken since 5.2 and is still an issue in 5.6.

I've entered an NFR (New Feature Request) with Fortinet to have the FortiAnalyzer support showing all SSIDs, APs, and WiFi clients, regardless of whether they are tunneled or bridged.

FYI, to explain this in more detail, I've included a paraphrase of my feature request text below.

The feature request is to fix what I see as a pretty large oversight/bug in FortiAnalyzer’s FortiView. FAZ 5.4.4 does not show any non-tunnel wifi clients, SSIDs, or APs, while the FortiGate correctly shows them all. I’d like to see the FortiAnalyzer correctly show all the FortiGate’s APs, SSIDs, and WiFi Clients.

To see the current situation, consider two FortiAP’s managed by a single FortiGate, each handling a few SSIDs but only one FAP having SSID’s with tunnel mode interfaces (the other SSIDs being local bridge interfaces).

From the FortiGate I can look at:

WiFi & Switch Controller

[ul]

Managed FortiAPs[/ul]

Log & Report

[ul]

WiFi Events[/ul]

Monitor

[ul]

WiFi Client Monitor

Rogue AP Monitor

WiFi Health Monitor[/ul]

And I will see both FAPs, all the SSIDs, and all of the WiFi clients.

From the FortiAnalyzer, I will only see the following:

FortiView > WiFi

[ul]

Authorized APs –Only FAP with tunnel mode SSIDs is listed. The other FAP won’t even be visible.

Authorized SSIDs – Only SSIDs with tunnel mode listed. No other SSIDs (the majority) are shown.

WiFi Clients – Only wifi clients on tunneled SSID shown. So I see less than a quarter of the wifi clients.[/ul]

Since the FortiAnalyzer is the main face of the security fabric, this means that the primary way recommended to view the network doesn't show over half of the wifi clients or SSIDs.

My feature request is that the FortiAnalyzer correctly show APs, SSIDs, and WiFi clients for SSIDs that are locally bridged by the APs.

This may require a small bit of extra logging from the FortiGate, as I believe this issue is due to SSID info not being logged for bridged interfaces.

Until this is implemented, this should really be listed in the FortiAnalyzer release notes as a known issue.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded