New Member

Solved

Having issues with APs suddenly becoming slow and almost unresponsive

Forum|Forum|10 years ago
May 29, 2015
19 replies
85081 views

I have been fighting this for so long, I dont know what to do.

I have several sites running FGT and FAPs. Yesterday I made the desition to TFTP new firmware on all the FAPs and FGTs to see if a clean start can fix the problem. The thing is. The setup can work fine, and then all the sudden the speed is terrible. I go inside the FGT and check SNR and stuff like that and everything looks great, but it is not. Once this client had this problem and I tried to change a setting in the AP profile, and after that, poof everything was fine again.

Another client reboots the FAP when it is to slow and all the sudden everything is fine again. So it does seem to be something with the APs. But a user should have to do that.

Has anyone heard of these kind of problems. I have had so many clients having problems with the FAPs, I am att crossroad where I am seriously thinking about exchanging those and never look back. But that would be very expensive.

I spoke to some other IT guy and many of them say FAPs are ****. But I am really wondering. Is it that bad. What do you guys here on the forum think. Do you have setups with FAPs that are working great. How do you setup the FAPs.

For one thing, I noticed when I only run 5GHz on a SSID the handoff from AP to AP does not work. But if I turn on 2,4GHz it works. That seems weird. I also tried setting up different AP profiles for different APs in the same office so that I can choose band and stuff like that. As soon as I do that the users complain about lots of issues. So for now I am running everything very "auto" which I think is weird that I need to do with expensive APs like this.

Please do help out. Even if it is telling me, stay away from FAPs. But if you have a working setup with at least 3 or more APs, how does your AP profile look and things like that.

Thanks, I really hope we can solve this, or I will have a lot of APs to exchange... that will be a big hit for my company, Something I dont think I deserve since I am just trusting my distributor and selling a brand I that thought did proper products.

PS. All my clients are Mac users if that helps in some way.

Best answer by eyexmeetsxeye

I have been working with FortiAP's and Fortigates for the past 2.5 years. It has been trying to say the least. I have over 100 of the 222B line (outdoor models), paired with 100D, 140D, 80CM, and 90D's.

Before 5.0 build 86, completely broken. Daily/nightly resets to try to get people working. Build 86, mostly stable with weird quirks, usually reset about every week or two. After build 86 (the newest build 98), I reverted back to 86 based on TACs recommendation because everything ground to a halt no matter how many soft resets we did. I wouldn't touch the 5.2.X line with a 10 foot pole (I will maybe try it around 5.2.8 or so).

The problem is there are some things that work absolutely great and other things that completely break the platform.

Resource provisioning - Does not work. I love seeing all 10 of my APs on site boot up and stay on Channel 1

Mesh Backhaul - Works great over 5ghz

AP Quality - Is hit or miss. Some units will drop and need to be powercycled. One month with zero resets and the next month 5 resets. I have begun to doubt their manufacturing source.

Multiple SSIDs - Despite what they say, putting on more than a few will cause you a lot of problems

Signal strength - Great

Single SSID Handoff between APs - Usually pretty good. I have watched a tech walk around and literally jump to different APs as he walked. The only problems you get here is the actual device itself refusing to switch

Working with Controllers - CAPWAP usually works pretty spot on. I do like the ease of pairing it with units, although my main gripe is that a WIFI unit has to use a tunnel SSID versus most of your actual AP's will benefit from bridge mode

Captive Portal with 3rd party radius- Only works with 5.2.X line on Fortigate - See above about firmware

We haven't given up yet, but hope for one day a good firmware without horrible broken bugs in it. I would like to setup a hospitality site without having to worry. After reading this forum I will be trying a couple tweaks but mainly waiting for Fortinet to put some time and effort into their firmware.

rbnAuthor

New Member

No one any thoughts on this? I would love to hear I am wrong... but if I am not, its time I get to know that more people are having problems.

Tim

New Member

Hi, we were made aware of this post from Fortinet at end of March 2015 (don't know if it has been superseded and not sure of exact source to check) - but we are managing at least one customer running 5.2.3 on firewall but with 5.0.9 (downgraded from 5.2.2) on FAPs to resolve the kind of issue you describe. The downgrade can be performed via the firewall gui in one step:

"Until further notice DO NOT use any 5.2.x version in any of the 11n FAPs models with the exception of the very new models that don’t have builds in the 5.0.x branch.

If a customer is having issues in 5.2.2 in any 11n FAPs check the release notes for downgrade compatibility, if supported, downgrade to the recommended version below.

# For All deployments including Forticloud use 5.0.9 build 86 GA in these models:

FAP_112B, FAP_11C, FAP_14C, FAP_210B, FAP_220B FAP_221B, FAP_222B, FAP_223B, FAP_224D, FAP_25D, FAP_28C, FAP_320B, FK_214B

Alternatively if the above models are already running version 5.0.9 build 86 (GA) but the customer is still experiencing problems that could be related to ARP, DHCP, FAP rejoins and others please upgrade them to build 88.

# For all 11ac models and new FAP that don’t support 5.0.X in all deployment types use 5.2 build 229. These are the models:

FAP_112D, FAP_21D, FAP_221C, FAP_222C, FAP_223C, FAP_24D, FAP_320C, FAP_321C"

Tim

GISS (UK)

rbnAuthor

New Member

Thank you so much Tim for this info.

Lets hope this gets solved. I did have to downgrade a client (downgrade was not possible but I did put the firmware though TFTP back in there) and until now they have not called. So I hope they are not having these issues.

It is terrible that we dont get informed about this. I am a partner to Fortinet so I think they should send these things out, even if it is embarrassing to say this to your clients (unstable uppgrades always is), it is better we know this info and know how to solve the problem instead of the user having lots of issues and becoming very unhappy.

I still dont understand why one of my clients cannot have just 5GHz turned on and still get the handoff to work, so even if they have the new FAP221AC there are still problems with these new ones too.

Tim, what kind of problems did Fortinet say the 11n units had if they where on 5.2?

rbnAuthor

New Member

Still looking for more people... I now have a client complaining about the new 221C. They also have troubles with the wifi suddenly becoming very slow.

Is there no one else with problems, or do you not use FAPs at all? Really need to know if it is worth working on this, or if I just should give up and put som other brand with my clients (with my money, so of course not the greatest solution)

JohnK

New Member

I am running 3 FAP 221C's (5.2 build 0245) with a Fortigate 100D (5.2.5 build 701).

I experience these issues often. I have only had the hardware for 1 month, but I've tried messing with the channels and other settings (lower power, auto power, Radio Resource Provision, etc) to no avail. Things will be fine, and all of a sudden things come to a halt or move very slowly, then after waiting a minute or two, things speed up a bit. It's very intermittent. My SNR is somewhere between 26dB and 57dB. Any advice would be helpful.

Thanks, John

Tim

New Member

We have many customers with FAPs, two I can think of specifically - a school with about 14 and a marina with about 28 - neither of which are experiencing issues since we made sure they were all on firmware version recommended above. Our view is we always want to assist FortiNet in ironing out any bugs whenever possible (not surprising as most of our many customers have fortinet kit) - no manufacturer ever produces perfect product due to the ever increasing complexity of IT these days. We'd suggest opening a ticket with Fortinet and provided as much information as possible to assist in mutually tracking down the issue to do with this unique environment (every environment is unique in some way). If it seems there is not enough time to do this - then by all means switch manufacturers, with fingers crossed that whatever complexity is causing an issue for Fortinet does not repeat itself in new manufacturer. ;)

namitguy

New Member

I am experiencing exactly the same issues as you are - we have full signal strength but the we lose connectivity and see lots of random time-outs. Hardware platform is a Fortigate 240D A/P cluster (FortiOS 2.5.3) with FortiAP 221C's.

We have had cases open with TAC for more than a month and they have provided me with two interim builds (0234 and 0238) which have the improved the situation somewhat, but the issues are still such that we cannot put it in production.

The information in this thread is valuable, as this was not mentioned to me by TAC. I will log a new case and reference this.

rbnAuthor

New Member

Thanks for the feedback Tim. Happy to hear you have setups that work great. That gives me hope :)

namitguy: Not happy to hear you have the same issues, but it is nice to know this is not on me. We ben having so much problems on so many sites, you start to wonder if you do something wrong :)

I just opened a case so lets see what that gives me.... I will keep you posten.

In the meantime, any one reading this post, please do post, good or bad, everything helps!!

Johan_Witters

New Member

We've got lots of FAP deployed at customers, running all kinds of FOS... At the moment we have little or no trouble, and in most cases where we have issues it's related to client side drivers or Mac's.

We did have some issues in the past due to radio provisioning being enabled or the ap being used as sniffer. But these were bugs in earlier releases of FGT and FAP firmware.

I suggest that you check the FAP's when facing issues to check memory and CPU load. If these are high, try disabling radio provisioning and/or rogue scanning.

namitguy

New Member

wittersjohan wrote:
We've got lots of FAP deployed at customers, running all kinds of FOS... At the moment we have little or no trouble, and in most cases where we have issues it's related to client side drivers or Mac's.

We did have some issues in the past due to radio provisioning being enabled or the ap being used as sniffer. But these were bugs in earlier releases of FGT and FAP firmware.

I suggest that you check the FAP's when facing issues to check memory and CPU load. If these are high, try disabling radio provisioning and/or rogue scanning.

Thanks for the comments Johan. We're a Fortinet partner and have numerous FortiAP deployments running without a hitch, this is the first one where we're experiencing such widespread issues. You're comments re the memory and CPU load are certainly valid and was the first variables we excluded (as mentioned we spent about a month working with TAC on this).

The fact that Fortinet provided us with various (3 in total if I remember correctly) private interim builds seems indicative of a bug that they are aware of. I have re-opened my TAC case, I have also requested TAC provided clarity on which firmware build to run on the FAP221C platform. I will keep this thread updated with their feedback.

Johan_Witters

New Member

The number of interim builds does seem to indicate issues... could also be that they are free wheeling, offering possible fixes without knowing what's the issue and what's causing it..

Johan_Witters

New Member

I'm not a mac expert, but there are some issues in Mac OS, make sure your customers have the latest patches installed.

In general we have issues with macs and Iphones etc when using anything else than WPA/AES or portal authentication. Issues reported are slow connection, frequent disconnects, not able to connect etc.. According to what I've been able to find on the issue Apple has a different view on wireless security which causes some issues

rbnAuthor

New Member

wittersjohan wrote:
I'm not a mac expert, but there are some issues in Mac OS, make sure your customers have the latest patches installed.

In general we have issues with macs and Iphones etc when using anything else than WPA/AES or portal authentication. Issues reported are slow connection, frequent disconnects, not able to connect etc.. According to what I've been able to find on the issue Apple has a different view on wireless security which causes some issues

What do you mean by WPA/AES. Do you mean the standard WPA2 Personal setting, or was this was solved by choosing any other setting from the CLI?

Johan_Witters

New Member

rbn wrote:
What do you mean by WPA/AES. Do you mean the standard WPA2 Personal setting, or was this was solved by choosing any other setting from the CLI?

Yes, the default WPA(2)-PSK settings work in most cases. But I've had issues too with rogue detect and radio resource provisioning as well and had to disable it to get the macs stable.. Collegues used to configure TKIP, but that turned out to be a bad idea.

On the most recent builds I've got the impression the default settings work.

namitguy

New Member

Hi All,

TAC has provided me with interim build 0241, along with the following comments "I notice that the version provided by the previous engineer is 5.2.3 build 239. After that build, several issues have been fixed in that code trunk."

We have deployed this build now - will update on whether or not there's any improvent.

Mircea_Mitu

New Member

Any updates on this?

I also encounter the same issue on multiple sites especially with Apple devices (Macs and iPhones). There's no way to tell the customer that their devices are faulty because with other wifi solutions (especially Apple AirPort) are working just fine.

The symptoms are frequent temporary freezings of network connections. If I turn wifi off and on on a device, it works ok. I experienced this with FortiAP 221C and controllers ranging from 40C to 200D.

ruan.kotze wrote:
Hi All,

TAC has provided me with interim build 0241, along with the following comments "I notice that the version provided by the previous engineer is 5.2.3 build 239. After that build, several issues have been fixed in that code trunk."

We have deployed this build now - will update on whether or not there's any improvent.

gerardor

New Member

Hi i am also having the same issue with OS devices and fortiAPs.

I had tried all the solutions that are described in this thread with no solution.

The fact that annoys me is the fortinet's attitude, I really dont know why do they keep realising new FortiAP firmwares with new "features" when they simply cannot maintain a regular connection with OS devices and the fact that this known issue is never listed in theirs release notes annoys me more

I can confirm that the Ruckus AP's in conjunction with Fortigate works very well and dont have this issues. As everyone had stated before is so embarrassing telling our clients that the solution that supposedly is an enterprise solution had this kind of issues.

I hope that they release a definitive solution and not only a new firmware telling us to "prove it" I had a TAC open ticket with this issue with zero advance

Sorry for my poor english, i'm from Mexico. Gerardo Romero

Network Security Alliance gerardo.romero@networksecurityalliance.com

Show more replies

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded