Technical Note: How to reject CAPWAP discovery request coming from an unknown Access Point

[lpetit_FTNT]

Purpose

The purpose of this document is to explain how to reject CAPWAP discovery requests coming from an unknown AP.

Scope

By default, the FortiGate will reject unknown Access Points to be discovered by the Wireless Controller. However, an attacker could spoof some elements of the CAPWAP Discovery Request and make them reach a FortiGate. In this case, the unknown AP might appear in the list of "Managed FortiAP" from the Wifi Controller.

In order to make sure this unknown AP is not added to the list of Managed FortiAP, the solution is to create a local-in-policy and to deny this incoming CAPWAP request.

Expectations, Requirements
.
Configuration

A custom service must be configured for the CAPWAP discovery port:

config firewall service custom
    edit "CAPWAPCtrl"
        set udp-portrange 5246
    next
end

An IP address can be configured to block a specific source or range:

config firewall address
  edit "IPtoblock"
        set subnet 10.10.10.219 255.255.255.255

 next
end

Last step is to create a local-in-policy to avoid the FortiGate responding to the Discovery Request

config firewall local-in-policy
    edit 1
        set intf "internal"
        set srcaddr "IPtoblock"
        set dstaddr "all"
        set service "CAPWAPCtrl"
        set schedule "always"
    next
end
The default action is "deny"

It is also possible to block any traffic coming from on a specific interface:

config firewall local-in-policy
    edit 1
        set intf "internal"
        set srcaddr "all"
        set dstaddr "all"
        set service "CAPWAPCtrl"
        set schedule "always"
    next
end

Verification

Without the local-in-policy:

FGT60Cxxxxxxxxxx # diagnose sniffer packet any "port 5246" 4
interfaces=[any]
filters=[port 5246]
32.318290 internal in 10.10.10.219.5246 -> 10.10.10.25.5246: udp 234
32.319864 internal out 10.10.10.25.5246 -> 10.10.10.219.5246: udp 138     ---> the FortiGate responds to the Discovery request and adds the AP to the Managed FortiAP list

With the local-in-policy:

99.317608 internal in 10.10.10.219.5246 -> 10.10.10.25.5246: udp 234
100.317569 internal in 10.10.10.219.5246 -> 10.10.10.25.5246: udp 234
102.317553 internal in 10.10.10.219.5246 -> 10.10.10.25.5246: udp 234
The FortiGate does not respond to the AP discovery requests.