Technical Tip: WiFi clients cannot connect to the SSIDs after FortiAP firmware upgrade via FortiGate due to fsm-state "RUN + Image Downloading"

[vpatil]

Description	This article describes the case when WiFi clients cannot connect to the SSIDs after a FortiAP firmware upgrade via FortiGate due to fsm-state 'RUN + Image Downloading'.
Scope	FGT-100F v7.0.11, FAP-431F v7.2 build0318.
Solution	SSH into FortiAP CLI and verify if the 'wcfg' output shows 'RUN + Image Downloading' as shown below: wcfg fsm-state : RUN + Image Downloading 5435392/40576666 664 wtp-ip-addr : 10.0.X.1:5246 - 10.0.X.1:57720 ac-ip-addr : 10.0.X.62:5246 - 10.0.X.62:5247 MULTICAST base-mac : d4:76:a0:xx:xx:xx      2. This may occur when 'set image-download enable' on FortiGate as shown below. By default, the image-download option is enabled on FortiGate and it is enabled for FortiAP image download at join time: config global     config wireless-controller global         set image-download enable     end Config wireless controller global.      3. Temporarily disable 'set image-download enable' on FortiGate or on a specific FortiAP using the below commands on FortiGate CLI and reboot the affected AP: Image-download under Global: config global     config wireless-controller global         set image-download disable     end Image-download under specific FortiAP: config wireless-controller wtp     edit <FAP_Serial_Number>     set image-download disable end Technical Tip: Managed FortiAP Firmware upgrade from FortiGate.      4. Thereafter, verify 'wcfg' output on the FortiAP CLI should show fsm-state 'RUN' as shown below and then WiFi clients should connect fine to the SSIDs: fsm-state : RUN 92 wtp-ip-addr : 10.0.X.1:5246 - 10.0.X.1:57720 ac-ip-addr : 10.0.X.62:5246 - 10.0.X.62:5247 MULTICAST base-mac : d4:76:a0:xx:xx:xx