Whenever we restart the FortiGate the APs goes down . Secondary firewall comes up after restart later 5 min the primary firewall takes the Master role and up.
Firewall restart process takes only maximum of 5min. But the Ap's connected to it takes 40min to come online. APs are getting IP and i can able to access the portal and checked the state it says discovered the Access controller but no SSID or not up status in Fortigate.
I captured some traffic and checked that APs are not sending client Hello request to FG and only sending & receiving Keep Alive Control Data 5247 .
After 30-35 Min it sends client hello request then immediately joins the Fortigate.
After sometime i found the workout , we need to restart the AP after the restarting the firewall so that we don' have wait for 30-40 min to join. After restart AP immediately joins the Fortigate.
I have read on internet that FortiAP can goes to configurator mode it will exit after 30min automatically , i doubt that my APs are going Configurator mode after restarting the firewall.
Both Firewall & Forti AP are in same Firmware 7.2 , its not firmware related .
Prima-configuration wireless-controller timers config wireless-controller timers set echo-interval 100 set discovery-interval 5 set client-idle-timeout 300 set client-idle-rehome-timeout 20 set auth-timeout 5 set rogue-ap-log 0 set fake-ap-log 1 set rogue-ap-cleanup 0 set sta-stats-interval 1 set vap-stats-interval 15 set radio-stats-interval 15 set sta-capability-interval 30 set sta-locate-timer 1800 set ipsec-intf-cleanup 120 set ble-scan-report-intv 30 set drma-interval 60 end
show full-configuration wireless-controller global config wireless-controller global set name '' set location '' set image-download enable set max-retransmit 25 set control-message-offload ebp-frame aeroscout-tag ap-list sta-list sta-cap -list stats aeroscout-mu sta-health spectral-analysis set data-ethernet-II enable set link-aggregation disable set mesh-eth-type 8755 set fiapp-eth-type 5252 set discovery-mc-addr 188.8.131.52 set max-clients 0 set rogue-scan-mac-adjacency 7 set ipsec-base-ip 169.254.0.1 set wtp-share disable set tunnel-mode compatible set nac-interval 120 set ap-log-server disable end