Country/Region Mismatch under managed APs since upgrading to 6.2.2.

[James_G]

Since upgrading to FortiOS 6.2.2 on 80D I get "Country/Region Mismatch" warning under managed FortiAP. I am trying to set everything to GB, to that end I have changed config wireless-controller setting to "set country GB", and I have changed the FortiAP profile to "set ap-country GB" - this is on the FAP321C UK profile, but I still get the mismatch warning. Am I missing anything else, do I need to set GB elsewhere in config? Extract from my config below:

config wireless-controller setting set country GB set darrp-optimize-schedules "default-darrp-optimize" end

config wireless-controller wtp-profile edit "FAP321C UK" config platform set type 321C end set handoff-sta-thresh 30 set ap-country GB config radio-1 set band 802.11n set frequency-handoff enable set ap-handoff enable set vap-all disable set vaps "dsfeswfre" "wfewfew" "wfewfewg" set channel "1" "6" "11" end config radio-2 set band 802.11ac set vap-all disable set vaps "dsfeswfre" "wfewfew" "wfewfewg" set channel "36" "40" "44" "48" end next end

[Dave_Hall]

Confirm that the AP profiles in question are actually being used and/or referenced to.   During the firmware upgrade process, AP profiles may need to undergo a script conversion process that might result in a new profile name being tied to the AP(s) in question. 

[James_G]

Yes the profile is linked to the ap, and I created a new profile to check if that helped.

[Dave_Hall]

If you have configs saved on the 80D, if possible do a diff compare between the last know good configuration vs the current one - see what has changed. 

Also, certain page elements do not render well in al web browsers, so try making the changes in difference browsers.

[yzhang_FTNT]

What's the AP's RegCode? It can be checked with command fap-get-status from the AP's shell.

[dsghi]

I have the same situation happening with a FortiGate 61E and a FC24JE - It's managed and the default setting on the FortiGate wireless controller is United States. But health check shows poor, and the details say: US Country/Region Mismatch ... I assume it's a bug, so I'm going to open a ticket and see where this goes. It's not creating a problem, just annoying to see errors in the GUI... lol

[James_G]

Found this is because some of my older AP's have been shipped as US config, must be a legacy issue.

I connected to the AP via SSH and ran fap-get-status - this shows the AP is US region locked. To resolve this I changed the region in the AP profile to US and warning disappeared.

I can live with this, my newer access points all seem to be correctly configured to EU / GB.

[dsghi]

Ahh interesting, thanks for the reply. I must have the opposite situation, lol. Guess I've never ever paid attention to the country of the AP prior to this showing up as an alert. :)

[ede_pfau]

I would not igore an r/c conflict between controller and AP.

Reason is that these settings control which channels may be used, the output power etc. which all are subject to official, national or regional, regulation (law). Otherwise, e.g. broadcasting on US frequencies if located in EU may severely interrupt public services rightfully assigned to them, like police, fire brigade, RADAR/flight control or even DECT. Won't matter much to you, your WiFi will indeed work, but wireless is not confined to any site. Let's be thankful that there is some regulation on this subject.

Give support a call (web chat) and ask to reset the r/c settings. Kind of this stuff happended to me last week. In my case, using EU APs, I had successfully set the controller to region "AT" - but it didn't 'take'. You could see the setting but the controller wouldn't use the APs.

Support set the region to 'US', using a CLI command which needs a password (not disclosed), and back to 'International'. Then we were able to reselect the country code, and everything was shiny.

[James_G]

Ede,

I've manually restricted the available channels on the ap profile, so I'm good, no laws broken here :)

it's only one site that must have received a questionable batch (although source is a Fortinet partner).

Now I know I can live with this one.