FAP11C - Can I disable LAN port?

[rmon]

Helllo! I have a FAP11C that I would like to deploy remotely and will provide the WPA2 key to authorized users but do not want anyone plugging directly into the LAN port after hours or when no one is around. Is it possible to somehow just disable the LAN port? If not, what would be the best way to prevent users from actually pulling an IP by plugging directly into it? I have set up with 90D POE and both the 90D and FAP11c are running 5.2 It seems when I do plug directly into the LAN, it issues a 192.168.99.x address which is the main subnet of the fortigate itself and dont think thats a very good thing. Thanks in advance for any suggestions. RMON

[rwdorman]

Is there a reason that you have DHCP server turned on on the Fortigate for that subnet? (maybe that' s what your wired clients use). I see two options 1. If your switches support it you can put a MAC filter on the port so that it wont give L2 access to anythign that isn' t that MAC 2. Define a VLAN or Physical interface just for your FortiAP' s and then do DHCP reservations on the Fortigate or Static IP' s on the FAP

[Dave_Hall]

I think rmon is referring to the LAN port on the FAP11C itself, which according to the hardware manual is " currently not supported" , but I understand that a recent firmware upgrade has " enabled" this port. I am not familiar with this AP but I would suggest just logging into it (either HTTP/S, SSH or USB MGMT) and checking to see if there are any " interface" settings that allows you to disable that LAN port.

[yzhang_FTNT]

what' s the output from the FAP11C? brctl cw_diag -c wtp-cfg

[Bromont_FTNT]

Are you not able to set the LAN port to " NONE" ?

[Dave_Hall]

The Wireless Deployment Handbook indicates the LAN port (bridge) setting are configured in wtp profile....I would assume you can somehow disable it from there.