Fabric Security Connectors Assistance Needed

[whozitsdad]

Morning.   Hopefully this will make sense.   We have 201F's running in HA (internet side).  We have 101F's running in HA on our lan side.   We use FortiAnalzyer.   The 201F is the root fabric, the 101F was originally in standalone mode.

I thought I would join the 101 (downstream) to the 201.  Followed the guide.  This attempt has completely messed up our access points.   They did appear in the 201 to authorize.  Sadly they all went offline in our  101 and for the life of me - I am at a standstill.  I need our AP's back online and not sure how to undo what I did.   I'd just like to get my 101F back to standalone and once again, manage the AP's from our  101.

Hope this makes sense.    

I did undo the fabric connector.   The Ap's still showed up on the 201.  Even if I deleted them, they showed up again.   And it appears, whatever took place reset our AP's.  Hostnames, evertying.

Any assistance, guidance, suggestions appreciated.

TIA

[Debbie_FTNT]

Hey whozitsdad,

I'm sorry to hear you faced such issues with security fabric and FortiAPs!

I'm by no means a FortiAP or Fabric expert, but it sounds a bit like the management of FortiAPs was taken over by the root FortiGate when you joined the 101F to the fabric. I did have a check through FortiAP documentation, but couldn't find if this is intentional or not.

Regarding restoring the previous functionality:

- If you have a configuration backup of your 101F from before you joined it to the fabric, restore that

- factory-reset the FortiAPs

https://community.fortinet.com/t5/FortiAP/Technical-Note-How-to-reset-the-default-configuration-on-F...

-> this should ensure they forget about the 201F and instead speak to the local 101F again

Aside from that, I would suggest opening a ticket with Fortinet Technical Support - we have a dedicated wireless team who should be able to tell you if that behavior (root FortiGate taking over FortiAP management) is intentional or not.

I hope this helps!

Debbie