FortiAP Issue

[dmourghen]

We have a Fortigate 80CM  with Wifi Controller, we created two SSID and when connecting to it, it works fine, however we wanted to extend the Wifi connection and we bought three FortiAP.  The three FortiAP were configured and place on the network however we get hell of problem because the wireless client can connect to it but cannot have access to internal network nor internet access.  We upgraded the firmware and yet still the same problem.  When we are connected to the AP, we can't even ping the DHCP created, Wifi Controller but we can still access and ping the FortiAP on the network.  

However what we noted is once we change the profile to Automatic it starts working again for sometime and stop again.

Would anyone have an idea how to troubleshoot this issue or have you ever come accross this issue?

The fortiAP is FAP210B

Thanks to advise.

[dmourghen]

Still no one has replied and support is unable to answer also...

[Bromont_FTNT]

So this problem is intermittent? If you reboot an AP instead of changing the profile does it fix the problem for a period of time? What firmware is running on those APs?

[dmourghen]

Yes while reboot or changing profile in both cases it starts to work back.

The AP Firmware is FortiAP-210B v5.2,build0262,160705

[Sumanth_FTNT]

Hi,

Can you please let us know the build on FGT80CM & also please let us know how is the AP connected to controller ports. Do you see same issue when any PC is connected to the same internal port of the FGT 80CM.

To troubleshoot

- Check if the issue is specific to Tunnel or Bridge vap

- can you please post the wtp-profile used in the setup & VAPs in use.

[dmourghen]

Build of FGT80CM: 

v5.2.8,build727 

AP is connected to switches on different floors.

All connections works fine on internally

We use Wireless to Tunnel and 

WTP Profile

            config radio-1

                set band 802.11n

                set darrp enable

                set frequency-handoff enable

                set ap-handoff enable

                set vaps "TSGROUP-OPEN" "wifi"

                set channel "1" "6" "11"

            end

            config radio-2

                set mode disabled

            end

    next

    edit "FAP220B-default"

        set ap-country ZA

            config radio-1

                set band 802.11n-5G

            end

            config radio-2

--More--                          set band 802.11n

            end

    next

    edit "11n-only"

            config platform

                set type 80CM-81CM

            end

        set ap-country ZA

            config radio-1

                set band 802.11n

            end

            config radio-2

                set mode disabled

            end

    next

    edit "Device Wifi"

            config platform

                set type 80CM-81CM

            end

        set ap-country US

            config radio-1

                set band 802.11n

                set vaps "TSGROUP-OPEN" "wifi"

                set channel "1" "6" "10"

--More--                      end

            config radio-2

                set mode disabled

            end

    next

end

VAP

config wireless-controller vap

    edit "wifi"

        set vdom "root"

        set ssid "TSGROUP-WIFI"

        set security wpa-personal

        set encrypt TKIP-AES

        set local-switching disable

        set passphrase ENC QaI9Aa7ehmv0nS2jAP6NvoknGw15WKpUDO4IcgfNiXpTOjiXiyPHQ9YPkGXRi0XZZluFzY+LvNYCyOXthvf19ESs7opv7bYzifpLOtmezWLk1zwvrcd9PuPzv3K8Y/GtStpH4WlZUm1UKDGWtSHkYVCjnC81JODqdpU/8+RixR8MOdTZbLzhL1aawtv6YXR6L/u7Nw==

    next

    edit "TSGROUP-OPEN"

        set vdom "root"

        set ssid "TSGROUP-OPEN"

        set security wpa-personal

        set encrypt TKIP-AES

        set local-switching disable

        set passphrase ENC ETMTeQ3bqKRc2bFtCFT8yETnsEvLc4SpsnjEpAptB26uVI77sURRz99vLrpgHQFCWJlsOH9bQESsYTUf/ac7O5+qF0MWEywY2ZZRbQ1n3oaTR+MdVNx0uFroEKLcDW7nsD5ygJpm1cOOO2AFc2Lb+RFtrzX5tN28Rrty9XMsFyCXULGZx9wrY1SWo0lkDdVLdY1EFQ==

    next

end

[Sumanth_FTNT]

Thanks,

Can you also give o/p from #sh system interface internal

sh sys switch-interface xxx

- Is the wireless interfaces added to software switch, like Tunnel vaps added to software switch interface ?

- Does all wireless clients get IP from same DHCP server ("TSGROUP-OPEN" "wifi")

- Is there a reason you are using wpa-personal over wpa2-only-personal.

[dmourghen]

config system interface

    edit "internal"

        set vdom "root"

        set ip 10.0.0.138 255.255.255.0

        set allowaccess ping https ssh fgfm capwap

        set vlanforward enable

        set type physical

        set device-identification enable

        set snmp-index 5

    next

end

We dont use software switch TSGroup Open and Wifi uses Tunnel to Wireless Controller

All Wireless client gets  DHCP ip from TSGROUP and wifi only

There is not specific reason over using wpa-personal over wpa2-only-personal. 

Thanks

[Sumanth_FTNT]

Thanks

- Is it possible to send us the FGT config. Is there a email id or TT number that we can access.

[dmourghen]

send me ur email i can send u full backup