FortiAP Offline in Fortigate Security Fabric

[fortimaster]

Hi all,

I've several FortiAp registered in FortilanCloud and all is working well. These APs are connected to Fortiswitch and Fortiswitch is connected to Fortigate.

These APs are connected to an interface with security fabric enable. If I check in Fortigate security fabric topology, I see all these APs connected but offline.I also see them offline if I check "managed FortiAp". 

It is possible to see the real state of these APs in Fortigate or is it not possible if they are registered in Fortilancloud? Why do they appear offline, is this a normal behaviour?

Thanks ¡¡

[saleha]

Hello fortimaster,

Thank you for reaching out. There are multiple possible reasons for this type of issues starting from whether the AP received an ip or if security fabric admin tool is enabled on the firewall interface. There systematic guide to troubleshooting this issue is found on the following article link:
https://community.fortinet.com/t5/FortiAP/Troubleshooting-Tip-FortiAP-Offline-Complete-Consolidated/...

Thank you,

saleha

[hbac]

Hi @fortimaster,

What is the firmware version of FortiGate and FortiAPs? Based on your description, FortiAPs are functioning but appear to be offline? 

Regards, 

[fortimaster]

Reading the link provided by Saleha I've found this:

"Make sure the AP is not discovered on the cloud, if AP is discovered on the cloud it will not come online on the FortiGate Firewall. Ask the customer for a cloud account or wcfg output, look for AC_DISCOVERY_TYPE".

hbac, 7.0.13. Yes, the APs are working but appear offline in fortigate, not in forticloud. I would like to know if it's possible to see them correctly in FG or if when they are discovered in Fortilancloud this is not possible.

[mle2802]

Hi @fortimaster,

On the switch port connected to those AP, what is the native vlan? Is those native vlan has DHCP and security fabric is enabled?

[fortimaster]

Hi @mle2802 ¡

On Fortiswitch ports with connected AP I have "set lldp-profile "default-auto-isl" enabled .

The AP is connected to the default Vlan. That Vlan have DHCP, and "Security fabric connection" enabled. On the firewall that Vlan is type "fortilink (vsw.fortilink) and belongs to "Fortilink interface". The DHCP pool for the APs, is not the same as the one used for Fortiswitches. Fortiswitches have addressing mode "Dedicated to Fortiswitch" (default network 164.224.1.1/24) in Fortilink interface. I attach you an image:

[adambomb1219]

NTP?

[fortimaster]

Fortigate and fortiswitches have NTP set.