FortiAP fragmentation issues

[cclg_support]

Hi all

I have a problem with the FortiAP 221E

I have a fleet of 50 FortiAPs on different networks interconnected in MPLS.
FortiAP management is done via a FortiGate 600E and a FortiManager
The FortiAps are all in 7.0.6
The FortiGate is in 7.0.11
The FortiManager is in 7.0.7

Here is the problem :

For some reason that I cannot identify, from time to time (on average one to two terminals per week), the terminal no longer responds to a ping with a packet size > 1500. Example ping –l 1800
When the problem occurs, I test the ping from the terminal's LAN, to rule out any MPLS fragmentation problem.
This makes the terminal unusable for customers (out of service captive portal, out of service PC authentication, etc.) anything that uses SSL no longer works. They therefore become unusable. On the other hand, a normal ping (< 1500) continues to work.

When this happens, I reboot the terminal (via the FortiManager or via the web interface of the terminal) and after restarting, the terminal is OK, the fragmentation is done well.
I tried different firmwares (from 7.0.5 to 7.2.2), it doesn't change anything.

BAUD_RATE:=9600

WTP_VERSION:=FortiAP-221E v7.0,build0108,230329 (GA)

FIRMWARE_UPGRADE:=0

FACTORY_RESET:=0

LOGIN_PASSWD_ENC:=xxxxxxxxxxxxxxxxxxxxxx

ADMIN_TIMEOUT:=5

WANLAN_MODE:=WAN-ONLY

AP_MODE:=0

STP_MODE:=0

AP_MGMT_VLAN_ID:=0

ADDR_MODE:=DHCP

AP_IPADDR:=192.168.1.2

AP_NETMASK:=255.255.255.0

IPGW:=192.168.1.1

DNS_SERVER:=208.91.112.53

ALLOW_HTTPS:=2

ALLOW_SSH:=2

AC_DISCOVERY_TYPE:=0

AC_IPADDR_1:=192.168.1.1

AC_IPADDR_2:=

AC_IPADDR_3:=

AC_HOSTNAME_1:=_capwap-control._udp.example.com

AC_HOSTNAME_2:=

AC_HOSTNAME_3:=

AC_DISCOVERY_MC_ADDR:=224.0.1.140

AC_DISCOVERY_DHCP_OPTION_CODE:=138

AC_DISCOVERY_FCLD_APCTRL:=

AC_DISCOVERY_FCLD_ID:=

AC_DISCOVERY_FCLD_PASSWD_ENC:=

AC_CTL_PORT:=5246

AP_DATA_CHAN_SEC:=clear,ipsec,dtls

BONJOUR_GW:=2

MESH_AP_TYPE:=0

LED_STATE:=2

WAN_1X_ENABLE:=0

WAN_1X_USERID:=

WAN_1X_PASSWD_ENC:=

WAN_1X_METHOD:=0

Here is the configuration of a terminal (they all have the same configuration)

have you encountered this problem before?

how to fix it?

Thanks for your help

[cclg_support]

Hi everyone

I've upgrade all my FortiAP to 7.2 (last build FP221E-v7.2-build0367) and all my other FortiProducts in 7.2 too (FortiGate, Manager, ...)

It's a nightmare.

I was having less than 5 AP on 80 having this problem daily (not always the same, perhaps 20 of the 80 where frequently having issues)

I've add a script on the FortiGate to reboot daily all the FortiAP.

Since upgrade to 7.2, i have more than 12 FortiAP to reboot daily.

The guide you've linked ebilcari, is not adapted. it's a solution for a client who have issues over CAPWAP due to fragmentation.

My probleme is the FortiAP fragmentation itself.

One of the consequense is the impossibility for the AP to speak with the Fortiget over SSL

[ebilcari]

The guide was suggested for jirikovoego and affects the user traffic received through WiFi, in your case the AP management traffic is affected. Did you follow up this issue with TAC support?
Does the CAPWAP tunnel stays up when this happens?

[jirikovoego]

I've upgraded to build 0367 and two weeks it seems fine. But I need more time for testing.

[jirikovoego]

Unfortunately, the issue is back. I tried change configuration you mention like this:

    edit The-FAP-Profile
        set ip-fragment-preventing tcp-mss-adjust
        set tun-mtu-uplink 1200
        set tun-mtu-downlink 1200
    end

No luck, after two weeks I'm not able work with packets longer, then 1414 :(

Edit: When this situation happened, I'm not ping longer data-size from FortiGate directly to FortiAP (via wire, the same network, no routers between).

Other APs, with same profile works fine.

[djulien]

Hi everyone
I still have problems in version FP221E-v7.2-build0367.

Fortinet asked me to test another firmware with an advanced (more verbose) debug mode in version FP221E-v7.2-build0337.
This version has, to date, not had any problems.
I have deployed it on 15 terminals for a month.
I also just tested the latest version in FP221E-v7.4-build0644 (7.4.4), with Fortigate in 7.2.
This version is also no longer a problem. It seems that Forti understood that there was a problem because in this version, they indicate that they have fixed a fragmentation bug. (BugID 0899796)