Problem receving DHCP fortiAP

[Soutienti]

Hello

I really have a strange problem. I have approximately 40 FortiAP, not all the same modele, but many is 231F.

I was up-to-date in the firmware version for my fortigate (501E) and my AP.

All is correct during few days or week. but after a time I have to reboot the FortiAp. the client never receive an ip from the dhcp. it's said connected without internet and I have an IP adress APIPA. I have many ssid, some are radius and other is wpa2. the wifi with wpa2 doesn't have the problem it's only the wifi with radius.

I check my server NPS I see the connection of the device, I see that the device receive the authorisation. but the device never receive the ip adress.

I use 2 differents DHCP one on the fortigate, the other was an windows 2019 server (not the same that the server NPS or DC).

I have the problem with both.

I reboot the AP and everyone can connect. but before all the device never receive an IP adress. it begins with one or 2 devices but quickly all the device wasn't able to receive an IP adress.

my dhcp lease is 4h, but the device always ask a new IP adress.

one person said

you should make sure to configure the fortigate wifi controller so that the AP change is supported without release/renew

I searched in this direction but found nothing.

Do you have any idea ? 

Thanks a lot

[AEK]

Hello

Check the following:

• DHCP pool may be full
• Check in FGT's traffic log if DHCP request are reaching DHCP server, and if DHCP server replies some bytes (sent received bytes)
• Has this issue started after firmware update on FGT or AP? If so, try downgrade and see

[ebilcari]

Since you are mentioning that only the SSID configured with RADIUS is affected it may be that the host is not put in the right VLAN after authentication. This could be the case if the SSID is configured for Dynamic VLAN assignment.

You can check the VLAN where the host resides directly on GUI, WiFi Controller>  WiFi Clients (if not present you can add the VLAN ID column)

or from CLI:

GW # diagnose wireless-controller wlac -c sta
-------------------------------STA    1----------------------------
STA mac              : 52:f4:dd:ea:38:21
...
    VLAN tag         : 0230 (560)

This part of the guide has also some useful t-shoot steps.

The mentioned feature I guess is Opportunistic Key Caching (OKC) that facilitates client roaming and remove the need of full EAP on each AP hopping.