Problems with WiFi FortiOS 7.4.5 and FAP sw 7.4.4

[nejcs]

We are having problems with WiFi after upgrade to 7.4.5 and 7.4.4. for FAP.

We are also running this on Fortinet switches, so misconfiguration of Vlans is highly unlikely. Also the vlan test on the AP is working fine. 

There are a few symptoms: 

- after restart, APs get their IP from DHCP on Fortigate, but later they disappear from DHCP table
- One SSID in bridge mode authenticates clients, they also get DHCP lease, but they can not even ping the gateway on Fortigate (Yes the Ping is ON on the interface)

This state is not permanent, and it looks like some of the APs are working even when this happens to others. 

I'm posting the problem here because Fortinet support starts with: "Did you switch it off and then on again?"

[Anthony_E]

Hello nejcs,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Hatibi]

Have you configured DHCP reservations in FortiGate for your APs?

If that is possible, try and set that up and then check if the issue still occurs for the APs. 

[nejcs]

I do not see how this could help solve the problem. Would you care to explain? 
I've configured the problematic SSID in Tunel mode, and now it works okay. 
APs are still disappearing from the DHCP table. Luckily, they do retain their IP, and connectivity seems to be okay. 

Please do not consider this problem solved. I would like to know why DHCP behaves as it does on Fortinet-only equipment. At the moment, out of 16 APs, only three are showing up in Dashboard/DHCP Clients. This is kind of scary if you consider Fortigate is supposed to be a network security device. 

[Hatibi]

Well, when you said the AP is dissapearing from DHCP table i presumed they were not retaining IP configuration.

- after restart, APs get their IP from DHCP on Fortigate, but later they disappear from DHCP table

You did not mention that the AP keeps its IP configuration. That is why i asked for DHCP reservation to see if that would resolve that.

So in this case the AP still shows as Online in the Managed FortiAP? The only problem is it is not visible in DHCP dashboard?

Are there any DHCP related events in Logs and Report -> System Events that maybe could be related to the time the entry is removed from the DHCP dashboard?

Check if the AP is listed with correct IP information in arp table in FGT:

get sys arp

If yes, then it looks like a GUI issue.

Not sure if this part would be directly related with the authenticated clients not able to ping gateway. 

You will need to debug dhcp in FGT and see if there is any error message or indication of issue:

diag debug reset
diag debug application dhcps -1
diag debug enable

Check also these articles:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Diagnosing-DHCP-on-a-FortiGate/ta-p/192960

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DHCP-address-leases-on-a-FortiGate/ta-p/19...