Remote fortiap doesn't work

[echo]

Hello! Has anybody got working a fortiap in a remote office which has been registered over the ipsec tunnel?

I could easily register a fortiap 14c against a router over the tunnel, the ssid's really appear as configured (be it tunnel or bridged), but the PSK that I enter just doesn't work! I see logs in the wifi fortigate controller like this: "Previous authentication no longer valid", in the laptop I see logs like "Failure reason: The driver disconnected while associating." It happens quickly right after I try to connect, like if I enter a wrong psk. I have tried the normal and remote wtp-profile on the fortiap but that didn't make any difference. What can be wrong?

FortiOS on 100D where the ssid's are, is 5.2.1 and same version is on fortiap. Well, actually I downgraded the version to be the same with the router os version but later read from fortiap release notes that "downgrade is no supported" (5.2.1 and 5.2.2 both say that). What does that mean? Does it mean that if I downgrade the software, the device will be broken? Anyway, then I downgraded it even lower and then upgraded back to the router os version number, no help. Then I upgraded the software again to the version number that our office's router has, created a test bridged ssid (just like I also did in the remote router), registered it in fortigate and it all worked. So the device is not broken and can be used, but so far not as a remote ap. Thanks in advance!