Well, this COULD HAVE BEEN the solution.Unfortunately the maximum number
of entry in config wireless-controller address is 256.256!That's a real
shame. I have more than 600 entries. A FortiGate 800D is not a toy,
neither it should be programmed as so...
https://docs.fortinet.com/document/fortigate/6.2.0/new-features/262899/wireless-mac-filter-updates
Maybe this new feature is the key Which actually makes more sense,
because with the previous solution everyone with a SSID WPA2-personal
password could...