FortiAP Wireless LAN Deployment and Management
Domain 3: FortiAP wireless LAN deployment and management
This domain tests FortiAP discovery, profiles, SSIDs, security, and traffic forwarding through the FortiGate wireless controller.
Core rules
- FortiAPs discover the controller by DHCP option 138, DNS, or broadcast. The AP must be authorized and have an assigned FortiAP profile.
- Tunnel mode sends client traffic to the FortiGate over CAPWAP; the SSID maps to a VLAN interface on the FortiGate. Bridge mode breaks traffic out locally at the AP and depends on the wired VLAN.
- SSID profiles define security (WPA2/WPA3 Personal or Enterprise), VLAN, captive portal, client limits, and DTLS. FortiAP profiles define radio band, channel width, transmit power, and Ethernet settings.
- WPA3-Enterprise uses 802.1X/RADIUS; WPA3-Personal uses SAE. 802.11k/v/r assist discovery and fast roaming, but client support varies.
- Country/region settings must match the deployment; incorrect regulatory settings can disable radios or violate spectrum rules.
Worked example
A corporate SSID must use WPA3-Enterprise with RADIUS, tunnel mode, and VLAN 30. Create the RADIUS server and user group on the FortiGate, create VLAN 30 on the FortiLink interface, and build an SSID profile with WPA3-Enterprise, VLAN 30, and tunnel forwarding. Attach it to a FortiAP profile with the correct bands and channels. Authorize the AP. The AP forms CAPWAP/DTLS, broadcasts the SSID, and proxies 802.1X to the FortiGate. A firewall policy from VLAN 30 to the internal network is still needed. If the SSID were bridged instead, VLAN 30 would need to be allowed on the AP's wired uplink.
Traps
- Using tunnel mode but forgetting the VLAN interface or policy on the FortiGate.
- Using bridge mode but not allowing the VLAN on the switch port.
- Forgetting AP authorization or assigning the wrong FortiAP profile.
- Mismatched country code, firmware, or WPA3 client capability.
- Assuming 802.11r is required for all roaming; it is optional and can break legacy clients.