NSE6 Part 8: FortiAP Hardware, CAPWAP Discovery, and AP Provisioning

9 June 2026 NSE6Fortinet

The FCA-FAP exam begins with wireless fundamentals — not because Fortinet wants you to pass the CWNA, but because the exam questions about RF management, SSID security, and troubleshooting assume you understand what 802.11ax OFDMA actually changes compared to 802.11ac. Get the foundations right and the Fortinet-specific configuration makes sense; skip them and the “why” questions will catch you out.

Wi-Fi Standards — What the Exam Expects You to Know

The standards progression

StandardBandMax rate (theoretical)Key technology
802.11a5 GHz54 MbpsOFDM
802.11b2.4 GHz11 MbpsDSSS
802.11g2.4 GHz54 MbpsOFDM
802.11n (Wi-Fi 4)2.4/5 GHz600 MbpsMIMO, channel bonding
802.11ac (Wi-Fi 5)5 GHz only3.5 GbpsMU-MIMO downlink, 160 MHz
802.11ax (Wi-Fi 6)2.4/5 GHz9.6 GbpsOFDMA, MU-MIMO uplink+downlink, TWT, BSS Coloring
802.11ax (Wi-Fi 6E)6 GHz9.6 GbpsAdds 6 GHz band

Wi-Fi 6 (802.11ax) — exam-specific details

OFDMA (Orthogonal Frequency Division Multiple Access): Allows a single transmission to carry data for multiple clients simultaneously by dividing the channel into smaller sub-channels called Resource Units (RUs). Contrast with 802.11ac where the entire channel is used for one client at a time per transmission. OFDMA improves efficiency in dense deployments (many clients, small packets).

MU-MIMO uplink: 802.11ac introduced MU-MIMO for the downlink (AP → client). 802.11ax adds MU-MIMO for the uplink (client → AP), meaning multiple clients can transmit simultaneously.

BSS Coloring: Assigns a “color” value to each BSS (Basic Service Set). When an AP sees a frame, it checks the color. If the frame’s color is different (from a different network on the same channel), the AP can immediately determine it’s from a foreign BSS and handle it with less deferral, reducing co-channel interference overhead.

Target Wake Time (TWT): Clients negotiate when they will wake up to send/receive data. Dramatically reduces battery drain for IoT devices.

2.4 GHz vs 5 GHz tradeoff

Property2.4 GHz5 GHz
RangeLonger (lower frequency = less attenuation)Shorter
Obstacle penetrationBetterWorse
Non-overlapping channels3 (1, 6, 11)24 (20 MHz channels)
InterferenceHigh (Bluetooth, microwaves, legacy Wi-Fi)Lower
Max channel width40 MHz practical80/160 MHz

The exam implication: 2.4 GHz is congested in dense environments; 5 GHz is preferred for throughput but has shorter range. Band steering (Part 9) pushes dual-band clients to 5 GHz.

FortiAP Hardware Portfolio

Fortinet’s AP lineup is organised by use case:

Indoor APs

  • FAP-221E — dual-radio 2×2 MIMO, 802.11ac Wave 2. Entry office AP.
  • FAP-231F — dual-radio 2×2 Wi-Fi 6, 1 × 2.5G uplink port. Current standard office AP.
  • FAP-431F — dual-radio 4×4 Wi-Fi 6, 2 × 2.5G uplink ports. High-density conference rooms.
  • FAP-432F — tri-radio 4×4 Wi-Fi 6. The third radio can be dedicated to scanning (WIDS) or a second 5 GHz SSID.
  • FAP-U431F — dual 5 GHz Wi-Fi 6 (no 2.4 GHz radio), purpose-built for high-throughput 5 GHz-only deployments.

Outdoor APs

  • FAP-224E — IP67, 802.11ac, directional antenna options. Building-to-building bridging.
  • FAP-432F-E — IP67 Wi-Fi 6, outdoor enterprise.

Remote/OfficeExtender

  • FAP-U24JEV — Wi-Fi 6, designed for home office deployments; splits traffic between a local SSID and a CAPWAP tunnel back to HQ.

PoE requirements

  • 802.3af (PoE): 15.4W. Sufficient for older single-radio APs.
  • 802.3at (PoE+): 30W. Required for most current dual-radio APs at full power.
  • 802.3bt (PoE++): 60W/90W. Required for tri-radio APs or APs with heated outdoor enclosures.

Exam point: An AP will underclock its radios or disable one radio if the PoE budget is insufficient. If a deployed AP shows lower-than-expected throughput or is missing a radio in diagnose wireless-controller wlac -d ap, PoE budget on the switch port is a likely cause.

FortiGate as Wireless LAN Controller

FortiGate has a wireless LAN controller (WLC) built into FortiOS — no separate Wireless Controller appliance is needed. Every FortiGate model that supports FortiAP management includes the WLC functionality.

CAPWAP — Control and Provisioning of Wireless Access Points

CAPWAP (RFC 5415) is the protocol between the FortiGate WLC and FortiAP:

ChannelPort (UDP)Purpose
Control channel5246AP discovery, config push, keepalive
Data channel5247Encapsulated 802.11 frames (tunnel mode only)

In tunnel mode SSIDs, client data frames are encapsulated in CAPWAP and sent to FortiGate for policy inspection. In bridge mode SSIDs, client data is forwarded locally by the AP without going through FortiGate — the CAPWAP control channel still runs, but data plane traffic is local.

The FortiGate must allow CAPWAP on the interface facing the APs (UDP 5246/5247 must not be blocked).

AP Discovery Methods

An AP needs to find the FortiGate WLC before it can register. FortiAP tries these methods in order:

1. Layer 2 broadcast (same subnet)

FortiAP sends a CAPWAP Discovery Request as a broadcast. FortiGate on the same subnet responds with a Discovery Response containing its IP address. Works out of the box when the AP and FortiGate are on the same VLAN.

2. DHCP Option 138

The DHCP server can be configured to return the FortiGate WLC IP in DHCP option 138. The AP learns the WLC IP from its DHCP lease.

On FortiGate DHCP server config:

config system dhcp server
  edit 1
    set interface "fortilink"
    config options
      edit 1
        set code 138
        set type ip
        set ip 10.0.0.1     # FortiGate IP
      next
    end
  next
end

3. DNS lookup

FortiAP resolves fortiwlc and fortiwlc.local via DNS. If the DNS server resolves these names to the FortiGate management IP, the AP finds the WLC automatically.

Add DNS A records: fortiwlc → 10.0.0.1, fortiwlc.local → 10.0.0.1

4. Manual configuration (static AC list)

Configure the FortiGate IP directly on the AP (via console or through a FortiGate-managed AP before factory reset):

cfg -a AC_IPADDR_1=10.0.0.1
cfg -c

This is the fallback for complex networks where broadcast, DHCP opt 138, and DNS are not available.

WTP Profiles

A WTP (Wireless Termination Point) profile is the FortiGate object that defines the radio settings for an AP model. FortiGate auto-creates a default WTP profile for each AP model it discovers.

WiFi & Switch Controller > AP Profiles

Key fields per radio:

FieldNotes
Band2.4G, 5G, or 6G
Channel width20/40/80/160 MHz
ChannelAuto or manual. DFS channels require radar detection.
TX powerAuto or manual (in dBm)
ModeAP (normal) or Monitor (WIDS scanning)
Short GIShort guard interval — increases throughput ~11%
Protection modeCTS/RTS for mixed 802.11b/g environments
config wireless-controller wtp-profile
  edit "FAP-431F-profile"
    config radio-1
      set band 802.11ax-5G
      set channel-width 80MHz
      set channel auto
      set powersave-optimize auto
    end
    config radio-2
      set band 802.11ax-2G
      set channel-width 40MHz
    end
  next
end

AP Authorisation Workflow

  1. AP powers on and discovers the FortiGate.
  2. AP appears in WiFi & Switch Controller > Managed FortiAPs with status Pending (or Connected if auto-authorisation is on).
  3. Admin selects the AP and clicks Authorise (or FortiGate auto-authorises if the wildcard WTP profile allows it).
  4. FortiGate assigns a WTP profile and pushes initial configuration.
  5. AP status changes to Connected and begins broadcasting configured SSIDs.

Auto-authorisation: Enable per-WTP-profile. Any AP matching that profile model is automatically authorised. Convenient for large-scale rollouts; disable in production security-sensitive environments.

config wireless-controller wtp-profile
  edit "FAP-231F-profile"
    set allowaccess-mac-auto enable   # auto-authorise
  next
end

AP location and description

After authorising, add location info (floor plan coordinates, description) for the AP inventory:

config wireless-controller wtp
  edit "FAP231FTF00001"
    set name "Office-AP-Floor2-South"
    set location "Building A, Floor 2, South Wing"
    set region "GB"      # Country code — determines allowed channels
  next
end

The region/country code is critical — it determines which channels are legal and what the maximum EIRP is. Setting the wrong country code can mean the AP tries to use channels that are not permitted in the deployment country.

Firmware Management

# Check current firmware on all APs
diagnose wireless-controller wlac -d ap | grep "version\|name"

# Upgrade a specific AP (image must be on FortiGate)
execute wireless-manager ap-data upgrade <AP-serial> <image-file>

# Or from GUI: WiFi & Switch Controller > Managed FortiAPs > [AP] > Upgrade

FortiGate downloads the AP firmware image from FortiGuard if internet access is available, or you can upload it manually. The AP reboots after upgrade — clients on that AP disconnect momentarily.

Key Diagnostic Commands

# All APs and their status
diagnose wireless-controller wlac -d ap

# All connected stations (clients)
diagnose wireless-controller wlac -d sta

# AP CAPWAP tunnel details
diagnose wireless-controller wlac -d wtpv2 <ap-name>

# Radio stats (retries, signal quality per AP)
diagnose wireless-controller wlac -d radio

# FortiGate WLC process status
diagnose wireless-controller wlac -d server

Common Exam Scenarios

Q: A newly deployed FortiAP cannot be seen in the Managed FortiAPs list on FortiGate. A: Work through the discovery order. Is the AP on the same subnet as FortiGate? If not, is DHCP option 138 configured on the DHCP server? Is DNS resolving fortiwlc? Check diagnose wireless-controller wlac -d server to confirm the WLC is running. Also check firewall policy — UDP 5246 must be permitted from the AP management VLAN to FortiGate.

Q: An AP shows as Connected but only one radio is active. The AP model has two radios. A: Check PoE power on the FortiSwitch port. If the PoE budget is insufficient, the AP may disable one radio. Switch to a PoE+ port (802.3at, 30W). Also check the WTP profile — if the second radio band is set to disabled, that’s the cause.

Q: After changing the country code on FortiAP, some channels are no longer available. A: Expected. Some 5 GHz channels (DFS channels) are country-specific. In the UK (GB), channels 100–140 require DFS and radar avoidance. Auto channel selection will avoid them if a radar is detected during the channel availability check (CAC timer).