FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
mdeparisse_FTNT
Article Id 194989
Description
This article has been written for a specific environment located in Monaco, it is not intended to be used in other locations.  However, this script could be used internally in a lab environment.

For other sites, a fallback could be used that will allow the choice of the channel to be used when a pulse is detected.


While running in a virtual Cell environment, it is sometimes necessary to protect the DFS detection that trigger channel back off to avoid breaking the single channel infrastructure that allow seamless hand over.

The local regulation must be followed dependent upon location.

Europe: ETSI
http://www.etsi.org/deliver/etsi_en/301800_301899/301893/01.07.02_20/en_301893v010702a.pdf
US: FCC
https://apps.fcc.gov/edocs_public/attachmatch/FCC-13-22A1.pdf

Solution
To avoid such scenario, DFS protection needs to be turned on across the entire Virtual Cell radio's.

The following procedure can be used to verify DFS protection and protect the Virtual Cell environment.

Trigger a normal radar detection with fallback enable.

Config of AP 1 and 2 is shown in the following screenshots.

mdeparisse_FD40083_tn_FD40083-1.jpg

mdeparisse_FD40083_tn_FD40083-2.jpg

On AP 1 the fallback will take place on channel 44 for 30 minutes and on AP 2 the fallback will be activated for 40 minuntes on channel 40.
wifilab-ctrl(15)# date
Mon Jan  9 08:55:10 UTC 2017
wifilab-ctrl(15)# show ess-ap essid wifilab
2     AP-2            2       100     40           Up           0         00:0c:e6:22:0b:57
2     AP-2            1       6       6            Up           0         00:0c:e6:22:3a:8c
1     AP-1            2       100     44           Up           0         00:0c:e6:22:70:bf
1     AP-1            1       6       6            Up           0         00:0c:e6:22:3a:8c
        ESS-AP Configuration(4 entries)

After 30 minutes the AP 1 is going back on channel 100.
wifilab-ctrl(15)# show ess-ap essid wifilab
AP ID AP Name         IfIndex Channel Oper Channel Admin State  Max Calls BSSID
2     AP-2            2       100     40           Up           0         00:0c:e6:22:0b:57
2     AP-2            1       6       6            Up           0         00:0c:e6:22:3a:8c
1     AP-1            2       100     100          Up           0         00:0c:e6:22:95:65
1     AP-1            1       6       6            Up           0         00:0c:e6:22:3a:8c
        ESS-AP Configuration(4 entries)

After 40 minutes the AP 2 is going back on its original channel 100.
 wifilab-ctrl(15)# show ess-ap essid wifilab
2     AP-2            2       100     100          Up           0         00:0c:e6:22:18:dd
2     AP-2            1       6       6            Up           0         00:0c:e6:22:3a:8c
1     AP-1            2       100     100          Up           0         00:0c:e6:22:95:65
1     AP-1            1       6       6            Up           0         00:0c:e6:22:3a:8c
        ESS-AP Configuration(4 entries)

The VCELL area will now be protected, the idea is to load a protection script on the different radios that form the VCELL.
 “dev cmd radio1 dfs_test_mode on”.

mdeparisse_FD40083_tn_FD40083-3.jpg

DFS protection implemented on the entire VCELL (AP 1 and AP 2 in the following example):

mdeparisse_FD40083_tn_FD40083-4.jpg

Use Bulk Update to load the script on the VCELL AP's:

mdeparisse_FD40083_tn_FD40083-5.jpg

Double check the script loaded on the VCELL’s AP (The AP's need to be rebooted for the script to be loaded):
wifilab-ctrl(15)# show ap 1
AP Table
 AP ID                      : 1
AP Name                    : AP-1
MAC Address                : 00:0c:e6:1a:12:35
Uptime                     : 02d:19h:41m:34s
Location                   :
Building                   :
Floor                      :
Contact                    :
Operational State          : Enabled
Availability Status        : Online
Alarm State                : No Alarm
LED Mode                   : Normal
AP Init Script             : DFS_Protection.scr
Boot Image Version         : rev-0.5 (Aug
FPGA Version               :
Runtime Image Version      : 8.2-3-0
Connectivity Layer         : L3
Dataplane Encryption       : off
Parent MAC Address         : 00:00:00:00:00:00
Parent AP ID               : 0
Link Probing Duration      : 120
AP IP Address for L3       : 10.5.51.130
AP Model                   : AP832e
Hardware Revision          : Rev 1
Power Supply Type          : 802.3-at
AP Indoor/Outdoor type     : Indoor
KeepAlive Timeout(seconds) : 60
VLAN Name                  :

wifilab-ctrl(15)# show ap 2
AP Table
 AP ID                      : 2
AP Name                    : AP-2
MAC Address                : 00:0c:e6:1b:23:c7
Uptime                     : 02d:19h:41m:01s
Location                   :
Building                   :
Floor                      :
Contact                    :
Operational State          : Enabled
Availability Status        : Online
Alarm State                : No Alarm
LED Mode                   : Normal
AP Init Script             : DFS_Protection.scr
Boot Image Version         : rev-0.5 (Aug
FPGA Version               :
Runtime Image Version      : 8.2-3-0
Connectivity Layer         : L3
Dataplane Encryption       : off
Parent MAC Address         : 00:00:00:00:00:00
Parent AP ID               : 0
Link Probing Duration      : 120
AP IP Address for L3       : 10.5.51.130
AP Model                   : AP832i
Hardware Revision          : Rev 1
Power Supply Type          : 802.3-at
AP Indoor/Outdoor type     : Indoor
KeepAlive Timeout(seconds) : 60
VLAN Name                  :

Now trigger a radar pulse and check the fallback behavior on the Controller:
wifilab-ctrl(15)# show ess-ap essid wifilab

AP ID AP Name         IfIndex Channel Oper Channel Admin State  Max Calls BSSID
2     AP-2            2       100     100           Up           0         00:0c:e6:22:0b:57
2     AP-2            1       6       6            Up           0         00:0c:e6:22:3a:8c
1     AP-1            2       100     100          Up           0         00:0c:e6:22:95:65
1     AP-1            1       6       6            Up           0         00:0c:e6:22:3a:8c
        ESS-AP Configuration(4 entries)

It can be seen that the protection is working as expected and that the VCELL is not impacted.

Contributors