FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ESCHAN_FTNT
Staff
Staff
Article Id 192293
Description
This article describes the advanced WiFi controller discovery.

There are six methods that a FortiAP unit can use to discover a WiFi controller.

Below is the list of AC discovery methods used in sequence, if the FortiAP's discovery type is set to auto:

1(static) → 2(dhcp) → 3(dns) → 7(forticloud) → 5(multicast) → 6(broadcast)

For every discovery type, FortiAP sends out discovery requests and sets a timer, an interval defined as a random number of seconds (between 2-180, default is 5 seconds), which is set via the CLI:
config wireless-controller timers
    set discovery-interval 5
end

After the timeout is reached, FortiAP sends out another discovery request, up to a maximum of 3 times.

After about 3 - 15 seconds, if FortiAP has no AC connection, it will switch to another discovery type and repeat the above process until the last one (broadcast) fails, which will lead to SULKING state.

After about 30 seconds, FortiAP will go into an AC_IP_DISCOVER state.

After the AC IP is found, it will go to IDLE state, and will eventually go to the DISCOVERY state, and repeat the above process again.

Note that while the process above is showcasing the auto discovery method, it's recommended to set the AC_DISCOVERY_TYPE to the used method in order to reduce downtime


Solution
Static IP configuration:

To specify the controller’s IP address on a FortiAP unit:
cfg –a AC_IPADDR_1="192.168.0.100"
To configure Static IP on AP:
cfg -a ADDR_MODE=STATIC
cfg –a AP_IPADDR="192.168.0.100"
cfg -a AP_NETMASK="255.255.255.0"
cfg –a IPGW=192.168.0.1
cfg -c


DHCP:

When configuring the DHCP server, configure Option 138 to specify the WiFi controller IP address.

Convert the address into hexadecimal. Convert each octet value separately from left to right and concatenate them. For example, 192.168.0.1 converts to C0A80001.

The following is the command to change the FortiAP DHCP option code. In this example, the command use option code 140:
cfg –a AC_DISCOVERY_DHCP_OPTION_CODE=140

DNS:

For the access point to do so, configure the DNS to return controller IP addresses in response.

Allow DNS lookup of the hostname configured in the AP by using the AP parameter "AC_HOSTNAME_1".


FortiCloud:

The access point can discover FortiCloud by doing a DNS lookup of the hardcoded FortiCloud AP controller hostname "apctrl1.fortinet.com".

The
FortiCloud AC discovery technique finds the AC info from apctl1.fortinet.com using HTTPS.

FortiCloud APController: apctrl1.fortinet.com:443 208.91.113.187:443


Multicast request:

The AP unit sends a multicast discovery request and the controller replies with a unicast discovery response message.

The AP and the controller do not need to be in the same broadcast domain if multicast routing is properly configured.

The default multicast destination address is 224.0.1.140. It can be changed through the CLI. The address must be same on the controller and AP.

To change the multicast address on the controller:
config wireless-controller global
    set discovery-mc-addr 224.0.1.250
end

To change the multicast address on a FortiAP unit:
cfg –a AC_DISCOVERY_MC_ADDR="224.0.1.250"

Broadcast request:

The AP unit broadcasts a discovery request message to the network and the controller replies.

The AP and the controller must be in the same broadcast domain. No configuration adjustments are required.



Contributors