+372 53 888 229info@itabiks.ee

FortiAP office Wi-Fi: step-by-step setup with FortiGate

How to manage FortiAP access points from FortiGate: authorising APs, staff and guest SSIDs, channels, transmit power and fixing the most common problems.

4 min

A FortiGate acts as the wireless controller itself, so FortiAP access points are managed from one place without a separate controller. In this guide you set up staff and guest Wi-Fi, choose channels and transmit power, and fix the most common problems. Menu names are based on FortiOS 7.x.

1. Connecting and authorising FortiAPs

  1. Connect the FortiAP to a PoE switch or a PoE injector. The FortiAP needs an address from DHCP.
  2. On the FortiGate interface the APs sit behind (Network → Interfaces), enable Security Fabric Connection under Administrative Access – this allows CAPWAP, the protocol APs use to talk to the controller. For a dedicated AP network you can set the interface addressing mode to Dedicated to FortiAP.
  3. Open WiFi & Switch Controller → Managed FortiAPs. After a few minutes the AP appears in the list. Right-click it and choose Authorize.
  4. Give each AP a clear name such as “AP-2nd-floor-meeting-room”, so it is easy to see later where a problem is.

2. Staff and guest SSIDs

SSIDs are created under WiFi & Switch Controller → SSIDs. A small office usually needs two:

  • Staff SSID – best is WPA2/WPA3-Enterprise, where each employee signs in with their own user account (through RADIUS, e.g. Microsoft Entra ID or a local server). When someone leaves, their account is disabled and there is no shared password to change. In a smaller office WPA2/WPA3-Personal (PSK) with a long passphrase is acceptable, but then the passphrase must be changed whenever someone leaves.
  • Guest SSID – its own subnet and DHCP (e.g. a tunnel-mode SSID, for which FortiGate creates a separate interface). The firewall policy (Policy & Objects → Firewall Policy) allows only internet access from the guest network, never the internal network. You can add a Captive Portal with terms of use if you like.

Do not add more SSIDs than you need – every extra SSID uses airtime and lowers throughput.

3. Channels, transmit power and placement

  • Channels – radio settings live in WiFi & Switch Controller → FortiAP Profiles. Enable automatic channel selection (Distributed Automatic Radio Resource Provisioning, DARRP) so FortiGate picks channels taking neighbouring interference into account. On 2.4 GHz use only channels 1, 6 and 11 with a narrow 20 MHz width. On 5 GHz, 20 or 40 MHz is usually sensible in an office.
  • Transmit power – “maximum” is not best. A loud AP attracts distant devices that cannot shout back, and devices stop roaming. Use automatic power control (Auto TX Power Control) or lower the power when there are many APs.
  • Placement – mount APs high on the ceiling or wall, in the middle of the area, not inside a cabinet or behind a metal box. Concrete walls and glass partitions weaken the signal a lot; several lower-power APs are better than one powerful one.
  • Roaming – all APs must broadcast the same SSID with the same security settings, then devices move between APs on their own. For calls, 802.11r/k/v support helps if the client devices support it.

4. Firmware

Keep FortiAP firmware compatible with the FortiGate’s FortiOS version – supported combinations are listed in the FortiAP Release Notes. You can upgrade by selecting the AP on the Managed FortiAPs page or together with the FortiGate upgrade in System → Firmware & Registration. Upgrade outside working hours because the AP reboots.

5. Common problems

  • AP does not appear in the list – check that the AP got a DHCP address and that CAPWAP (Security Fabric Connection) is enabled on the interface. If the AP is in a different subnet from the FortiGate, it cannot find the controller by broadcast; give it the controller address with DHCP option 138 or configure it statically on the AP. CAPWAP uses UDP ports 5246 and 5247 – they must not be blocked along the way.
  • AP reboots or the radio does not work – often a PoE issue. Check that the switch’s PoE budget (total watts) and the port standard (802.3af/at) meet the AP’s requirements.
  • Guests can see the internal network – review firewall policies: there must be no allow rule from the guest network to the internal network.
  • Poor speed – use the WiFi & Switch Controller monitors to check channel load and client signal strength; often the fix is an extra AP or a better location.

When to call a professional

If the office is large, spread over several floors or has thick walls, plan coverage before buying APs, because locations are hard to change afterwards. Enterprise authentication and RADIUS are also worth doing with a specialist. You can find suitable access points on the FortiAP page; for questions call +372 53 888 229.

Was this article helpful?