FCP_FWF_AD-7.4 FCP - Secure Wireless LAN 7.4 Administrator Questions and Answers

Comprehensive Detailed Step by Step Explanation from all your Knowledge and Guides availableExhibit Analysis:

The screenshot displays two FortiAPs (FP231FT and FP23JFT) in the wireless controller’s managed APs list.

Both APs are online and connected via APs.

FP231FT shows active SSIDs (“All Tunnel Mode SSIDs”) and has 11 clients connected.

FP23JFT shows “N/A” for all SSIDs and “0” clients.

Diagnosis:

“N/A” for SSIDs on FP23JFT clearly indicates it is not broadcasting any SSID.

Both APs are running the same OS version and have their respective FortiAP profiles assigned.

Evaluating the Options:

A. Enable the radios on the FAP23JF FortiAP profile.

Correct: If the radios (2.4GHz/5GHz) are disabled in the FortiAP profile, the AP will not broadcast any SSID, resulting in “N/A” and “0 clients”. This is a common issue seen in FortiOS Wireless LAN management.

This matches the symptom, as the AP is online (communicating with the controller), but has no active radio (hence, no SSID is broadcasted).

B. Replace the FortiAP device model to match the other device.

Incorrect. FortiOS supports different models in the same deployment, as long as the correct profile is applied.

C. Disable the override setting on the FortiAP that is preventing it from broadcasting SSIDs.

Misleading. Unless an override has specifically disabled SSID broadcasting, this is not directly indicated by the screenshot. Usually, radio disabled at profile is the root cause.

D. Assign the FAP231F FortiAP profile to the problematic FortiAP device.

Incorrect. The correct profile (FAP23JF) is already assigned to FP23JFT; assigning a mismatched profile can cause more issues and is not best practice.

Guide Reference & Reasoning:

FortiOS Administration Guide – Wireless Section:

When an AP is online but SSIDs are not broadcasted and “N/A” appears for radio slots, it strongly points to the radios being disabled in the FortiAP profile (see Wireless Controller > Managed FortiAPs).

The guide explains that “If the radios are disabled in the profile, the AP will not broadcast any SSID. To resolve, enable the radios (2.4GHz, 5GHz) in the FortiAP profile and reapply or reboot the AP”.

FortiAP Profile Settings:

Go to WiFi & Switch Controller > FortiAP Profiles.

Edit the FAP23JF profile.

Check both “Radio 1” and “Radio 2” (enable if disabled).

Save the changes and ensure the profile is pushed to the AP.

Typical Steps to Fix:

Log into the FortiGate.

Navigate to WiFi & Switch Controller > FortiAP Profiles.

Edit the FAP23JF profile.

Under the radio settings, ensure both radios are set to “Enable”.

Apply the changes.

The AP will now broadcast the SSIDs as configured.

Summary:

The problem is caused by disabled radios in the FAP23JF FortiAP profile. Enabling the radios in the profile will allow the AP to start broadcasting SSIDs.

Final Answer: A. Enable the radios on the FAP23JF FortiAP profile.

Scenario:

The IT department wants to prevent direct communication between wireless stations.

There is one SSID configured in bridge mode (all clients on the same SSID/VLAN, directly bridging to the wired network).

Correct Action:

Block intra-SSID traffic (sometimes called “client isolation” or “intra-SSID privacy”).

This feature prevents wireless clients connected to the same SSID from communicating directly with each other at Layer 2.

Each station can reach the network but cannot reach other wireless clients on the same SSID.

This is the industry-standard method to achieve the stated security goal in a wireless environment, especially in bridge mode.

Why Other Options Are Incorrect:

A. Create unique SSIDs for each FortiAP device

Impractical and unnecessary for user isolation; users on the same SSID but different APs can still be isolated with intra-SSID blocking.

B. Add an upstream layer 3 device on each FortiAP device

Overkill and not required; this does not directly solve intra-SSID traffic.

D. Drop all local traffic in the wireless network

Too broad; you only want to prevent client-to-client communication, not all local traffic (such as traffic to the gateway).

Summary:

Block intra-SSID traffic is the intended and correct configuration to prevent wireless stations from communicating directly while sharing the same SSID in bridge mode.

Channel utilization directly measures how much airtime is consumed by wireless transmissions (including data, management, and interference).

Monitoring channel utilization helps optimize the network by:

Identifying congestion or over-utilized channels.

Allowing channel re-planning and SSID optimization.

The other options (AP firmware, event logs, user count) are helpful, but only channel utilization gives actionable insight for radio resource optimization.

When a FortiAP is directly cabled to a FortiGate interface, it sends out a broadcast CAPWAP discovery packet.

The FortiGate listens for these on its interfaces and then discovers/provisions the FortiAP automatically.

WPA3 introduces improvements over WPA2, most notably replacing the PSK (Pre-Shared Key) handshake with the Simultaneous Authentication of Equals (SAE) handshake.

The SAE handshake is resistant to key reinstallation attacks (KRACK) that affected WPA2.

WPA3 also improves security in open networks but does not force enterprise-only mode or universally block all legacy protocols, and 128-bit key size alone isn’t unique to WPA3.

Understanding the Requirement:The question asks how to find the upstream (client to AP) and downstream (AP to client) link rates for a wireless client connected to a FortiAP. This is often used to diagnose wireless client performance and link quality.

Option Analysis:

A. On the FortiGate GUI using the WiFi Client monitor

The WiFi Client monitor on the FortiGate GUI provides general info about connected clients such as IP address, MAC address, SSID, AP, and signal strength (RSSI/SNR), but it does not display the detailed link rates (upstream/downstream rates) for individual clients.

B. On the FortiAP CLI using the cw_diag ksta command

Correct.

The cw_diag ksta command is executed directly on the FortiAP’s CLI.

It shows detailed wireless client statistics, including both tx rate (downstream/AP to client) and rx rate (upstream/client to AP) for each connected client.

Example output:

FAP# cw_diag ksta

00:11:22:33:44:55 (vlan 0) RSSI:45 SNR:35 RX rate: 433Mbps TX rate: 144Mbps

These rates are the link rates negotiated between the client and the AP in both directions.

C. On the FortiGate CLI using the diagnose wireless-controller wlac -d sta command

This FortiGate CLI command provides some info about clients (e.g., connection state, signal), but does not directly show both upstream and downstream link rates.

D. On the FortiAP CLI using the cw_diag -d sea command

This command (cw_diag -d sea) is used for spectral analysis/debugging and does not provide per-client link rates.

Reference from Official Fortinet Documentation and Guides:

FortiOS Administration Guide (7.4):

The guide states that for detailed wireless client statistics, including negotiated rates, you must SSH into the FortiAP and run the cw_diag ksta command.

This provides a summary of all associated clients, their negotiated rates, and more.

Typical Workflow:

SSH into the FortiAP device.

Enter the command:

cw_diag ksta

Review the output. For each client, you will see RX and TX rates (these correspond to upstream and downstream link rates).

Why Not Other Options?

Only the FortiAP CLI with cw_diag ksta shows the negotiated link rates for each client in both directions.

The FortiGate GUI/CLI provides only summary info or signal statistics, not real-time link rates per client.

Summary:

To find the upstream and downstream link rates of a wireless client connected to a FortiAP, use the FortiAP CLI with the cw_diag ksta command.