Fortinet black logo

Handbook

FortiAP CLI

6.0.0
Copy Link
Copy Doc ID 4afb0436-a998-11e9-81a4-00505692583a:65088
Download PDF

FortiAP CLI

The FortiAP CLI controls radio and network operations through the use of variables manipulated with the cfg command. There are also diagnostic commands.

The cfg command includes:

cfg -s

List variables.

cfg -a var=value

Add or change a variable value.

cfg -c

Commit the change to flash.

cfg -x

Reset settings to factory defaults.

cfg -r var

Remove variable.

cfg -e

Export variables.

cfg -h

Display help for all commands.

The configuration variables are:

Var

Description and Values

AC_CTL_PORT

WiFi Controller control (CAPWAP) port. Default 5246.

AC_DATA_CHAN_SEC

Data channel security.

0 - Clear text

1 - DTLS (encrypted)

2 - Accept either DTLS or clear text (default)

AC_DISCOVERY_TYPE

1 - Static. Specify WiFi Controllers

2 - DHCP

3 - DNS

5 - Broadcast

6 - Multicast

0 - Cycle through all of the discovery types until successful.

AP_IPADDR
AP_NETMASK
IPGW

These variables set the FortiAP unit IP address, netmask and default gateway when ADDR_MODE is STATIC.

Default 192.168.1.2 255.255.255.0, gateway 192.168.1.1.

AC_HOSTNAME_1
AC_HOSTNAME_2
AC_HOSTNAME_3

WiFi Controller host names for static discovery.

AC_IPADDR_1
AC_IPADDR_2
AC_IPADDR_3

WiFi Controller IP addresses for static discovery.

AC_DISCOVERY_DHCP_OPTION_CODE

Option code for DHCP server. Default 138.

AC_DISCOVERY_MC_ADDR

Multicast address for controller discovery. Default 224.0.1.140.

ADDR_MODE

How the FortiAP unit obtains its IP address and netmask.

DHCP - FortiGate interface assigns address.

STATIC - Specify in AP_IPADDR and AP_NETMASK.

Default is DHCP.

ADMIN_TIMEOUT

Administrative timeout in minutes. Applies to Telnet and GUI sessions. Default is 5 minutes.

AP_MGMT_VLAN_ID

Non-zero value applies VLAN ID for unit management. Default: 0.

AP_MODE

FortiAP operating mode.

0 - Thin AP (default)

2 - Unmanaged Site Survey mode. See SURVEY variables.

BAUD_RATE

Console data rate: 9600, 19200, 38400, 57600, or 115200 baud.

DNS_SERVER

DNS Server for clients. If ADDR_MODE is DHCP the DNS server is automatically assigned.

FIRMWARE_UPGRADE

Default is 0.

HTTP_ALLOW

Access to FortiAP GUI
1 - Yes (default), 0 - No.

LED_STATE

Enable/disable status LEDs.
0 - LEDs enabled, 1 - LEDs disabled, 2 - follow AC setting.

LOGIN_PASSWD

Administrator login password. By default this is empty.

STP_MODE

Spanning Tree Protocol. 0 is off. 1 is on.

TELNET_ALLOW

By default (value 0), Telnet access is closed when the FortiAP unit is authorized. Set value to 1 to keep Telnet always available.

WTP_LOCATION

Optional string describing AP location.

Mesh variables

MESH_AP_BGSCAN

Enable or disable background mesh root AP scan.

0 - Disabled

1 - Enabled

MESH_AP_BGSCAN_RSSI

If the root AP's signal is weak, and lower than the received signal strength indicator (RSSI) threshold, the WiFi driver will immediately start a new round scan and ignore the configured MESH_AP_BGSCAN_PERIOD delays. Set the value between 0-127.

After the new round scan is finished, a scan done event is passed to wtp daemon to trigger roaming.

MESH_AP_BGSCAN_PERIOD

Time in seconds that a delay period occurs between scans. Set the value between 1-3600.

MESH_AP_BGSCAN_IDLE

Time in milliseconds. Set the value between 0-1000.

MESH_AP_BGSCAN_INTV

Time in milliseconds between channel scans. Set the value between 200-16000.

MESH_AP_BGSCAN_DUR

Time in milliseconds that the radio will continue scanning the channel. Set the value between 10-200.

MESH_AP_SCANCHANLIST

Specify those channels to be scanned.

MESH_AP_TYPE

Type of communication for backhaul to controller:

0 - Ethernet (default)

1 - WiFi mesh

2 - Ethernet with mesh backup support

MESH_AP_SSID

SSID for mesh backhaul. Default: fortinet.mesh.root

MESH_AP_BSSID

WiFi MAC address

MESH_AP_PASSWD

Pre-shared key for mesh backhaul.

MESH_ETH_BRIDGE

1 - Bridge mesh WiFi SSID to FortiAP Ethernet port. This can be used for point-to-point bridge configuration. This is available only when MESH_AP_TYPE =1.

0 - No WiFi-Ethernet bridge (default).

MESH_MAX_HOPS

Maximum number of times packets can be passed from node to node on the mesh. Default is 4.

The following factors are summed and the FortiAP associates with the lowest scoring mesh AP.

MESH_SCORE_HOP_WEIGHT

Multiplier for number of mesh hops from root. Default 50.

MESH_SCORE_CHAN_WEIGHT

AP total RSSI multiplier. Default 1.

MESH_SCORE_RATE_WEIGHT

Beacon data rate multiplier. Default 1.

MESH_SCORE_BAND_WEIGHT

Band weight (0 for 2.4GHz, 1 for 5GHz) multiplier. Default 100.

MESH_SCORE_RSSI_WEIGHT

AP channel RSSI multiplier. Default 100.

Survey variables

SURVEY_SSID

SSID to broadcast in site survey mode (AP_MODE=2).

SURVEY_TX_POWER

Transmitter power in site survey mode (AP_MODE=2).

SURVEY_CH_24

Site survey transmit channel for the 2.4Ghz band (default 6).

SURVEY_CH_50

Site survey transmit channel for the 5Ghz band (default 36).

SURVEY_BEACON_INTV

Site survey beacon interval. Default 100msec.

note icon

Previously, FortiAP accepted Telnet and HTTP connection to any virtual interfaces that have an IP address. For security reasons, Telnet and HTTP access are now limited to br0 or br.vlan for AP_MGMT_VLAN_ID.

Diagnose commands include:

cw_diag help

Display help for all diagnose commands.

cw_diag uptime

Show daemon uptime.

cw_diag --tlog <on|off>

Turn on/off telnet log message.

cw_diag --clog <on|off>

Turn on/off console log message.

cw_diag baudrate [9600 | 19200 | 38400 | 57600 | 115200]

Set the console baud rate.

cw_diag plain-ctl [0|1]

Show or change current plain control setting.

cw_diag sniff-cfg ip port

Set sniff server ip and port.

cw_diag sniff [0|1|2]

Enable/disable sniff packet.

cw_diag stats wl_intf

Show wl_intf status.

cw_diag admin-timeout [30]

Set shell idle timeout in minutes.

cw_diag -c wtp-cfg

Show current wtp config parameters in control plane.

cw_diag -c radio-cfg

Show current radio config parameters in control plane.

cw_diag -c vap-cfg

Show current vaps in control plane.

cw_diag -c arp-req

Show scanned arp requests.

cw_diag -c ap-scan

Show scanned APs.

cw_diag -c sta-scan

Show scanned STAs.

cw_diag -c sta-cap

Show scanned STA capabilities.

cw_diag -c wids

Show scanned WIDS detections.

cw_diag -c darrp

Show darrp radio channel.

cw_diag -c mesh

Show mesh status.

cw_diag -c mesh-veth-acinfo

Show mesh veth ac info, and mesh ether type.

cw_diag -c mesh-veth-vap

Show mesh veth vap.

cw_diag -c mesh-veth-host

Show mesh veth host.

cw_diag -c mesh-ap

Show mesh ap candidates.

cw_diag -c scan-clr-all

Flush all scanned AP/STA/ARPs.

cw_diag -c ap-suppress

Show suppressed APs.

cw_diag -c sta-deauth

De-authenticate an STA.

note icon

Link aggregation can also be set in the CLI. Link aggregation is used to combine multiple network connections in parallel in order to increase throughput beyond what a single connection could sustain.

  • FortiAP 320B and 320C models are supported.
  • FortiAP 112B and 112D models cannot support link aggregation.
  • NPI FAP-S3xxCR and "wave2" FAP/FAP-S models will have link aggregation feature via synchronization with regular FortiAP trunk build.

FortiAP CLI

The FortiAP CLI controls radio and network operations through the use of variables manipulated with the cfg command. There are also diagnostic commands.

The cfg command includes:

cfg -s

List variables.

cfg -a var=value

Add or change a variable value.

cfg -c

Commit the change to flash.

cfg -x

Reset settings to factory defaults.

cfg -r var

Remove variable.

cfg -e

Export variables.

cfg -h

Display help for all commands.

The configuration variables are:

Var

Description and Values

AC_CTL_PORT

WiFi Controller control (CAPWAP) port. Default 5246.

AC_DATA_CHAN_SEC

Data channel security.

0 - Clear text

1 - DTLS (encrypted)

2 - Accept either DTLS or clear text (default)

AC_DISCOVERY_TYPE

1 - Static. Specify WiFi Controllers

2 - DHCP

3 - DNS

5 - Broadcast

6 - Multicast

0 - Cycle through all of the discovery types until successful.

AP_IPADDR
AP_NETMASK
IPGW

These variables set the FortiAP unit IP address, netmask and default gateway when ADDR_MODE is STATIC.

Default 192.168.1.2 255.255.255.0, gateway 192.168.1.1.

AC_HOSTNAME_1
AC_HOSTNAME_2
AC_HOSTNAME_3

WiFi Controller host names for static discovery.

AC_IPADDR_1
AC_IPADDR_2
AC_IPADDR_3

WiFi Controller IP addresses for static discovery.

AC_DISCOVERY_DHCP_OPTION_CODE

Option code for DHCP server. Default 138.

AC_DISCOVERY_MC_ADDR

Multicast address for controller discovery. Default 224.0.1.140.

ADDR_MODE

How the FortiAP unit obtains its IP address and netmask.

DHCP - FortiGate interface assigns address.

STATIC - Specify in AP_IPADDR and AP_NETMASK.

Default is DHCP.

ADMIN_TIMEOUT

Administrative timeout in minutes. Applies to Telnet and GUI sessions. Default is 5 minutes.

AP_MGMT_VLAN_ID

Non-zero value applies VLAN ID for unit management. Default: 0.

AP_MODE

FortiAP operating mode.

0 - Thin AP (default)

2 - Unmanaged Site Survey mode. See SURVEY variables.

BAUD_RATE

Console data rate: 9600, 19200, 38400, 57600, or 115200 baud.

DNS_SERVER

DNS Server for clients. If ADDR_MODE is DHCP the DNS server is automatically assigned.

FIRMWARE_UPGRADE

Default is 0.

HTTP_ALLOW

Access to FortiAP GUI
1 - Yes (default), 0 - No.

LED_STATE

Enable/disable status LEDs.
0 - LEDs enabled, 1 - LEDs disabled, 2 - follow AC setting.

LOGIN_PASSWD

Administrator login password. By default this is empty.

STP_MODE

Spanning Tree Protocol. 0 is off. 1 is on.

TELNET_ALLOW

By default (value 0), Telnet access is closed when the FortiAP unit is authorized. Set value to 1 to keep Telnet always available.

WTP_LOCATION

Optional string describing AP location.

Mesh variables

MESH_AP_BGSCAN

Enable or disable background mesh root AP scan.

0 - Disabled

1 - Enabled

MESH_AP_BGSCAN_RSSI

If the root AP's signal is weak, and lower than the received signal strength indicator (RSSI) threshold, the WiFi driver will immediately start a new round scan and ignore the configured MESH_AP_BGSCAN_PERIOD delays. Set the value between 0-127.

After the new round scan is finished, a scan done event is passed to wtp daemon to trigger roaming.

MESH_AP_BGSCAN_PERIOD

Time in seconds that a delay period occurs between scans. Set the value between 1-3600.

MESH_AP_BGSCAN_IDLE

Time in milliseconds. Set the value between 0-1000.

MESH_AP_BGSCAN_INTV

Time in milliseconds between channel scans. Set the value between 200-16000.

MESH_AP_BGSCAN_DUR

Time in milliseconds that the radio will continue scanning the channel. Set the value between 10-200.

MESH_AP_SCANCHANLIST

Specify those channels to be scanned.

MESH_AP_TYPE

Type of communication for backhaul to controller:

0 - Ethernet (default)

1 - WiFi mesh

2 - Ethernet with mesh backup support

MESH_AP_SSID

SSID for mesh backhaul. Default: fortinet.mesh.root

MESH_AP_BSSID

WiFi MAC address

MESH_AP_PASSWD

Pre-shared key for mesh backhaul.

MESH_ETH_BRIDGE

1 - Bridge mesh WiFi SSID to FortiAP Ethernet port. This can be used for point-to-point bridge configuration. This is available only when MESH_AP_TYPE =1.

0 - No WiFi-Ethernet bridge (default).

MESH_MAX_HOPS

Maximum number of times packets can be passed from node to node on the mesh. Default is 4.

The following factors are summed and the FortiAP associates with the lowest scoring mesh AP.

MESH_SCORE_HOP_WEIGHT

Multiplier for number of mesh hops from root. Default 50.

MESH_SCORE_CHAN_WEIGHT

AP total RSSI multiplier. Default 1.

MESH_SCORE_RATE_WEIGHT

Beacon data rate multiplier. Default 1.

MESH_SCORE_BAND_WEIGHT

Band weight (0 for 2.4GHz, 1 for 5GHz) multiplier. Default 100.

MESH_SCORE_RSSI_WEIGHT

AP channel RSSI multiplier. Default 100.

Survey variables

SURVEY_SSID

SSID to broadcast in site survey mode (AP_MODE=2).

SURVEY_TX_POWER

Transmitter power in site survey mode (AP_MODE=2).

SURVEY_CH_24

Site survey transmit channel for the 2.4Ghz band (default 6).

SURVEY_CH_50

Site survey transmit channel for the 5Ghz band (default 36).

SURVEY_BEACON_INTV

Site survey beacon interval. Default 100msec.

note icon

Previously, FortiAP accepted Telnet and HTTP connection to any virtual interfaces that have an IP address. For security reasons, Telnet and HTTP access are now limited to br0 or br.vlan for AP_MGMT_VLAN_ID.

Diagnose commands include:

cw_diag help

Display help for all diagnose commands.

cw_diag uptime

Show daemon uptime.

cw_diag --tlog <on|off>

Turn on/off telnet log message.

cw_diag --clog <on|off>

Turn on/off console log message.

cw_diag baudrate [9600 | 19200 | 38400 | 57600 | 115200]

Set the console baud rate.

cw_diag plain-ctl [0|1]

Show or change current plain control setting.

cw_diag sniff-cfg ip port

Set sniff server ip and port.

cw_diag sniff [0|1|2]

Enable/disable sniff packet.

cw_diag stats wl_intf

Show wl_intf status.

cw_diag admin-timeout [30]

Set shell idle timeout in minutes.

cw_diag -c wtp-cfg

Show current wtp config parameters in control plane.

cw_diag -c radio-cfg

Show current radio config parameters in control plane.

cw_diag -c vap-cfg

Show current vaps in control plane.

cw_diag -c arp-req

Show scanned arp requests.

cw_diag -c ap-scan

Show scanned APs.

cw_diag -c sta-scan

Show scanned STAs.

cw_diag -c sta-cap

Show scanned STA capabilities.

cw_diag -c wids

Show scanned WIDS detections.

cw_diag -c darrp

Show darrp radio channel.

cw_diag -c mesh

Show mesh status.

cw_diag -c mesh-veth-acinfo

Show mesh veth ac info, and mesh ether type.

cw_diag -c mesh-veth-vap

Show mesh veth vap.

cw_diag -c mesh-veth-host

Show mesh veth host.

cw_diag -c mesh-ap

Show mesh ap candidates.

cw_diag -c scan-clr-all

Flush all scanned AP/STA/ARPs.

cw_diag -c ap-suppress

Show suppressed APs.

cw_diag -c sta-deauth

De-authenticate an STA.

note icon

Link aggregation can also be set in the CLI. Link aggregation is used to combine multiple network connections in parallel in order to increase throughput beyond what a single connection could sustain.

  • FortiAP 320B and 320C models are supported.
  • FortiAP 112B and 112D models cannot support link aggregation.
  • NPI FAP-S3xxCR and "wave2" FAP/FAP-S models will have link aggregation feature via synchronization with regular FortiAP trunk build.