CLI Reference

alertemail
- alertemail setting
antivirus
- antivirus heuristic
- antivirus profile
- antivirus quarantine
- antivirus settings
application
- application custom
- application group
- application list
- application name
- application rule-settings
authentication
- authentication rule
- authentication scheme
- authentication setting
certificate
- certificate ca
- certificate crl
- certificate local
- certificate remote
credential-store
- credential-store domain-controller
dlp
- dlp filepattern
- dlp fp-doc-source
- dlp sensitivity
- dlp sensor
- dlp settings
dnsfilter
- dnsfilter domain-filter
- dnsfilter profile
emailfilter
- emailfilter bwl
- emailfilter bword
- emailfilter dnsbl
- emailfilter fortishield
- emailfilter iptrust
- emailfilter mheader
- emailfilter options
- emailfilter profile
endpoint-control
- endpoint-control fctems
extender-controller
- extender-controller dataplan
- extender-controller extender
file-filter
- file-filter profile
firewall
- firewall DoS-policy
- firewall DoS-policy6
- firewall acl
- firewall acl6
- firewall address
- firewall address6
- firewall address6-template
- firewall addrgrp
- firewall addrgrp6
- firewall auth-portal
- firewall central-snat-map
- firewall city
- firewall country
- firewall decrypted-traffic-mirror
- firewall dnstranslation
- firewall identity-based-route
- firewall interface-policy
- firewall interface-policy6
- firewall internet-service
- firewall internet-service-addition
- firewall internet-service-append
- firewall internet-service-botnet
- firewall internet-service-custom
- firewall internet-service-custom-group
- firewall internet-service-definition
- firewall internet-service-extension
- firewall internet-service-group
- firewall internet-service-ipbl-reason
- firewall internet-service-ipbl-vendor
- firewall internet-service-list
- firewall internet-service-name
- firewall internet-service-owner
- firewall internet-service-reputation
- firewall internet-service-sld
- firewall ip-translation
- firewall ipmacbinding setting
- firewall ipmacbinding table
- firewall ippool
- firewall ippool6
- firewall ldb-monitor
- firewall local-in-policy
- firewall local-in-policy6
- firewall multicast-address
- firewall multicast-address6
- firewall multicast-policy
- firewall multicast-policy6
- firewall policy
- firewall policy46
- firewall policy64
- firewall profile-group
- firewall profile-protocol-options
- firewall proxy-address
- firewall proxy-addrgrp
- firewall proxy-policy
- firewall region
- firewall schedule group
- firewall schedule onetime
- firewall schedule recurring
- firewall security-policy
- firewall service category
- firewall service custom
- firewall service group
- firewall shaper per-ip-shaper
- firewall shaper traffic-shaper
- firewall shaping-policy
- firewall shaping-profile
- firewall sniffer
- firewall ssh host-key
- firewall ssh local-ca
- firewall ssh local-key
- firewall ssh setting
- firewall ssl setting
- firewall ssl-server
- firewall ssl-ssh-profile
- firewall traffic-class
- firewall ttl-policy
- firewall vendor-mac
- firewall vip
- firewall vip46
- firewall vip6
- firewall vip64
- firewall vipgrp
- firewall vipgrp46
- firewall vipgrp6
- firewall vipgrp64
- firewall wildcard-fqdn custom
- firewall wildcard-fqdn group
ftp-proxy
- ftp-proxy explicit
icap
- icap profile
- icap server
ips
- ips custom
- ips decoder
- ips global
- ips rule
- ips rule-settings
- ips sensor
- ips settings
- ips view-map
log
- log custom-field
- log disk filter
- log disk setting
- log eventfilter
- log fortianalyzer filter
- log fortianalyzer override-filter
- log fortianalyzer override-setting
- log fortianalyzer setting
- log fortianalyzer-cloud filter
- log fortianalyzer-cloud override-filter
- log fortianalyzer-cloud override-setting
- log fortianalyzer-cloud setting
- log fortianalyzer2 filter
- log fortianalyzer2 override-filter
- log fortianalyzer2 override-setting
- log fortianalyzer2 setting
- log fortianalyzer3 filter
- log fortianalyzer3 override-filter
- log fortianalyzer3 override-setting
- log fortianalyzer3 setting
- log fortiguard filter
- log fortiguard override-filter
- log fortiguard override-setting
- log fortiguard setting
- log gui-display
- log memory filter
- log memory global-setting
- log memory setting
- log null-device filter
- log null-device setting
- log setting
- log syslogd filter
- log syslogd override-filter
- log syslogd override-setting
- log syslogd setting
- log syslogd2 filter
- log syslogd2 override-filter
- log syslogd2 override-setting
- log syslogd2 setting
- log syslogd3 filter
- log syslogd3 override-filter
- log syslogd3 override-setting
- log syslogd3 setting
- log syslogd4 filter
- log syslogd4 override-filter
- log syslogd4 override-setting
- log syslogd4 setting
- log threat-weight
- log webtrends filter
- log webtrends setting
monitoring
- monitoring np6-ipsec-engine
report
- report chart
- report dataset
- report layout
- report setting
- report style
- report theme
router
- router access-list
- router access-list6
- router aspath-list
- router auth-path
- router bfd
- router bfd6
- router bgp
- router community-list
- router isis
- router key-chain
- router multicast
- router multicast-flow
- router multicast6
- router ospf
- router ospf6
- router policy
- router policy6
- router prefix-list
- router prefix-list6
- router rip
- router ripng
- router route-map
- router setting
- router static
- router static6
ssh-filter
- ssh-filter profile
switch-controller
- switch-controller auto-config custom
- switch-controller auto-config default
- switch-controller auto-config policy
- switch-controller custom-command
- switch-controller global
- switch-controller initial-config template
- switch-controller initial-config vlans
- switch-controller lldp-profile
- switch-controller lldp-settings
- switch-controller location
- switch-controller mac-policy
- switch-controller managed-switch
- switch-controller nac-device
- switch-controller nac-settings
- switch-controller port-policy
- switch-controller ptp policy
- switch-controller qos dot1p-map
- switch-controller qos ip-dscp-map
- switch-controller qos qos-policy
- switch-controller qos queue-policy
- switch-controller remote-log
- switch-controller security-policy 802-1X
- switch-controller security-policy local-access
- switch-controller snmp-community
- switch-controller snmp-user
- switch-controller storm-control-policy
- switch-controller stp-instance
- switch-controller stp-settings
- switch-controller switch-group
- switch-controller switch-interface-tag
- switch-controller switch-profile
- switch-controller system
- switch-controller traffic-policy
- switch-controller virtual-port-pool
- switch-controller vlan-policy
system
- system 3g-modem custom
- system accprofile
- system admin
- system alarm
- system alias
- system api-user
- system arp-table
- system auto-install
- system auto-script
- system automation-action
- system automation-destination
- system automation-stitch
- system automation-trigger
- system autoupdate push-update
- system autoupdate schedule
- system autoupdate tunneling
- system central-management
- system cluster-sync
- system console
- system csf
- system custom-language
- system ddns
- system dedicated-mgmt
- system dhcp server
- system dhcp6 server
- system dns
- system dns-database
- system dns-server
- system dscp-based-priority
- system email-server
- system external-resource
- system fips-cc
- system fortiguard
- system fortimanager
- system fortisandbox
- system fsso-polling
- system ftm-push
- system geneve
- system geoip-country
- system geoip-override
- system global
- system gre-tunnel
- system ha
- system ha-monitor
- system interface
- system ipip-tunnel
- system ips
- system ips-urlfilter-dns
- system ips-urlfilter-dns6
- system ipsec-aggregate
- system ipv6-neighbor-cache
- system ipv6-tunnel
- system isf-queue-profile
- system link-monitor
- system lldp network-policy
- system lte-modem
- system mac-address-table
- system mobile-tunnel
- system modem
- system nat64
- system nd-proxy
- system netflow
- system network-visibility
- system np6
- system npu
- system ntp
- system object-tagging
- system password-policy
- system password-policy-guest-admin
- system pppoe-interface
- system probe-response
- system proxy-arp
- system ptp
- system replacemsg admin
- system replacemsg alertmail
- system replacemsg auth
- system replacemsg fortiguard-wf
- system replacemsg ftp
- system replacemsg http
- system replacemsg icap
- system replacemsg mail
- system replacemsg nac-quar
- system replacemsg spam
- system replacemsg sslvpn
- system replacemsg traffic-quota
- system replacemsg utm
- system replacemsg webproxy
- system replacemsg-group
- system replacemsg-image
- system resource-limits
- system saml
- system sdn-connector
- system sdwan
- system session-helper
- system session-ttl
- system settings
- system sflow
- system sit-tunnel
- system sms-server
- system snmp community
- system snmp sysinfo
- system snmp user
- system speed-test-server
- system sso-admin
- system standalone-cluster
- system storage
- system switch-interface
- system tos-based-priority
- system vdom
- system vdom-dns
- system vdom-exception
- system vdom-link
- system vdom-netflow
- system vdom-property
- system vdom-radius-server
- system vdom-sflow
- system virtual-wire-pair
- system vne-tunnel
- system vxlan
- system wccp
- system zone
user
- user adgrp
- user domain-controller
- user exchange
- user fortitoken
- user fsso
- user fsso-polling
- user group
- user krb-keytab
- user ldap
- user local
- user nac-policy
- user password-policy
- user peer
- user peergrp
- user pop3
- user radius
- user saml
- user security-exempt-list
- user setting
- user tacacs+
voip
- voip profile
vpn
- vpn certificate ca
- vpn certificate crl
- vpn certificate local
- vpn certificate ocsp-server
- vpn certificate remote
- vpn certificate setting
- vpn ipsec concentrator
- vpn ipsec forticlient
- vpn ipsec manualkey
- vpn ipsec manualkey-interface
- vpn ipsec phase1
- vpn ipsec phase1-interface
- vpn ipsec phase2
- vpn ipsec phase2-interface
- vpn l2tp
- vpn ocvpn
- vpn pptp
- vpn ssl settings
- vpn ssl web host-check-software
- vpn ssl web portal
- vpn ssl web realm
- vpn ssl web user-bookmark
- vpn ssl web user-group-bookmark
waf
- waf main-class
- waf profile
- waf signature
- waf sub-class
wanopt
- wanopt auth-group
- wanopt cache-service
- wanopt content-delivery-network-rule
- wanopt peer
- wanopt profile
- wanopt remote-storage
- wanopt settings
- wanopt webcache
web-proxy
- web-proxy debug-url
- web-proxy explicit
- web-proxy forward-server
- web-proxy forward-server-group
- web-proxy global
- web-proxy profile
- web-proxy url-match
- web-proxy wisp
webfilter
- webfilter content
- webfilter content-header
- webfilter fortiguard
- webfilter ftgd-local-cat
- webfilter ftgd-local-rating
- webfilter ips-urlfilter-cache-setting
- webfilter ips-urlfilter-setting
- webfilter ips-urlfilter-setting6
- webfilter override
- webfilter profile
- webfilter search-engine
- webfilter urlfilter
wireless-controller
- wireless-controller access-control-list
- wireless-controller address
- wireless-controller addrgrp
- wireless-controller ap-status
- wireless-controller apcfg-profile
- wireless-controller arrp-profile
- wireless-controller ble-profile
- wireless-controller bonjour-profile
- wireless-controller global
- wireless-controller hotspot20 anqp-3gpp-cellular
- wireless-controller hotspot20 anqp-ip-address-type
- wireless-controller hotspot20 anqp-nai-realm
- wireless-controller hotspot20 anqp-network-auth-type
- wireless-controller hotspot20 anqp-roaming-consortium
- wireless-controller hotspot20 anqp-venue-name
- wireless-controller hotspot20 h2qp-conn-capability
- wireless-controller hotspot20 h2qp-operator-name
- wireless-controller hotspot20 h2qp-osu-provider
- wireless-controller hotspot20 h2qp-wan-metric
- wireless-controller hotspot20 hs-profile
- wireless-controller hotspot20 icon
- wireless-controller hotspot20 qos-map
- wireless-controller inter-controller
- wireless-controller log
- wireless-controller mpsk-profile
- wireless-controller qos-profile
- wireless-controller region
- wireless-controller setting
- wireless-controller snmp
- wireless-controller timers
- wireless-controller utm-profile
- wireless-controller vap
- wireless-controller vap-group
- wireless-controller wag-profile
- wireless-controller wids-profile
- wireless-controller wtp
- wireless-controller wtp-group
- wireless-controller wtp-profile

Home FortiGate / FortiOS 6.4.2 CLI Reference

6.4.2

wireless-controller wtp

Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate.

  config wireless-controller wtp
      Description: Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate.
      edit <wtp-id>
          set index {integer}
          set uuid {uuid}
          set admin [discovered|disable|...]
          set name {string}
          set location {string}
          set region {string}
          set region-x {string}
          set region-y {string}
          set firmware-provision {string}
          set wtp-profile {string}
          set apcfg-profile {string}
          set bonjour-profile {string}
          set override-led-state [enable|disable]
          set led-state [enable|disable]
          set override-wan-port-mode [enable|disable]
          set wan-port-mode [wan-lan|wan-only]
          set override-ip-fragment [enable|disable]
          set ip-fragment-preventing {option1}, {option2}, ...
          set tun-mtu-uplink {integer}
          set tun-mtu-downlink {integer}
          set override-split-tunnel [enable|disable]
          set split-tunneling-acl-path [tunnel|local]
          set split-tunneling-acl-local-ap-subnet [enable|disable]
          config split-tunneling-acl
              Description: Split tunneling ACL filter list.
              edit <id>
                  set dest-ip {ipv4-classnet}
              next
          end
          set override-lan [enable|disable]
          config lan
              Description: WTP LAN port mapping.
              set port-mode [offline|nat-to-wan|...]
              set port-ssid {string}
              set port1-mode [offline|nat-to-wan|...]
              set port1-ssid {string}
              set port2-mode [offline|nat-to-wan|...]
              set port2-ssid {string}
              set port3-mode [offline|nat-to-wan|...]
              set port3-ssid {string}
              set port4-mode [offline|nat-to-wan|...]
              set port4-ssid {string}
              set port5-mode [offline|nat-to-wan|...]
              set port5-ssid {string}
              set port6-mode [offline|nat-to-wan|...]
              set port6-ssid {string}
              set port7-mode [offline|nat-to-wan|...]
              set port7-ssid {string}
              set port8-mode [offline|nat-to-wan|...]
              set port8-ssid {string}
              set port-esl-mode [offline|nat-to-wan|...]
              set port-esl-ssid {string}
          end
          set override-allowaccess [enable|disable]
          set allowaccess {option1}, {option2}, ...
          set override-login-passwd-change [enable|disable]
          set login-passwd-change [yes|default|...]
          set login-passwd {password}
          config radio-1
              Description: Configuration options for radio 1.
              set override-band [enable|disable]
              set band [802.11a|802.11b|...]
              set override-txpower [enable|disable]
              set auto-power-level [enable|disable]
              set auto-power-high {integer}
              set auto-power-low {integer}
              set power-level {integer}
              set override-vaps [enable|disable]
              set vap-all [tunnel|bridge|...]
              set vaps <name1>, <name2>, ...
              set override-channel [enable|disable]
              set channel <chan1>, <chan2>, ...
          end
          config radio-2
              Description: Configuration options for radio 2.
              set override-band [enable|disable]
              set band [802.11a|802.11b|...]
              set override-txpower [enable|disable]
              set auto-power-level [enable|disable]
              set auto-power-high {integer}
              set auto-power-low {integer}
              set power-level {integer}
              set override-vaps [enable|disable]
              set vap-all [tunnel|bridge|...]
              set vaps <name1>, <name2>, ...
              set override-channel [enable|disable]
              set channel <chan1>, <chan2>, ...
          end
          config radio-3
              Description: Configuration options for radio 3.
              set override-band [enable|disable]
              set band [802.11a|802.11b|...]
              set override-txpower [enable|disable]
              set auto-power-level [enable|disable]
              set auto-power-high {integer}
              set auto-power-low {integer}
              set power-level {integer}
              set override-vaps [enable|disable]
              set vap-all [tunnel|bridge|...]
              set vaps <name1>, <name2>, ...
              set override-channel [enable|disable]
              set channel <chan1>, <chan2>, ...
          end
          config radio-4
              Description: Configuration options for radio 4.
              set override-band [enable|disable]
              set band [802.11a|802.11b|...]
              set override-txpower [enable|disable]
              set auto-power-level [enable|disable]
              set auto-power-high {integer}
              set auto-power-low {integer}
              set power-level {integer}
              set override-vaps [enable|disable]
              set vap-all [tunnel|bridge|...]
              set vaps <name1>, <name2>, ...
              set override-channel [enable|disable]
              set channel <chan1>, <chan2>, ...
          end
          set image-download [enable|disable]
          set mesh-bridge-enable [default|enable|...]
          set coordinate-latitude {string}
          set coordinate-longitude {string}
      next
  end

config wireless-controller wtp

Parameter Name	Description	Type	Size
index	Index (0 - 4294967295).	integer	Minimum value: 0 Maximum value: 4294967295
uuid	Universally Unique Identifier (UUID; automatically assigned but can be manually reset).	uuid	Not Specified
admin	Configure how the FortiGate operating as a wireless controller discovers and manages this WTP, AP or FortiAP. discovered: FortiGate wireless controller discovers the WTP, AP, or FortiAP though discovery or join request messages. disable: FortiGate wireless controller is configured to not provide service to this WTP. enable: FortiGate wireless controller is configured to provide service to this WTP.	option	-
name	WTP, AP or FortiAP configuration name.	string	Maximum length: 35
location	Field for describing the physical location of the WTP, AP or FortiAP.	string	Maximum length: 35
region	Region name WTP is associated with.	string	Maximum length: 35
region-x	Relative horizontal region coordinate (between 0 and 1).	string	Maximum length: 15
region-y	Relative vertical region coordinate (between 0 and 1).	string	Maximum length: 15
firmware-provision	Firmware version to provision to this FortiAP on bootup (major.minor.build, i.e. 6.2.1234).	string	Maximum length: 35
wtp-profile	WTP profile name to apply to this WTP, AP or FortiAP.	string	Maximum length: 35
apcfg-profile	AP local configuration profile name.	string	Maximum length: 35
bonjour-profile	Bonjour profile name.	string	Maximum length: 35
override-led-state	Enable to override the profile LED state setting for this FortiAP. You must enable this option to use the led-state command to turn off the FortiAP's LEDs. enable: Override the WTP profile LED state. disable: Use the WTP profile LED state.	option	-
led-state	Enable to allow the FortiAPs LEDs to light. Disable to keep the LEDs off. You may want to keep the LEDs off so they are not distracting in low light areas etc. enable: Allow the LEDs on this FortiAP to light. disable: Keep the LEDs on this FortiAP off.	option	-
override-wan-port-mode	Enable/disable overriding the wan-port-mode in the WTP profile. enable: Override the WTP profile wan-port-mode. disable: Use the wan-port-mode in the WTP profile.	option	-
wan-port-mode	Enable/disable using the FortiAP WAN port as a LAN port. wan-lan: Use the FortiAP WAN port as a LAN port. wan-only: Do not use the WAN port as a LAN port.	option	-
override-ip-fragment	Enable/disable overriding the WTP profile IP fragment prevention setting. enable: Override the WTP profile IP fragment prevention setting. disable: Use the WTP profile IP fragment prevention setting.	option	-
ip-fragment-preventing	Method(s) by which IP fragmentation is prevented for control and data packets through CAPWAP tunnel (default = tcp-mss-adjust). tcp-mss-adjust: TCP maximum segment size adjustment. icmp-unreachable: Drop packet and send ICMP Destination Unreachable	option	-
tun-mtu-uplink	The maximum transmission unit (MTU) of uplink CAPWAP tunnel (576 - 1500 bytes or 0; 0 means the local MTU of FortiAP; default = 0).	integer	Minimum value: 576 Maximum value: 1500
tun-mtu-downlink	The MTU of downlink CAPWAP tunnel (576 - 1500 bytes or 0; 0 means the local MTU of FortiAP; default = 0).	integer	Minimum value: 576 Maximum value: 1500
override-split-tunnel	Enable/disable overriding the WTP profile split tunneling setting. enable: Override the WTP profile split tunneling setting. disable: Use the WTP profile split tunneling setting.	option	-
split-tunneling-acl-path	Split tunneling ACL path is local/tunnel. tunnel: Split tunneling ACL list traffic will be tunnel. local: Split tunneling ACL list traffic will be local NATed.	option	-
split-tunneling-acl-local-ap-subnet	Enable/disable automatically adding local subnetwork of FortiAP to split-tunneling ACL (default = disable). enable: Enable automatically adding local subnetwork of FortiAP to split-tunneling ACL. disable: Disable automatically adding local subnetwork of FortiAP to split-tunneling ACL.	option	-
override-lan	Enable to override the WTP profile LAN port setting. enable: Override the WTP profile LAN port setting. disable: Use the WTP profile LAN port setting.	option	-
override-allowaccess	Enable to override the WTP profile management access configuration. enable: Override the WTP profile management access configuration. disable: Use the WTP profile management access configuration.	option	-
allowaccess	Control management access to the managed WTP, FortiAP, or AP. Separate entries with a space. https: HTTPS access. ssh: SSH access. snmp: SNMP access.	option	-
override-login-passwd-change	Enable to override the WTP profile login-password (administrator password) setting. enable: Override the WTP profile login-password (administrator password) setting. disable: Use the the WTP profile login-password (administrator password) setting.	option	-
login-passwd-change	Change or reset the administrator password of a managed WTP, FortiAP or AP (yes, default, or no, default = no). yes: Change the managed WTP, FortiAP or AP's administrator password. Use the login-password option to set the password. default: Keep the managed WTP, FortiAP or AP's administrator password set to the factory default. no: Do not change the managed WTP, FortiAP or AP's administrator password.	option	-
login-passwd	Set the managed WTP, FortiAP, or AP's administrator password.	password	Not Specified
image-download	Enable/disable WTP image download. enable: Enable WTP image download at join time. disable: Disable WTP image download at join time.	option	-
mesh-bridge-enable	Enable/disable mesh Ethernet bridge when WTP is configured as a mesh branch/leaf AP. default: Use mesh Ethernet bridge local setting on the WTP. enable: Turn on mesh Ethernet bridge on the WTP. disable: Turn off mesh Ethernet bridge on the WTP.	option	-
coordinate-latitude	WTP latitude coordinate.	string	Maximum length: 19
coordinate-longitude	WTP longitude coordinate.	string	Maximum length: 19

config split-tunneling-acl

Parameter Name	Description	Type	Size
dest-ip	Destination IP and mask for the split-tunneling subnet.	ipv4-classnet	Not Specified

config lan

Parameter Name	Description	Type	Size
port-mode	LAN port mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port-ssid	Bridge LAN port to SSID.	string	Maximum length: 15
port1-mode	LAN port 1 mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port1-ssid	Bridge LAN port 1 to SSID.	string	Maximum length: 15
port2-mode	LAN port 2 mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port2-ssid	Bridge LAN port 2 to SSID.	string	Maximum length: 15
port3-mode	LAN port 3 mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port3-ssid	Bridge LAN port 3 to SSID.	string	Maximum length: 15
port4-mode	LAN port 4 mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port4-ssid	Bridge LAN port 4 to SSID.	string	Maximum length: 15
port5-mode	LAN port 5 mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port5-ssid	Bridge LAN port 5 to SSID.	string	Maximum length: 15
port6-mode	LAN port 6 mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port6-ssid	Bridge LAN port 6 to SSID.	string	Maximum length: 15
port7-mode	LAN port 7 mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port7-ssid	Bridge LAN port 7 to SSID.	string	Maximum length: 15
port8-mode	LAN port 8 mode. offline: Offline. nat-to-wan: NAT WTP LAN port to WTP WAN port. bridge-to-wan: Bridge WTP LAN port to WTP WAN port. bridge-to-ssid: Bridge WTP LAN port to SSID.	option	-
port8-ssid	Bridge LAN port 8 to SSID.	string	Maximum length: 15
port-esl-mode	ESL port mode. offline: Offline. nat-to-wan: NAT WTP ESL port to WTP WAN port. bridge-to-wan: Bridge WTP ESL port to WTP WAN port. bridge-to-ssid: Bridge WTP ESL port to SSID.	option	-
port-esl-ssid	Bridge ESL port to SSID.	string	Maximum length: 15

config radio-1

Parameter Name	Description	Type	Size
override-band	Enable to override the WTP profile band setting. enable: Override the WTP profile band setting. disable: Use the WTP profile band setting.	option	-
band	WiFi band that Radio 1 operates on. 802.11a: 802.11a. 802.11b: 802.11b. 802.11g: 802.11g/b. 802.11n: 802.11n/g/b at 2.4GHz. 802.11n-5G: 802.11n/a at 5GHz. 802.11ac: 802.11ac/n/a. 802.11ax-5G: 802.11ax/ac/n/a at 5GHz. 802.11ax: 802.11ax/n/g/b at 2.4GHz. 802.11ac-2G: 802.11ac at 2.4GHz. 802.11n,g-only: 802.11n/g at 2.4GHz. 802.11g-only: 802.11g. 802.11n-only: 802.11n at 2.4GHz. 802.11n-5G-only: 802.11n at 5GHz. 802.11ac,n-only: 802.11ac/n. 802.11ac-only: 802.11ac. 802.11ax,ac-only: 802.11ax/ac at 5GHz. 802.11ax,ac,n-only: 802.11ax/ac/n at 5GHz. 802.11ax-5G-only: 802.11ax at 5GHz. 802.11ax,n-only: 802.11ax/n at 2.4GHz. 802.11ax,n,g-only: 802.11ax/n/g at 2.4GHz. 802.11ax-only: 802.11ax at 2.4GHz.	option	-
override-txpower	Enable to override the WTP profile power level configuration. enable: Override the WTP profile power level configuration. disable: Use the WTP profile power level configuration.	option	-
auto-power-level	Enable/disable automatic power-level adjustment to prevent co-channel interference (default = enable). enable: Enable automatic transmit power adjustment. disable: Disable automatic transmit power adjustment.	option	-
auto-power-high	The upper bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).	integer	Minimum value: 0 Maximum value: 4294967295
auto-power-low	The lower bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).	integer	Minimum value: 0 Maximum value: 4294967295
power-level	Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).	integer	Minimum value: 0 Maximum value: 100
override-vaps	Enable to override WTP profile Virtual Access Point (VAP) settings. enable: Override WTP profile VAP settings. disable: Use WTP profile VAP settings.	option	-
vap-all	Configure method for assigning SSIDs to this FortiAP (default = automatically assign tunnel SSIDs). tunnel: Automatically select tunnel SSIDs. bridge: Automatically select local-bridging SSIDs. manual: Manually select SSIDs.	option	-
vaps `<name>`	Manually selected list of Virtual Access Points (VAPs). Virtual Access Point (VAP) name.	string	Maximum length: 35
override-channel	Enable to override WTP profile channel settings. enable: Override WTP profile channel settings. disable: Use WTP profile channel settings.	option	-
channel `<chan>`	Selected list of wireless radio channels. Channel number.	string	Maximum length: 3

config radio-2

Parameter Name	Description	Type	Size
override-band	Enable to override the WTP profile band setting. enable: Override the WTP profile band setting. disable: Use the WTP profile band setting.	option	-
band	WiFi band that Radio 2 operates on. 802.11a: 802.11a. 802.11b: 802.11b. 802.11g: 802.11g/b. 802.11n: 802.11n/g/b at 2.4GHz. 802.11n-5G: 802.11n/a at 5GHz. 802.11ac: 802.11ac/n/a. 802.11ax-5G: 802.11ax/ac/n/a at 5GHz. 802.11ax: 802.11ax/n/g/b at 2.4GHz. 802.11ac-2G: 802.11ac at 2.4GHz. 802.11n,g-only: 802.11n/g at 2.4GHz. 802.11g-only: 802.11g. 802.11n-only: 802.11n at 2.4GHz. 802.11n-5G-only: 802.11n at 5GHz. 802.11ac,n-only: 802.11ac/n. 802.11ac-only: 802.11ac. 802.11ax,ac-only: 802.11ax/ac at 5GHz. 802.11ax,ac,n-only: 802.11ax/ac/n at 5GHz. 802.11ax-5G-only: 802.11ax at 5GHz. 802.11ax,n-only: 802.11ax/n at 2.4GHz. 802.11ax,n,g-only: 802.11ax/n/g at 2.4GHz. 802.11ax-only: 802.11ax at 2.4GHz.	option	-
override-txpower	Enable to override the WTP profile power level configuration. enable: Override the WTP profile power level configuration. disable: Use the WTP profile power level configuration.	option	-
auto-power-level	Enable/disable automatic power-level adjustment to prevent co-channel interference (default = enable). enable: Enable automatic transmit power adjustment. disable: Disable automatic transmit power adjustment.	option	-
auto-power-high	The upper bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).	integer	Minimum value: 0 Maximum value: 4294967295
auto-power-low	The lower bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).	integer	Minimum value: 0 Maximum value: 4294967295
power-level	Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).	integer	Minimum value: 0 Maximum value: 100
override-vaps	Enable to override WTP profile Virtual Access Point (VAP) settings. enable: Override WTP profile VAP settings. disable: Use WTP profile VAP settings.	option	-
vap-all	Configure method for assigning SSIDs to this FortiAP (default = automatically assign tunnel SSIDs). tunnel: Automatically select tunnel SSIDs. bridge: Automatically select local-bridging SSIDs. manual: Manually select SSIDs.	option	-
vaps `<name>`	Manually selected list of Virtual Access Points (VAPs). Virtual Access Point (VAP) name.	string	Maximum length: 35
override-channel	Enable to override WTP profile channel settings. enable: Override WTP profile channel settings. disable: Use WTP profile channel settings.	option	-
channel `<chan>`	Selected list of wireless radio channels. Channel number.	string	Maximum length: 3

config radio-3

Parameter Name	Description	Type	Size
override-band	Enable to override the WTP profile band setting. enable: Override the WTP profile band setting. disable: Use the WTP profile band setting.	option	-
band	WiFi band that Radio 3 operates on. 802.11a: 802.11a. 802.11b: 802.11b. 802.11g: 802.11g/b. 802.11n: 802.11n/g/b at 2.4GHz. 802.11n-5G: 802.11n/a at 5GHz. 802.11ac: 802.11ac/n/a. 802.11ax-5G: 802.11ax/ac/n/a at 5GHz. 802.11ax: 802.11ax/n/g/b at 2.4GHz. 802.11ac-2G: 802.11ac at 2.4GHz. 802.11n,g-only: 802.11n/g at 2.4GHz. 802.11g-only: 802.11g. 802.11n-only: 802.11n at 2.4GHz. 802.11n-5G-only: 802.11n at 5GHz. 802.11ac,n-only: 802.11ac/n. 802.11ac-only: 802.11ac. 802.11ax,ac-only: 802.11ax/ac at 5GHz. 802.11ax,ac,n-only: 802.11ax/ac/n at 5GHz. 802.11ax-5G-only: 802.11ax at 5GHz. 802.11ax,n-only: 802.11ax/n at 2.4GHz. 802.11ax,n,g-only: 802.11ax/n/g at 2.4GHz. 802.11ax-only: 802.11ax at 2.4GHz.	option	-
override-txpower	Enable to override the WTP profile power level configuration. enable: Override the WTP profile power level configuration. disable: Use the WTP profile power level configuration.	option	-
auto-power-level	Enable/disable automatic power-level adjustment to prevent co-channel interference (default = enable). enable: Enable automatic transmit power adjustment. disable: Disable automatic transmit power adjustment.	option	-
auto-power-high	The upper bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).	integer	Minimum value: 0 Maximum value: 4294967295
auto-power-low	The lower bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).	integer	Minimum value: 0 Maximum value: 4294967295
power-level	Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).	integer	Minimum value: 0 Maximum value: 100
override-vaps	Enable to override WTP profile Virtual Access Point (VAP) settings. enable: Override WTP profile VAP settings. disable: Use WTP profile VAP settings.	option	-
vap-all	Configure method for assigning SSIDs to this FortiAP (default = automatically assign tunnel SSIDs). tunnel: Automatically select tunnel SSIDs. bridge: Automatically select local-bridging SSIDs. manual: Manually select SSIDs.	option	-
vaps `<name>`	Manually selected list of Virtual Access Points (VAPs). Virtual Access Point (VAP) name.	string	Maximum length: 35
override-channel	Enable to override WTP profile channel settings. enable: Override WTP profile channel settings. disable: Use WTP profile channel settings.	option	-
channel `<chan>`	Selected list of wireless radio channels. Channel number.	string	Maximum length: 3

config radio-4

Parameter Name	Description	Type	Size
override-band	Enable to override the WTP profile band setting. enable: Override the WTP profile band setting. disable: Use the WTP profile band setting.	option	-
band	WiFi band that Radio 4 operates on. 802.11a: 802.11a. 802.11b: 802.11b. 802.11g: 802.11g/b. 802.11n: 802.11n/g/b at 2.4GHz. 802.11n-5G: 802.11n/a at 5GHz. 802.11ac: 802.11ac/n/a. 802.11ax-5G: 802.11ax/ac/n/a at 5GHz. 802.11ax: 802.11ax/n/g/b at 2.4GHz. 802.11ac-2G: 802.11ac at 2.4GHz. 802.11n,g-only: 802.11n/g at 2.4GHz. 802.11g-only: 802.11g. 802.11n-only: 802.11n at 2.4GHz. 802.11n-5G-only: 802.11n at 5GHz. 802.11ac,n-only: 802.11ac/n. 802.11ac-only: 802.11ac. 802.11ax,ac-only: 802.11ax/ac at 5GHz. 802.11ax,ac,n-only: 802.11ax/ac/n at 5GHz. 802.11ax-5G-only: 802.11ax at 5GHz. 802.11ax,n-only: 802.11ax/n at 2.4GHz. 802.11ax,n,g-only: 802.11ax/n/g at 2.4GHz. 802.11ax-only: 802.11ax at 2.4GHz.	option	-
override-txpower	Enable to override the WTP profile power level configuration. enable: Override the WTP profile power level configuration. disable: Use the WTP profile power level configuration.	option	-
auto-power-level	Enable/disable automatic power-level adjustment to prevent co-channel interference (default = enable). enable: Enable automatic transmit power adjustment. disable: Disable automatic transmit power adjustment.	option	-
auto-power-high	The upper bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).	integer	Minimum value: 0 Maximum value: 4294967295
auto-power-low	The lower bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).	integer	Minimum value: 0 Maximum value: 4294967295
power-level	Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).	integer	Minimum value: 0 Maximum value: 100
override-vaps	Enable to override WTP profile Virtual Access Point (VAP) settings. enable: Override WTP profile VAP settings. disable: Use WTP profile VAP settings.	option	-
vap-all	Configure method for assigning SSIDs to this FortiAP (default = automatically assign tunnel SSIDs). tunnel: Automatically select tunnel SSIDs. bridge: Automatically select local-bridging SSIDs. manual: Manually select SSIDs.	option	-
vaps `<name>`	Manually selected list of Virtual Access Points (VAPs). Virtual Access Point (VAP) name.	string	Maximum length: 35
override-channel	Enable to override WTP profile channel settings. enable: Override WTP profile channel settings. disable: Use WTP profile channel settings.	option	-
channel `<chan>`	Selected list of wireless radio channels. Channel number.	string	Maximum length: 3

Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate.

config wireless-controller wtp Description: Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate. edit <wtp-id> set index {integer} set uuid {uuid} set admin [discovered|disable|...] set name {string} set location {string} set region {string} set region-x {string} set region-y {string} set firmware-provision {string} set wtp-profile {string} set apcfg-profile {string} set bonjour-profile {string} set override-led-state [enable|disable] set led-state [enable|disable] set override-wan-port-mode [enable|disable] set wan-port-mode [wan-lan|wan-only] set override-ip-fragment [enable|disable] set ip-fragment-preventing {option1}, {option2}, ... set tun-mtu-uplink {integer} set tun-mtu-downlink {integer} set override-split-tunnel [enable|disable] set split-tunneling-acl-path [tunnel|local] set split-tunneling-acl-local-ap-subnet [enable|disable] config split-tunneling-acl Description: Split tunneling ACL filter list. edit <id> set dest-ip {ipv4-classnet} next end set override-lan [enable|disable] config lan Description: WTP LAN port mapping. set port-mode [offline|nat-to-wan|...] set port-ssid {string} set port1-mode [offline|nat-to-wan|...] set port1-ssid {string} set port2-mode [offline|nat-to-wan|...] set port2-ssid {string} set port3-mode [offline|nat-to-wan|...] set port3-ssid {string} set port4-mode [offline|nat-to-wan|...] set port4-ssid {string} set port5-mode [offline|nat-to-wan|...] set port5-ssid {string} set port6-mode [offline|nat-to-wan|...] set port6-ssid {string} set port7-mode [offline|nat-to-wan|...] set port7-ssid {string} set port8-mode [offline|nat-to-wan|...] set port8-ssid {string} set port-esl-mode [offline|nat-to-wan|...] set port-esl-ssid {string} end set override-allowaccess [enable|disable] set allowaccess {option1}, {option2}, ... set override-login-passwd-change [enable|disable] set login-passwd-change [yes|default|...] set login-passwd {password} config radio-1 Description: Configuration options for radio 1. set override-band [enable|disable] set band [802.11a|802.11b|...] set override-txpower [enable|disable] set auto-power-level [enable|disable] set auto-power-high {integer} set auto-power-low {integer} set power-level {integer} set override-vaps [enable|disable] set vap-all [tunnel|bridge|...] set vaps <name1>, <name2>, ... set override-channel [enable|disable] set channel <chan1>, <chan2>, ... end config radio-2 Description: Configuration options for radio 2. set override-band [enable|disable] set band [802.11a|802.11b|...] set override-txpower [enable|disable] set auto-power-level [enable|disable] set auto-power-high {integer} set auto-power-low {integer} set power-level {integer} set override-vaps [enable|disable] set vap-all [tunnel|bridge|...] set vaps <name1>, <name2>, ... set override-channel [enable|disable] set channel <chan1>, <chan2>, ... end config radio-3 Description: Configuration options for radio 3. set override-band [enable|disable] set band [802.11a|802.11b|...] set override-txpower [enable|disable] set auto-power-level [enable|disable] set auto-power-high {integer} set auto-power-low {integer} set power-level {integer} set override-vaps [enable|disable] set vap-all [tunnel|bridge|...] set vaps <name1>, <name2>, ... set override-channel [enable|disable] set channel <chan1>, <chan2>, ... end config radio-4 Description: Configuration options for radio 4. set override-band [enable|disable] set band [802.11a|802.11b|...] set override-txpower [enable|disable] set auto-power-level [enable|disable] set auto-power-high {integer} set auto-power-low {integer} set power-level {integer} set override-vaps [enable|disable] set vap-all [tunnel|bridge|...] set vaps <name1>, <name2>, ... set override-channel [enable|disable] set channel <chan1>, <chan2>, ... end set image-download [enable|disable] set mesh-bridge-enable [default|enable|...] set coordinate-latitude {string} set coordinate-longitude {string} next end

config wireless-controller wtp

Parameter Name

Description

Type

Size

index

Index (0 - 4294967295).

integer

Minimum value: 0 Maximum value: 4294967295

uuid

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

admin

Configure how the FortiGate operating as a wireless controller discovers and manages this WTP, AP or FortiAP.
discovered: FortiGate wireless controller discovers the WTP, AP, or FortiAP though discovery or join request messages.
disable: FortiGate wireless controller is configured to not provide service to this WTP.
enable: FortiGate wireless controller is configured to provide service to this WTP.

option

name

WTP, AP or FortiAP configuration name.

string

Maximum length: 35

location

Field for describing the physical location of the WTP, AP or FortiAP.

string

Maximum length: 35

region

Region name WTP is associated with.

string

Maximum length: 35

region-x

Relative horizontal region coordinate (between 0 and 1).

string

Maximum length: 15

region-y

Relative vertical region coordinate (between 0 and 1).

string

Maximum length: 15

firmware-provision

Firmware version to provision to this FortiAP on bootup (major.minor.build, i.e. 6.2.1234).

string

Maximum length: 35

wtp-profile

WTP profile name to apply to this WTP, AP or FortiAP.

string

Maximum length: 35

apcfg-profile

AP local configuration profile name.

string

Maximum length: 35

bonjour-profile

Bonjour profile name.

string

Maximum length: 35

override-led-state

Enable to override the profile LED state setting for this FortiAP. You must enable this option to use the led-state command to turn off the FortiAP's LEDs.
enable: Override the WTP profile LED state.
disable: Use the WTP profile LED state.

option

led-state

Enable to allow the FortiAPs LEDs to light. Disable to keep the LEDs off. You may want to keep the LEDs off so they are not distracting in low light areas etc.
enable: Allow the LEDs on this FortiAP to light.
disable: Keep the LEDs on this FortiAP off.

option

override-wan-port-mode

Enable/disable overriding the wan-port-mode in the WTP profile.
enable: Override the WTP profile wan-port-mode.
disable: Use the wan-port-mode in the WTP profile.

option

wan-port-mode

Enable/disable using the FortiAP WAN port as a LAN port.
wan-lan: Use the FortiAP WAN port as a LAN port.
wan-only: Do not use the WAN port as a LAN port.

option

override-ip-fragment

Enable/disable overriding the WTP profile IP fragment prevention setting.
enable: Override the WTP profile IP fragment prevention setting.
disable: Use the WTP profile IP fragment prevention setting.

option

ip-fragment-preventing

Method(s) by which IP fragmentation is prevented for control and data packets through CAPWAP tunnel (default = tcp-mss-adjust).
tcp-mss-adjust: TCP maximum segment size adjustment.
icmp-unreachable: Drop packet and send ICMP Destination Unreachable

option

tun-mtu-uplink

The maximum transmission unit (MTU) of uplink CAPWAP tunnel (576 - 1500 bytes or 0; 0 means the local MTU of FortiAP; default = 0).

integer

Minimum value: 576 Maximum value: 1500

tun-mtu-downlink

The MTU of downlink CAPWAP tunnel (576 - 1500 bytes or 0; 0 means the local MTU of FortiAP; default = 0).

integer

Minimum value: 576 Maximum value: 1500

override-split-tunnel

Enable/disable overriding the WTP profile split tunneling setting.
enable: Override the WTP profile split tunneling setting.
disable: Use the WTP profile split tunneling setting.

option

split-tunneling-acl-path

Split tunneling ACL path is local/tunnel.
tunnel: Split tunneling ACL list traffic will be tunnel.
local: Split tunneling ACL list traffic will be local NATed.

option

split-tunneling-acl-local-ap-subnet

Enable/disable automatically adding local subnetwork of FortiAP to split-tunneling ACL (default = disable).
enable: Enable automatically adding local subnetwork of FortiAP to split-tunneling ACL.
disable: Disable automatically adding local subnetwork of FortiAP to split-tunneling ACL.

option

override-lan

Enable to override the WTP profile LAN port setting.
enable: Override the WTP profile LAN port setting.
disable: Use the WTP profile LAN port setting.

option

override-allowaccess

Enable to override the WTP profile management access configuration.
enable: Override the WTP profile management access configuration.
disable: Use the WTP profile management access configuration.

option

allowaccess

Control management access to the managed WTP, FortiAP, or AP. Separate entries with a space.
https: HTTPS access.
ssh: SSH access.
snmp: SNMP access.

option

override-login-passwd-change

Enable to override the WTP profile login-password (administrator password) setting.
enable: Override the WTP profile login-password (administrator password) setting.
disable: Use the the WTP profile login-password (administrator password) setting.

option

Change or reset the administrator password of a managed WTP, FortiAP or AP (yes, default, or no, default = no).
yes: Change the managed WTP, FortiAP or AP's administrator password. Use the login-password option to set the password.
default: Keep the managed WTP, FortiAP or AP's administrator password set to the factory default.
no: Do not change the managed WTP, FortiAP or AP's administrator password.

option

Set the managed WTP, FortiAP, or AP's administrator password.

password

Not Specified

image-download

Enable/disable WTP image download.
enable: Enable WTP image download at join time.
disable: Disable WTP image download at join time.

option

mesh-bridge-enable

Enable/disable mesh Ethernet bridge when WTP is configured as a mesh branch/leaf AP.
default: Use mesh Ethernet bridge local setting on the WTP.
enable: Turn on mesh Ethernet bridge on the WTP.
disable: Turn off mesh Ethernet bridge on the WTP.

option

coordinate-latitude

WTP latitude coordinate.

string

Maximum length: 19

coordinate-longitude

WTP longitude coordinate.

string

Maximum length: 19

Parameter Name

Description

Type

Size

dest-ip

Destination IP and mask for the split-tunneling subnet.

ipv4-classnet

Not Specified

config lan

Parameter Name

Description

Type

Size

port-mode

LAN port mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port-ssid

Bridge LAN port to SSID.

string

Maximum length: 15

port1-mode

LAN port 1 mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port1-ssid

Bridge LAN port 1 to SSID.

string

Maximum length: 15

port2-mode

LAN port 2 mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port2-ssid

Bridge LAN port 2 to SSID.

string

Maximum length: 15

port3-mode

LAN port 3 mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port3-ssid

Bridge LAN port 3 to SSID.

string

Maximum length: 15

port4-mode

LAN port 4 mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port4-ssid

Bridge LAN port 4 to SSID.

string

Maximum length: 15

port5-mode

LAN port 5 mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port5-ssid

Bridge LAN port 5 to SSID.

string

Maximum length: 15

port6-mode

LAN port 6 mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port6-ssid

Bridge LAN port 6 to SSID.

string

Maximum length: 15

port7-mode

LAN port 7 mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port7-ssid

Bridge LAN port 7 to SSID.

string

Maximum length: 15

port8-mode

LAN port 8 mode.
offline: Offline.
nat-to-wan: NAT WTP LAN port to WTP WAN port.
bridge-to-wan: Bridge WTP LAN port to WTP WAN port.
bridge-to-ssid: Bridge WTP LAN port to SSID.

option

port8-ssid

Bridge LAN port 8 to SSID.

string

Maximum length: 15

port-esl-mode

ESL port mode.
offline: Offline.
nat-to-wan: NAT WTP ESL port to WTP WAN port.
bridge-to-wan: Bridge WTP ESL port to WTP WAN port.
bridge-to-ssid: Bridge WTP ESL port to SSID.

option

port-esl-ssid

Bridge ESL port to SSID.

string

Maximum length: 15

config radio-1

Parameter Name

Description

Type

Size

override-band

Enable to override the WTP profile band setting.
enable: Override the WTP profile band setting.
disable: Use the WTP profile band setting.

option

band

WiFi band that Radio 1 operates on.
802.11a: 802.11a.
802.11b: 802.11b.
802.11g: 802.11g/b.
802.11n: 802.11n/g/b at 2.4GHz.
802.11n-5G: 802.11n/a at 5GHz.
802.11ac: 802.11ac/n/a.
802.11ax-5G: 802.11ax/ac/n/a at 5GHz.
802.11ax: 802.11ax/n/g/b at 2.4GHz.
802.11ac-2G: 802.11ac at 2.4GHz.
802.11n,g-only: 802.11n/g at 2.4GHz.
802.11g-only: 802.11g.
802.11n-only: 802.11n at 2.4GHz.
802.11n-5G-only: 802.11n at 5GHz.
802.11ac,n-only: 802.11ac/n.
802.11ac-only: 802.11ac.
802.11ax,ac-only: 802.11ax/ac at 5GHz.
802.11ax,ac,n-only: 802.11ax/ac/n at 5GHz.
802.11ax-5G-only: 802.11ax at 5GHz.
802.11ax,n-only: 802.11ax/n at 2.4GHz.
802.11ax,n,g-only: 802.11ax/n/g at 2.4GHz.
802.11ax-only: 802.11ax at 2.4GHz.

option

override-txpower

Enable to override the WTP profile power level configuration.
enable: Override the WTP profile power level configuration.
disable: Use the WTP profile power level configuration.

option

auto-power-level

Enable/disable automatic power-level adjustment to prevent co-channel interference (default = enable).
enable: Enable automatic transmit power adjustment.
disable: Disable automatic transmit power adjustment.

option

auto-power-high

The upper bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).

integer

Minimum value: 0 Maximum value: 4294967295

auto-power-low

The lower bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).

integer

Minimum value: 0 Maximum value: 4294967295

power-level

Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).

integer

Minimum value: 0 Maximum value: 100

override-vaps

Enable to override WTP profile Virtual Access Point (VAP) settings.
enable: Override WTP profile VAP settings.
disable: Use WTP profile VAP settings.

option

vap-all

Configure method for assigning SSIDs to this FortiAP (default = automatically assign tunnel SSIDs).
tunnel: Automatically select tunnel SSIDs.
bridge: Automatically select local-bridging SSIDs.
manual: Manually select SSIDs.

option

vaps <name>

Manually selected list of Virtual Access Points (VAPs).
Virtual Access Point (VAP) name.

string

Maximum length: 35

override-channel

Enable to override WTP profile channel settings.
enable: Override WTP profile channel settings.
disable: Use WTP profile channel settings.

option

channel <chan>

Selected list of wireless radio channels.
Channel number.

string

Maximum length: 3

config radio-2

Parameter Name

Description

Type

Size

override-band

Enable to override the WTP profile band setting.
enable: Override the WTP profile band setting.
disable: Use the WTP profile band setting.

option

band

WiFi band that Radio 2 operates on.
802.11a: 802.11a.
802.11b: 802.11b.
802.11g: 802.11g/b.
802.11n: 802.11n/g/b at 2.4GHz.
802.11n-5G: 802.11n/a at 5GHz.
802.11ac: 802.11ac/n/a.
802.11ax-5G: 802.11ax/ac/n/a at 5GHz.
802.11ax: 802.11ax/n/g/b at 2.4GHz.
802.11ac-2G: 802.11ac at 2.4GHz.
802.11n,g-only: 802.11n/g at 2.4GHz.
802.11g-only: 802.11g.
802.11n-only: 802.11n at 2.4GHz.
802.11n-5G-only: 802.11n at 5GHz.
802.11ac,n-only: 802.11ac/n.
802.11ac-only: 802.11ac.
802.11ax,ac-only: 802.11ax/ac at 5GHz.
802.11ax,ac,n-only: 802.11ax/ac/n at 5GHz.
802.11ax-5G-only: 802.11ax at 5GHz.
802.11ax,n-only: 802.11ax/n at 2.4GHz.
802.11ax,n,g-only: 802.11ax/n/g at 2.4GHz.
802.11ax-only: 802.11ax at 2.4GHz.

option

override-txpower

Enable to override the WTP profile power level configuration.
enable: Override the WTP profile power level configuration.
disable: Use the WTP profile power level configuration.

option

auto-power-level

option

auto-power-high

The upper bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).

integer

Minimum value: 0 Maximum value: 4294967295

auto-power-low

The lower bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).

integer

Minimum value: 0 Maximum value: 4294967295

power-level

Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).

integer

Minimum value: 0 Maximum value: 100

override-vaps

Enable to override WTP profile Virtual Access Point (VAP) settings.
enable: Override WTP profile VAP settings.
disable: Use WTP profile VAP settings.

option

vap-all

option

vaps <name>

Manually selected list of Virtual Access Points (VAPs).
Virtual Access Point (VAP) name.

string

Maximum length: 35

override-channel

Enable to override WTP profile channel settings.
enable: Override WTP profile channel settings.
disable: Use WTP profile channel settings.

option

channel <chan>

Selected list of wireless radio channels.
Channel number.

string

Maximum length: 3

config radio-3

Parameter Name

Description

Type

Size

override-band

Enable to override the WTP profile band setting.
enable: Override the WTP profile band setting.
disable: Use the WTP profile band setting.

option

band

WiFi band that Radio 3 operates on.
802.11a: 802.11a.
802.11b: 802.11b.
802.11g: 802.11g/b.
802.11n: 802.11n/g/b at 2.4GHz.
802.11n-5G: 802.11n/a at 5GHz.
802.11ac: 802.11ac/n/a.
802.11ax-5G: 802.11ax/ac/n/a at 5GHz.
802.11ax: 802.11ax/n/g/b at 2.4GHz.
802.11ac-2G: 802.11ac at 2.4GHz.
802.11n,g-only: 802.11n/g at 2.4GHz.
802.11g-only: 802.11g.
802.11n-only: 802.11n at 2.4GHz.
802.11n-5G-only: 802.11n at 5GHz.
802.11ac,n-only: 802.11ac/n.
802.11ac-only: 802.11ac.
802.11ax,ac-only: 802.11ax/ac at 5GHz.
802.11ax,ac,n-only: 802.11ax/ac/n at 5GHz.
802.11ax-5G-only: 802.11ax at 5GHz.
802.11ax,n-only: 802.11ax/n at 2.4GHz.
802.11ax,n,g-only: 802.11ax/n/g at 2.4GHz.
802.11ax-only: 802.11ax at 2.4GHz.

option

override-txpower

Enable to override the WTP profile power level configuration.
enable: Override the WTP profile power level configuration.
disable: Use the WTP profile power level configuration.

option

auto-power-level

option

auto-power-high

The upper bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).

integer

Minimum value: 0 Maximum value: 4294967295

auto-power-low

The lower bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).

integer

Minimum value: 0 Maximum value: 4294967295

power-level

Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).

integer

Minimum value: 0 Maximum value: 100

override-vaps

Enable to override WTP profile Virtual Access Point (VAP) settings.
enable: Override WTP profile VAP settings.
disable: Use WTP profile VAP settings.

option

vap-all

option

vaps <name>

Manually selected list of Virtual Access Points (VAPs).
Virtual Access Point (VAP) name.

string

Maximum length: 35

override-channel

Enable to override WTP profile channel settings.
enable: Override WTP profile channel settings.
disable: Use WTP profile channel settings.

option

channel <chan>

Selected list of wireless radio channels.
Channel number.

string

Maximum length: 3

config radio-4

Parameter Name

Description

Type

Size

override-band

Enable to override the WTP profile band setting.
enable: Override the WTP profile band setting.
disable: Use the WTP profile band setting.

option

band

WiFi band that Radio 4 operates on.
802.11a: 802.11a.
802.11b: 802.11b.
802.11g: 802.11g/b.
802.11n: 802.11n/g/b at 2.4GHz.
802.11n-5G: 802.11n/a at 5GHz.
802.11ac: 802.11ac/n/a.
802.11ax-5G: 802.11ax/ac/n/a at 5GHz.
802.11ax: 802.11ax/n/g/b at 2.4GHz.
802.11ac-2G: 802.11ac at 2.4GHz.
802.11n,g-only: 802.11n/g at 2.4GHz.
802.11g-only: 802.11g.
802.11n-only: 802.11n at 2.4GHz.
802.11n-5G-only: 802.11n at 5GHz.
802.11ac,n-only: 802.11ac/n.
802.11ac-only: 802.11ac.
802.11ax,ac-only: 802.11ax/ac at 5GHz.
802.11ax,ac,n-only: 802.11ax/ac/n at 5GHz.
802.11ax-5G-only: 802.11ax at 5GHz.
802.11ax,n-only: 802.11ax/n at 2.4GHz.
802.11ax,n,g-only: 802.11ax/n/g at 2.4GHz.
802.11ax-only: 802.11ax at 2.4GHz.

option

override-txpower

Enable to override the WTP profile power level configuration.
enable: Override the WTP profile power level configuration.
disable: Use the WTP profile power level configuration.

option

auto-power-level

option

auto-power-high

The upper bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).

integer

Minimum value: 0 Maximum value: 4294967295

auto-power-low

The lower bound of automatic transmit power adjustment in dBm (the actual range of transmit power depends on the AP platform type).

integer

Minimum value: 0 Maximum value: 4294967295

power-level

Radio power level as a percentage of the maximum transmit power (0 - 100, default = 100).

integer

Minimum value: 0 Maximum value: 100

override-vaps

Enable to override WTP profile Virtual Access Point (VAP) settings.
enable: Override WTP profile VAP settings.
disable: Use WTP profile VAP settings.

option

vap-all

option

vaps <name>

Manually selected list of Virtual Access Points (VAPs).
Virtual Access Point (VAP) name.

string

Maximum length: 35

override-channel

Enable to override WTP profile channel settings.
enable: Override WTP profile channel settings.
disable: Use WTP profile channel settings.

option

channel <chan>

Selected list of wireless radio channels.
Channel number.

string

Maximum length: 3

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

CLI Reference

wireless-controller wtp

Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate.

config wireless-controller wtp

config split-tunneling-acl

config lan

config radio-1

config radio-2

config radio-3

config radio-4

wireless-controller wtp

Configure Wireless Termination Points (WTPs), that is, FortiAPs or APs to be managed by FortiGate.

config wireless-controller wtp

config split-tunneling-acl