FortiAP CLI

FortiAP CLI Cheat Sheet

FortiGate-managed FortiAP troubleshooting plus practical setup workflows for wireless mesh and remote/teleworker FortiAP deployments.

Back to FortiAP CLI

Controller & managed AP status

Official / Fortinet reference ↗

get wireless-controller wtp
diagnose wireless-controller wlac help
diagnose wireless-controller wlac -c wtp
diagnose wireless-controller wlac -d wtp

Wireless clients / stations

Official / Fortinet reference ↗

diagnose wireless-controller wlac -c sta
diagnose wireless-controller wlac -d sta

VAP, radio & spectrum

Official / Fortinet reference ↗

diagnose wireless-controller wlac -c vap
diagnose wireless-controller wlac -c radio
diagnose wireless-controller spectral-info

Reachability from FortiGate

Official / Fortinet reference ↗

execute ping <FAP-IP>
diagnose sniffer packet any 'host <FAP-IP>' 4 0 l

CAPWAP / discovery capture

Official / Fortinet reference ↗

diagnose sniffer packet <interface> "arp or udp port 5246 or udp port 67" 6 0 l

Filter debug to one FortiAP

Official / Fortinet reference ↗

diagnose wireless-controller wlac wtp_filter clear
diagnose wireless-controller wlac wtp_filter <FAP-SN> 0-<FAP-IP>:5246 255
diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application cw_acd 0x7ff
diagnose debug enable
# reproduce the issue
diagnose debug disable
diagnose debug reset

Filter debug to one client

Official / Fortinet reference ↗

diagnose wireless-controller wlac sta_filter clear
diagnose wireless-controller wlac sta_filter <CLIENT-MAC> 255
diagnose debug enable
# reproduce the client issue
diagnose debug disable
diagnose debug reset

CAPWAP plain-control capture

Official / Fortinet reference ↗

# FortiGate/controller
diagnose wireless-controller wlac plain-ctl <FAP-SERIAL> 1

# FortiAP shell
cw_diag plain-ctl 1

Temporarily allow FortiAP SSH

Official / Fortinet reference ↗

config wireless-controller wtp
    edit "<FAP-SERIAL>"
        set override-allowaccess enable
        set allowaccess ssh
    next
end

Controller dependencies

Official / Fortinet reference ↗

show full system interface
show full system dhcp server
show full system ntp
show full system dns
diagnose debug crashlog read
diagnose wireless-controller wlac show all

FortiAP local shell collection

Official / Fortinet reference ↗

cw_diag show all
dmesg
cw_diag kernel-panic

Wireless mesh: root AP + remote/leaf AP

Use this when the root FortiAP has a wired connection to the FortiGate network, but the remote/leaf FortiAP needs to reach the controller over a wireless backhaul. The mesh backhaul is a separate SSID used by the APs; client SSIDs are configured separately.

Fortinet: Configuring a meshed WiFi network (7.4.10) ↗

1. Create the mesh backhaul SSID on the FortiGate

In the GUI, go to WiFi & Switch Controller → SSIDs → Create New, set Traffic Mode = Mesh, choose the backhaul SSID, and configure WPA2-Personal or WPA3-SAE. For Wi-Fi 6E mesh backhaul, Fortinet requires WPA3-SAE with H2E.

config wireless-controller vap
    edit "MESHROOT"
        set mesh-backhaul enable
        set ssid "fortinet.mesh.root"
        set security wpa3-sae
        set pmf enable
        set sae-h2e-only enable
        set schedule "always"
        set sae-password <STRONG-MESH-PASSWORD>
    next
end

2. Put the mesh SSID on the root AP backhaul radio

Edit the FortiAP profile used by the root AP.
Choose the radio that will carry the mesh backhaul and add MESHROOT to that radio.
For best performance, dedicate a radio to mesh backhaul when the AP model and design allow it.
Assign the profile to the wired root FortiAP and confirm the root is Online.

3. Configure the remote/leaf FortiAP for mesh uplink

You can connect to the leaf directly or temporarily manage it through the FortiGate, then enter the FortiAP-local commands below. The SSID, password, and security mode must match the root mesh backhaul.

cfg -a MESH_AP_TYPE=1
cfg -a MESH_AP_SSID=fortinet.mesh.root
cfg -a MESH_AP_SECURITY=2
cfg -a MESH_AP_PASSWD=<STRONG-MESH-PASSWORD>
cfg -c
exit

MESH_AP_SECURITY: 0 = open, 1 = WPA/WPA2-Personal, 2 = WPA3-SAE. Match the security mode configured on the mesh backhaul SSID.

4. Move the leaf AP to wireless backhaul

Disconnect Ethernet from the leaf AP and power-cycle it.
The leaf scans for the configured mesh SSID and connects through the root AP.
On the FortiGate, go to WiFi & Switch Controller → Managed FortiAPs.
When the leaf appears as waiting for authorization, authorize it and assign the appropriate FortiAP profile.
Verify that the leaf becomes Online through the mesh root.

5. Verify the mesh

get wireless-controller wtp
diagnose wireless-controller wlac -c wtp
diagnose wireless-controller wlac -d wtp

Version note: FortiAP 7.6.3+ with supported FortiOS releases also supports Zero-Touch Provisioning for mesh leaf APs using default-mesh-root. The manual workflow above is useful across the 7.4.x/7.6.x families and makes the backhaul settings explicit.

Remote FortiAP / work from home: tunnel corporate traffic to the FortiGate

This is different from wireless mesh. A remote/teleworker FortiAP connects through the user's home Internet connection to the enterprise FortiGate WiFi controller. The FortiAP can broadcast the corporate SSID at home and carry corporate traffic back through the FortiAP-to-FortiGate tunnel.

Fortinet: Remote WLAN FortiAPs (7.6.0) ↗

1. Prepare the FortiGate

Make sure the corporate wireless SSID is configured in Tunnel mode.
On the Internet-facing FortiGate interface that the remote FortiAP will reach, enable Security Fabric Connection.
Create a separate FortiAP profile for teleworkers/remote APs. Set an AP login password and select only the SSIDs that should be available remotely.
Use an encrypted FortiAP data channel. Fortinet supports DTLS and IPsec; IPsec is a common choice for Internet-connected remote APs.

config wireless-controller wtp-profile
    edit "<REMOTE-AP-PROFILE>"
        set dtls-policy ipsec-vpn
    next
end

2. Choose full tunnel or corporate-only split tunnel

Full tunnel: By default, remote FortiAP client traffic is sent back to the FortiGate. Leave split tunneling disabled if you want Internet and corporate traffic inspected at the main FortiGate.

Corporate-only tunnel: If you only want corporate destination subnets tunneled to the FortiGate and want normal Internet traffic to exit locally at home, enable split tunneling:

config system settings
    set gui-fortiap-split-tunneling enable
end

config wireless-controller wtp-profile
    edit "<REMOTE-AP-PROFILE>"
        set split-tunneling-acl-path tunnel
    next
end

Edit the remote corporate SSID and enable Split Tunneling.
Edit the remote FortiAP profile and add the corporate destination subnets that should be tunneled.
With split-tunneling-acl-path tunnel, the listed corporate subnets are sent to the FortiGate; other traffic can use the local home gateway.

3. Point the FortiAP at the main FortiGate before sending it home

Connect the FortiAP to a network with DHCP.
Open the FortiAP local GUI and go to Local Configuration.
Set AC Discovery Type to Static and enter the FortiGate's public IP, or use DNS and enter a public FQDN that resolves to the FortiGate.
Set AP Data Channel Security to IPsec Enabled.
Save the configuration.

FortiAP-local CLI can also set the primary controller address:

cfg -a AC_IPADDR_1=<FORTIGATE-PUBLIC-IP>
cfg -c

4. Pre-authorize the remote FortiAP

On the FortiGate, go to WiFi & Switch Controller → Managed FortiAPs.
Create a managed AP entry using the FortiAP serial number.
Give it a useful remote-user/site name.
Assign the teleworker/remote FortiAP profile.

You can also authorize and assign a profile through CLI after the AP is discovered:

config wireless-controller wtp
    edit "<FAP-SERIAL>"
        set admin enable
        set wtp-profile "<REMOTE-AP-PROFILE>"
    next
end

5. Install the FortiAP at home

Connect the FortiAP Ethernet/WAN uplink to the user's home router or network with DHCP and Internet access.
Power on the FortiAP.
The FortiAP uses the configured public FortiGate IP/FQDN to discover the enterprise controller over the Internet.
Once connected and authorized, the FortiAP downloads its profile and broadcasts the corporate SSID.
A client connecting to that SSID is carried back to the FortiGate according to the full-tunnel or split-tunnel policy selected above.

6. Verify and troubleshoot

get wireless-controller wtp
diagnose wireless-controller wlac -c wtp
diagnose wireless-controller wlac -d wtp

# CAPWAP control/data visibility
diagnose sniffer packet any 'udp port 5246 or udp port 5247' 4 0 l

Important: The FortiGate's public IP/FQDN must actually be reachable from the Internet path used by the remote AP. If the FortiGate sits behind upstream NAT, make sure the public address and upstream forwarding design deliver the FortiAP control/data traffic to the intended FortiGate.

Managed FortiAP workflow

1. Verify AP IP/DHCP/DNS/NTP and FortiGate reachability.
2. Confirm authorization and WTP state.
3. Check VAP and radio state.
4. Check station association and RSSI.
5. Capture CAPWAP / DHCP / ARP if discovery is failing.
6. Apply WTP or station filters before real-time debug.
7. Disable debug and reset filters when finished.