While all options are important, 802.11r Fast Roaming is specifically designed to reduce the latency and packet loss associated with the re-authentication process during client handoffs between APs. Enabling it is a key Fortinet recommendation for environments requiring seamless roaming, such as for VoIP or mobile users. Same SSID and VLAN are basic requirements, but without fast roaming, delays will persist.

Many older or budget personal devices only support the 2.4GHz band. If the Guest SSID is configured to broadcast only on 5GHz (a common practice to reduce congestion on 2.4GHz for corporate devices), these guest devices will be unable to detect the network. Checking and enabling dual-band broadcast for guest networks is a standard troubleshooting step.

In a high-density scenario, the primary goal is maximizing client-serving capacity. Configuring both radios on the FortiAP in ‘Access Point Mode’ allows the AP to use one radio for 2.4GHz clients and the other for 5GHz clients, effectively doubling the available airtime and number of serviceable clients. Other modes like Monitor or Spectrum Analysis are for scanning/security and do not serve clients.

Tunnel Mode (also known as CAPWAP tunnel mode) encapsulates all user wireless traffic (management and data) and sends it through a secure tunnel to the central FortiGate (or FortiLAN Cloud). This allows the FortiGate to apply security profiles, firewall policies, and see the original client IP addresses, which is essential for the described security policy. Bridge mode forwards traffic locally.

The Retry Percentage specifically measures the percentage of data frames that had to be re-transmitted to the client because an acknowledgment (ACK) was not received. A high value is a direct indicator of a poor-quality connection, often due to low signal strength (RSSI), distance, or interference, causing frames to be lost and needing re-sends, which degrades throughput.

The FortiGate’s built-in Report module contains specific templates (like ‘Wireless Network’ or ‘Wireless Clients’) designed to aggregate and present historical data over a configurable period. It can show trends, top clients, top applications, and association statistics, which is exactly what management requires. Logs are raw data, the client monitor is real-time, and performance graphs are more limited in scope.

The practical method is to use the Wireless Intrusion Detection (WIDS) profile. By enabling ‘Rogue AP Detection’ within a WIDS profile and applying that profile to the APs’ radio settings, the APs will use their off-channel scanning cycles to monitor for unauthorized devices. This leverages existing infrastructure (APs in dual-mode) rather than requiring dedicated hardware in monitor mode.

In Tunnel mode, the client’s DHCP discovery broadcast is encapsulated and sent to the FortiGate. The FortiGate acts as the DHCP relay agent. Therefore, the DHCP relay configuration (specifying the IP of the actual DHCP server) must be correctly set on the FortiGate interface that receives the tunneled traffic (typically the SSID’s dynamic interface). The local switch and FortiAP do not process this client DHCP traffic.

In Fortinet’s wireless mesh terminology, the AP with the wired uplink is designated as the ‘Mesh Root’. It forms the essential bridge between the wired network and the wireless mesh backhaul. Other APs (Mesh Nodes) connect wirelessly to a Mesh Root or another upstream node to extend network coverage where cabling is not feasible.

While all options are important, 802.11r Fast Roaming is specifically designed to reduce the latency and packet loss associated with the re-authentication process during client handoffs between APs. Enabling it is a key Fortinet recommendation for environments requiring seamless roaming, such as for VoIP or mobile users. Same SSID and VLAN are basic requirements, but without fast roaming, delays will persist.0