Fortinet wireless woes

[gerardsweeney]

Disclaimer: I'm a desktop admin, not infrastructure - so my phrasing here won't contain much accurate terminology - but I can obtain relevant information if required.

 

My authority has recently moved about half of their wireless infrastructure to Fortinet.. and it's been appalling, frankly.. Windows devices take anywhere from 5 to 15 minutes to connect to the 8021x SSID.

 

Fortinet support has not been 'speedy', other than diagnosing that the CPU and ram of the Fortinet gear is constantly spiking - and we only have a fraction of the WAPs that it's meant to be able to support.

 

Has anyone else had similar experiences, and possible solutions?

[Roberto]

I've had... mixed experiences shall we say... and therefore mixed opinions of Fortinet. That said, this does not sound anything like normal expected behaviour.

 

Is this a 'Windows-only' problem? Can other devices connect ok?

Are there any clues in the event logs on the workstations?

Issues with contacting authentication servers? If you're authenticating users with RADIUS, any errors on the radius server logs?

 

Where is the support from the installers in all this? Surely this was tested during the install and handover process?

[gerardsweeney]

A reasonably sized newly opened school was the pilot, and ran without any apparent issues for several months. The bigger primary schools and high schools were then migrated over the summer break.

 

Nothing noticeable in the event logs. If we take the same windows 10/11 devices to a non migrated school, they work immediately.

 

On affected devices, we can literally watch the PC trying to authenticate with the SSID. It usually just says it's unable to join.. Then eventually it'll join itself after a random interval between 5 and 15 minutes.

 

 

Radius.. pass. I can ask.

But the feedback we've had so far from our infrastructure team is that the Fortinet gateway (?) is running out of CPU and/or ram resources.

 

The initial setup apparently only had it running with a single CPU, so almost no devices were connecting ever on the first couple of weeks back. Changed settings saw an improvement in that it's a large portion of devices not connecting for 5-15 minutes.

 

Installers support - see above.. "not speedy".

 

We're predominantly Windows based. There's a chunk of Chromebooks out there that we actively don't support - but they're having the same issues (same WAPs, different SSID, Mac addresses control access rather than certificate based like Windows)

[Roberto]

This seems like a fairly fundamental thing for them to have missed if it really is that the Fortinet box is undersized. Is it also acting as a firewall? DPI absolutely killed performance on the Fortinet box I got annoyed with back in the day.

[gerardsweeney]

I don't believe it's acting as a firewall, no.

Not unless they've switched that on, and it's busy doing nothing helpful. I'll pass this onto my colleague.. Thanks for the suggestion!

[speakercon]

Experienced first hand no end of issues with FN waps, devices coming up with 'Can't connect to this network'.

 

If getting rid isn't an option try and find a firmware version that isn't too terrible and stick with it.

 

 

EDIT - Just looked up a post I made about this issue back in 2018! Looks like its not changed much. Not sure why people keep buying it, its not as if its cheap...

Edited September 9, 2024 by speakercon

[gerardsweeney]

Yikes.. that really doesn't sound promising.

Do you have a link to your post? And did you find a firmware version that wasn't terrible?

[speakercon]

FortiWLC-200D & Fortinet AP822i WAP's for new wireless network (edugeek.net)

 

There are some other threads too, one here from a few months ago - Fortinet FortiAP 231G Connected Classroom problems (edugeek.net)

 

No idea on the firmware I'm afraid, I wasn't involved in the deployment (thankfully). They just kept trying different versions from memory until one made it work just well enough to prevent it being ripped out (which it was a few years later).

[dmj]

We used to have fortinet back in the day. We found certain configurations could be extremely sensitive to out of date wifi drives on client devices.

It wasn't a problem for school owned devices where we could manage the wifi drivers, but was a huge issue with BYOD. A single out of date client driver could prevent an entire area from connecting, including devices that were updated.

Check your wifi drivers are upto date would be my experience.