Preventing IP fragmentation of packets in CAPWAP tunnels
A common problem with controller-based WiFi networks is reduced performance due to IP fragmentation of the packets in the CAPWAP tunnel.
Fragmentation can occur because of CAPWAP tunnel overhead increasing packet size. If the original wireless client packets are close to the maximum transmission unit (MTU) size for the network (usually 1500 bytes for Ethernet networks unless jumbo frames are used) the resulting CAPWAP packets may be larger than the MTU, causing the packets to be fragmented. Fragmenting packets can result in data loss, jitter, and decreased throughput.
LED options
The FortiOS/FortiAP solution to this problem is to cause wireless clients to send smaller packets to FortiAP devices, resulting in1500-byte CAPWAP packets and no fragmentation. The following options configure CAPWAP IP fragmentation control:
config wireless-controller wtp-profle edit FAP321C-default set ip-fragment-preventing {tcp-mss-adjust | icmp-unreachable}
set tun-mtu-uplink {0 | 576 | 1500} set tun-mtu-downlink {0 | 576 | 1500}
end
end
By default, tcp-mss-adjust is enabled, icmp-unreachable is disabled, and tun-mtu-uplink and tun-mtu-downlink are set to 0.
To set tun-mtu-uplink and tun-mtu-downlink, use the default TCP MTU value of 1500. This default configuration prevents packet fragmentation because the FortiAP unit limits the size of TCP packets received from wireless clients so the packets don’t have to be fragmented before CAPWAP encapsulation.
The tcp-mss-adjust option causes the FortiAP unit to limit the maximum segment size (MSS) of TCP packets sent by wireless clients. The FortiAP does this by adding a reduced MSS value to the SYN packets sent by the FortiAP unit when negotiating with a wireless client to establish a session. This results in the wireless client sending packets that are smaller than the tun-mtu-uplink setting, so that when the CAPWAP headers are added, the CAPWAP packets have an MTU that matches the tun-mtu-uplink size.
The icmp-unreachable option affects all traffic (UDP and TCP) between wireless clients and the FortiAP unit. This option causes the FortiAP unit to drop packets that have the “Don’t Fragment” bit set in their IP header and that are large enough to cause fragmentation and then send an ICMP packet — type 3 “ICMP Destination unreachable” with code 4 “Fragmentation Needed and Don’t Fragment was Set” back to the wireless controller. This should cause the wireless client to send smaller TCP and UDP packets.
Overriding IP fragmentation settings on a FortiAP
If the FortiAP Profile settings for IP fragmentation are not appropriate for a particular FortiAP, you can override the settings on that specific unit.
config wireless-controller wtp edit FAP321C3X14019926 set override-ip-fragment enable
set ip-fragment-preventing {tcp-mss-adjust | icmp-unreachable}
set tun-mtu-uplink {0 | 576 | 1500} set tun-mtu-downlink {0 | 576 | 1500}
end
end
LED options
Optionally, the status LEDs on the FortiAP can be kept dark. This is useful in dormitories, classrooms, hotels, medical clinics, hospitals where the lights might be distracting or annoying to occupants.
On the FortiGate, the LED state is controlled in the FortiAP Profile. By default the LEDs are enabled. The setting is CLI-only. For example, to disable the LEDs on FortiAP-221C units controlled by the FAP221C-default profile, enter:
config wireless-controller wtp-profile
CAPWAP bandwidth formula
edit FAP221C-default set led-state disable
end
You can override the FortiAP Profile LED state setting on an individual FortiAP using the CLI. For example, to make sure the LEDs are disabled on one specific unit, enter:
config wireless-controller wtp edit FAP221C3X14019926 set override-led-state enable set led-state disable
end
The LED state is also controllable from the FortiAP unit itself. By default, the FortiAP follows the FortiAP Profile setting.
LED schedules
Use the command below (led-schedule) to assign recurring firewall schedules for illuminating LEDs on the FortiAP. This entry is only available when led-state is enabled, at which point LEDs will be visible when at least one of the schedules is valid.
Separate multiple schedule names with a space, as configured under config firewall schedule group and config firewall schedule recurring.
Syntax
config wireless-controller wtp-profile edit {name} set led-state {enable | disable} set led-schedules <name>
next
end
Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!