FCP_FWF_AD-7.4 FCP - Secure Wireless LAN 7.4 Administrator Questions and Answers

When you need different access levels for various users and device types but want to keep the SSID structure simple, dynamic VLAN assignment is the best practice.

With dynamic VLANs, all clients connect to the same SSID. The RADIUS server (via 802.1X authentication or MAC authentication) assigns each user or device to a specific VLAN based on attributes (like user group, device type, etc.).

This design:

Reduces SSID sprawl.

Allows flexible, scalable, and policy-driven access.

Simplifies management and enhances security.

The other options are either less scalable (multiple SSIDs) or do not provide the required dynamic access control (user groups or NAC alone without VLAN assignment).

FortiAP and Rogue AP Detection:

Background Scanning:

FortiAPs can perform background scanning for rogue APs while actively servicing clients (broadcasting SSIDs). This means they periodically switch from client service to scan the air for unauthorized APs.

This enables detection of threats without a dedicated radio, using periodic scans on service radios.

Manual Suppression:

Suppression of rogue APs (for example, sending de-auth frames to clients of a rogue) must be triggered manually by an administrator from the FortiGate/FortiAP interface.

Automatic Suppression:

FortiAPs do NOT offer automatic suppression of rogue APs by default. Suppression is an explicit administrative action.

Dedicated Monitoring Radios:

Some APs (higher-end models) may have dedicated radios, but this is not the case for all FortiAPs; background scanning is the standard.

Option Breakdown:

A. FortiAP offers automatic suppression of rogue APs when broadcasting SSIDs

Incorrect. Suppression is manual.

B. FortiAP scans rogue APs in the background while broadcasting SSIDs

Correct. Background scanning is supported.

C. FortiAP detects rogue APs on dedicated monitoring radios

Incorrect for most deployments. Dedicated monitoring radios are available only in some models.

D. FortiAP suppresses detected rogue APs manually

Correct. Manual suppression is available via the management interface.

Channels 52 through 144 in the 5 GHz band (shown as UNII-2, UNII-2-Extended, and some adjacent channels) are marked in regulatory domains as DFS (Dynamic Frequency Selection) channels.

DFS channels must be monitored for radar activity (such as weather radar). If radar is detected, the AP must switch channels to avoid interference.

These channels can be used, but only if the AP supports DFS and performs the necessary checks before use.

WIDS can scan these channels but that’s not the defining characteristic.

Regulatory restrictions (B) apply only if DFS is not supported, which is rare on modern equipment.

Radio Resource Provisioning (C) is unrelated to DFS usage.

Wireless Intrusion Detection System (WIDS) in Fortinet’s Secure Wireless LAN (SWLAN) platform monitors for threats to the wireless environment and detects a range of attacks and misconfigurations.

The main threats detected by WIDS include:

Rogue access points: These are unauthorized APs plugged into the network, posing a security risk. WIDS scans and identifies any AP that is not part of the authorized network, flagging them as potential rogues.

Unauthorized wireless connections: WIDS can detect clients that connect to unauthorized or suspicious wireless networks, as well as unauthorized wireless devices attempting to connect to the network.

Analysis of Options:

A. Brute-force dictionary attacks:

WIDS does not specifically detect brute-force dictionary attacks against authentication. It focuses more on network topology threats and unauthorized devices.

B. Unauthorized wireless connection:

Correct. WIDS can detect unauthorized wireless connections, such as clients connecting to networks/APs that are not trusted.

C. Rogue access points:

Correct. Detecting rogue APs is a primary function of WIDS.

D. WPA2 authentication vulnerabilities:

WIDS does not specifically scan for cryptographic protocol vulnerabilities. It detects behavioral/network threats.

FortiPresence is Fortinet’s Wi-Fi analytics/cloud presence platform.

FortiAPs can be managed directly by FortiGate or FortiLAN Cloud and connect their analytics/events to the FortiPresence cloud for presence analytics.

FortiSASE and FortiSwitch Manager do not provide FortiPresence integration for APs.

Analysis of the Exhibits and Scenario:

The DHCP server configuration is correct for dynamic assignment within a specified IP range for the interface “WLAN01”.

The RADIUS configuration for user1 includes:

Tunnel-Type (should be set to VLAN, but value is missing)

Tunnel-Medium-Type (set to IEEE-802, which is correct for Ethernet/WiFi)

Tunnel-Private-Group-Id (set to “infrastructure” as a string)

The problem described: Dynamic VLAN assignment is not working for user1.

How Dynamic VLAN Assignment Works in 802.1X/EAP (with FortiGate/FortiAP):

When a user authenticates, the RADIUS server returns attributes specifying the VLAN that should be assigned.

The critical attributes are:

Tunnel-Type (must be set to value “VLAN”, which is integer 13)

Tunnel-Medium-Type (must be “IEEE-802”, integer 6)

Tunnel-Private-Group-Id (can be the VLAN name or VLAN ID, depending on your configuration)

Problem in the Exhibit:

The Tunnel-Type value is missing!

It must be set to 13 (for VLAN).

The Tunnel-Medium-Type and Tunnel-Private-Group-Id are correctly set.

Corrective Action:

Update user1’s RADIUS attributes so that Tunnel-Type is set to the correct value for VLAN (integer 13).

Without this, FortiGate/FortiAP will not know to interpret the returned VLAN name or ID for dynamic assignment.

Review of Options:

Disable the DHCP server on ONBOARD to allow VLAN assignment.

Irrelevant; DHCP server presence does not affect dynamic VLAN assignment.

Add user1 in one of the VLAN names

This is not how dynamic VLAN assignment works. The RADIUS response must include the correct VLAN assignment.

Update user1 RADIUS attributes to include a VLAN ID attribute ID

Correct. You must set Tunnel-Type (13) and possibly provide the VLAN ID in Tunnel-Private-Group-Id.

Create a new VLAN name infrastructure' with a VLAN ID associated with it

Not the root cause; you must first ensure the correct attributes are present in the RADIUS response.

Summary:

The missing “Tunnel-Type” attribute value is the reason dynamic VLAN assignment is not working. The correct configuration requires setting Tunnel-Type = 13 (VLAN) for user1 in the RADIUS server.