FortiAP CLI Cheat Sheet

get wireless-controller wtp
diagnose wireless-controller wlac help
diagnose wireless-controller wlac -c wtp
diagnose wireless-controller wlac -d wtp

diagnose wireless-controller wlac -c sta
diagnose wireless-controller wlac -d sta

diagnose wireless-controller wlac -c vap
diagnose wireless-controller wlac -c radio
diagnose wireless-controller spectral-info

execute ping <FAP-IP>
diagnose sniffer packet any 'host <FAP-IP>' 4 0 l

diagnose sniffer packet <interface> "arp or udp port 5246 or udp port 67" 6 0 l

diagnose wireless-controller wlac wtp_filter clear
diagnose wireless-controller wlac wtp_filter <FAP-SN> 0-<FAP-IP>:5246 255
diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application cw_acd 0x7ff
diagnose debug enable
# reproduce the issue
diagnose debug disable
diagnose debug reset

diagnose wireless-controller wlac sta_filter clear
diagnose wireless-controller wlac sta_filter <CLIENT-MAC> 255
diagnose debug enable
# reproduce the client issue
diagnose debug disable
diagnose debug reset

# FortiGate/controller
diagnose wireless-controller wlac plain-ctl <FAP-SERIAL> 1

# FortiAP shell
cw_diag plain-ctl 1

config wireless-controller wtp
    edit "<FAP-SERIAL>"
        set override-allowaccess enable
        set allowaccess ssh
    next
end

show full system interface
show full system dhcp server
show full system ntp
show full system dns
diagnose debug crashlog read
diagnose wireless-controller wlac show all

cw_diag show all
dmesg
cw_diag kernel-panic

1. Verify AP IP/DHCP/DNS/NTP and FortiGate reachability.
2. Confirm authorization and WTP state.
3. Check VAP and radio state.
4. Check station association and RSSI.
5. Capture CAPWAP / DHCP / ARP if discovery is failing.
6. Apply WTP or station filters before real-time debug.
7. Disable debug and reset filters when finished.