FortiAP CAPWAP DTLS Tunnel Timeout on High-Latency WAN Satellite Links
Remote FortiAPs connected across geostationary satellite (VSAT), Starlink, or high-jitter cellular WAN connections flap continuously and tear down CAPWAP sessions when DTLS keepalive heartbeats exceed the hardcoded 250ms controller response window.
Technical Root Cause Analysis
FortiGate wireless controller daemon cw_acd coordinates configuration, channel selection, and telemetry with FortiAPs over an encrypted CAPWAP DTLS tunnel (UDP 5246 and 5247). To verify tunnel liveness, the controller exchanges periodic DTLS Echo Request and Response datagrams with each managed access point.
In affected FortiOS 7.2 builds, cw_acd enforces a rigid heartbeat check: an echo interval of 5 seconds paired with a maximum retransmit limit of 3 consecutive misses, with an internal RTT deadline capped at 250ms. On satellite links (where propagation delay alone is 450–650ms) or jittery cellular connections, consecutive DTLS echo replies arrive outside the strict window. The controller prematurely declares the DTLS state dead, abruptly resets the CAPWAP session, disconnects associated client SSIDs, and forces the remote FortiAP to re-initiate discovery.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.2 – 7.2.6 | 7.2.7+ | Increase echo-interval & max-retransmit in AP profile |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Dynamic RTT calculation added in 7.4.2 |
| FortiOS 7.0 | Not Affected | 7.0.x Branch Clean | Legacy CAPWAP timer allowed wider default timeout window |
Platform Impact: Affects all FortiGate models managing FortiAP units (FAP-221E, 231F, 431F, etc.) over WAN connections with round-trip latency higher than 250ms or packet jitter exceeding 60ms.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to determine whether remote FortiAPs are experiencing DTLS echo timeouts and tunnel teardowns:
Diagnostic Commands
# 1. Inspect managed AP inventory, connection state, and uptime
diagnose wireless-controller wlc list-ap
# 2. Monitor wireless controller daemon CAPWAP DTLS events in real-time
diagnose debug application cw_acd -1
diagnose debug enable
# 3. Check detailed AP link quality and DTLS session status
diagnose wireless-controller wlc get-ap-status
# 4. Ping remote AP management IP to verify baseline WAN RTT and jitter
execute ping-options interval 1
execute ping-options repeat 10
execute ping <AP_IP_ADDRESS>Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the interactive Ferrite platform:
Frequently Asked Questions
The FortiOS wireless controller daemon cw_acd uses aggressive default DTLS heartbeat timers (echo interval of 5 seconds with 3 max retries). On high-latency links such as VSAT, Starlink, or rural cellular WANs where round-trip latency routinely exceeds 250ms or experiences queue delay, consecutive echo replies arrive after the timeout window. This triggers an ungraceful CAPWAP tunnel teardown and forces the AP into re-discovery.
Yes. By configuring 'set split-tunneling enable' or using local bridge SSIDs with 'set local-standalone enable', FortiAPs continue switching local LAN traffic even during transient CAPWAP management disconnects.
FortiOS 7.2.7 and 7.4.2 incorporate adaptive DTLS keepalive algorithms with dynamic RTT compensation for satellite and high-latency WAN links.