FortiOS Handbook - Deploying Wireless Networks

What’s new in FortiOS 5.4
To enable automatic authorization per-interface
config system interface
edit port15
set auto-auth-extension-device enable
end
In the GUI, the Automatically authorize devices option is available when Addressing Mode is set to
Dedicated to Extension Device.
Control WIDS client deauthentication rate for DoS attack (285674 278771)
As part of mitigating a Denial of Service (DoS) attack, the FortiGate sends deauthentication packets to unknown
clients. In an aggressive attack, this deauthentication activity can prevent the processing of packets from valid
clients. A new WIDS Profile option in the CLI limits the deauthentication rate.
config wireless-controller wids-profile
edit default
set deauth-unknown-src-thresh 10
end
The range is 1 to 65,535 deathorizations per second. 0 means no limit. The default is 10.
Prevent DHCP starvation (285521)
The SSID broadcast-suppression settings in the CLI now include an option to prevent clients from depleting the
DHCP address pool by making multiple requests. Add this option as follows:
config wireless-controller vap
edit "wifi"
append broadcast-suppression dhcp-starvation
end
Prevent ARP Poisoning (285674)
The SSID broadcast-suppression settings in the CLI now include an option to prevent clients from spoofing ARP
messages. Add this option as follows:
config wireless-controller vap
edit "wifi"
append broadcast-suppression arp-poison
end
Suppress all other multicast/broadcast packets (282404)
The SSID broadcast-suppression field in the CLI contains several options for specific multicast and broadcast
packet types. Two new options suppress multicast (mc) and broadcast (bc) packets that are not covered by any of
the specific options.
config wireless-controller vap
edit "wifi"
append broadcast-suppression all-other-mc all-other-bc
end
16 Deploying Wireless Networks for FortiOS 5.4
Fortinet Technologies Inc.