FortiAP (Wi-Fi 6/6E/7)

FortiAP is Fortinet's enterprise wireless access point family. It spans indoor, outdoor and ruggedized models across the Wi-Fi 6, Wi-Fi 6E and Wi-Fi 7 generations. They run under one of three management models without the need to buy a separate WLAN controller appliance: FortiGate's integrated WLAN controller, the FortiEdge Cloud provisioning portal, or FortiSASE (Fortinet FortiAP Series Data Sheet, 2026). The result is that wired and wireless security converge into a single policy set.

Threat data shows why that convergence matters. According to Verizon's 2025 Data Breach Investigations Report, edge devices and VPNs accounted for 22% of exploitation-of-vulnerability actions — almost eight times the previous year's 3% (Verizon DBIR, 2025). Every device at the network edge — access points included — is now an actively scanned attack surface. Managing access points from the same policy engine as the firewall is therefore a security requirement rather than an operational convenience.

What is FortiAP and how does it differ from a classic controller architecture?

Short answer: FortiAP is an enterprise Wi-Fi family that moves the management plane out of the access point itself — and out of a separate controller box — and into the Fortinet Security Fabric. In a traditional enterprise wireless architecture you buy a WLAN controller appliance (often a redundant pair), manage it from a separate interface, and write wireless security policy independently of the firewall on the wired side. With FortiAP that intermediate layer disappears: access points register with the WLAN controller inside the FortiGate firewall, and FortiGate's security profiles are applied to wireless traffic.

Fortinet's FortiAP data sheet describes this approach explicitly: access points are centrally managed through the wireless controller function integrated into the market-leading FortiGate appliance, and the built-in firewall, IPS, application control and web filter protect the wireless LAN against current threats (Fortinet, 2026).

This architecture delivers three concrete benefits to the network team. First, the policy a wireless client sees and the policy a wired client sees come from the same source; there is no need to maintain a separate rule set per SSID. Second, incident investigation happens in a single log stream — which user reached which application over which SSID lands in the same correlation engine as wired events on the FortiAnalyzer side. Third, on the procurement side, controller hardware, controller software maintenance and the high-availability pair for that hardware all come out of the budget.

This is also consistent with Fortinet's product strategy. Fortinet states that the Security Fabric provides unified visibility across an ecosystem covering more than 500 third-party solutions in addition to its own products, and according to the company's official page more than 1,000,000 customers use Fortinet solutions (Fortinet, 2026). The firewall leg of the platform was positioned as a Leader in the 2025 Gartner Magic Quadrant for Hybrid Mesh Firewall (Fortinet, 2025). FortiAP is the wireless access leg of that architecture; it is not a separate product island.

How many ways can FortiAP be managed, and which one suits whom?

Short answer: there are three models — FortiGate's integrated WLAN controller, the FortiEdge Cloud provisioning and management portal, and FortiSASE (Fortinet FortiAP Series Data Sheet, 2026). The choice depends on whether a FortiGate is already on site, how many locations there are, and whether local IT resources exist. The three are alternatives to one another, but they can also be combined across different location types.

In practice the first model is the most common choice. If the branch already has a FortiGate 80F and the campus distribution layer has a FortiGate 200F, no additional investment is needed for a wireless controller. Here it pays to be honest: how many FortiAPs a FortiGate can manage depends on the model, and the generic claim circulating online that "every FortiGate manages hundreds of APs" is not true. We verify that number against the official data sheet of the FortiGate model selected during design, and size it with headroom for growth.

The third model is increasingly requested for distributed and small locations. The FortiAP data sheet notes that in a micro-branch scenario the access point can operate as a SASE endpoint with provisioning done from the FortiSASE interface, while in the remote-worker scenario split tunneling keeps local traffic local and sends traffic that must be inspected to the central site (Fortinet, 2026).

What is the difference between Wi-Fi 6, Wi-Fi 6E and Wi-Fi 7, and which generation should I choose?

Short answer: the difference is available spectrum and channel width. Wi-Fi 6 (802.11ax) uses the same spectrum in the 2.4 and 5 GHz bands more efficiently; Wi-Fi 6E moves the same 802.11ax radio into the 6 GHz band, which is relatively new and therefore uncrowded; Wi-Fi 7 (802.11be) adds wider channels and multi-link operation on top of 6 GHz support, targeting latency stability. In an enterprise environment the deciding factor is not peak speed but stability under density.

The FortiAP portfolio covers all three generations together: indoor and outdoor Wi-Fi 7 models, ruggedized outdoor Wi-Fi 6E models (FAP-432G and FAP-234G) and Wi-Fi 6 models all sit in the same family; PoE requirements are 802.3at or 802.3bt depending on the model (Fortinet FortiAP Series Data Sheet, 2026). The family's Wi-Fi 7 flagships, FAP-441K and FAP-443K, offer four radios and four spatial streams, support the 6 GHz band, and come with 10 Gigabit Ethernet ports and 802.3bt PoE; the maximum data rate stated in the data sheet with 4x4 MU-MIMO is 1.148 Gbps in the 2.4 GHz band, 8.648 Gbps in the 5 GHz band and 11.53 Gbps in the 6 GHz band (Fortinet, 2026).

It is equally important to say what these numbers are not. They are theoretical PHY rates per band; they are not the throughput a single user will see. Real-world outcomes are determined by the generation mix of the client fleet, the channel plan, interference from neighbouring buildings, wall materials and uplink capacity. On the capacity side the data sheet publishes only two ceiling values: the maximum number of clients per radio is 128, 256 or 512 depending on the model, and on most models a maximum of 8 SSIDs can be broadcast per client-serving radio — a figure that drops to 7 when background scanning is enabled (Fortinet, 2026). These are hardware ceilings, not design targets; the vendor does not publish coverage figures of the "this model covers X square metres" variety. For that reason we do not quote numbers for coverage area or real user density on this page; both are determined project by project through a site survey and an RF plan.

Our practical advice is this: for a new building or a comprehensive refresh, Wi-Fi 7 models should be selected with the cabling planned alongside them, because cabling is a far longer-lived investment than access points. If an existing Wi-Fi 6 deployment is running without problems, there is no need for a wholesale swap purely to jump a generation; instead, the areas experiencing density issues (meeting floors, lecture halls, the cafeteria) are moved to Wi-Fi 6E/7 in a targeted way first. Older clients continue to connect to the new access points using the generation they support.

How is a campus network designed with FortiAP and FortiSwitch?

Short answer: FortiGate sits at the centre as the policy engine and WLAN controller, FortiSwitch provides PoE and segmentation at the access layer, and FortiAP forms the wireless edge. Because all three share the same management surface, the campus network is administered as a single logical device. The FortiLink protocol turns FortiSwitch into a logical extension of FortiGate; between 8 and 300 switches can be managed depending on the FortiGate model (Fortinet FortiSwitch Secure Access Data Sheet, 2026).

On the access layer, the FortiSwitch Secure Access series scales to 48 access ports in a 1 RU chassis, offers 10GE uplinks and can be managed in standalone, FortiLink or FortiEdge Cloud modes (Fortinet, 2026). The FortiLink integration also delivers basic network access control (NAC) at no extra cost: profiling of connected devices, automatic segmentation for IoT, quarantine on violation and virtual patching are all included (Fortinet, 2026).

NAC functions are included on the FortiAP side as well, but the FortiAP data sheet states in a footnote that these functions apply only in FortiGate-managed deployments (Fortinet, 2026). This distinction directly affects the architectural decision: if device profiling and automatic segmentation are expected, the access points must be registered with FortiGate.

In a typical campus design the layers are arranged as follows: FortiGate at the core or distribution layer; FortiSwitches connected by FortiLink on each floor; FortiAPs positioned in the ceiling according to the RF plan. User, guest, IoT and management traffic are separated into different VLANs, and inter-VLAN transitions pass through FortiGate policy. On the wireless side the same separation is applied at SSID level, with SSIDs carried to FortiGate in tunnel mode. As a result, whether a guest's phone can reach the corporate server network depends on central policy rather than on one mistaken switch configuration.

The access points themselves also support multiple SSID modes: the FortiAP data sheet lists the supported SSID types as Local-Bridge, Mesh and Tunnel (Fortinet, 2026). Local-Bridge mode keeps traffic local and suits low-latency requirements; Tunnel mode carries all traffic to the controller and suits centralized inspection; Mesh mode establishes a wireless uplink for locations where cable cannot be run.

How are the PoE budget and cabling planned?

Short answer: the PoE class of the access point must match the class the switch port can supply. FortiAP models require 802.3at or 802.3bt depending on the model (Fortinet, 2026). The four-radio Wi-Fi 7 flagships FAP-441K and FAP-443K are in the 802.3bt class, and the data sheet tabulates two power modes for these models: in Full mode (802.3bt, 2x802.3at or DC adapter) all radios run at maximum transmit power with 4x4 chains and the USB port is enabled; if power is supplied by 802.3at only or 2x802.3af, the device drops to High mode — radios fall to 17 dBm low transmit power, the chain count is halved to 2x2 and USB is disabled (Fortinet, 2026). The maximum power consumption of these same models is stated as 41.7 W. In other words, a Wi-Fi 7 access point plugged into an older 802.3at switch will work, but part of the capacity you paid for cannot be used; this is the single most common surprise in wireless projects.

On the supply side, all models in the FortiSwitch Secure Access family support PoE+; selected models deliver 90 W per port with 802.3bt — for example, a configuration with 8 x 802.3bt (90 W) and 16 x 802.3af/at (30 W) ports appears in the ordering table (Fortinet, 2026). The total PoE budget in a given cabinet varies by model; we do not write that value into a project without verifying it against the selected model's official data sheet.

Two decisions matter on the cabling side. First, the Wi-Fi 7 flagship models have a 10 Gigabit Ethernet port (Fortinet, 2026); if the access switch has no multi-gig or 10GE port, the access point cannot use its own capacity and the bottleneck forms in the cable rather than in the wireless. Second, redundancy: the FAP-441K and FAP-443K have two multi-speed RJ45 ports (100M/1G/2.5G/5G/10G), both ports can accept 802.3bt power, and the data sheet marks hit-less PoE failover as supported on these models (Fortinet, 2026). Connecting the second port to a different switch or a separate PoE source prevents a single switch or port failure from taking the access point down. In new-build projects, planning cabling one category higher so it does not have to be re-pulled when the access point generation changes raises the initial investment only modestly and saves money over the long term.

What threats does a wireless network face, and how does FortiAP respond?

Short answer: the wireless layer's own risks (rogue access points, weak authentication, uninspected guest traffic) overlap with the general trend of attacks aimed at the network edge. In Verizon's 2025 report, exploitation of vulnerabilities reached 20% as an initial access vector, a 34% increase over the previous report (Verizon DBIR, 2025). ENISA's 2025 Threat Landscape report, analysing 4,875 incidents, identifies phishing at 60% as the dominant intrusion vector (ENISA, 2025) — meaning that inspection after the user is on the network matters at least as much as connection security.

The corresponding capabilities on the FortiAP side are defined in the data sheet. Authentication supports WPA, WPA2 and WPA3 with 802.1X or pre-shared key, a web captive portal and MAC lists; at radio level, rogue scanning and WIPS/WIDS can be run in background or dedicated mode (Fortinet, 2026). On models with a dedicated scanning radio, scanning runs continuously without interrupting the access service — the four-radio FAP-441K and FAP-443K are examples of this group.

The real difference emerges on the policy side. When wireless traffic passes through FortiGate profiles, IPS, application control and web filtering are applied to the wireless client as well. FortiGuard Labs is stated to process and analyse more than 100 billion events per day using artificial intelligence and machine learning systems (Fortinet, 2026); a DNS request leaving the guest SSID is evaluated against that same intelligence set. Organizations that also want to close the endpoint side can bring device posture into the wireless access decision with FortiClient.

What do KVKK and PCI DSS require from a wireless network?

Short answer: that you treat the wireless network as a separate trust zone and document the control between the zones. Requirement 1.3.3 of PCI DSS v4.0 mandates that a network security control (NSC) be installed between the wireless network and the cardholder data environment (CDE), and that all traffic from the wireless network to the CDE be denied by default (PCI Security Standards Council, PCI DSS v4.0). If segmentation is used as a scope-reduction method, requirement 11.4.5 calls for segmentation controls to be penetration tested at least once every 12 months and after any change to segmentation (PCI Security Standards Council, PCI DSS v4.0).

One note: in PCI DSS v4.0 the term "firewall" was replaced by "Network Security Controls (NSC)"; be wary of documents that present the older v3.2.1 language as the current requirement text. The FortiAP data sheet likewise states that the product protects against advanced wireless threats and is designed to help meet industry compliance requirements such as PCI DSS (Fortinet, 2026).

On the KVKK (Turkey's data protection law) side, the reference text is the Personal Data Security Guide (Technical and Administrative Measures) published by the Turkish Personal Data Protection Authority (January 2018). The guide defines the firewall and gateway as the first line of defence against unauthorized access threats from the internet; in its summary table of technical measures, network security, intrusion detection and prevention systems, and keeping log records regularly are listed as separate items (KVKK, 2018).

In practice, the arrangement we build can be summarized as follows: a guest SSID on a separate VLAN with a separate policy set; a default-deny rule from guest to the corporate server network; central collection of authentication and session records; and storage of wireless authentication events in the same archive as wired events. On the logging side, the FortiAnalyzer hardware family supports between 180 and 10,000 devices/VDOMs and can be built into a high-availability cluster of up to four nodes (Fortinet FortiAnalyzer Data Sheet, 2026); the answers to audit questions are produced from that archive.

What does Sora Yazılım do in a FortiAP project?

Short answer: we treat the wireless network as a design exercise, not as a hardware list. As a Fortinet authorized channel partner we provide licensing, deployment, migration and managed services. The scope of a FortiAP project typically comprises the following steps: documenting the current state and the client fleet, site survey and RF plan, model and generation selection, PoE and cabling verification, controller configuration on FortiGate, SSID/VLAN/policy design, guest portal and registration method, post-installation validation measurements, and go-live.

The client fleet determines the model selection. Moving to a flagship Wi-Fi 7 model in an office that mostly hosts Wi-Fi 5 and Wi-Fi 6 devices is an inefficient use of budget; conversely, not choosing Wi-Fi 7 in a new campus building means revisiting the cabling within a few years. Ruggedized outdoor models are a separate topic altogether, intended for environments such as warehouse yards, ports, factory grounds and open car parks.

For organizations that want the entire campus network delivered by a single supplier, we position FortiAP together with FortiSwitch and FortiGate, bringing the whole Fortinet product family into one architecture. Our DevOps and infrastructure services come into play for automation, monitoring and continuity needs on the network and systems side. For organizations evaluating an alternative wireless platform for budget or supply reasons, we also offer Ruijie enterprise network solutions; the choice is made according to the organization's existing security architecture.

Talk to our team about a wireless network refresh, wireless design for a new building, a Wi-Fi 6E/7 migration, or a health check of your existing FortiAP deployment. We identify the model and licence combination that fits your requirements and prepare a project-based quotation — to get started, reach us through our contact page and let's schedule a site survey.