Looks like this has been broken since 5.2 and is still an issue in 5.6.
I've entered an NFR (New Feature Request) with Fortinet to have the FortiAnalyzer support showing all SSIDs, APs, and WiFi clients, regardless of whether they are tunneled or bridged.
FYI, to explain this in more detail, I've included a paraphrase of my feature request text below.
The feature request is to fix what I see as a pretty large oversight/bug in FortiAnalyzer’s FortiView. FAZ 5.4.4 does not show any non-tunnel wifi clients, SSIDs, or APs, while the FortiGate correctly shows them all. I’d like to see the FortiAnalyzer correctly show all the FortiGate’s APs, SSIDs, and WiFi Clients.
To see the current situation, consider two FortiAP’s managed by a single FortiGate, each handling a few SSIDs but only one FAP having SSID’s with tunnel mode interfaces (the other SSIDs being local bridge interfaces).
From the FortiGate I can look at:
WiFi & Switch Controller
Log & Report
- WiFi Client Monitor
- Rogue AP Monitor
- WiFi Health Monitor
And I will see both FAPs, all the SSIDs, and all of the WiFi clients.
From the FortiAnalyzer, I will only see the following:
FortiView > WiFi
- Authorized APs –Only FAP with tunnel mode SSIDs is listed. The other FAP won’t even be visible.
- Authorized SSIDs – Only SSIDs with tunnel mode listed. No other SSIDs (the majority) are shown.
- WiFi Clients – Only wifi clients on tunneled SSID shown. So I see less than a quarter of the wifi clients.
Since the FortiAnalyzer is the main face of the security fabric, this means that the primary way recommended to view the network doesn't show over half of the wifi clients or SSIDs.
My feature request is that the FortiAnalyzer correctly show APs, SSIDs, and WiFi clients for SSIDs that are locally bridged by the APs.
This may require a small bit of extra logging from the FortiGate, as I believe this issue is due to SSID info not being logged for bridged interfaces.
Until this is implemented, this should really be listed in the FortiAnalyzer release notes as a known issue.