Chapter 6 Deploying Wireless Networks for FortiOS 5.0 : Protecting the WiFi Network : WiFi data channel encryption
  
WiFi data channel encryption
Optionally, you can apply DTLS encryption to the data channel between the wireless controller and FortiAP units. This enhances security.
There are data channel encryption settings on both the FortiGate unit and the FortiAP units. At both ends, you can enable Clear Text, DTLS encryption, or both. The settings must agree or the FortiAP unit will not be able to join the WiFi network. By default, both Clear Text and DTLS-encrypted communication are enabled on the FortiAP unit, allowing the FortiGate setting to determine whether data channel encryption is used. If the FortiGate unit also enables both Clear Text and DTLS, Clear Text is used.
Data channel encryption settings are located in the Custom AP profile. If you use Automatic profile, only Clear Text is supported.
 
Data channel encryption is software-based and can affect performance. Verify that the system meets your performance requirements with encryption enabled.