Technical Tip: How to allow multiple bridge mode SSID from FortiAP
| Description | This article describes how to configure to bridge multiple internal networks wirelessly. |
| Scope | FortiAP managed by FortiGate. |
| Solution | When SSID is configured in bridge mode. It allows devices to connect seamlessly to the network using either wired or wireless means while maintaining a unified network environment. It allows wired and wireless networks to be on the same subnet. Bridge mode is commonly used in scenarios where network administrators want to extend the coverage of the wired network to areas where it is not feasible to run Ethernet cables, such as in large homes, office buildings, or campuses. In this case, it is wanted to bridge all the production VLAN networks present in the trunk interface of FortiGate.
Configure Management VLAN . Any VLAN that is passed from the trunk interface can be assigned as management VLAN for the FortiAP. However, in this case, a separate Management VLAN 40 is configured for ease of understanding. On the interface (Management VLAN), Security Fabric must be enabled for the CAPWAP connection.
Assign Management VLAN in FortiAP:
Here, FortiAP must be connected to a trunk interface that allows all the production VLANs 10, 20, 30 as well as management VLAN 40.
Configure VLAN on Bridge SSID. Since it is necessary to bridge the internal VLAN networks through wireless.
It is necessary to assign a VLAN ID on the 'Optional VLAN ID' of the Bridge Mode SSID.
Respectively, assign VLAN ID to the SSIDs wanted to bridge wirelessly.
Assign Bridged SSID to Managed FortiAP. Assign the Bridged SSID to the FortiAP profile and attach the profile to the Managed FortiAP.
Configure Firewall Policy. Allow wired and wireless devices to access external resources by configuring firewall policy facing toward the internet.
Configure trunk interfaces on the switch. Connect both FortiAP and FortiGate into two separate trunk interfaces of the switch. Allow all the VLANs including management VLAN through the trunk interface.
switch# configure terminal switch(config)# interface ethernet 0/1 switch(config-if)# description “Connected to FGT” switch(config-if)# switchport trunk allow vlan 10,20,30,40 switch(config-if)# end
switch# configure terminal switch(config)# interface ethernet 0/2 switch(config-if)# description “Connected to FortiAP” switch(config-if)# switchport trunk allow vlan 10,20,30,40 switch(config-if)# end
Related Document: WiFi network with wired LAN configuration.
|
