Staff

Technical Tip: How to configure a Bridge mode SSID on the FortiAP WiFi

Forum|Forum|1 year ago
September 23, 2024
0 replies
8608 views

Description

This article describes step-by-step instructions on how to configure a Bridge mode SSID on the FortiAP WiFi

Scope

FortiAP 7.4, FortiSwitch 7.2, and FortiGate 7.4.

FortiAP and FortiSwitch are managed by FortiGate and FortiAP is plugged into the FortiSwitch port.

SSID authentication mode is WPA2-PSK.

Solution

Navigate to 'WiFi & Switch Controller', and select 'Create New' -> SSID -> Traffic mode 'Bridge'.

In the Bridge mode SSID, the user data traffic is locally bridged by the AP, whereas in the Tunnel mode SSID the user data traffic is tunneled between the AP and the FGT via the CAPWAP Tunnel
By default, the 'Option VLAN ID' field is set to 0, meaning the users will be in the same VLAN as the AP management VLAN.
However, for better WiFi performance, use a dedicated VLAN for the Bridge SSID users: SSID and FortiAP should be in different VLANs.

Create a new VLAN 200 interface on the FortiGate (FortiSwitch Controller) and enable the DHCP Server on VLAN 200.

Image 2.PNG

Tag/Allow the new VLAN 200 on the AP uplink switchport; WiFi users connecting to this SSID will get an IP address from VLAN 200.

Image 3.PNG

Create a new Firewall policy to provide Internet access to the users in VLAN 200.

Image 4.PNG

Manually add the Bridge SSID 'Fortinet' to all the 'Access Point' radios in the FortiAP profile.

Image 5.PNG

Image 6.PNG

Connect and verify if the WiFi users connect to the WPA2-PSK with the passphrase, whether they get a valid IP address from the VLAN 200 DHCP Server scope, and whether they can access the Internet.

Image 7.PNG

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.

Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.