Technical Tip: How to centrally configure multiple FortiExtender devices controlled by FortiGate with the appropriate dataplan for the specific SIM inserted

In deployment scenarios where multiple FortiExtender devices are deployed in different geographical locations and hence have different signal strengths available for different mobile carriers, there is a requirement to provide a configuration that can adapt to the mobile carrier associated with the SIM card inserted in the FortiExtender device.

In this kind of scenario, usually the FortiExtender devices are integrated as FortiGate WAN extension, and when dealing with massive deployments, both the controller FortiGate and the FortiExtender devices are ultimately managed centrally from FortiManager.

For reasons of specificity, a FortiExtender-511F (4G/5G) is considered in this article. This model supports a single modem with dual SIM, and the supported SIM card is in Micro SIM (3FF) only.

FortiExtender is already pre-defined with regular carriers, and hence it already contains the corresponding MCC and MNC codes for those pre-defined carriers. However, if the SIM carrier MCC and MNC are not part of the pre-defined list, then LTE may not work on FortiExtender.

The second article in the 'Related documents' section in this article mentions how to use the 'config carrier' and 'config lte simmap' FortiExtender CLI commands for declaring a carrier that is not pre-defined in the FortiExtender.

Having the carrier correctly defined is a requirement for the different dataplans that will be created to be operational.

In this scenario, where the configuration is managed centrally from FortiManager, declaring the specific carriers locally on each FortiExtender is not an option, and hence an alternative approach should be used instead.

The 'execute extender lte-carrier add' and 'execute extender lte-simmap add' CLI commands available in the FortiOS CLI for the FortiGate controller fit that purpose.

execute extender lte-carrier add <FEX-serial-number> <carrier-1>
execute extender lte-carrier add <FEX-serial-number> <carrier-2>
execute extender lte-simmap add <FEX-serial-number> <MCC-carrier-1> <MNC-carrier-1> <carrier-1>
execute extender lte-simmap add <FEX-serial-number> <MCC-carrier-2> <MNC-carrier-2> <carrier-2>

These commands can be included in a FortiManager CLI script, allowing for the push of this configuration to all FortiExtender devices through the FortiGate controller devices for each of those FortiExtender devices.

Once this configuration is deployed to all FortiExtender devices, then it is possible to reference those carriers in the 'config extension-controller dataplan' configuration section:

config extension-controller dataplan
    edit "dataplan-template-carrier-1"
        set modem-id modem1
        set type carrier
        set carrier "carrier-1"
        set apn "carrier-1-apn"
        set auth-type pap
        set username "user-carrier-1"
        set password ENC ZAoA<obfuscated>nLA==
        set preferred-subnet 32
    next
    edit "dataplan-template-carrier-2"
        set modem-id modem1
        set type carrier
        set carrier "carrier-2"
        set apn "carrier-2-apn"
        set auth-type pap
        set username "user-carrier-2"
        set password ENC ZAoA<obfuscated>/oPQ==
        set preferred-subnet 32
    next
end

config extension-controller extender-profile
    edit "FX511F"
        set id 1
        set model FX511F
        set allowaccess ping https ssh
        set login-password-change yes
        set login-password ENC jIp2<obfuscated>itRg==
            config cellular
                set dataplan "dataplan-template-carrier-1" "dataplan-template-carrier-2"
                    config controller-report
                        set status enable
                    end
                    config sms-notification
                    end
                    config modem1
                        config auto-switch
                            set disconnect enable
                        end
                    end
            end
    next
end

config extension-controller extender
    edit "FEX-serial-number"
        set id "FEX-serial-number"
        set authorized enable
        set ext-name "FEX-name"
        set device-id 0
        set extension-type wan-extension
        set profile "FX511F"
        set override-login-password-change enable
        set login-password-change yes
        set login-password ENC n8R<obfuscated>zCxQ==
            config wan-extension
                set modem1-extension "UL-1"
            end
    next
end

With this central configuration, all FortiExtender devices will select the configuration based on the carrier corresponding to the SIM card inserted, where the SIM card will be for the mobile carrier with better coverage in that specific location.

Related articles:

• Technical Tip: How to insert the SIM card correctly into the SIM slot for FortiExtender-511F
• Technical Tip: How to find and add MCC MNC on FortiExtender