Skip to main content
ajdinzutic
ajdinzutic
Explorer
September 27, 2024
Question

Allow Admin Access FortiSwitch + FortiAP to FortiGate

  • September 27, 2024
  • 2 replies
  • 1895 views

Hi there

 

I've set a new setup up and created the SSID, and allowed access with the checkboxes.

Also in the Fortigate Settings allowed listening to the services and SSID.

 

Somehow i can't access the fortigate when i'm over FortiSwitch and FortiAP. Do i have to allow something else?

 

my goal is, that from the internal SSID we should have access to the fortigate. And the SSID Guest don't.

 

Kind regards

2 replies

ajdinzutic
ajdinzuticAuthor
Explorer
September 27, 2024

As it seems i can't create a dedicated VLAN for the FortiGate itself. Since they use the fortilink.

Or did i setup something wrong?

 

27-09-2024_09-57-50.png27-09-2024_09-58-28.png27-09-2024_09-59-44.png27-09-2024_10-01-09.png27-09-2024_10-01-48.png

ebilcari
Staff
ebilcari
Staff
September 28, 2024

The option 'Listen on Interfaces' in the last screenshot is not used for the management interface service, this option is dedicated to the NTP service only.

Emirjon
    ebilcari
    Staff
    ebilcari
    Staff
    September 28, 2024

    If I get it right you want to access FGT from a node/PC that is connected to a FSW port or a SSID/FAP not from the FSW/FAP itself (their management subnet). If this is the case than on the interface (VLAN or SSID) that you configure for the end users (gateway) in 'Administrative Access' you have to enable HTTPS/HTTP. This should be enough to gain access to FGT management interface (GUI) from an end host that is connected to that subnet.

    Emirjon
      ajdinzutic
      ajdinzuticAuthor
      Explorer
      September 29, 2024

      hi cool to know :)

      It seems i can't even ping the FGT from the FAP

       

      FGT got a DHCP with 192.169.100.1/24

      and FAP DHCP with 192.169.10.1/24

      is there a way to create a Shared DHCP so that i can ping them? Or do i have to buy a Forti Switch to handle VLAN Access?

      ebilcari
      Staff
      ebilcari
      Staff
      September 30, 2024

      For AP management, a dedicated management subnet/VLAN need to be created in FGT and spanned in the FSW or in a 3rd party switch and have ' Security Fabric Connection' enabled. There is no limitation from FGT, Fortilink/FSW just simplify configuration and monitoring the switch ports.

      In case of a 3rd party switch a sub interface with a VLAN ID could be the easiest way to configure the AP management VLAN, like this for example:

      subinter.PNG

      After selecting the proper 'Administrative Access' options, FGT and FAP can manage and reach both ways.

      The subnets you have shared in the last reply are not in the private IP range and are not in the same network.

      Emirjon
      Terms & ConditionsAccessibility statement