New Member

Question

Best Practice: Connect Third-Party WAP to switch or FortiGate port2?

Forum|Forum|6 years ago
February 6, 2020
6 replies
8328 views

I have a FortiGate 60E in a small office. I am using a UniFi wireless AP for wifi. Everything is working fine, but I have a question about best practices.

Currently, the WAP is connected to the same switch that all computers are connected to, like this:

FG60E (port1-7) <> NetGear switch <> WAP & computers

Everything works well. Only the FG60E hands out DHCP IPs. The WAP and all computers are on the same subnet (192.168.33.x). Simple.

Would this setup be "better?"

FG60E (port1-6) <> NetGear switch <> Computers

FG60E (port7) <> WAP

I would create a new interface for port7. I'd assign this interface 192.168.34.1 and let DHCP hand out 192.168.34.50-100.

So my wireless devices would be on a separate network. I'd create policies to allow the wireless devices to access to the Internet (WAN1) and one printer on the 192.168.33.x network.

Thoughts?

SuperUser

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

SuperUser

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

SuperUser

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

SuperUser

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

SuperUser

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

SuperUser

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

SuperUser

side note: the AP doesn't have to support VLANs, the switch will tag the traffic for it.

I generally mirror every SSID onto it's own VLAN. Even home switches are VLAN capable nowadays...

New Member

I highly doubt it matters. My setup at home is a FWF51E + internal-lan and I have 1x googe-wireless connected to one of the internal lan port. LAN and WLAN hosts gets the same address subnets via DHCP.

I could move it to a dedicated port and build a 2nd subnet but I did not in this case. In another use case we have a customer who has integrated switch for computers and dedicated port ( i.e lan5 ) for his APs which are connected to a cisco business switch.

It's 50/50 in what method you deploy.

Ken Felix