FG FS FAP stack and VLAN not getting DHCP

Question

I wonder how others address this, seemingly, simple config using FG-80F with FS-108E-FPOE and FAP-433F. How would you connect/configure this (an overview will suffice):

FG and FS on 7.2.3, FAP on 7.2.1
All 6 ports of FG belong to a VALAN 10 for wired clients
VLAN 10 also has wireless clients that should be bridged to its wired clients
port 8 of FS is connected to FG port a via fortilink
ports 1-6 of SW belong to VLAN 20 for wired clients
VLAN 20 also has wireless clients that should be bridged to its wired clients
So, for FAP only port 7 available on FS, and port b on FG (POE not necessary for FAP, could be powered by a power supply). In absolute worst case, port 6 of FG could be freed for FAP

My problem is where and how to connect FAP? If a new FAP management VLAN created on SW and FAP connected to FS port 7, then VLAN 20 devices (wired and wireless) are ok but VLAN 10 wireless clients not getting IPs; if FAP management interface is created on FG by removing port b from fortilink, then VLAN 10 clients (wired and wireless) are ok but VLAN 20 wireless devices not getting an IP.

Any info or pointers would be appreciated

gfleming · Accepted Answer

If your FortiGate switch ports are always going to be separate from those on your FortiSwitch (i.e. FGT will always only have VLAN10 and FSW will always have only VLAN20 and other VLANs outside of VLAN10) then you can just keep VLAN10 off the FortiLink/FSW and manage it on the FGT switch ports only.

The caveat with that solution is that your WiFi clients will never be able to join VLAN10 directly. However, using Firewall Policies you can allow devices from other VLANs to access devices like printers in VLAN10 and vice versa.

If you want VLAN10 integrated on your FSW and FAP then you'll need to use the physical bridge link for VLAN10 between the FSW and the FGT as I described before. That way if you want WiFi Clients existing directly in VLAN10 you can have the FGT-connected devices also participating in VLAN10.

It might simplify things if you put your Wi-Fi clients into their own VLAN and use Firewall policies to allow access to/from the Wi-Fi VLAN and the other Wired VLANs. You can also join some of your VLANs into an Interface ZONE and in that case you do not need any policies to allow access to-from the VLANs.

gfleming · Answer

Alright. FortiLink is tricky because while it allows you to manage all of your switch ports and AP from the FortiGate it does not manage or integrate the switchports that exist on the Firewall! VLAN 10 on the FortiSwitch has no knowledge of VLAN10 on the FortiGate.

So you either have to not use your switch ports on the Firewall or consider a couple solutions:

- A separate physical link between a FortiSwitch port configured for VLAN10 connected to one of the FortiGate switch ports (which should be configured as untagged) to bridge and connect those two domains

- Running the FortiSwitch in standalone mode and bridging everything that way through the uplink

For the AP jjust connect it to the FortiSwitch port 7 and set up a AP MGMT network as the native VLAN and tag VLAN 10 and VLAN 20. Two SSIDs configured, one for VLAN10 wireless clients and one for VLAN 20 for other wireless clients.

Sign up

Login with SSO

Login to the community

Login with SSO