FortiAP clients Not Connecting to Internet

Hi ​@CBCFT 

When a FortiAP is configured in bridge mode it allows networks to be on the same subnet. For bridge mode SSIDs, you must create a firewall policy where the incoming interface is the FortiAP interface (physical or VLAN) and the destination is the Internet-facing interface. Without this policy, traffic from bridged clients will be dropped.

Clients connected to a bridged SSID may not receive IP addresses if DHCP is not properly configured on the VLAN interface associated with the bridge SSID

• Run a sniffer to verify DHCP traffic:

diagnose sniffer packet <interface_name> 'port 67 or port 68' 4 0 l

If a switch exists between the FortiAP and FortiGate, the VLAN used by the bridge SSID must be included in the allowed VLANs on the switch port where the FortiAP is connected 

By default, only tunnel mode SSIDs are enabled on FortiAPs. Bridge mode SSIDs must be manually added to the FortiAP profile.

Refer:

Make sure the AP is showing online on the FGT.

Just checking on the Bridged SSID that you have the optional VLAN set in the SSID for the DATA VLAN and that the fortiswitch has the DATA VLAN set in the allowed VLAN on the Port the FortiAP is managed through.  If DATA VLAN is 20 then the SSID optionla VLAN should be 20.

If so then any client on the Bridged SSID should show up as Fortiswitch clients and you should be able to see their MAC addresses associated with the Port alongside the FortiAP mac address in the Fortiswitch ports table (I am assuming here a Fortigate managed Fortiswitch) you should also be able to see them listed in the DHCP scope as per the answer from sjoshi.

If you cant see the users in the above worth going to diagnostics on the fortiAP and running the VLAN scan to check the DATA VLAN is tagged and available to the AP.  I assume from the comment that users on the switch can access the DATA VLAN that you have a policy in place for the DATA VLAN to access the internet and it is likely an issue between the AP and the Firewall and not being on the correct VLAN.

That looks right and if you click on the +2 next to the fortiAP in the switch menu you should see the MAC addresses of clients on teh bridged SSID, ideally you would manage your FortiAP on a different VLAN to the traffic, did you add the DATA VLAN to allow based on my comment?  I typically have a FortiAP MGMT VLAN wwhich has a DHCP scope seperate ot the client traffic (this will also be used for Tunnel SSIDs) you typically wouldnt want or have the native and allowed VLANs as the same it used to not let you select them that way in previous versions, that looks right from the point of view of config.

If you know the clinets you are looking to see on the SSID have a look at fortiswitch clients and see if they show up in the list, also have a look in Wifi clients and from their you can look at sessions etc that might show you any policy related issues with the clients.  Right click on the Managed AP and go to Diagnostics you can see a bunch of lcient related information.

That looks like the Bridge SSID is working as you have the clients bridged to the switch VLAN if they arent getting internet then its worth looking at the fortiview sessions for those clients if you linger over them in Fortswitch CLients and cllick on Asset Details you will be taken to a device specific view

THis is an example of a Bridge SSID client, you can see the SSID details the Switch port and VLAN bridged too and also the policies on the firewall that are being hit by that user.

That should give you the info you need on why the clients arent working, you can do a similar view form Wifi clients if they arent bridging correctly.

https://docs.fortinet.com/document/fortiap/8.0.0/fortiwifi-and-fortiap-configuration-guide/252439/configuring-the-fortigate-interface-to-manage-fortiap-units

This is the Fortinet guide, it doesnt specifically call out havign a seperate mgmt VLAN for the FortiAP I do it as you can then control access to the APs them selves restirct outbound access to the internet or from different segments of your network.  With your initial problem the logic around Native VLAN allowed VLAN and the SSID VLAN probably comes down to these elements on how the VLAN is managed through the Fortiswitch, if SSID was set to VLAN 10 and native VLAN was 10 and allowed is 10 you can have odd behaviour.  Ideally leave DATA as allowed and move the FortiAP Mgmt (native VLAN to be just for mgmt it will need CAPWAP enabled and a DHCP scope for AP mgmt.

This is my setup for AP mgmt and Bridge, any Tunnel SSIDs will run over the MGMT network back to the Fortigate its only Bridge SSIDs that you need to worry about VLAN mgmt for.