Explorer

Question

FortiAP's on 3rd party switch

Forum|Forum|1 year ago
November 28, 2024
16 replies
4912 views

I need to connect a Forti AP through a Dell switch

I have 2 x fortiswitches with several working AP's, 2x SSID's all fine.

I setup a physical port which connects my Dell switch to my Edge switch stack and the fortiAP is online and given the correct DHCP address i setup.

But I cannot get DHCP to work on the SSID's of this AP.

Do i need to recreate VLANS? as I tried this and nobody could connect on any AP and was giving random 169.xxx addressed.

When i try and connect to either SSID on the not working AP - i get a 169 address.

I need it to see the VLANS on the fortlink - but dont know how to do this or if it can? thats why i think i need to recreate them?

Thanks

sjoshi

Staff

Hi,

To enable DHCP for the SSIDs on the FortiAP connected through a Dell switch, ensure that the VLANs are correctly configured on the FortiSwitches. Create FortiSwitch VLANs for the APs, assign them to the FortiSwitch ports connected to the Dell switch, and verify that the VLANs are correctly tagged on the Dell switch ports. Make sure the DHCP server settings on the FortiGate are properly configured to assign IP addresses to the SSIDs. If clients are receiving 169.xxx addresses, it indicates a DHCP issue, possibly due to VLAN misconfiguration. Double-check VLAN settings and ensure proper VLAN tagging on all switches involved in the network path.

Thanks, Salon

Forti-MonAuthor

Explorer

Hi, thanks for the reply

The Fortiswitch VLAN's work perfectly for any AP connecting to any ports on the Fortiswtich

I have several AP's running using those VLANs with no issues.

The DHCP works perfectly for both SSID's on the Fortiswitch AP's

The Fortiswitch isn't connected to the Dell switch

The Dell switch is connected to the Fortigate

ebilcari

Staff

If the SSIDs for this AP are in bridge mode, you have to span the VLANs through the Dell switch and configure them as sub interfaces in the FGT port where the Dell switch uplink is connected, like as the example:

If you can use tunneled SSID, it will simplify the configuration since only the AP management VLAN need to be configured on the Dell switch, user traffic will be tunneled.

Emirjon

Forti-MonAuthor

Explorer

So to be clear

I have the physical port

I then need a mgmt VLAN

I then need a VLAN for one of the SSIDs

I then need a VLAN for the second SSID

These VLANs must have different ID's to the VLAN's in the Fortilink?

ebilcari

Staff

Yes, and the VLAN used for AP management should have enabled 'Security Fabric Connection'.

The VLAN ID can also have the same ID with the VLANs used in Fortilink but they will not be related at all so it would be better to use other IDs to avoid the confusion.

As mentioned earlier you can also use a software switch to combine all this networks to a single subnet, but that involves configuration changes and doesn't fit every deployment due to performance limitation. In the example below there are 3 type of interfaces: sub/interface VLAN, a Fortilink VLAN and a SSID in the same software switch and they are using the same subnet:

software switch.PNG

Emirjon

Forti-MonAuthor

Explorer

the second I change the native VLAN on the switch to the VLAN created in fortigate, the AP drops offline.

any ideas?

ebilcari

Staff

You can try to reboot the AP by cutting PoE, so it can receive an IP from the new subnet. Also make sure on the switch configuration to have the VLAN as access on the port when the AP is connected and allow it in the trunk/uplink port with the FGT.

Emirjon

Forti-MonAuthor

Explorer

So set the managed AP VLAN attached to the physical interface an access port on the DELL switch?

as it's currently a trunk port?

ebilcari

Staff

I meant to set the AP management VLAN as the native/PVID/untagged VLAN in the port. Every vendor like to put a different name on this :)

Emirjon

Forti-MonAuthor

Explorer

The second i change the untagged native VLAN from the Fortilink VLAN to the Phyiscal interface untagged VLAN the AP goes offline

Just dont understand why

ebilcari

Staff

You need to isolate the problem:
- at L2 level, verify that the switch learns the MAC addresses of the AP and the FGT on the new VLAN.
- at L3 level, verify that the AP has received a new IP from DHCP and the new subnet, AP should be pinged by FGT. Verify AP configuration if it has any static IP configured.
- CAPWAP tunnel troubleshoot, like shown in this article.

Emirjon

Sign up

Login with SSO

Login to the community

Login with SSO