Skip to main content
UserQC
UserQC
New Member
September 18, 2018
Solved

FortiAP Wireless Mesh using FortiCloud

  • September 18, 2018
  • 5 replies
  • 8775 views

Hi everyone,

Sorry if I'm not using the correct forum to post my question...

 

I'm trying to connect two FortiAP 220B together by using a mesh topology but as I'm using FortiCloud and it seems I'm missing something. I'm trying to replicate the diagram below less the FortiGate as it is replaced by FortiCloud.

 

FortiAP units used as both mesh root AP and leaf AP

 

In my configuration, the first AP (A), the mess root, is directly connected to an Ethernet network with an access to the Internet. The second AP (B) should only be able to reach the Internet thru AP "A" because it is not connected physically. The mesh configuration has been made in Forticloud with the 5Ghz radio and the mesh SSID is the only one on this interface.

 

When looking at the AP "B" in the CLI I can see that both APs are connected together correctly and running (see below) but the IP traffic is never going thru as I'm not able to ping the other AP nor the Internet. I can also see on AP "A" that a client is connected to the mesh network SSID. It is AP "B" but it is displaying the IP address of my Internet service provider?!?!

 

I've read about everything I can find on the web for configuring a Fortinet wireless mesh network but to be honest I'm out of ideas because nothing I found explain how to do it in FortiCloud. I'm pretty sure I have to authorized the meshed AP "B" somehow but I can't find anything about this in any menus FortiCloud has to offer.

 

Also, I've read from the FortiCloud Administration Guide at page 27 that mesh support has been added to FortiCloud v3.3.0: https://docs.fortinet.com/uploaded/files/3896/FortiCloud-330-AdminGuide.pdf. I'm running on FortiCloud V3.3.0_0256.

 

Thanks in advance for any help you could give me!

 

 

Here is the extract from the CLI of the remote AP

 

cw_diag -c mesh

 

Sys Cfg AP addr mode: static stp mode : 0 dflt ip : 192.168.2.112 dflt mask: 255.255.255.0 dflt gw : 192.168.2.1

Mesh Cfg Uplink : Mesh Uplink AP SSID : meshssid AP BSSID : 00:09:0f:34:aa:a2 AP PASSWD : ****** local eth bridge : 2(Disable)

Mesh Oper AP Type : Mesh Uplink wbh status : [style="background-color: #ffff00;"]running[/style] wbh rId : 0 wbh mac : 72:09:0f:fd:34:30 wbh bssid : 00:09:0f:34:aa:a2 wbh Chan : 44 vap mhc : 1 eth type : 0x0000

main dhcp ip : 0.0.0.0 main dhcp mask : 0.0.0.0 main dhcp gw : 0.0.0.0

bh dhcp ip : 0.0.0.0 bh dhcp mask : 0.0.0.0 bh dhcp gw : 0.0.0.0

main ip : 192.168.2.112 main mask : 255.255.255.0 main gw : 192.168.2.1

bh ip : 0.0.0.0 bh mask : 0.0.0.0 bh gw : 0.0.0.0 bh mac : 00:00:00:00:00:00

eth bridge : 0(Unknown)

 

 

    Best answer by wanglei_FTNT

    Hi All,

     

    1) mesh support with FCLD was added recently and is only available to some of newer AP models ( 220B is not supported)

    2) mac-access-control with FCLD is per SSID base and it's only available from 5.6.2.  If you are using 220B, unfortunately it's not supported as the model has been EOLed for a while). 

     

    5 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    September 18, 2018

    I wouldn't be any helpful while this is one of my test items with FortiCloud 3.3.0 and I haven't made any progress yet. By the way, one thing I noticed in your diagram was you don't have to configure mesh SSID on "leaf" AP profile. It just looks for mesh SSID an upstream AP (root or branch) broadcasts. But even if you configured it, it wouldn't prohibit it from acting as "branch" AP.  At a glance, only thing we can configure at FortiCloud site seems to be the "Mesh Link" checkbox in SSID config, which should be all we need.

    So I don't know why it wouldn't work at this moment. The admin guide is almost useless, which doesn't explain any of "how to configure" but only saying "supported". What kind of "guide" is it if it doesn't tell how? When I tried to figure out what "MAC Access Control" does, I found the guide said "per AP". But the fact seems to be configuring the list of MAC addresses to allow access and attach it to an SSID(s). So not "per AP" but "per SSID".

    UserQC
    UserQCAuthor
    New Member
    September 19, 2018

    Thank you Toshi for your reply. From what I'm reading we are at the same place for now...

     

    Let me know if your tests get better results than mine!

     

     

    Have a good day!

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    September 19, 2018

    Even MAC Access Control doesn't seem to work. I have a ticket opened with TAC. Probably mesh is on the same boat.

    wanglei_FTNT
    Staff
    wanglei_FTNTAnswer
    Staff
    September 19, 2018

    Hi All,

     

    1) mesh support with FCLD was added recently and is only available to some of newer AP models ( 220B is not supported)

    2) mac-access-control with FCLD is per SSID base and it's only available from 5.6.2.  If you are using 220B, unfortunately it's not supported as the model has been EOLed for a while). 

     

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    September 19, 2018

    That's good to know. I'll test with 221C/E then.

    By the way, I asked this TAC person, who is still researching, but can you tell me how MAC access control work? Is it based on DHCP like FGT wirless-controller's MAC filter? Or special mechanism on the AP to block/filter MAC so that NAT mode/Bridge mode doesn't matter?

     

    I wish that kind of info were available on the 3.3.0 admin guide.

    wanglei_FTNT
    Staff
    wanglei_FTNT
    Staff
    September 20, 2018

    Thanks for your comments @UserQC and @Toshi,

     

    As far as how MAC-access-control works, basically AP checks whether certain MAC is allowed during association phase. Client might pass association but it couldn't get IP or pass any traffic

    Terms & ConditionsAccessibility statement