Fortigate 40F - 2 LAN and 2 WLAN networks with same subnets for LAN/WLAN

Forum|Forum|1 year ago
November 24, 2024
2 replies
2286 views

Hi,
I have Fortigate 40F and I need to set 2 LAN and WLAN networks. LAN 1 and WAN 1 should be on the same subnet and same LAN2, WAN2.

LAN 1: VLAN 101 (e.g. 192.168.1.0/24)
LAN 2: VLAN 102 (e.g. 192.168.2.0/24)

WLAN 1: VLAN 101
WLAN 2: VLAN 102

Port A - LAN 2
Port 1 - LAN 1
Port 2 - AP 1 (Ubiquity UAC-AC-Pro)
Port 3 - AP 2 (Ubiquity UAC-AC-Pro)

In normal environment I would add Port 1 to VLAN 101, Port 2 and 3 to VLANs 101, 102 and Port A to VLAN 102. I would set IPs for VLAN 101 and 102 (GWs for both VLANs), but not sure how to set this config on Fortigate. Would you advice?

FortiGate

DPadula

Staff & Editor

Hi Vito1891,

I believe the following document answer your question: How to combine a wireless network and wired LAN with a software switch

Don't forget to mark the answer as solution to help other community members.

Vito1891Author

New Member

Hi DPadula,

I've revied this document before I posted here, and if I understood well this document, it's not going to work for my requirenments.

Again this is expected configuration:

Port A - LAN 2, VLAN 102, Port type: access
Port 1 - LAN 1, VLAN 101, Port type: access
Port 2 - AP 1 (Ubiquiti UAC-AC-Pro), Port type: trunk (allowed vlans: 101,102)
Port 3 - AP 2 (Ubiquiti UAC-AC-Pro), Port type: trunk (allowed vlans: 101,102)

Both APs need to broadcast 2 SSIDs (SSID1 in vlan 101, and SSID2 in vlan 102)

For these 2 vlans I have virtual interfaces with IPs within diffrent subnets, with DHCP enabled, so user from LAN 1 / WLAN (SSID 1) get IP from subnet 1 and user from LAN 2 / WLAN (SSID 2) get ip from subnet 2.

APs need to be connected directly to Fortigate, as I have only unmanaged L2 switches in my hardware config.

Toshi_Esumi

SuperUser

Of course you need to use software switches to combine wired and wireless network in one subnet/DHCP. But if you don't have a switch with PoE but directly hook those APs directly to the 40F using either local power adapters or PoE injectors, you don't have to use VLANs but separate those three ports 1-3 to independent lan1 - lan3 ports by removing from "lan" hard-switch.
Then combine "lan1"(LAN1) and "lan2"(AP1), and "a"(LAN2) and "lan3"(AP2) to two software swiches.

Toshi

Vito1891Author

New Member

Hi Toshi,
Thanks for advice, but in your configuration each AP provides only 1 SSID in 1 vlan. I need to have 2 wired vlans (e.g. 101 and 102) and have these vlans in wireless network on both APs (2 SSIDs (SSID 1 = vlan 101, SSID 2 = vlan 102)).

Toshi_Esumi

SuperUser

Sorry I gave you a wrong description of operation. Please disregard my last comment. It's been a while I configured a new tunnel mode SSID last time.

Each tunnel SSID should become an "interface" as type:vap-interface (Go to interface view in GUI, or "config sys int" then "show" in CLI to see them). So that you can put the SSID and physical interface, like lan1, together into one software switch interface.
Those lan2 and lan3 physical interfaces are the termiation point of FAP's management interface. Tunnel mode SSIDs are NOT bound to those physical/management interfaces (coming to the physical interface over CAPWAP tunnel).

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded