Skip to main content
KMart
KMart
New Member
March 15, 2019
Solved

Guest Wifi access, but allow printer access on LAN

  • March 15, 2019
  • 1 reply
  • 9842 views

Hello all!

 

I am working on a 60E with three FortiAPs.  

 

I am looking to create a special guest wifi network that has a separate subnet, but be able to access one or more printers on the local LAN.  Is this possible?  Creating the guest wifi if easy, but I cannot seem to get a policy to work.

 

Thank you,

 

Kelly

 

    Best answer by Toshi_Esumi

    Should be a simple policy Guest_WiFi_Interface/Subnet->LAN/Printer_Addr_Group. Please show what you have now.

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_EsumiAnswer
    SuperUser
    March 15, 2019

    Should be a simple policy Guest_WiFi_Interface/Subnet->LAN/Printer_Addr_Group. Please show what you have now.

    KMart
    KMartAuthor
    New Member
    March 15, 2019

    I think I may have it.  I'm still new to Fortigates.  :)

     

    I created a new tunneling SSID for guest + printing.  I had gone into device inventory and named the printer instead of creating it in addresses.  So I created a printer address, then created a policy of Guestwifiprint on incoming, internal on outgoing interface.  Source is all, destination is printer address object, schedule always and service all.  I also have a policy allowing the guestwifiprint out through the WAN for Internet access.

     

    This should work, right?

     

    Thanks!

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    March 15, 2019

    Since each user need to know IP on the printers, I would just statically assign IPs to them and create an address objects then include them in an address group. Then user the destination in the policy toward LAN interface. The tunnel mode WiFI SSID should become as an interface so you can use it as the policies source interface.

    Then when someone on the SSID, the user should be able to ping the printers.

    If not, you need to sniff (diag sniffer packet) then run flow debug (diag debug flow) to figure out what's wrong. 

    Terms & ConditionsAccessibility statement