New Member

Question

Need help to Connect 10 FortiAps to cisco Switch which is Connected to my Firewall Fortinet 100F

Forum|Forum|1 year ago
March 31, 2025
20 replies
3957 views

Hi,

I am trying on my own to figure out how to replace my existing Aps with FortiAps 431F. I am planning to replace all the Switches which are Cisco and some are HP in the short run but for now am just replacing the APs.

It is a live network and I am very cautious as each time I am trying something I am doing a backup.

I can see the SSID on my phone and laptop but I cannot connect.When I try to connect it shows connecting and then Couldn't get an IP address.

Can any one guide me where to start checking and what to check please.

Thanks

Tazio

AEK

SuperUser

Hi Tazio

I guess you configured the SSID in bridge mode.

If you want is simpler then try create the SSID in tunnel mode, configure DHCP for this SSID and it should work without issue.

AEK

Tazio4436Author

New Member

Hi Aek,

I configured the SSID in Tunnel mode and DHCP has been configured too.

Thanks

Tazio

Toshi_Esumi

SuperUser

Just tell us your intention of design, bridge mode (sharing the LAN subnet with wired devices) or tunnel mode (a separate subnet from LAN), and your GUI view for 1) Managed APs, and 2) SSID (edit interface) config.

Toshi

Tazio4436Author

New Member

Hello Toshi,

I want to use Tunnel mode.

Please see attached pictures. I can see one client with 169 ip address.

Thanks

Tazio SSID Edit Int.png Managed APs.png

Toshi_Esumi

SuperUser

The config looks fine by itself. Security Fabric is not necessary for SSID interface though. It's needed on the managment interface for the FAP, "Local_Lan". But since the FAP is online you configured it there.

Only concern is if you configured DNS server with "forward-only" mode on "FORTINETSSID" interface since you set the client's DNS server to be "Same as Interface IP". I wouldn't think this would cause clients not to recieve a DHCP IP as well as DNS server IP as 172.254.1.1. But it would drop the wifi connection shortly after when the client finds out the DNS server is not working since you didn't configure it properly.
If not sure, try change it to "Specify" with like 8.8.8.8/8.8.4.4 to see if it makes any difference.

Toshi

Tazio4436Author

New Member

Thank you very much for your support.

I tried what you requested but unfortunately it did not help.

Please see attached pictures.

Thanks

Tazio wifi edit DNS.png DNS server.png

Toshi_Esumi

SuperUser

I didn't request but suggested. "forward-only" mode is under DNS services when you enabled "DNS database" feature at System->Feature Visibility in GUI. CLI is much easier. If you don't want to deal with them just don't use the interface IP as client's DNS server IP. Choose either the system DNS or specify.
Anyway, then it's time you need to dig in to debugging. First, run sniffer to see if DHCP requests are arriving and your FGT is responding at FORTINETSSID interface. Below is my 40F with a FAP SSID interface fap221b (actual fap is not 221b though) received and replied to a DHCP request from a wifi client. Can you see the same?

fg40f-utm (root) # diag sniffer packet any 'udp and port 67' 4 0
interfaces=[any]
filters=[udp and port 67]
5.079051 fap221b in 0.0.0.0.68 -> 255.255.255.255.67: udp 361
5.080258 fap221b out 192.168.5.1.67 -> 192.168.5.3.68: udp 335
^C
2 packets received by filter
0 packets dropped by kernel

Toshi

Tazio4436Author

New Member

Hi Toshi,

The output for diag sniffer packet any 'udp and port 67' 4 0 is empty

Thanks

Tazio

Tazio4436Author

New Member

Hi Toshi,

I got this answer after some time.

PRIMARY # diag sniffer packet any 'udp and port 67' 4 0
interfaces=[any]
filters=[udp and port 67]
308.560279 port8 in 0.0.0.0.68 -> 255.255.255.255.67: udp 329
308.560283 Local_Lan in 0.0.0.0.68 -> 255.255.255.255.67: udp 329
308.560364 port9 in 0.0.0.0.68 -> 255.255.255.255.67: udp 329
308.561923 port9 in 10.21.68.1.67 -> 255.255.255.255.68: udp 320
308.561930 port8 in 10.21.68.1.67 -> 255.255.255.255.68: udp 320
308.561931 Local_Lan in 10.21.68.1.67 -> 255.255.255.255.68: udp 320

Thanks

Abhi

joshbergm

Explorer

Hi,

Did you already try disabling the broadcast suppression option in the VAP (SSID) profile?
Broadcast suppression can block DHCP.

Tazio4436Author

New Member

Hello,

I hope this is what you are telling me about.

Broadcast suppression.png

Thanks

Tazio

joshbergm

Explorer

Hi,

that’s indeed what I was talking about :)

let me know if it helps!

Tazio4436Author

New Member

Hi,

I am not sure if this small diagram will help understanding how the FAP is connected.

There is my FW 100F where the WAN comes in and 2 ports goes down stream to my Core SW which is a Cisco L3 SW. The core SW does all the DHCP for all my VLANs and the Core SW is connected to multiple Cisco SWs as Trunk. The FAP is connected to one of the Cisco SW for testing purposes. Note that all the Cisco SW will be removed later this year or next year.

Please see attached diagram. This is a simplified version of the actual network as we have 2 FW 100F stacked and the Core is also 2 stacked Cisco SW.

Any help step by step will be appreciated.

Thanks

Tazio

Toshi_Esumi

SuperUser

So, you meant the DHCP server is located at the root Cisco switch, not at the FGT? (You should have told us at the beginning)
Then, IP assignement by the DHCP server wouldn't work if the SSID is tunnel mode. You need to consider changing SSID to bridge mode, or putting SSID interface and the VLAN to reach the DHCP server together in a software switch (I haven't tried it before so not sure if it's feasible though).

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO