Skip to main content
CollabraIT
CollabraIT
New Member
August 10, 2016
Solved

[Solved]Wireless access to internal network

  • August 10, 2016
  • 4 replies
  • 7415 views

We left setting up our wireless networks for after we had the pre-existing wired networks duplicated and working when we made the switch from Cisco to Fortinet. It seems now that this may have been a mistake.

We want 2 networks. One for guests, and one for corporate users. The one for guests is no problem. It's up and running. The one for corporate users isn't.

We'd like the corporate wifi to be on the same network as the internal wired network. The problem is that this was already setup as it's own dedicated interface. From what I've read, the usual solution is to make the wired and wireless part of the same virtual switch. This isn't an option for us due to the current setup.

How can I make the wireless bridge that internal network? Or maybe make that wireless network separate, but have access to the internal network as if it was a member?

    Best answer by ede_pfau

    Picking up on the first idea, if you create a policy from 'SSID' to 'internal', check the static NAT box. This way, the WiFi clients will appear as internal hosts, no matter which (different) subnet you've assigned to the WiFi.

    Of course, there's a difference to true bridging: routing will not carry over broadcasts from one subnet to the other. That depends on your environment whether that is a requirement or not. Usually it isn't but there are corner cases.

    4 replies

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    August 11, 2016

    Picking up on the first idea, if you create a policy from 'SSID' to 'internal', check the static NAT box. This way, the WiFi clients will appear as internal hosts, no matter which (different) subnet you've assigned to the WiFi.

    Of course, there's a difference to true bridging: routing will not carry over broadcasts from one subnet to the other. That depends on your environment whether that is a requirement or not. Usually it isn't but there are corner cases.

    Nils
    Nils
    New Member
    August 11, 2016

    I've created a SSID with option "Local Bridge" and then I've just connected the AP to the same switch/vlan as the Internal network.

    Then you don't have to create a software switch.

    CollabraIT
    CollabraITAuthor
    New Member
    August 11, 2016

    azh wrote:

    Hello 

     

    1) You can create policy from dedicated interface for wifi to Internal Lan Interface. 

     

    OR 

     

    2)  Create hardware switch then u will use same subnet for Lan and Wifi. 

     

    ede_pfau wrote:

    Picking up on the first idea, if you create a policy from 'SSID' to 'internal', check the static NAT box. This way, the WiFi clients will appear as internal hosts, no matter which (different) subnet you've assigned to the WiFi.

    Of course, there's a difference to true bridging: routing will not carry over broadcasts from one subnet to the other. That depends on your environment whether that is a requirement or not. Usually it isn't but there are corner cases.

    1 is what I was thinking might work, thanks I'll give it a try. 2 Can this work even though the interfaces for Lan and Wifi are already configured as separate ports?

    Nilsan wrote:

    I've created a SSID with option "Local Bridge" and then I've just connected the AP to the same switch/vlan as the Internal network.

    Then you don't have to create a software switch.

    I tried this, but since my vlans are not specified in the firewall it doesn't work. My vlans are controlled at the switches.

    Terms & ConditionsAccessibility statement