FortiAP devices are thin wireless access points (AP) supporting the latest Wi-Fi technologies (multi-user MIMO 802.11ac Wave 1 and Wave 2, 4x4), as well as 802.11n, 802.11AX , and the demand for plug and play deployment.
Article Id 194984

You can create a point-to-point bridge to connect two wired network segments using a WiFi link. The effect is the same as connecting the two network segments to the same wired switch. Both wired and WiFi users on the leaf AP side are connected to the LAN segment on the root mesh side.

Two FortiAPs.  Wireless mesh feature is used to implement the point-to-point WiFi link.


One of the APs, the 112B is an outdoor AP, for the purpose of the lab, the second AP was a 221C.
This configuration would typically be done using 2 outdoor APs with line of sight.

Network topology:

CaleV_Wireless mesh bridge_Topology.JPG

The AP connects to the FortiGate on an interface with CAPWAP enabled and it will show up in the Managed Access Points list.

WiFi Controller > Managed Access Points > Managed FortiAPs

Select each AP and Click Authorize for the FortiGate to manage the AP.

CaleV_Wireless mesh bridge_001.JPG

It will take a few minutes for the APs to authorize.

CaleV_Wireless mesh bridge_002.JPG CaleV_Wireless mesh bridge_003.JPG

Create the Mesh SSID

  • -          Make sure you follow the naming convention for the interface as mesh followed by the vdom
  • -          Traffic Mode = Mesh Downlink
  • -          SSID naming convention is name, mesh, vdom
  • -          Security mode is personal
  • -          Configure the Pre-shared Key
CaleV_Wireless mesh bridge_004.JPG

We will configure a regular SSID that can be broadcast on the remote location as well.

But we want this SSID to bridge with the LAN , so we will create it as a Local bridge.

  • -          Set the interface name
  • -          Set the traffic mode to be “Local bridge with FortiAPs Interface”
  • -          Set the SSID (you can use the same name as the interface to make it easy to distinguish)
  • -          Set the Security Mode to persona
  • -         Set the Pre-shared key

CaleV_Wireless mesh bridge_005.JPG

Now that we created the SSIDs, we want to configure the APs.

The 112B will be our Mesh branch AP.

We will create a FortiAP profile and configure it to broadcast the Mesh SSID.

CaleV_Wireless mesh bridge_006.JPG

We then apply the profile to the AP.

CaleV_Wireless mesh bridge_007.JPG

The 221C is going to be our remote AP.

We need to log into the AP via its IP to manage it and configure it to connect to the Mesh.

  • -          Set the Uplink type as Mesh
  • -          The MeshAP SSID must be configured as the mesh SSID name
  • -          Set the Mesh AP Password as the Pre-shared key used on the mesh SSID
  • -          We want to bridge with the LAN network, so it is important to select the Ethernet Bridge
CaleV_Wireless mesh bridge_008.JPG

We want the 221C to broadcast a SSID as well, in the remote location. To do so we will need to configure the FortiAP Profile.

CaleV_Wireless mesh bridge_009.JPG

We then apply the profile to the AP.

CaleV_Wireless mesh bridge_010.JPG

After this is done, we will view the managed FortiAPs.

The remote AP (in this case the 221C), will be grayed out while the mesh is formed, when the State will show a green circle with a check mark. This can take up to 5 min.

CaleV_Wireless mesh bridge_011.JPG CaleV_Wireless mesh bridge_replace01.JPG

Once the meshed is formed, we will unplug the Ethernet cable from the FortiGate and the AP will stay connected.

Once we confirm the connection is stable, we will power down the AP and place it in its final location within line of site to the local AP (112B).

CaleV_Wireless mesh bridge_013.JPG CaleV_Wireless mesh bridge_014.JPG

Now we will plug a switch into the LAN port of the AP. In this case it is an unmanaged switch.

We will plug a Laptop into the switch. At this time the WiFi is disabled and the LAN NIC is being utilized.

The laptop shows up in the DHCP monitor with the IP address as

CaleV_Wireless mesh bridge_015.JPG

Now we will enable the wireless and connect to the SSID that the remote AP  (221C) is broadcasting.

CaleV_Wireless mesh bridge_016.JPG

We can ping Google while connected to the wired and wireless network.

We can ping a computer on the local subnet that has an IP of

CaleV_Wireless mesh bridge_017.JPG

We can ping from to the remote computer,

CaleV_Wireless mesh bridge_018.JPG

Considerations when Selecting Channel for Wireless Bridge:

The example above used the 2.4GHz channel as that is what is available on the  112B.
Some FortiAP models also support 5GHZ radio which could be therefore used to form the mesh.

Advantage: 5GHz is faster and less susceptible to interference.
Disadvantage: Has a shorter range and does not penetrate solid objects as well as 2.4GHz.

Related Articles

Technical Note: Configuring a Wireless Mesh