Technical Tip: How to configure MESH with FortiAP on FortiGate

rmittal · ‎07-18-2022

Description

This article describes how to configure MESH with FortiAP on FortiGate.

Scope

FortiAP, FortiAPU, FortiAPS, FortiAP-W2 (6.2.2 and above).

Solution

Creating the mesh root SSID.

Go to WiFi and Switch Controller -> SSIDs and select Create New -> SSID.
Enter a Name for the WiFi interface.
In Traffic Mode, select Mesh.
Enter the SSID. In this example, the name will be MESH.
Set Security Mode to WPA2 Personal and enter the Pre-shared key.
Select OK.

Create the FortiAP profile.

Configure FortiAP.

Get the Root and Leaf AP online on FortiGate as normal APs.

Add the FortiAP profile to Root and Leaf FortiAP.

Once both the FortiAPs are online, configure the leaf FortiAP.

Get CLI access to the Leaf FortiAP. See How to enable SSH access to FortiAP managed by FortiGate.

Assign static IP to leaf FortiAP.

cfg -a ADDR_MODE=STATIC

cfg -a AP_IPADDR=x.x.x.x <--- AP IP address

cfg -a AP_NETMASK=y.y.y.y <--- AP Netmask

cfg -a IPGW=z.z.z.z <--- AP Gateway

Set type to leaf and enter mesh SSID name and password:

cfg -a MESH_AP_TYPE=1 <- WiFi Mesh.

cfg -a MESH_AP_SSID=MESH <- SSID name.

cfg -a MESH_AP_SECURITY=1 <- Mesh configured with WPA/WPA2-Personal.

cfg -a MESH_AP_PASSWD=test1234 <- SSID Mesh password.

See FortiAP CLI configuration and diagnostics commands.

To save the above changes on Leaf FortiAP:

cfg -c

When the root FortiAP is connected and online, apply power to the preconfigured leaf FortiAPs. At this point, user can disconnect the FortiAP Leaf from the network and take it somewhere else, where the SSID Mesh can be used. Then energize the leaf FortiAP, which will connect wirelessly to the WiFi Controller through the mesh network.

Viewing the status of the mesh network.

The user can also see the APs connected to the mesh by checking the FortiAP Clients and filtering by SSID Mesh. The user should be able to see the Leaf APs IP on the FortiAP Client column 'IP Address'.

Note: It is possible that user do not see the FortiAP displayed as a 'Leaf' AP on 'Managed FortiAPs' if no additional SSIDs different than MESH are configured. Try overriding the SSIDs configured on the Leaf APs and refresh the GUI.