Technical Tip: How to configure MESH with FortiAP on FortiGate

[rmittal]

Description	This article describes how to configure MESH with FortiAP on FortiGate.
Scope	FortiAP, FortiAPU, FortiAPS, FortiAP-W2 (6.2.2 and above).
Solution	Creating the mesh root SSID: Go to WiFi and Switch Controller -> SSIDs and select Create New -> SSID. Enter a Name for the WiFi interface. In Traffic Mode, select Mesh. Enter the SSID. In this example, the name will be MESH. Set Security Mode to WPA2 Personal and enter the Pre-shared key. Select OK. Create the FortiAP profile. Configure FortiAP: Get the Root and Leaf AP online on FortiGate as normal APs. Add the FortiAP profile to the Root and Leaf FortiAP. Once both the FortiAPs are online, configure the leaf FortiAP. Get CLI access to the Leaf FortiAP. See How to enable SSH access to FortiAP managed by FortiGate. Assign a static IP to the leaf FortiAP. cfg -a ADDR_MODE=STATIC cfg -a AP_IPADDR=x.x.x.x <--- AP IP address cfg -a AP_NETMASK=y.y.y.y <--- AP Netmask cfg -a  IPGW=z.z.z.z <--- AP Gateway Set type to leaf and enter the mesh SSID name and password: cfg -a MESH_AP_TYPE=1 <- WiFi Mesh. cfg -a MESH_AP_SSID=MESH <- SSID name. cfg -a MESH_AP_SECURITY=1 <- Mesh configured with WPA/WPA2-Personal. cfg -a MESH_AP_PASSWD=test1234 <- SSID Mesh password. See FortiAP CLI configuration and diagnostics commands. To save the above changes on Leaf FortiAP: cfg -c When the root FortiAP is connected and online, apply power to the preconfigured leaf FortiAPs. At this point, user can disconnect the FortiAP Leaf from the network and take it somewhere else, where the SSID Mesh can be used. Then energize the leaf FortiAP, which will connect wirelessly to the WiFi Controller through the mesh network. Viewing the status of the mesh network. The user can also see the APs connected to the mesh by checking the FortiAP Clients and filtering by SSID Mesh. The user should be able to see the Leaf AP's IP on the FortiAP Client column 'IP Address'. Note: It is possible that users do not see the FortiAP displayed as a 'Leaf' AP on 'Managed FortiAPs' if no additional SSIDs different than MESH are configured. Try overriding the SSIDs configured on the Leaf APs and refresh the GUI. Note: On FortiAP-431G v7.2.x, The command (cfg -a MESH_AP_SECURITY=1) is not available and therefore the Mesh network may not be established. It is necessary to update to v7.4.5, where the entry of said line is allowed, and it works correctly.