- FortiGate allows multiple SSID objects to have the same SSID value (name), but each can be mapped to:
- A different VLAN interface.
- Different security policies.
- Different user roles.
- Each FortiAP profile or VAP can be configured to broadcast one of these SSID objects.
- Behind the scenes, FortiGate differentiates them by their VAP object name, VLAN ID, and interface association - not just the SSID string.
Example SSID config:
config wireless-controller va
edit "TAC-ssid-1"
set ssid "TACWiFi"
set vlanid 10
set security wpa2-only
next
edit "TAC-ssid-2"
set ssid "TACWiFi"
set vlanid 20
set security wpa2-only
next
end
FortiAP profile config:
config wireless-controller wtp-profil
edit "ap-profile-1"
config vap
edit 1
set vap-name "TAC-ssid-1"
next
end
next
edit "ap-profile-2"
config vap
edit 1
set vap-name "TAC-ssid-2"
next
end
next
Use case:
- Multi-tenant deployments.
Multiple organizations use the same SSID name (e.g. 'Guest'), but are isolated using VLANs or policy-based routing.
- Location-based traffic segmentation.
The same SSID name is used in different buildings or floors but mapped to different subnets or firewalls for segmentation and control.
- SSID tunneling scenarios.
FortiAPs in different branches use the same SSID, but traffic is tunneled to different FortiGates or VLANs centrally.
Important: Duplicate SSID is disabled by FortiGate and FortiEdge Cloud by default.
To enable it on FortiGate, make the following config change via CLI:
config wireless-controller setting
set duplicate-ssid enable
end
Alternatively, enable this feature in the GUI only after enabling the Advanced WiFi Settings on Feature visibility (FortiGate 7.6.3 administration guide).
 Enabling Duplicate SSID on FortiGate
To enable it on FortiEdge Cloud, enter the desired Network, then select Network Settings -> Wireless -> Duplicate SSID -> Allow Duplicate SSID.
Note:
- Roaming between APs with duplicate SSIDs across VLANs is not seamless unless the backend handles inter-VLAN routing and mobility support.
- DHCP scope and IP addressing must be handled carefully.
- Policy enforcement needs to differentiate based on VLAN/interface.
- Monitoring and troubleshooting become more complex: logs will show the SSID as the same, so VLAN and interface context are key.
Related document:
WiFi settings - FortiManager 7.6.1 administration guide
|
