| Description |
This article describes an expected behavior where a FortiAP will request multiple IP addresses from the FortiGate via DHCP when configured for Remote WLAN with split-tunneling also enabled (see also: Remote WLAN FortiAPs). Notably, if the DHCP address pool used for the SSID is not large enough, then DHCP IP pool exhaustion may occur because of this behavior, leading to network access issues for valid wireless clients. |
| Scope |
FortiGate, FortiAP, Remote WLAN. |
| Solution |
As a primer, the Remote WLAN functionality allows certain FortiAPs to be deployed to a remote site (such as with a remote/travelling employee) where they can broadcast the same SSID as the corporate wireless network. This is effectively a Wi-Fi-based extension back to the corporate office. Remote WLAN has two notable features that extend its capabilities:
However, after enabling split-tunneling for an SSID and deploying the FortiAP for Remote WLAN, administrators will find that the FortiGate will report multiple instances of devices named 'vap-bssid' with DHCP leases from that SSID. In the example below, the DHCP lease list on the FortiGate shows multiple instances of a 'vap-bssid' device that obtained multiple IP addresses from the 10.1.100.0/24 subnet:
The device name 'vap-bssid' actually corresponds to the FortiAPs deployed in the Remote WLAN configuration. When the FortiAP sends the DHCP Request, it includes the DHCP option 12 to specify the hostname as 'vap-bssid':
Dynamic Host Configuration Protocol (Request) Message type: Boot Request (1) Length: 9 Option: (60) Vendor class identifier
Meanwhile, the FortiGate Device Inventory function (if enabled for the SSID interface) will utilize this information in DHCP Option 12 to learn the device's hostname, which is why the corresponding entry in the DHCP lease list shows as 'vap-bssid'. As noted above, this behavior, where the FortiAP requests multiple DHCP leases, is expected when the split-tunneling feature is enabled in the SSID configuration. For example:
config wireless-controller vap edit 'Office-desk' set ssid 'Office-desk' next end
With split-tunneling enabled, the FortiAP will require one IP address for each physical interface that is participating in the SSID. This will include at least one IP address for the base MAC address belonging to the wireless radio broadcasting the SSID, and it may also include one additional IP address for each LAN port that is bridged to the same SSID. For example, if a FortiAP has split-tunneling enabled as well as 3x LAN interfaces bridged to that SSID, then it is expected to see that FortiAP requesting a total of 4x IP addresses from the DHCP pool.
To confirm this, SSH into one of the FortiAPs and run the wcfg command. Check for the FortiAP Base MAC address, LAN port MAC addresses, and corresponding IP addresses, then compare them against the entries in the DHCP lease list (those entries will likely show a hostname of 'vap-bssid').
Remote_AP1 # wcfg base-mac : 38:c0:xx:xx:xx:58
Note: The port1 MAC address is simply incremented from the Base MAC Address of the FortiAP.
Since this is the expected behavior when using the split-tunneling feature, administrators will need to increase the DHCP address pool size to account for both the IP addresses of connected wireless clients as well as the IP addresses required for the wireless/wired LAN ports on the FortiAP.
For example, if there are 10 FortiAPs in a Remote WLAN configuration with 4 LAN ports, administrators can expect a total of 50 IP addresses to be assigned just to the FortiAPs (10x FortiAPs, each requiring an IP address for the wireless radio plus 4x additional IP addresses for the LAN ports).
Related documents: |
