Technical Tip: How to setup a wireless network on FortiGate using Tunnel-Mode SSID

[jera]

Description	This article describes how to create a wireless-only dedicated network called Tunnel Mode.  The client traffic is tunneled back to the FortiGate over CAPWAP and managed centrally.
Scope	FortiGate v7.4.8, v7.6.x
Solution	Navigate to WiFi Controller -> SSIDs -> Create. Configure a new SSID by adding a name. Choose the traffic mode as 'Tunnel-mode'. Add the IP or Network Mask for the wireless interface.  Enable DHCP. The address range will be automatically populated based on the IP Network assigned to the SSID. Complete the WiFi settings by adding the SSID and passphrase. Keep the rest of the configuration on default or configure Radius if necessary. Create an AP Profile for a specific hardware model, WiFi Controller -> FortiAP profiles > Create. Supply the name and the hardware model for the platform on which the profile will be applied.   The SSIDs, by default, assign all Tunnel-mode SSIDs to the profile. The SSIDs must be the same for Radio 1 and Radio 2. Leave the rest of the setting to default. Select 'OK' to save. Create a firewall policy to allow internet traffic for the wireless network. Ensure that the SSID is selected as the       Incoming interface and the Internet-facing Interface as the Outgoing Interface.  Note: Starting FortiOS v7.6.5, the quarantine option is disabled by default when creating tunnel-mode SSID, preventing automatic creation of unused quarantine VLANs and simplifying configuration and management. In the CLI: Endeavour-kvm63 # config wireless-controller vap Endeavour-kvm63 (vap) # edit tunnel_vap new entry 'tunnel_vap' added Endeavour-kvm63 (tunnel_vap) # sh fu | grep quarantine set quarantine disable Endeavour-kvm63 (tunnel_vap) #