Allow Admin Access FortiSwitch + FortiAP to FortiGate

[ajdinzutic]

Hi there

I've set a new setup up and created the SSID, and allowed access with the checkboxes.

Also in the Fortigate Settings allowed listening to the services and SSID.

Somehow i can't access the fortigate when i'm over FortiSwitch and FortiAP. Do i have to allow something else?

my goal is, that from the internal SSID we should have access to the fortigate. And the SSID Guest don't.

Kind regards

[ajdinzutic]

As it seems i can't create a dedicated VLAN for the FortiGate itself. Since they use the fortilink.

Or did i setup something wrong?

[ebilcari]

The option 'Listen on Interfaces' in the last screenshot is not used for the management interface service, this option is dedicated to the NTP service only.

[ajdinzutic]

nice didn't knew about it :) thanks

[ebilcari]

If I get it right you want to access FGT from a node/PC that is connected to a FSW port or a SSID/FAP not from the FSW/FAP itself (their management subnet). If this is the case than on the interface (VLAN or SSID) that you configure for the end users (gateway) in 'Administrative Access' you have to enable HTTPS/HTTP. This should be enough to gain access to FGT management interface (GUI) from an end host that is connected to that subnet.

[ajdinzutic]

hi cool to know :)

It seems i can't even ping the FGT from the FAP

FGT got a DHCP with 192.169.100.1/24

and FAP DHCP with 192.169.10.1/24

is there a way to create a Shared DHCP so that i can ping them? Or do i have to buy a Forti Switch to handle VLAN Access?

[ebilcari]

For AP management, a dedicated management subnet/VLAN need to be created in FGT and spanned in the FSW or in a 3rd party switch and have ' Security Fabric Connection' enabled. There is no limitation from FGT, Fortilink/FSW just simplify configuration and monitoring the switch ports.

In case of a 3rd party switch a sub interface with a VLAN ID could be the easiest way to configure the AP management VLAN, like this for example:

After selecting the proper 'Administrative Access' options, FGT and FAP can manage and reach both ways.

The subnets you have shared in the last reply are not in the private IP range and are not in the same network.