Best Practice: Connect Third-Party WAP to switch or FortiGate port2?

[sw28671]

I have a FortiGate 60E in a small office.  I am using a UniFi wireless AP for wifi.  Everything is working fine, but I have a question about best practices.

Currently, the WAP is connected to the same switch that all computers are connected to, like this:

FG60E (port1-7) <> NetGear switch <> WAP & computers

Everything works well.  Only the FG60E hands out DHCP IPs.  The WAP and all computers are on the same subnet (192.168.33.x).  Simple.

Would this setup be "better?"

FG60E (port1-6) <> NetGear switch <> Computers

FG60E (port7) <> WAP

I would create a new interface for port7.  I'd assign this interface 192.168.34.1 and let DHCP hand out 192.168.34.50-100.

So my wireless devices would be on a separate network.  I'd create policies to allow the wireless devices to access to the Internet (WAN1) and one printer on the 192.168.33.x network.

Thoughts?

[Toshi_Esumi]

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

[Toshi_Esumi]

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

[Toshi_Esumi]

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

[Toshi_Esumi]

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

[Toshi_Esumi]

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

[ede_pfau]

side note: the AP doesn't have to support VLANs, the switch will tag the traffic for it.

I generally mirror every SSID onto it's own VLAN. Even home switches are VLAN capable nowadays...

[emnoc]

I highly doubt  it matters. My  setup at home is  a FWF51E + internal-lan and I  have 1x googe-wireless connected to one of the internal lan port. LAN and WLAN hosts gets the same address subnets via DHCP.

I could move it to a dedicated port and build a 2nd subnet but I did not in this case. In another use case  we have a customer who has integrated switch for computers and dedicated port ( i.e lan5 ) for his APs which are connected to a cisco business switch. 

It's 50/50 in what method you deploy.

Ken Felix

[Toshi_Esumi]

I apologize I posted multiple times. My screen didn't refresh after clicking submit button so clicked multiple times.

In case two SSIDs; "guest" and "corp" are hosted by one AP, the traffic needs to be separated by VLAN tags from the AP to have adequate separation.

[Toshi_Esumi]

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.