Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sw28671
New Contributor

Best Practice: Connect Third-Party WAP to switch or FortiGate port2?

I have a FortiGate 60E in a small office.  I am using a UniFi wireless AP for wifi.  Everything is working fine, but I have a question about best practices.

 

Currently, the WAP is connected to the same switch that all computers are connected to, like this:

 

FG60E (port1-7) <> NetGear switch <> WAP & computers

 

Everything works well.  Only the FG60E hands out DHCP IPs.  The WAP and all computers are on the same subnet (192.168.33.x).  Simple.

 

Would this setup be "better?"

 

FG60E (port1-6) <> NetGear switch <> Computers

FG60E (port7) <> WAP

 

I would create a new interface for port7.  I'd assign this interface 192.168.34.1 and let DHCP hand out 192.168.34.50-100.

 

So my wireless devices would be on a separate network.  I'd create policies to allow the wireless devices to access to the Internet (WAN1) and one printer on the 192.168.33.x network.

 

Thoughts?

9 REPLIES 9
Toshi_Esumi
Esteemed Contributor III

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

 

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

Toshi_Esumi
Esteemed Contributor III

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

 

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

Toshi_Esumi
Esteemed Contributor III

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

 

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

Toshi_Esumi
Esteemed Contributor III

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

 

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

Toshi_Esumi
Esteemed Contributor III

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

 

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

ede_pfau
Esteemed Contributor III

side note: the AP doesn't have to support VLANs, the switch will tag the traffic for it.

 

I generally mirror every SSID onto it's own VLAN. Even home switches are VLAN capable nowadays...


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
emnoc
Esteemed Contributor III

I highly doubt  it matters. My  setup at home is  a FWF51E + internal-lan and I  have 1x googe-wireless connected to one of the internal lan port. LAN and WLAN hosts gets the same address subnets via DHCP.

 

I could move it to a dedicated port and build a 2nd subnet but I did not in this case. In another use case  we have a customer who has integrated switch for computers and dedicated port ( i.e lan5 ) for his APs which are connected to a cisco business switch. 

 

It's 50/50 in what method you deploy.

 

Ken Felix

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Toshi_Esumi
Esteemed Contributor III

I apologize I posted multiple times. My screen didn't refresh after clicking submit button so clicked multiple times.

In case two SSIDs; "guest" and "corp" are hosted by one AP, the traffic needs to be separated by VLAN tags from the AP to have adequate separation.

Toshi_Esumi
Esteemed Contributor III

It's up to the capability of the AP and the switch. What we always try to do is to separate Guest WiFi from other "corp" network with a different DHCP range so that we can build a separate policy easily from all other "corp" policies. Some situations actually require the separation to meet regulations and security standards our customers need to comply with.

The best way is to set a separate VLAN because APs generally have only one Ethernet port, and pull it at least into the switch, if not all the way into the FGT. To do that both AP and switch need to be VLAN capable. If the switch has this capability, you can ether terminate them at two different port on the FGT (non-tagged), or just pull those VLANs all the way to the FGT at a trunk port (at least two VLAN subinterface).

 

Separating the entire AP network from LAN is probably nicer to manage both sides of clients from IT/Admin person's perspective. But to me, it's not a huge benefit.

Top Kudoed Authors