Bridging SSID via VLANs

[Anonymous]

Hi all, I would greatly appreciate help in resolving a problem I have with FG-80F and FAP-433F both on 7.2.0 where I'm trying to bridge WiFi with local interface using VLANS, without software switch.

Configuration:

• System/Settings/VLAN switch mode: on
• ports 1-4 as "internal_LAN", VLAN Switch with VLAN 167. This interface is configured with an IP and DHCP. All hosts connecting to this IF get IP fine.
• ports 5-6 as "internal_IoT" - VLAN 50, I've tried different configs but for now it's unconfigured
• FAP is connected to FG port 4 (which is internal_LAN)
  "WiFi_LAN" SSID for my LAN is configured as "bridge" and since it is physically connected to VLAN 167, it works fine bridging WiFi with LAN.

I'm trying to create a "WiFi_IoT" as bridge specifying "OPTIONAL VLAN ID" 50 and have it bridged with "internal_IoT".

Here is what I've tried so far.

Software switch: SS requires tunneling mode for SSID but then it's pretty easy, add SSID and unconfigured physical interfaces into it, configure SS with IP and DHCP and all connected get IP - done but not in bridge and no VLANs

I tried, deleting "internal_IoT" VLAN switch to free up ports 5 and 6, then creating a VLAN 50 subinterface for SS: remove IP and DHCP from SS, configure SS VLAN (50) with IP and DHCP, then if I specify "OPTIONAL VLAN ID" (50) for "WiFi_IoT" (which is a member of SS) - wifi clients get IP fine, but no matter what I do, physical interfaces 5 and 6 (which I added to SS for this config) never get served IP.

I tried creating VLAN SWITCH, adding 4 and 5 to it, then creating VLAN as subinterface with IP and DCHP but physical interfaces never get served by it.

I've tried creating VLAN SWITCH with ID 50 and no IP config, then adding it to SS but physical ports again never get served with IP

Since AP is physically connected to "internal_LAN", I tried setting VLANFORWARD as enabled for "internal_LAN" VLAN SWITCH thinking that it would pass traffic from AP tagged to other VLANs but no avail.

I've seen youtube where bridging SSIDs to VLANs in "bridge" mode and specifying "optional vlan id" was done but in that config AP was connected to FortiSwitch 108 which was then fortilinked to FG

Is there a way for me bridge SSIDs to FG using VLANs?

[pminarik · Accepted solution]

Yeah, additional bridging would simply consist of the repetition of:

- set the "optional" VLAN ID for the bridged SSID

- create VLAN-SWITCH with the same VLAN-ID (solution #1) / or create another VLAN-interface on top of the HW-switch with the same VLAN-ID (solution #2)

And you're right about "wouldn't I need internal1 to assign IP to AP?". That's the part where I am not certain about solution #1. I suspect that the trunk-interface may not accept untagged traffic.

If you're willing to test this, and the trunk-interface indeed does not accept untagged frames from the FortiAP, then you could consider setting the management VLAN-ID for the FortiAP, as described in this KB . If you choose to go this way, then you will additionally need to make one more VLAN-switch with the same VLAN-ID. This would then be the place to configure the IP/subnet/DHCP for the FortiAP.

[pminarik]

Your comment about switching "B" to trunk after configuring it as a VLAN-switch did seem like some unsupported edge-case that was only configurable by accident. The fact that it reverts after reboot is a further suggestion that it's not intended to work like that.

I'm glad to see you managed to get it working at least somehow, although it is clear that this is not perfect. FortiSwitch would've made this much easier. :)

Going forward, you could try reporting this in a TAC ticket. This could end up as an NFR, or at least make sure trunk isn't configurable like that to avoid causing issues in the future.

[Anonymous]

@pminarik 

How would you configure this setup with FortiSiwtch?

I have one on order for months but everything is back ordered nowadays. This setup in which everything hangs from FG is a temp config for me while I'm waiting for the FS to come in. I have a general idea how this config would look with FS but would love to hear your opinion.

Thank you

[pminarik]

With a managed FortiSwitch, I would:

- create the virtual VLAN interfaces (they're just VLANs on top of the FortiLink interface)

- set the physical port's "native VLAN" to the FortiAP management network (accept&process FAP's own untagged frames)

- add an allowed VLAN(s) that matches the VLAN-ID(s) of the VLAN-IDs used by the bridged SSIDs (process wifi client traffic)

- set other switch ports to their relevant native VLANs as desired

And that should be it.

This is be a good starting point if you're looking for documentation. 

One thing to remember is that you cannot switch together physical ports on FortiSwitch with physical ports on the FortiGate (at least not easily without jumping through hoops).

[Anonymous]

@pminarik 

Thank you, yes, that's how I was planning to reconfigure once the switch is in.

One more question, please, if you dont mind. See my interfaces screenshot. I'm planning to move "internal CAM" and "internal IoT" VLANS from FG to the switch once it arrives, so, their VLAN definition and configuration will be done in the switch VLANs - will I be able to access switch's VLANs in my zones and/or policies on FG?

[pminarik]

Assuming this will be a FortiGate-managed FortiSwitch, then yes. VLANs on FWS are treated like other virtual VLAN interfaces in FortiOS - you can put them in firewall policies, into zones, etc.