Can FortiAP broadcast 2 different SSIDs from different VDOMS within FortiGate?

[emilf]

Hi there,

What we want: to broadcast 2 different SSIDs each on another vdom (VDOM1 ssid for VDOM1-Bridge to LAN 192.168.1.0/24) and (VDOM2 ssid for VDOM2-Bridge to LAN 192.168.2.0/24)

 Is it possible to achive this ?

What we’ve got:  1 FortGate 201F with multi-vdom (VDOM1, VDOM2…) and 1 FortiAP U231F with two rj45 Lan ports

Managed AP within VDOM1

VDOM1 – LAN 192.168.1.0/24 , SSID VDOM1 with WPA2-Enterprise Local Auth with Remote Active Directory Group

VDOM2 – LAN 192.168.2.0/24, SSID VDOM2 with WPA2-Personal PreSharedKey Auth

When we activate AP Profile with both SSIDs (VDOM1 and VDOM2) , clients are connecting but they get the Dhcp IP from the VDOM1 even if they connect to SSID vdom2.

Worst, even if the cables are connected correctly each LAN port to VDOM1 and VDOM2, the FortiAp acts as a L2 Swich merging the networks.

Many thanks,

Emil

[Toshi_Esumi]

5.6 added tunnel mode VAPs/SSIDs to be at different vdoms from root as in comments in an old thread.

https://forum.fortinet.com/tm.aspx?m=179438

But I don't know if it has been expanded to bridge mode SSIDs by now. My guess is not, but some others might know the answer.

Toshi

[emilf]

Hi Toshi and thank's for the reply,

Yes indeed, the CLI command makes SSID "VDOM2" visible to Managed AP profile within VDOM1 ,

BUT it throughs DHCP IP from VDOM1 instead VDOM2 although when I edit the VDOM2 SSID interface it point to VDOM2.

"config wireless-controller global    set wtp-share enable end"

I even tried to configure AP interfaces in "WAN-LAN" mode - by default they are in "WAN-only"

https://docs.fortinet.com/document/fortiap/6.4.3/fortiwifi-and-fortiap-configuration-guide/430146/la... 

[ul]

Enabling WAN-LAN mode on FortiAP-U models:

cfg -a FAP_ETHER_TRUNK=3cfg -c

Note: By default, FAP_ETHER_TRUNK is set to 0.

[/ul]

The problem seems to be at assigning VDOMs SSID interface.... it says that is within VDOM2 but it actually behaves like a L2 Switch....seams to me...

[emilf]

Anybody with a suggestion even if is not an expert one ?

Or should we close this topic and move to something simple?