Can't access web interface via wifi?

[finsfree]

Hello,

Noob question here.

I have a Fortigate 60D. I can access the web interface from the LAN port just fine. I get an "access refused" message every time I try from the wifi client. I have tried with 3 different browsers (opera, chrome, edge). I'm not seeing in the web GUI where I can enable this setting.

The AP is a FortiAP 221E.

Thanks,

[Toshi_Esumi]

If the SSID is in tunnel mode, the SSID is just a logical interface like VLANs, etc. To access the LAN (internal?) interface from SSID interface, you have to have a policy from SSID interface to LAN interface allowing the access.

[finsfree]

toshiesumi wrote:

If the SSID is in tunnel mode, the SSID is just a logical interface like VLANs, etc. To access the LAN (internal?) interface from SSID interface, you have to have a policy from SSID interface to LAN interface allowing the access.

It is in "Tunnel Mode" and the there is a policy created "SSID > INTERNAL" allowing "ALL" services, however I still can not access the Fortinet web interface from a wifi client. 

Does it matter if the port that the AP is plugged into has a different IP address then what the SSID has?

Example:

[ul]

Port 7 (where the FortiAP 221E is plugged into) IP Address 10.0.1.1/24

SSID 10.0.2.1/24 (DHCP Range 10.0.2.100 - 200/24)

Fortigate LAN (internal) IP Address 10.0.0.1:4433 (this is how I access the web interface from the LAN)[/ul]

Attached is what I receive when trying to access the Fortigate web interface from wifi

[Toshi_Esumi]

Was this FGT set up by somebody else before? Only things I can think of are either tursthosts or/and local-in policy might be configured to allow only certain sources, not including the SSID subnet/interface.

All of those you listed are directly connected network., Reachability shouldn't be a problem.

[TecnetRuss]

In Network / Interfaces - for the SSID Tunnel interface - do you have HTTP/HTTPS enabled under Administrative Access?  Web/SSH access must be enabled on a per-interface basis (port, switch, VLAN, SSID, etc.) and is disabled by default when you create a new interface.  Also, if you've restricted Admin Access using Trusted Hosts (System / Administrators), you'll need to make sure your SSID's subnet is covered there too.

Russ

NSE7

[finsfree]

Okay, we are getting closer. I can access the web client via my Android phone (a wifi client), however not with Windows 10 laptop (also a wifi client). I went as far as completely disabling the windows firewall, but that didn't work either. I do not have Trusted Host enabled. I do have HTTPS and HTTP enabled in all interfaces. 

What the H3LL could be causing this???

[TecnetRuss]

When you're on wifi, make sure you are accessing the web interface with the SSID's subnet interface IP and not the LAN IP or WAN IP.

In System Settings, under Administrative Settings, perhaps try changing the HTTPS port to something other than 443.  This is generally a good idea to avoid conflicts with HTTPS port forwarding policies.

Also, in System, Certificates (enable in Feature Visibility if you don't see this option), try downloading the "Fortinet_CA_SSL" and "Fortinet_CA" CA certificates and then importing them into your computer's local Trust Root Certificate Authority.  This might help if your browser is complaining about the self-signed certificate the FortiGate is using for web admin.

Russ

NSE7