DHCP not passing through fortigate ap in bridge mode with vlan tagging

[megadragon]

I have a question in regards to fortigate ap in bridge mode with vlan tagging and I can't get a satisfactory answer on how to get it working correctly.

I have fortigate 100F  with Fortigae AP 223E which is connected through EdgeSwitch 48 750W. 100F connected to switch from X1  to port 51 10GB  and AP is connected on port 20 to the switch.  In F100 everything is on Interface “Hardware switch”. (Don't know if this makes any difference out AD is providing DHCP for our main network so AP 223E IP is in the 192.168.1.0 range)  I have created a vLAN 53 under “Hardware switch” interface and Tagged the appropriate ports on the switch 20 and 51 to allow vLAN 53 to go through. Created DHCP on that Vlan connection 10.53.10.0/29.  I have tested that hardwired vLAN 53 works by connecting a laptop with wire and getting IP.

Now the question is when I create SSID in bridge mode with Optional VLAN ID 53; what are the proper steps to make sure that the created SSID is passing Ips to the clients wirelessly.  As far as I can see the only solution is to create a software switch and combine wired vLAN and SSID in there, but as far as I understand that slows things down. What would be the proper solution to this situation?

[Toshi_Esumi]

The bridge mode/bridged SSID bridges the WLAN/SSID network to the LAN the FAP is connected to, which is no tagged VLAN (192.168.1.0/24?) in your case.

If you want to use VLAN 53 with 10.53.10.0 for the bridged LAN subnet, you have to connect the FAP to the VLAN 53 subinterface.

But if nothing else is connected to that VLAN, I'm not sure the bridge mode has any benefit compared to a tunnel mode.

Toshi

[megadragon]

I am planning to segregate multiple tenants that rent offices from us. They will need wired connections coming from the switch and wireless connections. I wanted to provide DHCP from the vLAN side not create a separate tunnel for each wireless connection with its own DHCP. Is my only option to create a software switch with all my wired vLANs and SSID. Is this the best practice, especially if I want to use only one port in 100F X1 for connection because it is 10Gb?    

[Toshi_Esumi]

You can test it easily if DHCP server can be outside of the FGT for the wifi clients, which I haven't tried before so I don't know. Somebody else might chime in.

By the way, you might want to give some thought to VDOMs to segregate tenants. An SSID can be placed at each VDOM.