FAP 231F/431F: Bridging VLAN/SSID to second LAN port

[Jakob-AHHG]

Hi Community,

If you have ever used FortiAP 23JF (Inroom, wall mounted) and used an Operation Profile to configure the LAN ports to specific VLAN's, like a VoIP or IPTV connection, you might get puzzled if you try the same on FAP231F or FortiAP 431F.
The GUI in the Operation Profile has the same options as the OP for FAP23JF, but for some (strange) reason, on those models, you need to either A) use the CLI on the AP to actually enable the Bridge Mode, or B) create a configuration profile that does it on the AP's you assign that OP too.

Why the FortiGate can do this all by itself on FAP23JF, but not on FAP321F or FAP431F is left out in the open.. 

For option A, a description is mentioned here.
In short, SSH to the AP, after you have set the Bridge-To-SSID values on the AP/OP Profile, and then use these commands:

cfg -a WANLAN_MODE=WAN-LAN 
cfg -c 

For option B:
1: On the Operation Profile, enable the option: FortiAP configuration profile.

2: In the Popup, click [+ Create]
3: Name the profile, give it a comment if needed. Set the Family to FortiAP. Leave the rest at the defaults.

4: Create a new Command, with:
   Name: WANLAN_MODE
   Type: Non-password
   Value: WAN-LAN

Save the profile and Apply the changes - the AP('s) in question will now be updated.

If you create the apcfg-profile in CLI, it should look like this:

Fortigate # config wireless-controller apcfg-profile

Fortigate (apcfg-profile) # show
config wireless-controller apcfg-profile
   edit "BridgeFAP_WAN2LAN"
      set comment "Bridge WAN 2 LAN"
      config command-list
         edit 1
            set name "WANLAN_MODE"
            set value "WAN-LAN"
         next
      end
   next
end

Hope it helps people out there, in need to utilize the extra port for a wired connection.
And for some reason, Fortinet Support does not see this as a bug.. it clearly is to me.

Testet on version 7.4.1-7.4.5

[ebilcari]

Thanks for sharing your findings, interesting approach :)

I guess you already know that these two APs are designed for different scopes, even if they share similar firmware and have multiple ports. For the FAP-23JF is expected to have wired hosts connected, for other APs those are dedicated uplinks.

[Jakob-AHHG]

Hi Emirjon,

Yes, I do know that, but the GUI in Fortigate does not reflect this!
It has the same configuration options for FAP321F & FAP431F as the FAP23JF, simply adjusted for number of ports.
That leads the admin to think, that the configuration that works for 23J also works for 321 & 431 (and maybe other models as well).

[Jakob-AHHG]

Followup note:
If you enable any of the Bridge Modes on FAP321F & FAP431F, it will bridge the native VLAN and the VLAN's that the AP has active on SSID's.
Meaning: Bridge-to-LAN & Bridge-to-SSID works identical, as mentioned above, unless you use the configuration commands mentioned above!
And they will both only bridge the VLANs that are active on SSID's on the AP - you will not get VLAN's that are trunked on the uplink port, unless they are active on a SSID!

To me, this seems like a bug.. not a 'feature' ;)

[HacDMac]

Thanks for that info!  You just prevented me from wasting time on this effort!  I wanted to run a VLAN from a 108POE (1st floor) through a 431F (2nd floor) and up to a 108E (3rd) floor, but this indicates I would need an active SSID which defeats my purpose (non-WiFi VLAN).  So I guess I’m running  cable today.