Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Jakob-AHHG
Contributor II

FAP 231F/431F: Bridging VLAN/SSID to second LAN port

Hi Community,

 

If you have ever used FortiAP 23JF (Inroom, wall mounted) and used an Operation Profile to configure the LAN ports to specific VLAN's, like a VoIP or IPTV connection, you might get puzzled if you try the same on FAP231F or FortiAP 431F.
The GUI in the Operation Profile has the same options as the OP for FAP23JF, but for some (strange) reason, on those models, you need to either A) use the CLI on the AP to actually enable the Bridge Mode, or B) create a configuration profile that does it on the AP's you assign that OP too.

 

Why the FortiGate can do this all by itself on FAP23JF, but not on FAP321F or FAP431F is left out in the open.. 

For option A, a description is mentioned here.
In short, SSH to the AP, after you have set the Bridge-To-SSID values on the AP/OP Profile, and then use these commands:

 

cfg -a WANLAN_MODE=WAN-LAN 
cfg -c

 

For option B:
1: On the Operation Profile, enable the option: FortiAP configuration profile.

2: In the Popup, click [+ Create]
3: Name the profile, give it a comment if needed. Set the Family to FortiAP. Leave the rest at the defaults.

4: Create a new Command, with:
   Name: WANLAN_MODE
   Type: Non-password
   Value: WAN-LAN

Save the profile and Apply the changes - the AP('s) in question will now be updated.

 

If you create the apcfg-profile in CLI, it should look like this:

Fortigate # config wireless-controller apcfg-profile

Fortigate (apcfg-profile) # show
config wireless-controller apcfg-profile
edit "BridgeFAP_WAN2LAN"
set comment "Bridge WAN 2 LAN"
config command-list
edit 1
set name "WANLAN_MODE"
set value "WAN-LAN"
next
end
next
end

 

Hope it helps people out there, in need to utilize the extra port for a wired connection.
And for some reason, Fortinet Support does not see this as a bug.. it clearly is to me.

Jakob Peterhänsel,
IT System Admin,
Arp-Hansen Hotrel Group A/S, Copenhagen, DK
Jakob Peterhänsel,IT System Admin,Arp-Hansen Hotrel Group A/S, Copenhagen, DK
4 REPLIES 4
ebilcari
Staff
Staff

Thanks for sharing your findings, interesting approach :)

I guess you already know that these two APs are designed for different scopes, even if they share similar firmware and have multiple ports. For the FAP-23JF is expected to have wired hosts connected, for other APs those are dedicated uplinks.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
Jakob-AHHG

Hi Emirjon,

Yes, I do know that, but the GUI in Fortigate does not reflect this!
It has the same configuration options for FAP321F & FAP431F as the FAP23JF, simply adjusted for number of ports.
That leads the admin to think, that the configuration that works for 23J also works for 321 & 431 (and maybe other models as well).

Jakob Peterhänsel,
IT System Admin,
Arp-Hansen Hotrel Group A/S, Copenhagen, DK
Jakob Peterhänsel,IT System Admin,Arp-Hansen Hotrel Group A/S, Copenhagen, DK
Jakob-AHHG
Contributor II

Followup note:
If you enable any of the Bridge Modes on FAP321F & FAP431F, it will bridge the native VLAN and the VLAN's that the AP has active on SSID's.
Meaning: Bridge-to-LAN & Bridge-to-SSID works identical, as mentioned above, unless you use the configuration commands mentioned above!
And they will both only bridge the VLANs that are active on SSID's on the AP - you will not get VLAN's that are trunked on the uplink port, unless they are active on a SSID!

To me, this seems like a bug.. not a 'feature' ;)

Jakob Peterhänsel,
IT System Admin,
Arp-Hansen Hotrel Group A/S, Copenhagen, DK
Jakob Peterhänsel,IT System Admin,Arp-Hansen Hotrel Group A/S, Copenhagen, DK
HacDMac

Thanks for that info!  You just prevented me from wasting time on this effort!  I wanted to run a VLAN from a 108POE (1st floor) through a 431F (2nd floor) and up to a 108E (3rd) floor, but this indicates I would need an active SSID which defeats my purpose (non-WiFi VLAN).  So I guess I’m running  cable today.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors