FortiAP With Cisco Switch

[The_Nude_Deer]

Hi, Having a little difficulty with this, I have a FortiAP plugged into a CISCO 3750, port is trunked with native VLAN 50 , LLDP is enabled. Cisco is connected to another Cisco 9K , vlan 50 trunked and LLDP enabled there also. Fortigate (7.0.14) has a Layer 3 Aggregate inteface connected to the Cisco 9K, no issues there.

In order to get the AP MGMT, I created an SVI 50, with DHCP etc, and put it behind the Agg Layer 3, this is where I think there is a problem, I allow ALL traffic for now, but the AP will not come online, simply says "no LLDP neighbours found"

if I do "diagnose lldprx neighhour" you can see the Cisco 9K, and the Cisco 9K can see the 3750 as an LLDP neighbour, so not sure why the AP cannot get to the SVI on the Fortigate, I did notice on the SVI you cannot set "recieve LLDP" or "Transmit LLDP" the option isnt there..

I have enabled security fabric, you can see the AP MAC on the cisco switches on VLAN 152..any suggestions where I have made a silly mistake??

THankyou

[Toshi_Esumi · Accepted solution]

Ok I missed one post when I went to grab food for lunch. So the SW 9K is not extending the VLAN ID 50 from the FGT toward the FAP? Then DHCP on the FGT would never work for the FAP. It has to be on the same L2 network. You have to set DHCP server on the switch where FAP is connected to it via L2 network.

[The_Nude_Deer]

Yeah, I need to keep this on a layer 2 broadcast.. was over complicating it, cheers buddy

[Toshi_Esumi]

Once you moved the DHCP and VLAN 50 network on the L3 switch side, you don't need the VLAN 50 interface on the FGT. And, FAP should be able to reach FGT's X.X.X.X ip routed by the L3 switch. However, you need to change the config on the FAP to specify the X.X.X.X as the wireless controller's IP (AC). I think the default on the FAP is either the LAN GW IP or 192.168.1.1 or something like that.

Toshi

[The_Nude_Deer]

I need the Fortigate to do the DHCP though, ill still need an interface on the Fortigate to act as the controller in the same range as VLAN 50, the controller needs to be in the same subnet, The AP will go through discovery , static first, then DHCP so the IP doesnt matter on the AP, it needs to get an IP from the Fortigate.

[Toshi_Esumi]

You don't have to if you configure the FAP directly by getting into either GUI or CLI.
https://docs.fortinet.com/document/fortiap/7.4.2/fortiwifi-and-fortiap-configuration-guide/306409/fo...

But if you want to directly connect it, you have to put it on the same L2 network so that DHCP request to 0.0.0.0 would reach the FGT interface. Likely you want to assign a new subnet the L3 SW doesn't have on a new VLAN. Then span the VLAN toward the FAP port over the switches.

Toshi