FortiAP's on 3rd party switch

[Forti-Mon]

I need to connect a Forti AP through a Dell switch

I have 2 x fortiswitches with several working AP's, 2x SSID's all fine.

I setup a physical port which connects my Dell switch to my Edge switch stack and the fortiAP is online and given the correct DHCP address i setup.

But I cannot get DHCP to work on the SSID's of this AP.

Do i need to recreate VLANS? as I tried this and nobody could connect on any AP and was giving random 169.xxx addressed.

When i try and connect to either SSID on the not working AP - i get a 169 address.

I need it to see the VLANS on the fortlink - but dont know how to do this or if it can? thats why i think i need to recreate them?

Thanks

[sjoshi]

Hi,

To enable DHCP for the SSIDs on the FortiAP connected through a Dell switch, ensure that the VLANs are correctly configured on the FortiSwitches. Create FortiSwitch VLANs for the APs, assign them to the FortiSwitch ports connected to the Dell switch, and verify that the VLANs are correctly tagged on the Dell switch ports. Make sure the DHCP server settings on the FortiGate are properly configured to assign IP addresses to the SSIDs. If clients are receiving 169.xxx addresses, it indicates a DHCP issue, possibly due to VLAN misconfiguration. Double-check VLAN settings and ensure proper VLAN tagging on all switches involved in the network path.

[Forti-Mon]

Hi, thanks for the reply

The Fortiswitch VLAN's work perfectly for any AP connecting to any ports on the Fortiswtich

I have several AP's running using those VLANs with no issues.

The DHCP works perfectly for both SSID's on the Fortiswitch AP's

The Fortiswitch isn't connected to the Dell switch

The Dell switch is connected to the Fortigate

[ebilcari]

If the SSIDs for this AP are in bridge mode, you have to span the VLANs through the Dell switch and configure them as sub interfaces in the FGT port where the Dell switch uplink is connected, like as the example:

 

If you can use tunneled SSID, it will simplify the configuration since only the AP management VLAN need to be configured on the Dell switch, user traffic will be tunneled.

[Forti-Mon]

I have done that

Still doesn't work

[ebilcari]

Keep in mind that this is considered a new interface, using the same VLAN ID with a VLAN in the FortiLink will not span this VLAN.

You need to configure this sub/interface with its own IP and a DHCP server role and range.
A software switch creation may allow 'merging' this traffic but that require changes on existing configuration.

[Forti-Mon]

Ok that makes sense.

So it's the mgmt VLAN that's the issue

I just have 2 VLAN's for the SSID's in the physical interface

Is a mgmt VLAN needed to be setup? then used as the native on the DELL switch?

[Forti-Mon]

The AP mgmt VLAN is in the Fortilink....there isn't a mgmt VLAN in the physical port interface.....would I be using the fortilink mgmt VLAN as the native VLAN on the Dell switch port? or do I need a different one?

[ebilcari]

The new VLAN used for AP management in the Dell switch will not be related to FortiLink, just make sure to enable 'Security Fabric Connection' under 'Administrative Access' in FGT sub/interface settings. This will allow the build of CAPWAP tunnel and to manage the AP.

[Forti-Mon]

So to be clear

I have the physical port

I then need a mgmt VLAN

I then need a VLAN for one of the SSIDs

I then need a VLAN for the second SSID

These VLANs must have different ID's to the VLAN's in the Fortilink?